4 ms·

I don't really like the way attribution for these sorts of things happens. Conspiracy theories aside, we do have a history of questionable attribution (Gulf of

I don't really like the way attribution for these sorts of things happens. Conspiracy theories aside, we do have a history of questionable attribution (Gulf of Tonkin, Iraq WMD to name two). So a rational mind is right to be skeptical and ask for evidence before accepting a narrative whole cloth. Instead, we are rarely given any evidence at all. In the article cited, we're just supposed to trust that Microsoft knows it's Russian government and can prove it. When we _are_ given some explanation, it's usually pretty weak: IP addresses are from XYZ country, metadata in a word doc is ABC language, etc. Add to that you have criminal elements that may or may not be controlled by their government. ...and then when you do question, you're downvoted, accused of being a shill, etc. I understand this sort of thing can rarely be proven 100%, and there is a need to protect intelligence sources and methods, but given that we should stop speaking and behaving as though things are 100% certain. Personally I'd like to see articles present more evidence and/or summarize into a percentage. "We rate the likelihood this is XYZ branch of Russian government at 60% due to the following factors: ...."

JumpCrisscross 5y ago
> you have criminal elements that may or may not be controlled by their government We can debate whether the Kremlin controls Russia's criminal elements. What is apparent is it's unwilling to pursue them. So much so that they practically live in the open.
jcrawfordor 5y ago
I think the major problem for organizations like MSTIC is that the vast majority of information they have access to came from other companies under strict confidentiality agreements. This is the norm in information security, most intelligence sharing goes through large vendor security centers or ISACs. In order to encourage/facilitate that sharing, these organizations require all of their members to agree to non-disclosure regimes (the "traffic light protocol" classification scheme is common in ISACs). It creates a bureaucratic situation where a company might have a great deal of data points to base an attribution on, but is prevented from disclosing 95% of them... not necessarily out of concern about source protection, but simply by contract with the data source(s). There's a long-running controversy within the industry about whether or not this situation is productive. The confidentiality agreements make corporations more willing to disclose data due to reduced risk of reputational damage and liability. But it also tends to make research and open communication more difficult and vague. The federal government has been through basically the exact same controversy over the last two decades regarding intelligence sharing, and to further complicate things it's common for there to be government elements (e.g. DHS) involved in these circles that mean there are also confidentiality agreements between government agencies and private industry that enforce many of the same rules. At its core, this comes out of a fundamental tension of liability and the law: is it better to do research that will produce damning material in lawsuit discovery, or to avoid doing the research and remain ignorant to the problem? Various industries have various half-solutions to this problem (e.g. Patient Safety Organizations in healthcare that are exempt from discovery), but the dominant one in information security reflects the roots of the industry in the intelligence community: anonymity of sources and confidentiality of information.
lodonnell9213 5y ago
There will likely be some form of confidential agreement with another party who supplied the info to MSFTIC, however, I also agree with your statement. Microsoft has been quite lax lately with a lot of things, you only need to see the stuff Kevin Beaumont is posting (ex-MSFT employee - senior cyber) about them knowingly hosting malware in OneDrive (standout as a OneDrive user), and knowing about a lot of issues and potentially being rather passive about fixing them. I love MSFT products, but lately from what I’ve been reading, their attitude to a lot of things security lately is a bit worrisome to me, I could be completely wrong as i don’t know what’s happening internally, but it’s also slightly worrying from one of essentially, the most powerful cyber security firms around.

JumpCrisscross 5y ago

> you have criminal elements that may or may not be controlled by their government We can debate whether the Kremlin controls Russia's criminal elements. What is apparent is it's unwilling to pursue them. So much so that they practically live in the open.

jcrawfordor 5y ago

I think the major problem for organizations like MSTIC is that the vast majority of information they have access to came from other companies under strict confidentiality agreements. This is the norm in information security, most intelligence sharing goes through large vendor security centers or ISACs. In order to encourage/facilitate that sharing, these organizations require all of their members to agree to non-disclosure regimes (the "traffic light protocol" classification scheme is common in ISACs). It creates a bureaucratic situation where a company might have a great deal of data points to base an attribution on, but is prevented from disclosing 95% of them... not necessarily out of concern about source protection, but simply by contract with the data source(s). There's a long-running controversy within the industry about whether or not this situation is productive. The confidentiality agreements make corporations more willing to disclose data due to reduced risk of reputational damage and liability. But it also tends to make research and open communication more difficult and vague. The federal government has been through basically the exact same controversy over the last two decades regarding intelligence sharing, and to further complicate things it's common for there to be government elements (e.g. DHS) involved in these circles that mean there are also confidentiality agreements between government agencies and private industry that enforce many of the same rules. At its core, this comes out of a fundamental tension of liability and the law: is it better to do research that will produce damning material in lawsuit discovery, or to avoid doing the research and remain ignorant to the problem? Various industries have various half-solutions to this problem (e.g. Patient Safety Organizations in healthcare that are exempt from discovery), but the dominant one in information security reflects the roots of the industry in the intelligence community: anonymity of sources and confidentiality of information.

lodonnell9213 5y ago

There will likely be some form of confidential agreement with another party who supplied the info to MSFTIC, however, I also agree with your statement. Microsoft has been quite lax lately with a lot of things, you only need to see the stuff Kevin Beaumont is posting (ex-MSFT employee - senior cyber) about them knowingly hosting malware in OneDrive (standout as a OneDrive user), and knowing about a lot of issues and potentially being rather passive about fixing them. I love MSFT products, but lately from what I’ve been reading, their attitude to a lot of things security lately is a bit worrisome to me, I could be completely wrong as i don’t know what’s happening internally, but it’s also slightly worrying from one of essentially, the most powerful cyber security firms around.