3 ms·

Crowdstrike attributed the 2015/2016 DNC "Hacks" to Russia based solely on a file creation timestamp in the same timezone as Moscow and the presence of Cyrillic

Crowdstrike attributed the 2015/2016 DNC "Hacks" to Russia based solely on a file creation timestamp in the same timezone as Moscow and the presence of Cyrillic in a Word document's metadata, and the western world ran with it for years. Don't expect much.

Yoofie 5y ago
Is there a source for this? If true, this is a new low for all these "cybersecurity" firms even though I already took their claims as a pinch of salt.
mistermann 5y ago
The "Russian" Twitter propagandists were identified based on a similarly specious methodology, and I only ever encountered one article (Wired) they even bothered to mention it. And in many, many internet conversations I've had, I've not once met a believer who had the ability to consider whether authenticity was important, even while they mocked their outgroup for believing whatever story pleases them. People are funny.
staticassertion 5y ago
Why would you think this? They found shared infrastructure and TTPS related to other attacks for the actors. edit: And what's with the "hacks" scare quotes? We know exactly how the attack happened, step by step... in what way was it not a very straightforward hack?
- pydry 5y ago
  This was still straw grasping. Tactics and techniques get imitated all the time. Covering your tracks and laying down false trails is standard opsec. This hack wasnt special in this respect though. Hack attribution is usually based on pathetically thin evidence. For a high profile hack attack it really isn't feasible politically to say that you aren't sure who the attacker is, though. It makes you look weak and powerless. Not being sure who the enemy is or being utterly sure and wrong for long periods of time is a weird feature of cyberwarfare that I'm not sure any country is capable of adapting to yet.
  - staticassertion 5y ago
    So there's lots of evidence to support attribution, but your flimsy hand waving about uncertainty is supposed to carry weight? Once again, we have: * Shared infrastructure * Shared TTPs * Clues like language * No evidence to the contrary And that's just what's public. I assure you that quite a lot stays between people. I know many people in the field who can't share public details about breaches due to pending legal issues - Dropboxers couldn't talk about aspects of the 2012 breach until just this last year.
    - pydry 5y ago
      What specific evidence did you find most compelling? Please, share it, if it's more convincing than Cyrillic in a document header or a Russian IP address. Or, you could just hit us with the oft repeated 2003 weapons of mass destruction talking point of "the evidence is there it's probably just classified" if you want to make me reminiscent for the good old days.
      - staticassertion 5y ago
        Yeah, unrelated things decades ago were wrong or something therefor... uh, something. I'm not really interested in doing research for you.
        pydry 5y ago
        I researched it a while back. That's how I reached this conclusion - in particular, the idea that one hacker used broadly similar techniques to another ("shared TTPs" as you so obliquely put it) being used as evidence stood out precisely because of how flimsy it was. Likewise when IP addresses from specific countries are cited it's like waving a red flag saying "we actually don't know" to anybody with a rudimentary understanding of networking. I asked in case I missed or misinterpreted some specific piece of evidence that was particularly compelling.

Yoofie 5y ago

Is there a source for this? If true, this is a new low for all these "cybersecurity" firms even though I already took their claims as a pinch of salt.

mistermann 5y ago

The "Russian" Twitter propagandists were identified based on a similarly specious methodology, and I only ever encountered one article (Wired) they even bothered to mention it. And in many, many internet conversations I've had, I've not once met a believer who had the ability to consider whether authenticity was important, even while they mocked their outgroup for believing whatever story pleases them. People are funny.

staticassertion 5y ago

Why would you think this? They found shared infrastructure and TTPS related to other attacks for the actors. edit: And what's with the "hacks" scare quotes? We know exactly how the attack happened, step by step... in what way was it not a very straightforward hack?

pydry 5y ago
This was still straw grasping. Tactics and techniques get imitated all the time. Covering your tracks and laying down false trails is standard opsec. This hack wasnt special in this respect though. Hack attribution is usually based on pathetically thin evidence. For a high profile hack attack it really isn't feasible politically to say that you aren't sure who the attacker is, though. It makes you look weak and powerless. Not being sure who the enemy is or being utterly sure and wrong for long periods of time is a weird feature of cyberwarfare that I'm not sure any country is capable of adapting to yet.
- staticassertion 5y ago
  So there's lots of evidence to support attribution, but your flimsy hand waving about uncertainty is supposed to carry weight? Once again, we have: * Shared infrastructure * Shared TTPs * Clues like language * No evidence to the contrary And that's just what's public. I assure you that quite a lot stays between people. I know many people in the field who can't share public details about breaches due to pending legal issues - Dropboxers couldn't talk about aspects of the 2012 breach until just this last year.
  - pydry 5y ago
    What specific evidence did you find most compelling? Please, share it, if it's more convincing than Cyrillic in a document header or a Russian IP address. Or, you could just hit us with the oft repeated 2003 weapons of mass destruction talking point of "the evidence is there it's probably just classified" if you want to make me reminiscent for the good old days.
    - staticassertion 5y ago
      Yeah, unrelated things decades ago were wrong or something therefor... uh, something. I'm not really interested in doing research for you.
      - pydry 5y ago
        I researched it a while back. That's how I reached this conclusion - in particular, the idea that one hacker used broadly similar techniques to another ("shared TTPs" as you so obliquely put it) being used as evidence stood out precisely because of how flimsy it was. Likewise when IP addresses from specific countries are cited it's like waving a red flag saying "we actually don't know" to anybody with a rudimentary understanding of networking. I asked in case I missed or misinterpreted some specific piece of evidence that was particularly compelling.