4 ms·

>That kind of statement is designed to make you think they have good reasons to make the claim, but if they did they would just share the reasons. Well, no, be

>That kind of statement is designed to make you think they have good reasons to make the claim, but if they did they would just share the reasons. Well, no, because obviously the Chinese government's teams don't want to get tracked and attributed, and obviously the people trying to catch them don't want to reveal the techniques they use to track and attribute their alleged activity. Of course, their saying "just take my word for it" doesn't mean you should trust them or their findings, but it doesn't mean you should necessarily distrust them just because they don't reveal their methods. >One past example of a "hacking group believed to have links to the Chinese government" was someone they suspected as a hacker taking an rideshare to a large office building that rented space to a government organization. What's the source on this one? Sounds like an interesting story.

boomboomsubban 5y ago
> and obviously the people trying to catch them don't want to reveal the techniques they use to track and attribute their alleged activity. Most of these methods are already public knowledge, usually advanced versions of "don't reuse email addresses." >Of course, their saying "just take my word for it" doesn't mean you should trust them or their findings, but it doesn't mean you should necessarily distrust them just because they don't reveal their methods. I should assume their statement is false until evidence is provided. That's a fairly universal concept. >What's the source on this one? Sounds like an interesting story. https://www.crowdstrike.com/blog/two-birds-one-stone-panda/ https://www.crowdstrike.com/blog/two-birds-one-stone-panda/
- meowface 5y ago
  >Most of these methods are already public knowledge, usually advanced versions of "don't reuse email addresses." Yes, a decent chunk of it comes down to that general idea, but in practice you're dealing with a ton of permutations of that idea. You don't want the adversary to know the specific data types or values you were pivoting off of and correlating against. So it's not about the general methodology but the specific applications and indicators. Plus there are many other attribution methods beyond just that. >I should assume their statement is false until evidence is provided. That's a fairly universal concept. I don't think that's how that works. You just have no evidence or reason to believe their statement is true. That's different from assuming their statement is false. "Failing to reject the null hypothesis" isn't the same thing as "confirming the null hypothesis". >https://www.crowdstrike.com/blog/two-birds-one-stone-panda/ https://www.crowdstrike.com/blog/two-birds-one-stone-panda/ >One past example of a "hacking group believed to have links to the Chinese government" was someone they suspected as a hacker taking an rideshare to a large office building that rented space to a government organization. That seems like a major misrepresentation. Here're the two posts that that CrowdStrike post is based on: https://intrusiontruth.wordpress.com/2018/08/02/who-is-mr-gao/ https://intrusiontruth.wordpress.com/2018/08/02/who-is-mr-ga... https://intrusiontruth.wordpress.com/2018/08/15/apt10-was-managed-by-the-tianjin-bureau-of-the-chinese-ministry-of-state-security/ https://intrusiontruth.wordpress.com/2018/08/15/apt10-was-ma... I'm not going to summarize everything IntrusionTruth and CrowdStrike reported, but it definitely wasn't just "someone they suspected as a hacker taking a rideshare to a large office building that rented space to a government organization". It was someone whose name and other personal information they already had likely associated with APT10 - through several different means - allegedly also appearing on multiple Uber ride receipts with a destination of the regional headquarters of the Ministry of State Security, which is in the city he appears to work and live in. (Among several other indicators pointing to his likely involvement, including potential associations between local companies he was affiliated with and the Ministry of State Security Tianjin Bureau + APT campaigns.) What are you basing this "rented space to a government organization" on? Could you imagine the NSA putting a regional headquarters in some rented office space, for example? In my opinion, the totality of the combined analyses makes a pretty good case that Gao was part of APT10, and a moderate case that he may have worked for or with the Ministry of State Security Tianjin Bureau. Combined with other reports published by both parties, the case for associations between APT10 and MSS Tianjin Bureau is additionally strengthened. Then a few months later, the Justice Department announced this indictment: https://www.justice.gov/opa/pr/two-chinese-hackers-associated-ministry-state-security-charged-global-computer-intrusion https://www.justice.gov/opa/pr/two-chinese-hackers-associate... >Two Chinese Hackers Associated With the Ministry of State Security Charged with Global Computer Intrusion Campaigns Targeting Intellectual Property and Confidential Business Information >Defendants Were Members of the APT 10 Hacking Group Who Acted in Association with the Tianjin State Security Bureau and Engaged in Global Computer Intrusions for More Than a Decade, Continuing into 2018, Including Thefts from Managed Service Providers and More Than 45 Technology Companies
  - boomboomsubban 5y ago
    >I don't think that's how that works. You just have no evidence or reason to believe their statement is true. That's different from assuming their statement is false. " I have no evidence to believe the statement "meowface is a Chinese hacker" is true, but I shouldn't assume it is false? Accusations need evidence. This isn't science, it's criminal justice. As for the rest, all of the evidence they provided was pretty unsubstantiated in my opinion, but I had combined "an uber receipt they can't verify saying an alleged hacker went to an MSS building" and "a supposed recruiting message gave the same address as CNITSEC." I had not read the details in several years, that was my mistake. That was the grand total of the evidence provided though, and the indictment does not provide anymore.
    - meowface 5y ago
      >I have no evidence to believe the statement "meowface is a Chinese hacker" is true, but I shouldn't assume it is false? Accusations need evidence. This isn't science, it's criminal justice. Yes, you shouldn't assume it's false. People should simultaneously assume I'm not guilty of any accusation until conclusive evidence is produced, and also not prima facie assume any such claim is false. Purely as a standalone statement, you can't assume it's either true or false. You shouldn't assume it to be true, but that doesn't mean you should assume it to be false. To use an extreme example, let's say someone you know tells you they were assaulted by some individual, and at that moment you have no other information besides that. Should your immediate reaction be to assume the statement is false? This is why one should simultaneously give both accusers and accused the benefit of the doubt. You should simultaneously grant victims the presumption of not lying and grant the alleged perpetrators the presumption of non-guilt. A victim makes an accusation, and the accused says they didn't do it, and you have no other information besides that. Do you simultaneously assume both statements from both people are false? No. You assume both are indeterminate at the present time, given you have no other information. The burden of proof is always on the accuser, but there's still a difference between "not assuming something to be true" and "assuming something to be false". This is also why courts never find someone innocent; they just find you to be guilty or not guilty. Not guilty means the prosecutor/plaintiff failed to conclusively demonstrate guilt. Innocence would be a positive claim rather than a mere failure to accept a claim. There's an exception if a claim is particularly extraordinary. If you have an extremely low prior, it's fine to assume the claim is false. "This person talking about security stuff online is a Chinese hacker" is a big claim, but not an extraordinary claim like "telekinesis is real". Also, in this case with the MTA, it's not (yet) criminal justice. It's some private firms saying they believe they have evidence that indicates the perpetrators are likely affiliated with the Chinese government. If they were standing trial instead of just having some company making some claims about them, of course the standard of evidence would be much, much higher.

boomboomsubban 5y ago

> and obviously the people trying to catch them don't want to reveal the techniques they use to track and attribute their alleged activity. Most of these methods are already public knowledge, usually advanced versions of "don't reuse email addresses." >Of course, their saying "just take my word for it" doesn't mean you should trust them or their findings, but it doesn't mean you should necessarily distrust them just because they don't reveal their methods. I should assume their statement is false until evidence is provided. That's a fairly universal concept. >What's the source on this one? Sounds like an interesting story. https://www.crowdstrike.com/blog/two-birds-one-stone-panda/ https://www.crowdstrike.com/blog/two-birds-one-stone-panda/

meowface 5y ago
>Most of these methods are already public knowledge, usually advanced versions of "don't reuse email addresses." Yes, a decent chunk of it comes down to that general idea, but in practice you're dealing with a ton of permutations of that idea. You don't want the adversary to know the specific data types or values you were pivoting off of and correlating against. So it's not about the general methodology but the specific applications and indicators. Plus there are many other attribution methods beyond just that. >I should assume their statement is false until evidence is provided. That's a fairly universal concept. I don't think that's how that works. You just have no evidence or reason to believe their statement is true. That's different from assuming their statement is false. "Failing to reject the null hypothesis" isn't the same thing as "confirming the null hypothesis". >https://www.crowdstrike.com/blog/two-birds-one-stone-panda/ https://www.crowdstrike.com/blog/two-birds-one-stone-panda/ >One past example of a "hacking group believed to have links to the Chinese government" was someone they suspected as a hacker taking an rideshare to a large office building that rented space to a government organization. That seems like a major misrepresentation. Here're the two posts that that CrowdStrike post is based on: https://intrusiontruth.wordpress.com/2018/08/02/who-is-mr-gao/ https://intrusiontruth.wordpress.com/2018/08/02/who-is-mr-ga... https://intrusiontruth.wordpress.com/2018/08/15/apt10-was-managed-by-the-tianjin-bureau-of-the-chinese-ministry-of-state-security/ https://intrusiontruth.wordpress.com/2018/08/15/apt10-was-ma... I'm not going to summarize everything IntrusionTruth and CrowdStrike reported, but it definitely wasn't just "someone they suspected as a hacker taking a rideshare to a large office building that rented space to a government organization". It was someone whose name and other personal information they already had likely associated with APT10 - through several different means - allegedly also appearing on multiple Uber ride receipts with a destination of the regional headquarters of the Ministry of State Security, which is in the city he appears to work and live in. (Among several other indicators pointing to his likely involvement, including potential associations between local companies he was affiliated with and the Ministry of State Security Tianjin Bureau + APT campaigns.) What are you basing this "rented space to a government organization" on? Could you imagine the NSA putting a regional headquarters in some rented office space, for example? In my opinion, the totality of the combined analyses makes a pretty good case that Gao was part of APT10, and a moderate case that he may have worked for or with the Ministry of State Security Tianjin Bureau. Combined with other reports published by both parties, the case for associations between APT10 and MSS Tianjin Bureau is additionally strengthened. Then a few months later, the Justice Department announced this indictment: https://www.justice.gov/opa/pr/two-chinese-hackers-associated-ministry-state-security-charged-global-computer-intrusion https://www.justice.gov/opa/pr/two-chinese-hackers-associate... >Two Chinese Hackers Associated With the Ministry of State Security Charged with Global Computer Intrusion Campaigns Targeting Intellectual Property and Confidential Business Information >Defendants Were Members of the APT 10 Hacking Group Who Acted in Association with the Tianjin State Security Bureau and Engaged in Global Computer Intrusions for More Than a Decade, Continuing into 2018, Including Thefts from Managed Service Providers and More Than 45 Technology Companies
- boomboomsubban 5y ago
  >I don't think that's how that works. You just have no evidence or reason to believe their statement is true. That's different from assuming their statement is false. " I have no evidence to believe the statement "meowface is a Chinese hacker" is true, but I shouldn't assume it is false? Accusations need evidence. This isn't science, it's criminal justice. As for the rest, all of the evidence they provided was pretty unsubstantiated in my opinion, but I had combined "an uber receipt they can't verify saying an alleged hacker went to an MSS building" and "a supposed recruiting message gave the same address as CNITSEC." I had not read the details in several years, that was my mistake. That was the grand total of the evidence provided though, and the indictment does not provide anymore.
  - meowface 5y ago
    >I have no evidence to believe the statement "meowface is a Chinese hacker" is true, but I shouldn't assume it is false? Accusations need evidence. This isn't science, it's criminal justice. Yes, you shouldn't assume it's false. People should simultaneously assume I'm not guilty of any accusation until conclusive evidence is produced, and also not prima facie assume any such claim is false. Purely as a standalone statement, you can't assume it's either true or false. You shouldn't assume it to be true, but that doesn't mean you should assume it to be false. To use an extreme example, let's say someone you know tells you they were assaulted by some individual, and at that moment you have no other information besides that. Should your immediate reaction be to assume the statement is false? This is why one should simultaneously give both accusers and accused the benefit of the doubt. You should simultaneously grant victims the presumption of not lying and grant the alleged perpetrators the presumption of non-guilt. A victim makes an accusation, and the accused says they didn't do it, and you have no other information besides that. Do you simultaneously assume both statements from both people are false? No. You assume both are indeterminate at the present time, given you have no other information. The burden of proof is always on the accuser, but there's still a difference between "not assuming something to be true" and "assuming something to be false". This is also why courts never find someone innocent; they just find you to be guilty or not guilty. Not guilty means the prosecutor/plaintiff failed to conclusively demonstrate guilt. Innocence would be a positive claim rather than a mere failure to accept a claim. There's an exception if a claim is particularly extraordinary. If you have an extremely low prior, it's fine to assume the claim is false. "This person talking about security stuff online is a Chinese hacker" is a big claim, but not an extraordinary claim like "telekinesis is real". Also, in this case with the MTA, it's not (yet) criminal justice. It's some private firms saying they believe they have evidence that indicates the perpetrators are likely affiliated with the Chinese government. If they were standing trial instead of just having some company making some claims about them, of course the standard of evidence would be much, much higher.