4 ms·

I've never understood how it's determined that it's a Russian hacking group that did this or any cyber attack. If it's so well understood what a Russian attack

by 93po 2y ago

I've never understood how it's determined that it's a Russian hacking group that did this or any cyber attack. If it's so well understood what a Russian attack looks like, wouldn't it be trivial to make any attack look Russian? And if it's not so clear what a Russian-specific attack looks like, how can we be so confident all the time that it's undoubtedly Russian?

jononor 2y ago
Oceania was always at war with Eastasia... Just blaming public enemy of the day. Knowing who actually did it I difficult and not really important either.
2OEH8eoCRo0 2y ago
I think that's BS because if I Google that exact question it tells me how. You don't understand because you either don't want to understand or haven't taken any time at all to research the topic. It's also not always Russia, there were two cyber attack headlines yesterday and neither appeared to be state actors.
- 93po 2y ago
  Google tells me it's complicated and there's no sure-fire way to know, and that effectively every single accusation of origin is only an estimation, which reinforces my original point that these attacks are stated factually as Russian instead of "forensic experts of unknown bias has some reason to believe it may be Russian of origin, but there is also evidence it could be other actors or actors trying to come across as Russian". But that doesn't make for as nice of a narrative.
foverzar 2y ago
It is based on various attribution factors. But since it is typically easier to point at the currently hated scapegoat and be done with it, the quality of these attribution factors leaves much to be desired. E.g. https://blog.sekoia.io/noname05716-ddosia-project-2024-updates-and-behavioural-shifts/ https://blog.sekoia.io/noname05716-ddosia-project-2024-updat... "The decision not to mandate VPN usage in Russia, especially given their statement “it is extremely unlikely that there will be any problems”, suggests a possible collaboration between the NoName057(16) group and the Russian state." I imagine you've also heard of attributions like "Cyrillic layout" (used all over eurasia) or "IP pool associated with a Russian AS" (as if VPS renting isn't a thing or commodity routers in Russia aren't hackable and can't be forced into a botnet)

by 93po 2y ago

jononor 2y ago

Oceania was always at war with Eastasia... Just blaming public enemy of the day. Knowing who actually did it I difficult and not really important either.

2OEH8eoCRo0 2y ago

I think that's BS because if I Google that exact question it tells me how. You don't understand because you either don't want to understand or haven't taken any time at all to research the topic. It's also not always Russia, there were two cyber attack headlines yesterday and neither appeared to be state actors.

93po 2y ago
Google tells me it's complicated and there's no sure-fire way to know, and that effectively every single accusation of origin is only an estimation, which reinforces my original point that these attacks are stated factually as Russian instead of "forensic experts of unknown bias has some reason to believe it may be Russian of origin, but there is also evidence it could be other actors or actors trying to come across as Russian". But that doesn't make for as nice of a narrative.

foverzar 2y ago

It is based on various attribution factors. But since it is typically easier to point at the currently hated scapegoat and be done with it, the quality of these attribution factors leaves much to be desired. E.g. https://blog.sekoia.io/noname05716-ddosia-project-2024-updates-and-behavioural-shifts/ https://blog.sekoia.io/noname05716-ddosia-project-2024-updat... "The decision not to mandate VPN usage in Russia, especially given their statement “it is extremely unlikely that there will be any problems”, suggests a possible collaboration between the NoName057(16) group and the Russian state." I imagine you've also heard of attributions like "Cyrillic layout" (used all over eurasia) or "IP pool associated with a Russian AS" (as if VPS renting isn't a thing or commodity routers in Russia aren't hackable and can't be forced into a botnet)