Comment by ge0rg | Hacker News Reader

Comment by ge0rg | Hacker News Reader

Feds take aim at potent VPNFilter malware allegedly unleashed by Russia.

[..] to counter Russian-engineered malware that has infected hundreds of thousands devices.

I'm interested in the evidence for this attribution. Both ars and dailybeast [0] are pointing to Russia, but the only specific hints are that it's targeting Ukraine (which might also have to do with the prevalence of vulnerable devices there, we don't know that), and that it shares code with the BlackEnergy bot builder toolkit[1], which apparently can be bought on the black market for a decade already.

Neither of the original articles [2,3] mention Russia or any of the Russian APTs, so I'm genuinly interested in better attribution data.

[0] https://amp.thedailybeast.com/exclusive-fbi-seizes-control-o...

[1] https://community.rsa.com/thread/186012

[2] https://blog.talosintelligence.com/2018/05/VPNFilter.html

[3] https://www.symantec.com/blogs/threat-intelligence/vpnfilter...

Makes you wonder how much is protected sources and methods. One good mole (digital or human, really) would make technical analysis a secondary consideration.

Another article mentioned an rc4 implementation that had been tied to a previous Russian State sponsored cyber attack. (Sorry, am mobile, don't have the link).

You are right. The not-quite-RC4 implementation is mentioned in the Talos post, and it is originating from BlackEnergy. Talos is referencing a US-CERT report of APT28/29[0], which links an F-Secure whitepaper on APTs using "crimeware"[1]:

BlackEnergy is a toolkit that has been used for years by various criminal outfits. In the summer of 2014, we noted that certain samples of BlackEnergy malware began targeting Ukranian government organizations for information harvesting. These samples were identified as being the work of one group, referred to in this document as “Quedagh”, which has a history of targeting political organizations.

The only way I see how anybody could conclude from "APT uses a black market toolkit" to "Anybody using this toolkit is that APT" is: clickbait.

[0] https://www.us-cert.gov/sites/default/files/publications/AR-...

[1] https://www.f-secure.com/documents/996508/1030745/blackenerg...

Clickbait is among the more innocent explanations. Reporters who dutifully parrot what the TLAs tell them get more opportunities to do so. Reporters who don't, in short order aren't writing this sort of article. This is such a basic situation, repeated hundreds of times, yet the resolutely naive will bitterly deny that it ever occurs.

Reply on news.ycombinator.com