7 ms·

> (NEW YORK) -- Some of the nation's largest airports have been targeted for cyberattacks Monday by an attacker within the Russian Federation, a senior official

> (NEW YORK) -- Some of the nation's largest airports have been targeted for cyberattacks Monday by an attacker within the Russian Federation, a senior official briefed confirmed to ABC News. Senior official from what agency / organization are making those claims? > The attacks have resulted in targeted "denial of public access" to public-facing web domains that report airport wait times and congestion Why would they be doing DDoS on this service? > Hartsfield-Jackson Atlanta International Airport reported around 10:30 a.m. ET that its site is back up and running and that "at no time were operations at the airport impacted." And operations are not being impacted... I hear "Russia" is doing X and at this point I don't believe it without evidence being presented. Anonymous sources are equivalent to saying "some random person says X". Also why would they do anything with not negative impacts. This isn't much of a story IMO

snake_doc 4y ago
Do you want more than a name and a organization? Would you like John’s home address? > Over a dozen airport websites were impacted by the "denial of service" attack, John Hultquist, head of intelligence analysis at cybersecurity firm Mandian[t], told ABC News. That type of attack essentially overloads sites by jamming them with artificial users. >” Killnet," a pro-Russian hacker group, is believed to be behind the attack, according to Hultquist. While similar groups have been found to be fronts for state-backed actors, Hultquist said there is no evidence the Russian government was involved in directing this attack.
- mkoryak 4y ago
  Serious question: How do they know that? I assume killnet does not have a static IP address and doesn't leave it's return address
  - woodruffw 4y ago
    I don’t know about the details in this case, but hacking (particularly DDoS) groups can be remarkably childish: they sometimes intentionally leave their name in requests, knowing that it’ll show up in logs. The other identifying technique is correlation: if they’re using a network of hacked devices to create a flood of traffic, any previous attacks that saw traffic from those same devices are possibly from the same group. So it’s possible killnet has a public chronology here.
    - Minor49er 4y ago
      The former of these would easily open the possibility of a false flag. Same with the latter, though it would be harder to pull off
      - woodruffw 4y ago
        This would be a pretty strange false flag: why bother blaming some random group that hasn’t been linked to the Russian government? To my mind, the most likely explanation here is the simplest one: airport websites make good testing targets, and Russia doesn’t punish hackers who target non-military resources in the West.
        Minor49er 4y ago
        I was speaking generally, but in this case it would be used to simply say "the Russians," regardless of whether or not they are under the Russian government. Even then, using your own example: imagine you are testing a malicious system that you built that is hitting a public testing target. Wouldn't you want to link it to anyone other than yourself for when it is inevitably detected?
  - NegativeK 4y ago
    People doing threat intelligence are generally on top of attribution and try to do appropriate, fact-based attribution. That said, the warnings about Russia interfering with US infrastructure were flowing a bit before the invasion of Ukraine. Russia would be the first suspect on the top of the list, even barring good threat intel.
  - status200 4y ago
    Hacking groups can have a recognizable fingerprint / strategy [0] Killnet has claimed responsibility for similar attacks in the past [1] [0] http://attack.mitre.org/ http://attack.mitre.org/ [1] https://www.cisa.gov/uscert/ncas/alerts/aa22-110a https://www.cisa.gov/uscert/ncas/alerts/aa22-110a
    - citilife 4y ago
      DDoS a website is probably the most common forms of attacks globally...
      - Auracle 4y ago
        I guess it could be a DDoS with the same botnet?
  - kasey_junk 4y ago
    https://www.mandiant.com/resources/blog/how-mandiant-tracks-uncategorized-threat-actors https://www.mandiant.com/resources/blog/how-mandiant-tracks-...
  - laba 4y ago
    killnet spends a lot of time promoting themselves, 7 hours ago they announced in their telegram channel that they are going to start an attack on USA airport websites and asked everybody to join them They've also done similar attacks before so they were clearly under radar
- fit2rule 4y ago
- citilife 4y ago
  > Over a dozen airport websites were impacted by the "denial of service" attack, John Hultquist, head of intelligence analysis at cybersecurity firm Mandian, told ABC News. That type of attack essentially overloads sites by jamming them with artificial users. That's not a "senior official"; "official" implies government, that's a company. Yes, I would like to know the government agency official providing this information. >” Killnet," a pro-Russian hacker group, is believed to be behind the attack, according to Hultquist. While similar groups have been found to be fronts for state-backed actors, Hultquist said there is no evidence the Russian government was involved in directing this attack. What evidence supports this? IMO it's coming from that unspecified official. And yes, I think evidence needs to be provided before claims are made. They're just saying "I think it's these guys" ... because?
  - kasey_junk 4y ago
    The quote you embedded is attributed to a person and where they work? Perhaps you meant to quote something else? Mandiants attribution methodology is trivially found on their website: https://www.mandiant.com/resources/blog/how-mandiant-tracks-uncategorized-threat-actors https://www.mandiant.com/resources/blog/how-mandiant-tracks-...
    - deleted 4y ago
      [deleted]
    - citilife 4y ago
      Read the ABC article carefully (as one should always do) There's mention of a "senior official" > senior official briefed confirmed to ABC News. So a source in government confirmed this to ABC (who's that?). Was it just a "could be russia" type comment. There's a separate person, who's primarily sharing the story: > Over a dozen airport websites were impacted by the "denial of service" attack, John Hultquist, head of intelligence analysis at cybersecurity firm Mandian, told ABC News. ABC and many news outlets generally require multiple sources prior to publishing. There's been a lot of stories lately that have the same base source, but they decide to count as "multiple sources" because an official in the government leaks to two different people and those two people confirm. It's called "information laundering" Anyway, i'd really out of genuine curiosity know how they know this is from Russia. Which agencies are confirming this? IMO it seems petty and not something a government would do.
- laba 4y ago
  this killnet guys stated that they are starting USA airports DDOS in their telegram channel, they also provided list of airports and their urls they've done similar things before, most of their "hacking" consists of ddosing some sites that they randomly decide are an enemy to Russia
matai_kolila 4y ago
...the source literally isn't anonymous, it's Mandiant (not Mandian, that's a typo), and Mandiant has released so much evidence to back its claims over the years that if you can't by now at least give some credibility to the Mandiant name, you're not acting rationally. He also directly states that this group is Russian but not acting on behalf of the Russian government in this case: > Hultquist said there is no evidence the Russian government was involved in directing this attack.
- ghostpepper 4y ago
  The fact that they couldn't get the name of Mandiant right does not inspire faith that they have a handle on reporting security news more broadly.
- citilife 4y ago
  There are two sources. Read the article carefully. There's an anonymous "senior official" and a person from "Mandian" (assuming ABC made a typo - Mandiant).
  - matai_kolila 4y ago
    Only one source has relevant information pertinent to your questions, the named source from Mandiant. The "official" would not be equipped to answer the questions you've asked, and they're more than likely an airport official not a government official (as US airports are almost entirely run by private, for-profit organizations). But more importantly, neither source said anything about the Russian government doing anything here; if you read carefully at most it's a group within the country of Russia, and that's it. In fact Mandiant directly states that there's no evidence the government of Russia directed the attackers.
cycrutchfield 4y ago
https://amp.knowyourmeme.com/memes/proofster https://amp.knowyourmeme.com/memes/proofster

snake_doc 4y ago

Do you want more than a name and a organization? Would you like John’s home address? > Over a dozen airport websites were impacted by the "denial of service" attack, John Hultquist, head of intelligence analysis at cybersecurity firm Mandian[t], told ABC News. That type of attack essentially overloads sites by jamming them with artificial users. >” Killnet," a pro-Russian hacker group, is believed to be behind the attack, according to Hultquist. While similar groups have been found to be fronts for state-backed actors, Hultquist said there is no evidence the Russian government was involved in directing this attack.

mkoryak 4y ago
Serious question: How do they know that? I assume killnet does not have a static IP address and doesn't leave it's return address
- woodruffw 4y ago
  I don’t know about the details in this case, but hacking (particularly DDoS) groups can be remarkably childish: they sometimes intentionally leave their name in requests, knowing that it’ll show up in logs. The other identifying technique is correlation: if they’re using a network of hacked devices to create a flood of traffic, any previous attacks that saw traffic from those same devices are possibly from the same group. So it’s possible killnet has a public chronology here.
  - Minor49er 4y ago
    The former of these would easily open the possibility of a false flag. Same with the latter, though it would be harder to pull off
    - woodruffw 4y ago
      This would be a pretty strange false flag: why bother blaming some random group that hasn’t been linked to the Russian government? To my mind, the most likely explanation here is the simplest one: airport websites make good testing targets, and Russia doesn’t punish hackers who target non-military resources in the West.
      - Minor49er 4y ago
        I was speaking generally, but in this case it would be used to simply say "the Russians," regardless of whether or not they are under the Russian government. Even then, using your own example: imagine you are testing a malicious system that you built that is hitting a public testing target. Wouldn't you want to link it to anyone other than yourself for when it is inevitably detected?
- NegativeK 4y ago
  People doing threat intelligence are generally on top of attribution and try to do appropriate, fact-based attribution. That said, the warnings about Russia interfering with US infrastructure were flowing a bit before the invasion of Ukraine. Russia would be the first suspect on the top of the list, even barring good threat intel.
- status200 4y ago
  Hacking groups can have a recognizable fingerprint / strategy [0] Killnet has claimed responsibility for similar attacks in the past [1] [0] http://attack.mitre.org/ http://attack.mitre.org/ [1] https://www.cisa.gov/uscert/ncas/alerts/aa22-110a https://www.cisa.gov/uscert/ncas/alerts/aa22-110a
  - citilife 4y ago
    DDoS a website is probably the most common forms of attacks globally...
    - Auracle 4y ago
      I guess it could be a DDoS with the same botnet?
- kasey_junk 4y ago
  https://www.mandiant.com/resources/blog/how-mandiant-tracks-uncategorized-threat-actors https://www.mandiant.com/resources/blog/how-mandiant-tracks-...
- laba 4y ago
  killnet spends a lot of time promoting themselves, 7 hours ago they announced in their telegram channel that they are going to start an attack on USA airport websites and asked everybody to join them They've also done similar attacks before so they were clearly under radar
fit2rule 4y ago
citilife 4y ago
> Over a dozen airport websites were impacted by the "denial of service" attack, John Hultquist, head of intelligence analysis at cybersecurity firm Mandian, told ABC News. That type of attack essentially overloads sites by jamming them with artificial users. That's not a "senior official"; "official" implies government, that's a company. Yes, I would like to know the government agency official providing this information. >” Killnet," a pro-Russian hacker group, is believed to be behind the attack, according to Hultquist. While similar groups have been found to be fronts for state-backed actors, Hultquist said there is no evidence the Russian government was involved in directing this attack. What evidence supports this? IMO it's coming from that unspecified official. And yes, I think evidence needs to be provided before claims are made. They're just saying "I think it's these guys" ... because?
- kasey_junk 4y ago
  The quote you embedded is attributed to a person and where they work? Perhaps you meant to quote something else? Mandiants attribution methodology is trivially found on their website: https://www.mandiant.com/resources/blog/how-mandiant-tracks-uncategorized-threat-actors https://www.mandiant.com/resources/blog/how-mandiant-tracks-...
  - deleted 4y ago
    [deleted]
  - citilife 4y ago
    Read the ABC article carefully (as one should always do) There's mention of a "senior official" > senior official briefed confirmed to ABC News. So a source in government confirmed this to ABC (who's that?). Was it just a "could be russia" type comment. There's a separate person, who's primarily sharing the story: > Over a dozen airport websites were impacted by the "denial of service" attack, John Hultquist, head of intelligence analysis at cybersecurity firm Mandian, told ABC News. ABC and many news outlets generally require multiple sources prior to publishing. There's been a lot of stories lately that have the same base source, but they decide to count as "multiple sources" because an official in the government leaks to two different people and those two people confirm. It's called "information laundering" Anyway, i'd really out of genuine curiosity know how they know this is from Russia. Which agencies are confirming this? IMO it seems petty and not something a government would do.
laba 4y ago
this killnet guys stated that they are starting USA airports DDOS in their telegram channel, they also provided list of airports and their urls they've done similar things before, most of their "hacking" consists of ddosing some sites that they randomly decide are an enemy to Russia

matai_kolila 4y ago

...the source literally isn't anonymous, it's Mandiant (not Mandian, that's a typo), and Mandiant has released so much evidence to back its claims over the years that if you can't by now at least give some credibility to the Mandiant name, you're not acting rationally. He also directly states that this group is Russian but not acting on behalf of the Russian government in this case: > Hultquist said there is no evidence the Russian government was involved in directing this attack.

ghostpepper 4y ago
The fact that they couldn't get the name of Mandiant right does not inspire faith that they have a handle on reporting security news more broadly.
citilife 4y ago
There are two sources. Read the article carefully. There's an anonymous "senior official" and a person from "Mandian" (assuming ABC made a typo - Mandiant).
- matai_kolila 4y ago
  Only one source has relevant information pertinent to your questions, the named source from Mandiant. The "official" would not be equipped to answer the questions you've asked, and they're more than likely an airport official not a government official (as US airports are almost entirely run by private, for-profit organizations). But more importantly, neither source said anything about the Russian government doing anything here; if you read carefully at most it's a group within the country of Russia, and that's it. In fact Mandiant directly states that there's no evidence the government of Russia directed the attackers.

cycrutchfield 4y ago

https://amp.knowyourmeme.com/memes/proofster https://amp.knowyourmeme.com/memes/proofster