Leaked Files Show How NSA Tracks Other Countries’ Hackers
theintercept.com
theintercept.com
I have a hard time accepting that. Sure,if it was a financially motivated actor or common malware a few "high quality" indicators are all you need. But APT actors know they are being tracked by their adversary using these same indicators. It isn't difficult or costly for them to avoid reuse of infrastructure and tooling. The few attribtions I looked at in detail require a more speculative and somewhat imprecise correlation by humans as opposed to clear and static indicators.
Please correct my ignorance if I am wrong.
EDIT: Security companies do use "thousands" of signatures and indicators to find events that might possibly be associates with an APT group. Why is the NSA special? That's what I can't accept. As good as the NSA is,multi billion dollar security companies are not far behind (I would say some are even ahead when it comes to defensive security)
However due to this, you are right: it's incredibly messy and attribution is mostly bullshit. If you notice, it mostly warns the operator to seek help, so others can try to confirm.
Attribution rarely seems to be a significant concern for the people running these ops.
This is interesting considering recent high profile attacks (The DNC, OPM, Sony) have pointed to state actors, but many in the InfoSec community have come back and said many of the tools have been out in the Wild for years. It means almost any hacking team could be using them, indicating that many of the tools are common amongst these groups so pinning a hack to a specific group because of the tools they used isn't a reliable way to track them.
Not my opinion, just something that would seem to contradict the idea that a set of tools indicates who the actors are.
However, that does NOT contradict the simple fact that various APT groups do absolutely use the same tried and true TTPs get get in, gain foothold, and persist. They evolve them over time, but you'd be foolish to think they entirely wing it each time, using a chaotic set of techniques. They establish patterns, and you can absolutely build a signature off of that.
I think people, especially on HN, like to think of these groups as far more professional than they are. Just look at all the talk of “tradecraft” and “threat actors”.
Empirically, it appears that hackers are simply people. These groups seem to have maybe just one or a handful of talented individuals at their core, and they all have habits they like to return to.
This is my opinion of the type-a “hacker-types” that palantir hires...
(Had dinner with the head of US cyber-security and his minions and military contractors (This was when I was with Lockheed))
Like Sherlock-style high functioning sociopaths, or Patrick Bateman with top notch computer skills?
Sure,that's why Indicators of compromise exist to begin with. What I don't get is this notion of a "high quality" indicator. You would normally match on all indicators you have.
I mean,why match with a dozen indicators knowing full well the attacker might reuse any one of the hundreds of indicators that exist? All the big name security companies match against all known indicators for a group. What practical benefit is there to limiting yourself to a few indicators,even if they are top notch indicators?
Public tools and stolen private tools are worse than useless for attribution because they are specifically used to avoid attribution or to cause false attribution.
Accurate attribution, if possible, can only be based on unique internally developed tools, which means you have to have the knowledge of the overall environment to see that some tool is unique and being deployed for the first time, and then track the deployment of that tool across other targets, and correlate it with the deployment of other unique tools.
Not necessarily. Given enough public tools, combinations of usage can be unique.
false attribution shouldn't work. nobody blindly believes binary signatures like we did in the 20th century.
accurate attribution can only be based on the whole picture, with a focus on technique. i.e. types of exploits used, styles of shellcode used, c2 key exchange used, intel types gathered, etc. etc.
the arms race is real, information doesn't vanish, nothing is simple.
There is the mythical claim that "someone is doing it right" but at the end of the day, these are just people. They make mistakes and are just doing a job.
Maybe they're looking for tools the other groups use to establish initial beachheads and not tools that are used for exploitation, info gathering or other more involved tasks.
I'd be interested in a tool that can indicate suspicious kernel modifications, USB drivers and other software that behaves in unusual ways without triggering tons of false positives and independently of any certificates or whether the software comes from a supposedly trusted repository. But AFAIK, there is not even a key logger detection tool for Linux.
Plot twist: Around 20 of them turn out to be separate clandestine programs operated by the US Government.
Seeing as they had all their tools stolen, that must have worked out really well.
Why does the NSA need defending this badly anyway?
It just feels really out of place under an article focusing on the technical side of things, not accusing the NSA of anything nefarious.
Despite neither the article or any of the comments here suggesting there's anything wrong with the NSA activities being discussed, several users felt the need to preemptively stand up the agency:
https://news.ycombinator.com/item?id=16536778
https://news.ycombinator.com/item?id=16537479
I don't know exactly what to make of it, but this kind of behavior just seems strange to me.
It also makes you wonder why it isn't commonplace to harden targets against the exploit that was used to get in, to deny that space to competitors. Perhaps it is, and it's just that there's so many vulnerabilities out there that it's common for multiple teams to break into the same box via different exploits.