15 ms·

Which "nation state" do we think this was?

meowface 3y ago
For these kinds of attacks it's nearly always China, Russia, US, or sometimes Iran. 95% chance it's either China or Russia, here.
- 2OEH8eoCRo0 3y ago
  When has it been the US?
  - AzzyHN 3y ago
    We do a lot of hacking
    - 2OEH8eoCRo0 3y ago
      I'm sure we do. I don't agree that we attack private civilian enterprise.
      - vikramkr 3y ago
        If the usa does I don't understand why you expect we'd know about it. Also the us totally does and we do know about it - the nsa buys zero days - it's not exactly a secret lol
        2OEH8eoCRo0 3y ago
        The same way Cloudflare can report on foreign state hackers, other countries can discover and report on ours, no?
        vikramkr 3y ago
        Right- and they probably do, and they don't know it was us just like cloudflare doesn't know what country it was. For all we know that cloudflare attack was the US. I don't know why China/Russia/Iran/nk would be able to carry out the cloudflare attack without cloudflare being able to pin who exactly did it while the US is supposed to be so incompetent that we would be immediately identified and called out?
  - toyg 3y ago
    Stuxnet?
    - 2OEH8eoCRo0 3y ago
      Stuxnet targeted the uranium enrichment facility at Natanz run by the Iranian government. When does the US attack private enterprise?
      - askvictor 3y ago
        When it suits them (i.e. when there is data to be gained). But it's more often done through the courts, and when it needs to be a covert op, I'm guessing they'd get their buddies in friendly countries to do the dirty work.
        2OEH8eoCRo0 3y ago
        Well how about some evidence then?
        jrockway 3y ago
        I mean, did we already forget about Ed Snowden and "SSL added and removed here :-)"?
        askvictor 3y ago
        I mean there's https://www.schneier.com/blog/archives/2022/06/on-the-subversion-of-nist-by-the-nsa.html https://www.schneier.com/blog/archives/2022/06/on-the-subver... for one. And you can look for instances of warrant canaries to see where else they've used the existing legal system. As for covert ops, well, they're covert. I don't have any evidence (hence I said "I'm guessing") but that's how I understand secretive agencies do things. If you look at all of the agencies involved in Stuxnet, you'd get the idea that allied countries' secret services tend to work together (or for each other) to some degree when it suits them.
      - 0xy 3y ago
        The NSA spied on French private companies according to Wikileaks docs from 2015. [1] There's many such cases. They're well known for spying on Siemens as well. With allies like the United States, who needs enemies? [1] https://www.spiegel.de/politik/ausland/wikileaks-enthuellung-nsa-soll-auch-franzoesische-wirtschaft-bespitzelt-haben-a-1041268.html https://www.spiegel.de/politik/ausland/wikileaks-enthuellung...
- toyg 3y ago
  Their response program being called "Code Red" is likely a hint.
godzillabrennus 3y ago
China.
jedahan 3y ago
The writeup contains indicators, including IP addresses, and the location of those addresses. In this case, the IP address associated with the threat actor is currently located in Bucharest, Romania.
- tomschlick 3y ago
  No nation state is going to use IPs from their own country if they don't want to be caught. They will use multiple layers of rented VPS's with fake identities to pay for those resources.
  - jrockway 3y ago
    Yeah. I've dealt with definitely-not-nation-states before, and their pattern was to sign up for free/cheap CI services (CircleCI, Github Actions, that sort of thing) and launch their attacks from there. The VPS thing also sounds very very plausible to me, I figured there was a long tail, but until I was looking up every network that was attacking us, I really had no idea how deep the long tail goes. I now feel like half the world's side hustle is to rent a server that they never update and host a couple of small business websites there.
    - bredren 3y ago
      > I now feel like half the world's side hustle is to rent a server that they never update and host a couple of small business websites there. Do you mean people are offering build / host services for small biz, and leaving their servers in such a state they can be owned and used as jump points for intrusion? Reason I ask is long-hosted small business websites are sometimes established with the intent to legitimize some future unrelated traffic.
      - outworlder 3y ago
        > Do you mean people are offering build / host services for small biz, and leaving their servers in such a state they can be owned and used as jump points for intrusion? Probably not what's happening. I've tried to build a cloud CI service a while ago. Per their nature, you _have to_ allow arbitrary commands to be run. And you also have to allow outbound connectivity. So you don't need to 'own' anything in order to be dangerous. They will not run with heightened privileges but that's of little help if the target is external. It is pretty difficult to reliably secure them against being used as a source of attacks as there's a lot you can do that will mimic legitimate traffic. Sure, you can block connections to things like IRC and you can throttle or flag some suspicious traffic. You can't really prevent HTTPS requests from going out. Heck, even SSH is pretty much required if you are allowing access to git. Generally speaking, a build service provider will try to harden their own services and sandbox anything that is run in order to protect themselves from being compromised. Most providers won't want to be known as a major source of malicious activity, so there's some effort there. AWS and other large providers have more resources and will easily ban your ass, but that doesn't matter if it happens after a successful attack was launched.
lijok 3y ago
Which nation state has good enough employment protection laws that they can take weekends off while doing recon on a top value target?
- icepat 3y ago
  Yes, they must have been a member of the Norwegian Foreningen Svartehattehackere. They are a very strong union.
- toyg 3y ago
  Might be a coincidence. A certain nation-state is currently engaged in all-out war; the intruder might have been summoned to another, more urgent task.
- papertokyo 3y ago
  I assume the break is to have less chance of their activities be discovered and/or connected.
wubbert 3y ago
Israel.

For these kinds of attacks it's nearly always China, Russia, US, or sometimes Iran. 95% chance it's either China or Russia, here.

2OEH8eoCRo0 3y ago
When has it been the US?
- AzzyHN 3y ago
  We do a lot of hacking
  - 2OEH8eoCRo0 3y ago
    I'm sure we do. I don't agree that we attack private civilian enterprise.
    - vikramkr 3y ago
      If the usa does I don't understand why you expect we'd know about it. Also the us totally does and we do know about it - the nsa buys zero days - it's not exactly a secret lol
      - 2OEH8eoCRo0 3y ago
        The same way Cloudflare can report on foreign state hackers, other countries can discover and report on ours, no?
        vikramkr 3y ago
        Right- and they probably do, and they don't know it was us just like cloudflare doesn't know what country it was. For all we know that cloudflare attack was the US. I don't know why China/Russia/Iran/nk would be able to carry out the cloudflare attack without cloudflare being able to pin who exactly did it while the US is supposed to be so incompetent that we would be immediately identified and called out?
- toyg 3y ago
  Stuxnet?
  - 2OEH8eoCRo0 3y ago
    Stuxnet targeted the uranium enrichment facility at Natanz run by the Iranian government. When does the US attack private enterprise?
    - askvictor 3y ago
      When it suits them (i.e. when there is data to be gained). But it's more often done through the courts, and when it needs to be a covert op, I'm guessing they'd get their buddies in friendly countries to do the dirty work.
      - 2OEH8eoCRo0 3y ago
        Well how about some evidence then?
        jrockway 3y ago
        I mean, did we already forget about Ed Snowden and "SSL added and removed here :-)"?
        askvictor 3y ago
        I mean there's https://www.schneier.com/blog/archives/2022/06/on-the-subversion-of-nist-by-the-nsa.html https://www.schneier.com/blog/archives/2022/06/on-the-subver... for one. And you can look for instances of warrant canaries to see where else they've used the existing legal system. As for covert ops, well, they're covert. I don't have any evidence (hence I said "I'm guessing") but that's how I understand secretive agencies do things. If you look at all of the agencies involved in Stuxnet, you'd get the idea that allied countries' secret services tend to work together (or for each other) to some degree when it suits them.
    - 0xy 3y ago
      The NSA spied on French private companies according to Wikileaks docs from 2015. [1] There's many such cases. They're well known for spying on Siemens as well. With allies like the United States, who needs enemies? [1] https://www.spiegel.de/politik/ausland/wikileaks-enthuellung-nsa-soll-auch-franzoesische-wirtschaft-bespitzelt-haben-a-1041268.html https://www.spiegel.de/politik/ausland/wikileaks-enthuellung...
toyg 3y ago
Their response program being called "Code Red" is likely a hint.

godzillabrennus 3y ago

China.

jedahan 3y ago

The writeup contains indicators, including IP addresses, and the location of those addresses. In this case, the IP address associated with the threat actor is currently located in Bucharest, Romania.

tomschlick 3y ago
No nation state is going to use IPs from their own country if they don't want to be caught. They will use multiple layers of rented VPS's with fake identities to pay for those resources.
- jrockway 3y ago
  Yeah. I've dealt with definitely-not-nation-states before, and their pattern was to sign up for free/cheap CI services (CircleCI, Github Actions, that sort of thing) and launch their attacks from there. The VPS thing also sounds very very plausible to me, I figured there was a long tail, but until I was looking up every network that was attacking us, I really had no idea how deep the long tail goes. I now feel like half the world's side hustle is to rent a server that they never update and host a couple of small business websites there.
  - bredren 3y ago
    > I now feel like half the world's side hustle is to rent a server that they never update and host a couple of small business websites there. Do you mean people are offering build / host services for small biz, and leaving their servers in such a state they can be owned and used as jump points for intrusion? Reason I ask is long-hosted small business websites are sometimes established with the intent to legitimize some future unrelated traffic.
    - outworlder 3y ago
      > Do you mean people are offering build / host services for small biz, and leaving their servers in such a state they can be owned and used as jump points for intrusion? Probably not what's happening. I've tried to build a cloud CI service a while ago. Per their nature, you _have to_ allow arbitrary commands to be run. And you also have to allow outbound connectivity. So you don't need to 'own' anything in order to be dangerous. They will not run with heightened privileges but that's of little help if the target is external. It is pretty difficult to reliably secure them against being used as a source of attacks as there's a lot you can do that will mimic legitimate traffic. Sure, you can block connections to things like IRC and you can throttle or flag some suspicious traffic. You can't really prevent HTTPS requests from going out. Heck, even SSH is pretty much required if you are allowing access to git. Generally speaking, a build service provider will try to harden their own services and sandbox anything that is run in order to protect themselves from being compromised. Most providers won't want to be known as a major source of malicious activity, so there's some effort there. AWS and other large providers have more resources and will easily ban your ass, but that doesn't matter if it happens after a successful attack was launched.

lijok 3y ago

Which nation state has good enough employment protection laws that they can take weekends off while doing recon on a top value target?

icepat 3y ago
Yes, they must have been a member of the Norwegian Foreningen Svartehattehackere. They are a very strong union.
toyg 3y ago
Might be a coincidence. A certain nation-state is currently engaged in all-out war; the intruder might have been summoned to another, more urgent task.
papertokyo 3y ago
I assume the break is to have less chance of their activities be discovered and/or connected.

wubbert 3y ago

Israel.