4 ms·

The problem with this analogy is that the CIA uses frameworks like Marble [1] to stage false flag cyberattacks. Attribution is never as obvious as helicopter la

The problem with this analogy is that the CIA uses frameworks like Marble [1] to stage false flag cyberattacks. Attribution is never as obvious as helicopter landing on your roof, not even close. [1] - https://en.wikipedia.org/wiki/Vault_7#Marble_framework https://en.wikipedia.org/wiki/Vault_7#Marble_framework

helloooooooo 4y ago
The wiki article doesn’t even mention false flags? Why wouldn’t the CIA make their malware another language? You think they are going to be hacking Russian networks with English language malware?
- _jal 4y ago
  Putting aside what any specific intelligence outfit does, attribution is a massive problem in infosec. Google "security attribution problem" if you are unfamiliar with the topic, it is a big one.
- pphysch 4y ago
  And yet people routinely act like the presence of Chinese/Russian/Iranian strings in a malware hexdump is strong evidence of the respective state's culpability.
  - mc32 4y ago
    People believe what they're predisposed to believe ideologically. I sympathize with [entity] -> Despite evidence, I cannot admit it was entity. I dislike [entity] -> despite lack of evidence, the plausibility allows me to attribute it to [entity].
- the_af 4y ago
  The wiki does mention false flags: > "In its release, WikiLeaks described the primary purpose of "Marble" as to insert foreign language text into the malware to mask viruses, trojans and hacking attacks, making it more difficult for them to be tracked to the CIA and to cause forensic investigators to falsely attribute code to the wrong nation."
  - LtWorf 4y ago
    Ah that must be why i code in english: put the blame on the americans! :D
- MichaelCollins 4y ago
  > Why wouldn’t the CIA make their malware another language? You think they are going to be hacking Russian networks with English language malware? When you disguise yourself to look like somebody else when doing something nefarious, knowing that you will be mistaken for that somebody else, that's a false flag. > A false flag operation is an act committed with the intent of disguising the actual source of responsibility and pinning blame on another party. https://en.wikipedia.org/wiki/False_flag https://en.wikipedia.org/wiki/False_flag
tlb 4y ago
Attribution can be difficult with IRL attacks too. So you can't be sure about every attack, but you're often sure about some of them because secrecy is hard. For example: Stuxnet was one of many responses to Iran's nuclear weapons program. Another response was, allegedly [0], assassination of some senior scientists. Attribution is still disputed about the latter, but not the former. [0] https://en.wikipedia.org/wiki/Nuclear_program_of_Iran#Possible_espionage_and_assassinations https://en.wikipedia.org/wiki/Nuclear_program_of_Iran#Possib...
- pphysch 4y ago
  > Attribution is still disputed about the latter, but not the former. Is anyone seriously considering that it was not Mossad/CIA? Cui bono?

helloooooooo 4y ago

The wiki article doesn’t even mention false flags? Why wouldn’t the CIA make their malware another language? You think they are going to be hacking Russian networks with English language malware?

_jal 4y ago
Putting aside what any specific intelligence outfit does, attribution is a massive problem in infosec. Google "security attribution problem" if you are unfamiliar with the topic, it is a big one.
pphysch 4y ago
And yet people routinely act like the presence of Chinese/Russian/Iranian strings in a malware hexdump is strong evidence of the respective state's culpability.
- mc32 4y ago
  People believe what they're predisposed to believe ideologically. I sympathize with [entity] -> Despite evidence, I cannot admit it was entity. I dislike [entity] -> despite lack of evidence, the plausibility allows me to attribute it to [entity].
the_af 4y ago
The wiki does mention false flags: > "In its release, WikiLeaks described the primary purpose of "Marble" as to insert foreign language text into the malware to mask viruses, trojans and hacking attacks, making it more difficult for them to be tracked to the CIA and to cause forensic investigators to falsely attribute code to the wrong nation."
- LtWorf 4y ago
  Ah that must be why i code in english: put the blame on the americans! :D
MichaelCollins 4y ago
> Why wouldn’t the CIA make their malware another language? You think they are going to be hacking Russian networks with English language malware? When you disguise yourself to look like somebody else when doing something nefarious, knowing that you will be mistaken for that somebody else, that's a false flag. > A false flag operation is an act committed with the intent of disguising the actual source of responsibility and pinning blame on another party. https://en.wikipedia.org/wiki/False_flag https://en.wikipedia.org/wiki/False_flag

tlb 4y ago

Attribution can be difficult with IRL attacks too. So you can't be sure about every attack, but you're often sure about some of them because secrecy is hard. For example: Stuxnet was one of many responses to Iran's nuclear weapons program. Another response was, allegedly [0], assassination of some senior scientists. Attribution is still disputed about the latter, but not the former. [0] https://en.wikipedia.org/wiki/Nuclear_program_of_Iran#Possible_espionage_and_assassinations https://en.wikipedia.org/wiki/Nuclear_program_of_Iran#Possib...

pphysch 4y ago
> Attribution is still disputed about the latter, but not the former. Is anyone seriously considering that it was not Mossad/CIA? Cui bono?