4 ms·

It is worthwhile to apply the same scepticism for placement of attribution as was applied with the Sony hack. In the latter many security analysts question NK a

by cyphunk 12y ago

It is worthwhile to apply the same scepticism for placement of attribution as was applied with the Sony hack. In the latter many security analysts question NK attribution based on the similarity of code argument given by the US -- pointing out that the code base was in the wild for a long time, could be purchased on black market or reverse/reengineered after picking up the malware from a vulnerable machine. Shouldn't we also assume that this malware, having been in the wild for "10 years", could have simply been modified and thrown into the NSA tool chest? When applying the same level of scepticism from the Sony hack, nothing in this article represents real proof to counter relevant arguments against US attribution. Regardless, the Spiegel assumptions or slant is worthy if for nothing else than to teach everyone the issues with attribution, whether applied to greater or lesser evils.

at-fates-hands 12y ago
I stopped reading the article when I got to this point: "In the QWERTY code, there are numerous references to cricket, a sport that enjoys extreme popularity in the Commonwealth." In the immortal words of John McEnroe, "YOU CANNOT BE SERIOUS!?"
k-mcgrady 12y ago
>> "It is worthwhile to apply the same scepticism for placement of attribution as was applied with the Sony hack." Just playing devils advocate here. The alternative is to do as the USG did and immediately jump to conclusions based on not that great evidence. If they don't give others the benefit of the doubt why should we give it to them?
- dsjoerg 12y ago
  If your goal is to understand who is doing what, then you want to be smart about how you draw conclusions. If, on the other hand, your goal is to flame people who have done bad stuff when the opportunity arises, then yeah, go for it.
- d23 12y ago
  Because 1) the USG isn't one single guy and 2) the truth might be more important to some than conclusion-jumping.
- hueving 12y ago
  Displaying a lack of intellectual rigor in response does not garner any respect from people that can think. The quickest way to get people smart to tune out is to engage in a political mudslinging contest lacking real content.
- cyphunk 12y ago
  I agree and this is what I was hinting at with the last point. I think in the end there is no way to update our understanding to a world filled with acts of conflict that are difficult to attribute. We've lived in an attribution luxury until now. So this Hippocratic of attribution will probably continue. I do think in the end the public will just learn to take attribution with a grain of salt. This is why I think cyberwarfare represents one of the most fascinating areas of exploration for political science students. In addition to the collective psychological affect from attribution complexity (further discussion if interested https://medium.com/@cyphunk/the-nature-of-conflict-is-changing-f9ef39709cab https://medium.com/@cyphunk/the-nature-of-conflict-is-changi...) there is also the breaking down of the 2 state/coalition actor assumption. The actor could be from a known state enemy, an unclear enemy just disturbed by your trade/sanctions policies, some activists with a cause or a bunch of people from b/chan doing it for the lulz. The absurdity of the US response and attempt to protect some lousy hollywood comedy only illustrates this change of environment all too clearly.
beezle 12y ago
Spiegel might have done better to call it a GCHQ tool used by the NSA. You are suggesting that a tool that has been around for 10 years was picked up and used by NSA/GHCQ. Even if we grant that, the sophistication level is a bit more than "simply modified". When is a fork no longer a fork because the code base has been modified/improved? With your argument, one could go back as far as they wished - NSA takes an idea from academia and implements it, then we just say 'oh well, it was the univeristy who came up with it, not NSA as they only used it'
- cyphunk 12y ago
  My question was concerning attribution. Though debatable lets assume still the original was not theirs and they remixed it. Even if they made massive changes turning into their own beast allowing us to call the Snowden version significant we are still left with the question of: Are all the attacks over the past 10 years attributed to this general varietal, their attacks? Without full knowledge attribution is like a blind taste testing of different vintages of wine. Also I think the remixed and implemented idea from academia applies less. It would be more like taking the paper from one journal, changing a few paragraphs and publishing it in another. And assuming these journals had a policy of publishing without names, how can we know who the author is in all prior journals when we eventually find a way to attribute one author to one journal?
- drostie 12y ago
  Basically what cyphunk is saying is: how do we know that this was used by the NSA? More precisely: how does Spiegel know to say "clear proof that Regin is in fact the cyber-attack platform belonging to the Five Eyes alliance"? We have something out in the wild (Regin) which contains a component (QWERTY) which was leaked in the Snowden documents, however it is quite possible that both descend from a common non-NSA source (Putative) such that: P (non-NSA) / \ Q R (non-NSA) (NSA) Furthermore it is possible that in fact P = R, and that Q was derived from Regin rather than the other way around. Lots of possibilities are out there. We don't really have proof that P = Q and that therefore R also belongs to the NSA. The issue is that we can attribute malicious attacks to R, and the article seems to be suggesting that therefore we should attribute these to the NSA. The reply by cyphunk is saying that this is a dangerous logical leap.

by cyphunk 12y ago

at-fates-hands 12y ago

I stopped reading the article when I got to this point: "In the QWERTY code, there are numerous references to cricket, a sport that enjoys extreme popularity in the Commonwealth." In the immortal words of John McEnroe, "YOU CANNOT BE SERIOUS!?"

k-mcgrady 12y ago

>> "It is worthwhile to apply the same scepticism for placement of attribution as was applied with the Sony hack." Just playing devils advocate here. The alternative is to do as the USG did and immediately jump to conclusions based on not that great evidence. If they don't give others the benefit of the doubt why should we give it to them?

dsjoerg 12y ago
If your goal is to understand who is doing what, then you want to be smart about how you draw conclusions. If, on the other hand, your goal is to flame people who have done bad stuff when the opportunity arises, then yeah, go for it.
d23 12y ago
Because 1) the USG isn't one single guy and 2) the truth might be more important to some than conclusion-jumping.
hueving 12y ago
Displaying a lack of intellectual rigor in response does not garner any respect from people that can think. The quickest way to get people smart to tune out is to engage in a political mudslinging contest lacking real content.
cyphunk 12y ago
I agree and this is what I was hinting at with the last point. I think in the end there is no way to update our understanding to a world filled with acts of conflict that are difficult to attribute. We've lived in an attribution luxury until now. So this Hippocratic of attribution will probably continue. I do think in the end the public will just learn to take attribution with a grain of salt. This is why I think cyberwarfare represents one of the most fascinating areas of exploration for political science students. In addition to the collective psychological affect from attribution complexity (further discussion if interested https://medium.com/@cyphunk/the-nature-of-conflict-is-changing-f9ef39709cab https://medium.com/@cyphunk/the-nature-of-conflict-is-changi...) there is also the breaking down of the 2 state/coalition actor assumption. The actor could be from a known state enemy, an unclear enemy just disturbed by your trade/sanctions policies, some activists with a cause or a bunch of people from b/chan doing it for the lulz. The absurdity of the US response and attempt to protect some lousy hollywood comedy only illustrates this change of environment all too clearly.

beezle 12y ago

Spiegel might have done better to call it a GCHQ tool used by the NSA. You are suggesting that a tool that has been around for 10 years was picked up and used by NSA/GHCQ. Even if we grant that, the sophistication level is a bit more than "simply modified". When is a fork no longer a fork because the code base has been modified/improved? With your argument, one could go back as far as they wished - NSA takes an idea from academia and implements it, then we just say 'oh well, it was the univeristy who came up with it, not NSA as they only used it'

cyphunk 12y ago
My question was concerning attribution. Though debatable lets assume still the original was not theirs and they remixed it. Even if they made massive changes turning into their own beast allowing us to call the Snowden version significant we are still left with the question of: Are all the attacks over the past 10 years attributed to this general varietal, their attacks? Without full knowledge attribution is like a blind taste testing of different vintages of wine. Also I think the remixed and implemented idea from academia applies less. It would be more like taking the paper from one journal, changing a few paragraphs and publishing it in another. And assuming these journals had a policy of publishing without names, how can we know who the author is in all prior journals when we eventually find a way to attribute one author to one journal?
drostie 12y ago
Basically what cyphunk is saying is: how do we know that this was used by the NSA? More precisely: how does Spiegel know to say "clear proof that Regin is in fact the cyber-attack platform belonging to the Five Eyes alliance"? We have something out in the wild (Regin) which contains a component (QWERTY) which was leaked in the Snowden documents, however it is quite possible that both descend from a common non-NSA source (Putative) such that: P (non-NSA) / \ Q R (non-NSA) (NSA) Furthermore it is possible that in fact P = R, and that Q was derived from Regin rather than the other way around. Lots of possibilities are out there. We don't really have proof that P = Q and that therefore R also belongs to the NSA. The issue is that we can attribute malicious attacks to R, and the article seems to be suggesting that therefore we should attribute these to the NSA. The reply by cyphunk is saying that this is a dangerous logical leap.