4 ms·

I don't put much stock in attribution, but keeping an eye on what attacks stop when an adversary ends up refocusing their attention due to scandal and/or war is

I don't put much stock in attribution, but keeping an eye on what attacks stop when an adversary ends up refocusing their attention due to scandal and/or war is a pretty reliable indicator in my experience (and very difficult to false-flag). Activity we previously attributed to the Russians didn't flicker when Russia invaded Ukraine-- but did stop very quickly into Israel's invasion of Gaza.

anonomousename 3y ago
If true, that seems like some solid evidence. Do you have any links/sources I can read up on? I wasn’t able to find anything.
- appplication 3y ago
  This type of analysis quickly starts to wade into “intelligence” in the CIA sense of the word. It’s possible to do some of this digging on your own, but for the most part this type of information ends up requiring a lot of inference and synthesis across different sources and collection mechanisms to build a coherent story. If there’s one thing I learned from working in this space, it’s how there’s just massive amounts of “history” playing out every day that will never be written down or acknowledged. In particular, cyber/electronic warfare is a very active space, and quite a few nation states regularly commit what many of us would imagine would be considered acts of war against each other, without a word said to the public.
- jstarfish 3y ago
  It's not evidence at all, just data (intelligence) that makes me reconsider what I thought I knew about the situation and what else might be related that I didn't consider before. We have a "special" relationship with Israel so I can't go too much into detail, but suffice to say it was password spraying attacks that originated from domestic residential IPs that dropped off. Normally foreign agencies use datacenters and a known set of VPN ASNs. Israel happens to have their own onion routing network in the form of Hola/Luminati, but that isn't a discrete ASN-- it's a botnet of residential proxies. https://news.ycombinator.com/item?id=18161706 https://news.ycombinator.com/item?id=18161706 I don't know if Luminati is even still a thing but this is the sort of footprint I'd expect from it. They'd find residential proxies useful for their astroturfing campaigns so I assume it's still up. Attribution is a game of educated guesses. Now, I'm not implying the Israeli government is the actor here. For all I know it's some bored teenager fucking with us. The timing is what's suspect. Either the operator was compelled to stop when war broke out or the infrastructure they were using was somehow impacted by the Gaza offensive.
15457345234 3y ago
> Activity we previously attributed to the Russians didn't flicker when Russia invaded Ukraine-- but did stop very quickly into Israel's invasion of Gaza. What's your conclusion here, though? Who do you believe now was the actual bad actor and why did they stop? You're just leaving it open.
- jstarfish 3y ago
  I kinda have to leave it open. I can't rightfully say for certain it's Mossad. It looks like it's related to Israel's offensive, but even that is subject to interpretation. It remains an open question to me too. The most I'd feel comfortable speculating on is that the attacks were possibly leveraging Israeli infrastructure (Luminati?), which says little about the actors involved. There's a secondary insider event that occurred coincidental to the beginning of the attacks against us that makes me particularly suspicious of our "friends" but I absolutely cannot discuss that here.
g-b-r 3y ago
SSH attacks seem actually to have clearly spiked in the wake of Ukraine's invasion https://www.bsdly.net/~peter/Predicting_developments_in_real_world_conflict_from_patterns_of_failed_logins.html https://www.bsdly.net/~peter/Predicting_developments_in_real...
- jstarfish 3y ago
  Interesting. We don't run public SSH so it wasn't a consideration.

anonomousename 3y ago

If true, that seems like some solid evidence. Do you have any links/sources I can read up on? I wasn’t able to find anything.

appplication 3y ago
This type of analysis quickly starts to wade into “intelligence” in the CIA sense of the word. It’s possible to do some of this digging on your own, but for the most part this type of information ends up requiring a lot of inference and synthesis across different sources and collection mechanisms to build a coherent story. If there’s one thing I learned from working in this space, it’s how there’s just massive amounts of “history” playing out every day that will never be written down or acknowledged. In particular, cyber/electronic warfare is a very active space, and quite a few nation states regularly commit what many of us would imagine would be considered acts of war against each other, without a word said to the public.
jstarfish 3y ago
It's not evidence at all, just data (intelligence) that makes me reconsider what I thought I knew about the situation and what else might be related that I didn't consider before. We have a "special" relationship with Israel so I can't go too much into detail, but suffice to say it was password spraying attacks that originated from domestic residential IPs that dropped off. Normally foreign agencies use datacenters and a known set of VPN ASNs. Israel happens to have their own onion routing network in the form of Hola/Luminati, but that isn't a discrete ASN-- it's a botnet of residential proxies. https://news.ycombinator.com/item?id=18161706 https://news.ycombinator.com/item?id=18161706 I don't know if Luminati is even still a thing but this is the sort of footprint I'd expect from it. They'd find residential proxies useful for their astroturfing campaigns so I assume it's still up. Attribution is a game of educated guesses. Now, I'm not implying the Israeli government is the actor here. For all I know it's some bored teenager fucking with us. The timing is what's suspect. Either the operator was compelled to stop when war broke out or the infrastructure they were using was somehow impacted by the Gaza offensive.

15457345234 3y ago

> Activity we previously attributed to the Russians didn't flicker when Russia invaded Ukraine-- but did stop very quickly into Israel's invasion of Gaza. What's your conclusion here, though? Who do you believe now was the actual bad actor and why did they stop? You're just leaving it open.

jstarfish 3y ago
I kinda have to leave it open. I can't rightfully say for certain it's Mossad. It looks like it's related to Israel's offensive, but even that is subject to interpretation. It remains an open question to me too. The most I'd feel comfortable speculating on is that the attacks were possibly leveraging Israeli infrastructure (Luminati?), which says little about the actors involved. There's a secondary insider event that occurred coincidental to the beginning of the attacks against us that makes me particularly suspicious of our "friends" but I absolutely cannot discuss that here.

g-b-r 3y ago

SSH attacks seem actually to have clearly spiked in the wake of Ukraine's invasion https://www.bsdly.net/~peter/Predicting_developments_in_real_world_conflict_from_patterns_of_failed_logins.html https://www.bsdly.net/~peter/Predicting_developments_in_real...

jstarfish 3y ago
Interesting. We don't run public SSH so it wasn't a consideration.