If pretty basic software can place misleading markers on internet traffic and file metadata, why is the presence of Russian metadata in a hack or leak considered evidence?
If you want an example of the kind of analytical techniques that people use for attribution in the US government and sophisticated industry groups, then refer to the Diamond Model of Intrusion Analysis: http://www.activeresponse.org/wp-content/uploads/2013/07/dia...
https://cdn.securelist.com/files/2017/10/Guerrero-Saade-Raiu...
It was on HN before, but it vanished quickly -
A self-signed certificate using the CN of a website which the target device may already connect to (assuming it has KAV) is useful for stealth as it allows your implant to blend into traffic more easily.
However, attributing an attack based on the CN of an invalid TLS certificate would be very silly, as literally anyone can generate one (Instructions for generating the self-signed certs are actually right there in the source bundle).
You don't need to look at a physical server to make these conclusions.
> just took the word of a campaign affiliated and funded company
Literally a company PAID to provide security.
The Company was PAID for remediation, to write an execute report, and to testify.
Why would you pay a private company versus the United States Government that would have much more man power and most likely free services?
You generally pay someone when you want a favorable outcome, isn't that Politics 101?
Here is a pretty interesting presentation from the Snowden leaks regarding attribution of Chinese CNE (Warning: TS/SI content): https://www.eff.org/files/2015/02/03/20150117-spiegel-byzant...
I was trying to be courteous to any readers with an active security clearance, as viewing such material may require them to report the incident.
> (U) Definition: Special Intelligence, or SI, Is a sensitive compartmented information (SCI) control system designed to protect technical and Intelligence Information derived from the monitoring of foreign communications signals by other than the intended recipients. The SI control system protects SI-derived Information and information relating to SI activities, capabilities, techniques, process and procedures.
Page 80 here: https://fas.org/sgp/othergov/intel/capco_reg_v6-0.pdf
"Evidence" doesn't have to be irrefutable to make it into a court of law (and the standards are far lower for the court of public opinion).