3 ms·
What got me was this line. > What is surprising is the unfaltering belief that since attacks come from IP addresses in the same geographic region as a PLA unit
by smutticus 14y ago
What got me was this line.
> What is surprising is the unfaltering belief that since attacks come from IP addresses in the same geographic region as a PLA unit, ipso facto, the attacks are state sponsored and need some sort of government response.
Mandiant and the US government aren't using IP address details to determine this is the Chinese. In fact, they're explicitly not depending on IP addresses to link these attacks to Unit 61398. Mandiant specifically refers to 'indicators' which can range can be IP addresses but can also be source code comments, coding styles, reused usernames, reused passwords, reused encryption certificates, reused domain names, etc. In short, the evidence linking Unit 61398 to these activities is the same kind of patterned evidence that is used to pin multiple crimes on serial killers. It paints a compelling modus operandi that cannot be easily dismissed as multiple independent actors. It is one group doing this and that group is most likely Unit 61398.
- DanielBMarkham 14y agoYep. Seems like the author "remembers" some information, then conveniently "forgets" other information. He leaves it open for the rest of us to straighten it all out. One of the other commenters took me to task (quite politely) for not arguing the facts. There is a good reason for that. We don't want to get into a situation where one side posts all the knowledge it has about the attacks, only to see the other side adapt. Let's not use the free press as a means to shoot ourselves in the ass. So a lot of articles and a lot of details like this will go unanswered, and that's fine with me. I've watched my server logs, I've seen enough details here and there to know the score. I don't need a public debate with all the witnesses present and cross-examination and so forth. Maybe if this evolves into a shooting war, but not right now.