6 ms·

Why would it be so localized to one country? Does Germany have a unique enemy compared to other NATO countries?

by ballenf 3y ago

mantas 3y ago
Maybe German state itself is the actor.
- hedora 3y ago
  What state actor doesn’t understand statistical deanoymization attacks against tor? (e.g., if you single-handedly double the network traffic, then an outside observer can figure out what ingress/egress traffic is yours)
  - mantas 3y ago
    Why pay attention to this if you can simply blame another state actor? And German federal government have a history for covert shitposting.
    - throwaway2037 3y ago
      And German federal government have a history for covert shitposting. Wow, I never heard this before. Can you provide some examples famous examples?
      - mantas 3y ago
        I remember there was a series of articles several years ago that German intelligence officers generated a lot activity in far-right websites. To the point that frequently it was mostly undercover „extremists“ discussing between themselves. The closest article I can quickly find is about Germany intelligence informants doing the same in meatspace though. > There was a "risk that sources of the intelligence service (Office for the Protection of the Constitution) could goad each other on to undertake bigger actions;" in other words, the system threatened to create an "incendiary effect." https://www.spiegel.de/international/germany/german-police-document-says-informants-fuelled-far-right-extremism-a-865461.html https://www.spiegel.de/international/germany/german-police-d...
- tetris11 3y ago
  My bet is Russia. I work in a German institution. I was recently hacked by such a botnet recently (lessons learned: use AuthorizedKeys, allow only one SSH user, proxy all http connections to a webhoster, and check your SSH and UFW logs often!) It setup a virtual environment where it downloaded some kind of Tor node and ran some sort of code that used 100% of my CPU. My guess is crypto-mining. I purged the account, deleted everything before I could do forensics, but I checked the logs for the connections and they all came from Russia.
- throwaway2037 3y ago
  Can you explain more?
aeyes 3y ago
My guess is that a certain router is getting infected with a botnet because ISPs usually hand out the same router to their customers. And ISPs are usually limited to a single country.
- riedel 3y ago
  That would be an explanation and probably by okhams razor be more likely. But wouldn't that ISP notice the difference in traffic patterns drastically and react? It is just unlikely (but far from impossible) that this is something 'normal' happening. My fear would be that someone still is trying to gather a critical mass of nodes to contact controll servers via TOR to cause mass havoc in a single country from within a single country. Generally IMHO Germany would be a good target for destabilisation currently. But I think and hope this could just a bit of overinterpreting. Probably one would need a good statistic on the subnets the users come from.
  - eitland 3y ago
    > That would be an explanation and probably by okhams razor be more likely. But wouldn't that ISP notice the difference in traffic patterns drastically and react? I hope to be wrong but I am afraid you are overestimating the technical competency of the average ISP.
  - NoZebra120vClip 3y ago
    I can't speak to German ISPs or anyone outside of these USA. But I believe that ISPs are absolutely the weakest link when it comes to malicious botnets and other types of widespread network-based compromises. ISPs certainly have the tooling and the positioning to be able to detect C&C channels, outgoing DDOS attacks, and compromised customer premises equipment. But do they? And if they do detect any of it, do they take action? When is the last time you heard about an ISP disconnecting a paying customer because of the customer's compromised device(s)? When is the last time you even heard of an ISP notifying a customer about such a thing? Two months ago, my router was compromised and joined to some sort of botnet in the capacity of a DNS resolver. I would never have been able to detect such WAN-side traffic if I hadn't had a special setup on my part. My ISP was the first to hear when I'd detected it, and I sincerely doubt that they receive many such reports, especially with logs as evidence. Can you imagine receiving a phone call, "Hello, this is your ISP! You're pwned! Please follow through these remediation steps as I prompt you: ..." You'd undoubtedly think it was a phishing scam. Because ISPs just don't seem to care about abuse. They will send you copyright strikes and prosecute you for BitTorrent, but it does't seem like they'd lift a finger to prevent the next big DDOS or spam factory originating from their own customers.

Why would it be so localized to one country? Does Germany have a unique enemy compared to other NATO countries?

mantas 3y ago

Maybe German state itself is the actor.

hedora 3y ago
What state actor doesn’t understand statistical deanoymization attacks against tor? (e.g., if you single-handedly double the network traffic, then an outside observer can figure out what ingress/egress traffic is yours)
- mantas 3y ago
  Why pay attention to this if you can simply blame another state actor? And German federal government have a history for covert shitposting.
  - throwaway2037 3y ago
    And German federal government have a history for covert shitposting. Wow, I never heard this before. Can you provide some examples famous examples?
    - mantas 3y ago
      I remember there was a series of articles several years ago that German intelligence officers generated a lot activity in far-right websites. To the point that frequently it was mostly undercover „extremists“ discussing between themselves. The closest article I can quickly find is about Germany intelligence informants doing the same in meatspace though. > There was a "risk that sources of the intelligence service (Office for the Protection of the Constitution) could goad each other on to undertake bigger actions;" in other words, the system threatened to create an "incendiary effect." https://www.spiegel.de/international/germany/german-police-document-says-informants-fuelled-far-right-extremism-a-865461.html https://www.spiegel.de/international/germany/german-police-d...
tetris11 3y ago
My bet is Russia. I work in a German institution. I was recently hacked by such a botnet recently (lessons learned: use AuthorizedKeys, allow only one SSH user, proxy all http connections to a webhoster, and check your SSH and UFW logs often!) It setup a virtual environment where it downloaded some kind of Tor node and ran some sort of code that used 100% of my CPU. My guess is crypto-mining. I purged the account, deleted everything before I could do forensics, but I checked the logs for the connections and they all came from Russia.
throwaway2037 3y ago
Can you explain more?

aeyes 3y ago

My guess is that a certain router is getting infected with a botnet because ISPs usually hand out the same router to their customers. And ISPs are usually limited to a single country.

riedel 3y ago
That would be an explanation and probably by okhams razor be more likely. But wouldn't that ISP notice the difference in traffic patterns drastically and react? It is just unlikely (but far from impossible) that this is something 'normal' happening. My fear would be that someone still is trying to gather a critical mass of nodes to contact controll servers via TOR to cause mass havoc in a single country from within a single country. Generally IMHO Germany would be a good target for destabilisation currently. But I think and hope this could just a bit of overinterpreting. Probably one would need a good statistic on the subnets the users come from.
- eitland 3y ago
  > That would be an explanation and probably by okhams razor be more likely. But wouldn't that ISP notice the difference in traffic patterns drastically and react? I hope to be wrong but I am afraid you are overestimating the technical competency of the average ISP.
- NoZebra120vClip 3y ago
  I can't speak to German ISPs or anyone outside of these USA. But I believe that ISPs are absolutely the weakest link when it comes to malicious botnets and other types of widespread network-based compromises. ISPs certainly have the tooling and the positioning to be able to detect C&C channels, outgoing DDOS attacks, and compromised customer premises equipment. But do they? And if they do detect any of it, do they take action? When is the last time you heard about an ISP disconnecting a paying customer because of the customer's compromised device(s)? When is the last time you even heard of an ISP notifying a customer about such a thing? Two months ago, my router was compromised and joined to some sort of botnet in the capacity of a DNS resolver. I would never have been able to detect such WAN-side traffic if I hadn't had a special setup on my part. My ISP was the first to hear when I'd detected it, and I sincerely doubt that they receive many such reports, especially with logs as evidence. Can you imagine receiving a phone call, "Hello, this is your ISP! You're pwned! Please follow through these remediation steps as I prompt you: ..." You'd undoubtedly think it was a phishing scam. Because ISPs just don't seem to care about abuse. They will send you copyright strikes and prosecute you for BitTorrent, but it does't seem like they'd lift a finger to prevent the next big DDOS or spam factory originating from their own customers.