3 ms·

The analysis is interesting, but I don't understand how it undermines the FBI's claims. He looks at each IP and exclaims, "This could have been used by anyone!"

The analysis is interesting, but I don't understand how it undermines the FBI's claims. He looks at each IP and exclaims, "This could have been used by anyone!" But we already knew that, didn't we? The claim is not that these IPs are used exclusively by North Korea. The claim is that there is a suspicious overlap between the IPs used in this attack, and others used by North Korea in the past. If these were the only bad actor/compromised IPs out there, then maybe this would not be so surprising. But there are many many of them, so it would be coincidental, to say the least, if this attack and prior North Korean attacks just happened to use the same IPs, if North Korea is not involved (or, another possible explanation, if the same tool is not involved as in prior attacks by North Korea).

jamesbrownuhh 12y ago
The nature of the Internet is that many resources will be used globally. It should not be surprising that a few well-known open proxies would be used by bad actors of any nationality - the fact that (Nation State X) was accused of using (globally accessible resource Y) in the past does not in any way mean that resource Y is used ONLY by State X, so the use of resource Y is quite, quite unsuitable as a means of identifying anyone.
- pdabbadabba 12y ago
  I think what we would need to know, in order to determine the strength of this evidence, is how many total IPs North Korea is known to have used in previous attacks, and how many total were used in this one. I.e., how closely correlated is prior NK use with an IPs use in this case. If only a handful were used on both occasions, and the overlap is significant, then we have some fairly interesting evidence. But if, on one of more occasions NK used hundreds of IPs, and there are a handful in common between those two sets, then there's really nothing to see. I've had the impression it was the former, but perhaps I'm mistaken. Does anyone have an answer?
qyv 12y ago
It is even more than that, the FBI PR quote that this is based on is the following: "For example, the FBI discovered that several Internet protocol (IP) addresses associated with known North Korean infrastructure communicated with IP addresses that were hardcoded into the data deletion malware used in this attack." Firstly, this isn't a statement of evidence, it is an generalized example of the type of evidence the FBI apparently has. Given the lack of any further clarifications on this statement, I don't see how you can make and presumptions as to what the actual evidence is. there just is not enough data here. Secondly, the statement is carefully worded to say that the C&C IP's have communicated with known NK infrastructure. This is massively different than saying that the C&C IP's are associated with NK infrastructure. What the FBI is saying is that they have been able to apparently collect evidence that shows NK was communicating with the C&C IP's, presumably while the attacks were going on. With what we know about the state of internet surveillance, is it really that unrealistic to think that US SIGINT is collecting every single packet that transits known KN networks? Seems right in their wheelhouse. Point is, the FBI aint telling us squat about what evidence they may or may not really have. Maybe this is because they are making the whole thing up, or maybe it is because they just don't want to tell us how much evidence they got, and how they got it.

jamesbrownuhh 12y ago

The nature of the Internet is that many resources will be used globally. It should not be surprising that a few well-known open proxies would be used by bad actors of any nationality - the fact that (Nation State X) was accused of using (globally accessible resource Y) in the past does not in any way mean that resource Y is used ONLY by State X, so the use of resource Y is quite, quite unsuitable as a means of identifying anyone.

pdabbadabba 12y ago
I think what we would need to know, in order to determine the strength of this evidence, is how many total IPs North Korea is known to have used in previous attacks, and how many total were used in this one. I.e., how closely correlated is prior NK use with an IPs use in this case. If only a handful were used on both occasions, and the overlap is significant, then we have some fairly interesting evidence. But if, on one of more occasions NK used hundreds of IPs, and there are a handful in common between those two sets, then there's really nothing to see. I've had the impression it was the former, but perhaps I'm mistaken. Does anyone have an answer?

qyv 12y ago

It is even more than that, the FBI PR quote that this is based on is the following: "For example, the FBI discovered that several Internet protocol (IP) addresses associated with known North Korean infrastructure communicated with IP addresses that were hardcoded into the data deletion malware used in this attack." Firstly, this isn't a statement of evidence, it is an generalized example of the type of evidence the FBI apparently has. Given the lack of any further clarifications on this statement, I don't see how you can make and presumptions as to what the actual evidence is. there just is not enough data here. Secondly, the statement is carefully worded to say that the C&C IP's have communicated with known NK infrastructure. This is massively different than saying that the C&C IP's are associated with NK infrastructure. What the FBI is saying is that they have been able to apparently collect evidence that shows NK was communicating with the C&C IP's, presumably while the attacks were going on. With what we know about the state of internet surveillance, is it really that unrealistic to think that US SIGINT is collecting every single packet that transits known KN networks? Seems right in their wheelhouse. Point is, the FBI aint telling us squat about what evidence they may or may not really have. Maybe this is because they are making the whole thing up, or maybe it is because they just don't want to tell us how much evidence they got, and how they got it.