3 ms·
> No attacks occurred during Memorial Day and Independence Day holidays which were unique American holidays. Simple but effective. A good non-NSA agency should
by rdtsc 2y ago
> No attacks occurred during Memorial Day and Independence Day holidays which were unique American holidays.
Simple but effective. A good non-NSA agency should also learn from this to be able to effectively false-flag as NSA, as long as they are flexible enough to allow off-hours and overtime pay and remember to respect the US federal holidays.
> Two zero-days were used to breach any company with SunOS-exposed systems in neighbouring countries to China
SunOS? Wonder if it's because it's genuinely used still quite a bit or they simply had zero-days for it since many of those are old and unpatched?
- formerly_proven 2y agoAssuming they mean Solaris, it's still technically maintained, at least in the Oracle sense (of both "technically" and "maintained").
- rdtsc 2y agoI assumed that much, SunOS is pretty ancient, last version was what, in early 1990s? Though, Solaris still would report a SunOS 5.$solarisver version or something like that. So I guess we can say it is a "SunOS" box if we wanted to.
- jjtheblunt 2y agoSunOS 4.x is the BSD lineage and SunOS 5.x the Solaris lineage, or at least was when i worked at Sun.
- zdragnar 2y agoThe same strategy is used to attribute attacks against US based targets by Russian, N.Korean and Iranian and other state or state sponsored actors. Time of day, holidays, etc. are (in tandem with other evidence) considered to be surprisingly reliable. If I were in charge of things I'd like to think that this sort of thing would be the first step I'd take to cover my tracks, but I still hear cyber security firms using it in their attributions.
- kokx 2y agoThe type of work the people working at an APT do, is mainly office work, while it still is very much "hands-on-keyboard" work (so you cannot set an action to automatically occur when nobody is checking the results in the middle of the night). You might want to try shuffling this up when you are in charge, but your (usually highly skilled and expensive) employees probably don't want to be working weird shifts all the time. Especially when they have families. It also may not be worth it. Generally APT's want to stay under the radar while they are executing. But after the goals have been reached, most of the time it doesn't matter much if they get attributed. We have yet to see real consequences against any APT's. So paying your employees more to work night shifts, likely doesn't stack up against the consequences of attribution.
- vlovich123 2y agoI have a hard time imagining these APT attacks are manual at the keyboard typing. That seems like an invention for entertainment whereas I'd expect reality to be "run script & establish an ongoing backdoor" or "run script & perform attack". You might need on-call to flag if anything has gone wrong, but I'd have a hard time imagining the entire team is involved for that so the cost of paying extra for an on-call is quite trivial vs the overall cost of the team. In industry that's not even compensated since salaried employees don't get overtime although I imagine that for government work the unions have negotiated this better. EDIT: Huh, I guess sometimes it is like the movies: > One of the frameworks used by TAO that was forensically uncovered during the incident named “NOPEN” requires human operation. As such, a lot of the attack required hands-on-keyboard and data analysis of the incident timeline showed 98% of all the attacks occurred during 9am – 16pm EST (US working hours).
- luckylion 2y agoOn-Call for mission of this size sounds fairly unlikely, doesn't it? You wouldn't spend hundreds of thousands of dollars on large scale attacks with lots of (temporary) infrastructure and planning to then yolo it at the last minute and hope that everything goes well and you have the results back when you come back on Monday.
- viccis 2y ago>A good non-NSA agency should also learn from this to be able to effectively false-flag as NSA It seems like such a lapse in tradecraft that, absent other indicators, I would just assume it's a crude false flag attempt.
- rdtsc 2y agoIt's a Schrödinger's false-flag! Just incompetent enough to look like a false flag. But at the same time, it's coming from the heart of US bureaucracy, which finds cash to build multi-billion dollar hidden data centers, but is also inflexible enough properly pay for overtime and off-schedule work.
- plagiarist 2y agoI don't find the money inexplicable at all. Building multi-billion dollar data centers increases wealth for billionaires but paying overtime would benefit a middle-class pleb.
- actionfromafar 2y agoWell how convenient those plebs are down-sized right now.
- sitkack 2y agoI heard goldman sachs is scooping up federal talent and putting them on the bench to then rent them back out to 47 for 10x the price.
- nonrandomstring 2y agoWasn't one of the curiosities in Snowden vault7 an "attribution engineering toolkit"? That sounds quite flexible.
- greatgib 2y agoHonestly they might also totally not care about it. They might want to avoid detection while the hack is working but what is the point of covering their tracks after the thing is discovered? It's not like China will sue them, and not like both sides can easily say that it is just reciprocal.
- runjake 2y ago*> A good non-NSA agency should also learn from this to be able to effectively false-flag as NSA* For what it's worth, this is already a TTP used domestically, as well as by our adversaries (and allies, eg GCHQ and 8200).