One is from Norse, a widely discredited and now defunct security firm, ironically infamous for their false attributions.
Two are journalists. Enough said.
One is Seth Rogen the actor. Enough said.
One is Sabu from LulzSec, a script kid turned FBI snitch, who is way out of his league commenting on this.
One is Marc Rogers, who I don't know personally, but I doubt he maintains his skepticism today. In any case, a security expert to be certain, but not an expert in attribution and not privy to the evidence (only some of which has ever been made public). Worth noting that he published followup blog posts to the wikipedia-linked citation that walked back his skepticism quite a bit (http://marcrogers.org/2015/01/24/wrapping-up-the-whole-sony-... - "In my eyes, the preponderance of evidence definitely suggests North Korean involvement or someone trying very hard to make it look like North Korean involvement."). He basically settled on it being plausible, but concerning, and acknowledged that he wasn't privy to the evidence.
I'm fine with the prospect of China hacking the US. It fits in just fine with my world view. However, there's also the sinking of the Maine, the Gulf of Tonkin incident, and Iraqi WMD. Skepticism is called for.
[1]Although to be fair, Saddam _wanted_ his neighbors to believe he had WMDs. It was a sort of a reverse 'boy who cried wolf' and then not wanting to lose face kept playing games (which fooled many to believe more than they should have with flimsy independent evidence that he had WMDs (including many in the opposition parties).
Not that anybody in the Bush administration would have cared, everybody there was well aware of this fact, that's also the reason why they tried to play up the fictitious "Saddam al-Qaeda" link [1] for a while and why the whole WMD thing just became a joke to them a mere year after the invasion [2].
[0] https://en.wikipedia.org/wiki/Scott_Ritter
[1] https://en.wikipedia.org/wiki/Saddam_Hussein_and_al-Qaeda_li...
The US had no justification for doing what it did in Iraq, literally the whole world said "No" resulting in the biggest global peace protests in human history, the UN said "No", yet the US went straight ahead with it's "coalition of the willing".
Framing this like the "US just wanted to spread democracy out of the goodness of her heart" is not only dishonest, it's extremely cynical. The US isn't some "nice good guy", it didn't go into Iraq because it cared so deeply about the Iraqi people, it went in there for its own geopolitical interests.
Saddam was a dictator and an all around bad guy [he gassed, he killed indiscriminately], he also, like Marshall Tito, kept a lid on the pressure cooker. But, yes, there was reason to get rid of him. If I take your claim at face value, Democrats claiming Trump should be impeached is the height of folly because they have no reason to want to unseat him.
Just like Syria used to be an "ally in the war on terror" when Assad tortured terrorist suspects for the US, only to then turn around and use said torture as a pretext for "regime change actions" [1].
This is a common theme with US foreign policy, not just in the MENA region, and it's a major factor for the US not only losing international goodwill but also stirring up anti-US sentiments because most rational people see it for what it is: Hypocrisy
You also don't need to take any of my "claims" at face value, they've been considered established facts since the very beginning [2], particularly outside of the US [3]. Only in the Anglo-Saxon sphere was there any support for the invasion and most of that support was fabricated through influencing the narrative in the media [4].
The fact that you are still able to deny this, over a decade after, with all of its consequences undeniably impacting the world to this day, speaks bounds and volumes about the levels of indoctrination that happened back then.
What happened in Iraq was one of the greatest injustices in modern history and a major factor for radicalizing moderate Muslims, the "War on Terror" did nothing but create more terror. Exactly how Osama wanted 9/11 to play out, just like it kicked off massive refugee streams into Europe, lasting to this day.
Yet here you are, still trying to justify it like it's been the most normal thing in the world.
[0] https://foreignpolicy.com/2013/08/26/exclusive-cia-files-pro...
[1] https://www.theguardian.com/commentisfree/2012/feb/19/syria-...
[2] https://www.csmonitor.com/2001/0919/p12s2-woeu.html
People do this all the time because people working in the sector know [0] that attribution, with anything "cyber", is near impossible, if the attackers know what they are doing it actually is impossible. As such most attribution usually boils down to guessing games based on code samples and used attack vectors but rarely, if ever, on anything actually solid.
[0] https://www.schneier.com/blog/archives/2015/01/attack_attrib...
That's why it's important to point out the difficulties of attribution or else people will simply take it as they see it, without even questioning it.
In that context questioning it is not "hedging" anything, it's inquiring about actual evidence, which most rational people should be asking for instead of "hedging" based on political beliefs.
This is wrong. Schneier has no idea what he is talking about (as usual). The funny part is that he opens with skepticism about the North Korea/Sony hack, of which many were skeptical early on, but now is not disputed by anybody. So he was wrong about that too. So very wrong. Especially this line:
More likely, the culprits are random hackers who have loved to hate Sony for over a decade, or possibly a disgruntled insider.
I'll be honest, I was skeptical of that one too. But I knew what I didn't know, so instead of challenging experts or trying to get my uninformed opinion out in the public sphere, I kept that to myself. And when I heard someone who I know would know make the NK claim without hesitation, it made me re-evaluate some assumptions. When it turned out that they were correct, I knew it was not a lucky guess.
Attribution is not easy, but it's absolutely not impossible in all cases, or even difficult in many cases.
People who understand technology make a lot of assumptions about how attribution works, and then make assertions like this. Attribution isn't simply that the bad packets came from a Chinese IP address.
A good rant on the topic is here: http://www.robertmlee.org/russian-election-meddling-grizzley...
This is to say nothing about this particular case. I have no idea how solid the attribution is here. But the same comments to dismiss the whole idea of attribution out of hand come up every time, and they don't get it.
We shouldn't take it on blind faith that some attribution is accurate because it appears in the press. But we also should not interject with uninformed speculation about how we think attribution works, and then attack that straw man so they can cast aspersions on the motives of those making said attributions.
And when did that happen? You do realize that the US DoJ charging somebody still isn't "evidence"? Just like claims that some NK agents coded something are mostly based on code heuristics and usually nothing else.
> Attribution isn't simply that the bad packets came from a Chinese IP address.
Where did I ever claim that? It's the whole reason why I pointed out what I did. Even your linked "rant" agrees that much:
> Attribution is not done with single pieces of evidence or a smoking gun it is done as analysis on complex data sets most of which is not even technical
"most of which is not even technical"
Just because you are clustering together a bunch of assumptions still doesn't make them any more than assumptions. Just like companies working in the sector have a vested interest in making it look like they are more certain than they actually are because nobody pays them for "maybes", people pay them with the expectation of getting solid answers.
In that context, it does not really help to harp on about "MOs" and how other security firms totally agreed with some attribution, they are all just wild-guessing based on what they expect the opposition to use and what fits their "MO". Assumptions which are extremely easy to exploit for anybody willing to go the distance.
Sorry, but let's just agree to disagree, it's clear there ain't anything else left to do here.
>Attribution is not about having a smoking gun. Attribution is a good example of doing true intelligence analysis; there are no certainties and you only can come to an assessment such as low, moderate, or high confidence. Almost every single piece of data put forward in that assessment can and should have counters to it. Very reasonable counters as well.
Which is completely in line with.
> People do this all the time because people working in the sector know [0] that attribution, with anything "cyber", is near impossible, if the attackers know what they are doing it actually is impossible.
And that is plain and simply right. There is no credible way to actually attribute anything cyber. You can make an argument, that something looks like it was done by X, but not that something was actually done by X.
1. Attribution is not about proofing something, or finding "the one proof", but about verbalizing that there are indications that someone might be responsible. And quantifying this likelihood.
2. Having a reasonable level of attribution of cyber attacks cant ever be realistic if your opponent isnt a moron, as the indications you work with can be artificially created to fool you. There is no way to differentiate between a high likelihood attribution and a clever enough framing. While this is also true for real life attribution, for lets say chemical weapons, it is much easier to create indications in cyber attacks. And the incentives to do so are clear.
You are taking one reasonable critique, that you cant expect a "one proof" in attribution and turn it around to make attribution to something that could actually proof something. The limit of attributions is that you can vocalize, to what degree something looks like it was done by someone. Nothing less but also nothing more.
You likely aren't aware (because you're speaking from ignorance) but you just called literally every intel agency "a moron" here. Even the NSA TAO has been attributed, beyond any doubt whatsoever, multiple times.
Given that you're digging your heels in and seem to be more interested in making false assertions than learning, I see no need to continue this. You've never worked in attribution or threat intel. Why do you feel the need to have a strong opinion about it? Do you do the same thing for other complex topics that you know little about? It's not a good look.
This is directly from the rant you posted.
"Attribution is a good example of doing true intelligence analysis; there are no certainties"
>Why do you feel the need to have a strong opinion about it?
A lot of people try to use attribution as something it isnt is, as evidence. There is no reason to muddy the water and use the misrepresentation of attributions for political means. This nonsense gives the entire field a bad rep. Its intelligence analysis and not forensics.
I find it a bit rich to call others ignorant, when your argument consists of nothing more then the assertion that your counterpart is wrong and unnamed experts would agree with you.
Every attacker makes mistakes. It's not a matter of "knowing what they're doing". They're human.
Unless you want to suggest that on one hand they are sophisticated enough to infiltrate all kinds of hardened systems, but still dumb enough to let themselves get caught in the act while doing so/leaving evidence behind pointing straight back at them.
That's why the vast majority of cyber attribution is rarely based on actual technical evidence, but rather on cui bono assumptions and by ascribing certain tools as exclusively used by certain actors. And because none of this a secret, it's a pretty easy to exploit methodology [0].
[0] https://arstechnica.com/information-technology/2017/04/wikil...
So what exactly was the Obama Administration getting an agreement on? China was doing it before, stopped after a publicly acknowledged agreement with the Obama Admin, and then it's so far fetched that they'd start up again during an increasingly aggressive trade war as to be worthy of false flag considerations - I don't think so.
If it was China in this case, it's nothing more than par for the course for how they've been behaving for the last decade plus. It's an invaluable tool in their arsenal for dealing with the US in a variety of regards.