9 ms·

So I guess if I were a non-Russian actor wanting to pin this on Russia I could just search for information that a Russian actor would look for to pin it on them

So I guess if I were a non-Russian actor wanting to pin this on Russia I could just search for information that a Russian actor would look for to pin it on them? Equally applies if I wanted to pin this on China, Iran, and so forth? Isn’t this too simplistic or perhaps it just serves domestic political interests?

runnerup 5y ago
Probably too simplistic in a world where western governments watch the internal CCTV security cameras of Russian/Chinese state hacking offices: https://www.washingtonpost.com/news/worldviews/wp/2018/01/26/dutch-media-reveal-country-to-be-secret-u-s-ally-in-war-against-russian-hackers/ https://www.washingtonpost.com/news/worldviews/wp/2018/01/26...
- kgeist 5y ago
  >The country’s analysts were reportedly also able to track the location of the hackers' offices down to a university building next Moscow’s Red Square. When I lived in Moscow my location was often misidentified as next to Red Square on various sites that tried to guess my location by IP or whatever else they use. I hope the analysts didn't use same tools.
  - runnerup 5y ago
    I would assume at the point they had CCTV camera feeds they would be able to confirm the precise building by having agents watch people go in/out and comparing clothes of people on the camera vs in real life. But who knows what actually happened.
boomboomsubban 5y ago
Or if I'm the US and want to use this hack for political gains, I would announce that certain information was targeted when in reality they just dumped everything. Why would you use the limited time you may have access to comb through data when you can just grab everything?
Threeve303 5y ago
One of many methods is to look at the code page used if it is a text document or something similar. I guess if you wanted to there is nothing stopping you from making a document look like it came from a foreign country based on the document encoding. Then you have a ton of other metadata on files now that would have to match. Not exactly impossible.
snksnk 5y ago
Yes, and to be more subtle also see e.g. UMBRAGE in Vault7 [1]. CIA has impersonated Kaspersky Labs, and other agencies/countries do the same. [1] https://wikileaks.org/ciav7p1/ https://wikileaks.org/ciav7p1/

runnerup 5y ago

Probably too simplistic in a world where western governments watch the internal CCTV security cameras of Russian/Chinese state hacking offices: https://www.washingtonpost.com/news/worldviews/wp/2018/01/26/dutch-media-reveal-country-to-be-secret-u-s-ally-in-war-against-russian-hackers/ https://www.washingtonpost.com/news/worldviews/wp/2018/01/26...

kgeist 5y ago
>The country’s analysts were reportedly also able to track the location of the hackers' offices down to a university building next Moscow’s Red Square. When I lived in Moscow my location was often misidentified as next to Red Square on various sites that tried to guess my location by IP or whatever else they use. I hope the analysts didn't use same tools.
- runnerup 5y ago
  I would assume at the point they had CCTV camera feeds they would be able to confirm the precise building by having agents watch people go in/out and comparing clothes of people on the camera vs in real life. But who knows what actually happened.

boomboomsubban 5y ago

Or if I'm the US and want to use this hack for political gains, I would announce that certain information was targeted when in reality they just dumped everything. Why would you use the limited time you may have access to comb through data when you can just grab everything?

Threeve303 5y ago

One of many methods is to look at the code page used if it is a text document or something similar. I guess if you wanted to there is nothing stopping you from making a document look like it came from a foreign country based on the document encoding. Then you have a ton of other metadata on files now that would have to match. Not exactly impossible.

snksnk 5y ago

Yes, and to be more subtle also see e.g. UMBRAGE in Vault7 [1]. CIA has impersonated Kaspersky Labs, and other agencies/countries do the same. [1] https://wikileaks.org/ciav7p1/ https://wikileaks.org/ciav7p1/