4 ms·

> I'd suggest reading the relevant portions of the muller report and the related indictments of the GRU agents. Why can't you just spell out the method of attr

> I'd suggest reading the relevant portions of the muller report and the related indictments of the GRU agents. Why can't you just spell out the method of attribution, instead requiring me to read trough dozens of, mostly political, reports? > The attack, carried out with many technical signifiers of a Russian state backed attack, that was used to geopolitically help Russia was Russian. Technical signifiers are not difficult to spoof, nothing about them requires any nation state backing as they rely on heuristics which are semi-public. That's been the reality of the "cyber theater" for decades: It's asymmetric, there's been more than one example of some lone kid on the spectrum, living in their parents basement, pwning very important and advanced national infrastructure at scale. That's why I'm very skeptical when a cyber incident is instantly declared as "state level!", usually that's just part of PR and damage control script, along the lines of: "The adversary was a whole nation state, there's nothing we could have done to prevent this from happening!". Even when the methods deployed are anything but exclusive to nation state actors: Spear-phishing and social engineering are not types of attacks that require nation state resources or knowledge, there's a whole grey market industry offering such attacks as a service. > The alternative is that someone (who?) was capable enough to infiltrate Russian cyber intelligence resources to then launch an attack on the us, which they then used to geopolitically assist Russia. Why would that be the only alternative? Your alternative assumes that the attribution to the Russian cyber intelligence is a fact beyond doubt. > I'm not sure I can think of any attack where someone tried to successfully frame another nation. That's because if said attack is successful, you wouldn't even know about it being such an attack, that's the crux of the problem. > Far more likely is that successfully impersonating a state cyber attack is actually really really difficult, because doing so successfully would in general require persistent access to the state actor you're impersonating. As mentioned before: Nobody needs to impersonate a state cyber attack because by now that's the default assumption not just by media but often enough by those affected themselves to cover up for their own InfoSec negligence. "We got pwned by the whole Russian intelligence apparatus using massive resources!" sounds much more impressive, and sympathy inducing ,than "We got pwned by some kid from Ukraine because we don't patch our stuff/one of our employees got phished".

joshuamorton 5y ago
As I understand it, signifiers included command and control servers known to be under Russian state control. So, yes, someone would need to have piggybacked on Russian state controlled servers. > Technical signifiers are not difficult to spoof, nothing about them requires any nation state backing as they rely on heuristics which are semi-public Do you work in this field? I've basically only seen lay people suggest this. > That's because if said attack is successful, you wouldn't even know about it being such an attack, that's the crux of the problem. Hence my second point: that we've never seen evidence of an unsuccessful attempt, meaning that there's a 100% success rate of spoofing. You're telling me that's realistic? That the spoofers are just so incredibly more competent than everyone else that they never fuck up? That the random Ukrainian kid is so much better at hacking than various state agencies that when he impersonates them he always does it perfectly? That every Ukrainian kid is that competent? Come on. Your thesis is essentially that state actors are the least competent "cyber actors", because everyone can impersonate them and none of them can tell. That's counter to basically everything else we know.
- rendall 5y ago
  > As I understand it, signifiers included command and control servers known to be under Russian state control. If you could be more specific, we could address this. However, you cannot, because the allegations are all this vague. If it's the assertion that I think it is, the "command and control servers" were asserted by Crowdstrike to be under Russian control, and its evidence for this, again, were somewhere deep in a rabbit warren of cross- and circular references[1]. > Do you work in this field? I've basically only seen lay people suggest this. I have seen journalists claim that only lay people suggest this. To your vague and amorphous allegations of "state actors", I reply with this specific analysis of the few concrete indicators of compromise supplied by the departments of the government making the allegation. It's farcical. If Russiagate were to be true, the Russian hackers are no better than script kiddies, using outdated PHP malware as they do. https://www.wordfence.com/blog/2016/12/russia-malware-ip-hack/ https://www.wordfence.com/blog/2016/12/russia-malware-ip-hac... [1] Furthermore, IP addresses change constantly. Again, if you're referring to the assertion I think you are, that IP address had been defunct for over 2 years before the attack See https://www.wordfence.com/blog/2017/01/election-hack-faq/ https://www.wordfence.com/blog/2017/01/election-hack-faq/ An IP that was being used by Russian Intelligence today to hack a target may be used by another attacker to hack a different target a few days later. This can happen for several reasons: - A hacked IP can be used by one attacker and then be compromised by a different attacker later on to also launch attacks. - IP addresses change ownership from time to time. A Linode IP may be hacked by Russia and used to launch attacks. Then it may be shut down by Linode, change ownership and the new owner’s site can get hacked. Then that IP address is attacking once again, but the attacker is someone else. - IP addresses are also dynamic if they belong to an internet service provider (ISP). Some of the IP’s in the Grizzly Steppe report do belong to ISP’s. For example we can see IP’s belonging to Yota.ru, a Russian internet service provider. The hostnames are ‘wimax-client.yota.ru’ which suggests that they are wifi customers. These IP’s are probably dynamic and regularly change hands. They may be used by one attacker today and a different attacker tomorrow.

joshuamorton 5y ago

As I understand it, signifiers included command and control servers known to be under Russian state control. So, yes, someone would need to have piggybacked on Russian state controlled servers. > Technical signifiers are not difficult to spoof, nothing about them requires any nation state backing as they rely on heuristics which are semi-public Do you work in this field? I've basically only seen lay people suggest this. > That's because if said attack is successful, you wouldn't even know about it being such an attack, that's the crux of the problem. Hence my second point: that we've never seen evidence of an unsuccessful attempt, meaning that there's a 100% success rate of spoofing. You're telling me that's realistic? That the spoofers are just so incredibly more competent than everyone else that they never fuck up? That the random Ukrainian kid is so much better at hacking than various state agencies that when he impersonates them he always does it perfectly? That every Ukrainian kid is that competent? Come on. Your thesis is essentially that state actors are the least competent "cyber actors", because everyone can impersonate them and none of them can tell. That's counter to basically everything else we know.

rendall 5y ago
> As I understand it, signifiers included command and control servers known to be under Russian state control. If you could be more specific, we could address this. However, you cannot, because the allegations are all this vague. If it's the assertion that I think it is, the "command and control servers" were asserted by Crowdstrike to be under Russian control, and its evidence for this, again, were somewhere deep in a rabbit warren of cross- and circular references[1]. > Do you work in this field? I've basically only seen lay people suggest this. I have seen journalists claim that only lay people suggest this. To your vague and amorphous allegations of "state actors", I reply with this specific analysis of the few concrete indicators of compromise supplied by the departments of the government making the allegation. It's farcical. If Russiagate were to be true, the Russian hackers are no better than script kiddies, using outdated PHP malware as they do. https://www.wordfence.com/blog/2016/12/russia-malware-ip-hack/ https://www.wordfence.com/blog/2016/12/russia-malware-ip-hac... [1] Furthermore, IP addresses change constantly. Again, if you're referring to the assertion I think you are, that IP address had been defunct for over 2 years before the attack See https://www.wordfence.com/blog/2017/01/election-hack-faq/ https://www.wordfence.com/blog/2017/01/election-hack-faq/ An IP that was being used by Russian Intelligence today to hack a target may be used by another attacker to hack a different target a few days later. This can happen for several reasons: - A hacked IP can be used by one attacker and then be compromised by a different attacker later on to also launch attacks. - IP addresses change ownership from time to time. A Linode IP may be hacked by Russia and used to launch attacks. Then it may be shut down by Linode, change ownership and the new owner’s site can get hacked. Then that IP address is attacking once again, but the attacker is someone else. - IP addresses are also dynamic if they belong to an internet service provider (ISP). Some of the IP’s in the Grizzly Steppe report do belong to ISP’s. For example we can see IP’s belonging to Yota.ru, a Russian internet service provider. The hostnames are ‘wimax-client.yota.ru’ which suggests that they are wifi customers. These IP’s are probably dynamic and regularly change hands. They may be used by one attacker today and a different attacker tomorrow.