People do this all the time because people working in the sector know [0] that attribution, with anything "cyber", is near impossible, if the attackers know what they are doing it actually is impossible. As such most attribution usually boils down to guessing games based on code samples and used attack vectors but rarely, if ever, on anything actually solid.
[0] https://www.schneier.com/blog/archives/2015/01/attack_attrib...
This is wrong. Schneier has no idea what he is talking about (as usual). The funny part is that he opens with skepticism about the North Korea/Sony hack, of which many were skeptical early on, but now is not disputed by anybody. So he was wrong about that too. So very wrong. Especially this line:
More likely, the culprits are random hackers who have loved to hate Sony for over a decade, or possibly a disgruntled insider.
I'll be honest, I was skeptical of that one too. But I knew what I didn't know, so instead of challenging experts or trying to get my uninformed opinion out in the public sphere, I kept that to myself. And when I heard someone who I know would know make the NK claim without hesitation, it made me re-evaluate some assumptions. When it turned out that they were correct, I knew it was not a lucky guess.
Attribution is not easy, but it's absolutely not impossible in all cases, or even difficult in many cases.
People who understand technology make a lot of assumptions about how attribution works, and then make assertions like this. Attribution isn't simply that the bad packets came from a Chinese IP address.
A good rant on the topic is here: http://www.robertmlee.org/russian-election-meddling-grizzley...
This is to say nothing about this particular case. I have no idea how solid the attribution is here. But the same comments to dismiss the whole idea of attribution out of hand come up every time, and they don't get it.
We shouldn't take it on blind faith that some attribution is accurate because it appears in the press. But we also should not interject with uninformed speculation about how we think attribution works, and then attack that straw man so they can cast aspersions on the motives of those making said attributions.
And when did that happen? You do realize that the US DoJ charging somebody still isn't "evidence"? Just like claims that some NK agents coded something are mostly based on code heuristics and usually nothing else.
> Attribution isn't simply that the bad packets came from a Chinese IP address.
Where did I ever claim that? It's the whole reason why I pointed out what I did. Even your linked "rant" agrees that much:
> Attribution is not done with single pieces of evidence or a smoking gun it is done as analysis on complex data sets most of which is not even technical
"most of which is not even technical"
Just because you are clustering together a bunch of assumptions still doesn't make them any more than assumptions. Just like companies working in the sector have a vested interest in making it look like they are more certain than they actually are because nobody pays them for "maybes", people pay them with the expectation of getting solid answers.
In that context, it does not really help to harp on about "MOs" and how other security firms totally agreed with some attribution, they are all just wild-guessing based on what they expect the opposition to use and what fits their "MO". Assumptions which are extremely easy to exploit for anybody willing to go the distance.
Sorry, but let's just agree to disagree, it's clear there ain't anything else left to do here.
>Attribution is not about having a smoking gun. Attribution is a good example of doing true intelligence analysis; there are no certainties and you only can come to an assessment such as low, moderate, or high confidence. Almost every single piece of data put forward in that assessment can and should have counters to it. Very reasonable counters as well.
Which is completely in line with.
> People do this all the time because people working in the sector know [0] that attribution, with anything "cyber", is near impossible, if the attackers know what they are doing it actually is impossible.
And that is plain and simply right. There is no credible way to actually attribute anything cyber. You can make an argument, that something looks like it was done by X, but not that something was actually done by X.
1. Attribution is not about proofing something, or finding "the one proof", but about verbalizing that there are indications that someone might be responsible. And quantifying this likelihood.
2. Having a reasonable level of attribution of cyber attacks cant ever be realistic if your opponent isnt a moron, as the indications you work with can be artificially created to fool you. There is no way to differentiate between a high likelihood attribution and a clever enough framing. While this is also true for real life attribution, for lets say chemical weapons, it is much easier to create indications in cyber attacks. And the incentives to do so are clear.
You are taking one reasonable critique, that you cant expect a "one proof" in attribution and turn it around to make attribution to something that could actually proof something. The limit of attributions is that you can vocalize, to what degree something looks like it was done by someone. Nothing less but also nothing more.
You likely aren't aware (because you're speaking from ignorance) but you just called literally every intel agency "a moron" here. Even the NSA TAO has been attributed, beyond any doubt whatsoever, multiple times.
Given that you're digging your heels in and seem to be more interested in making false assertions than learning, I see no need to continue this. You've never worked in attribution or threat intel. Why do you feel the need to have a strong opinion about it? Do you do the same thing for other complex topics that you know little about? It's not a good look.
This is directly from the rant you posted.
"Attribution is a good example of doing true intelligence analysis; there are no certainties"
>Why do you feel the need to have a strong opinion about it?
A lot of people try to use attribution as something it isnt is, as evidence. There is no reason to muddy the water and use the misrepresentation of attributions for political means. This nonsense gives the entire field a bad rep. Its intelligence analysis and not forensics.
I find it a bit rich to call others ignorant, when your argument consists of nothing more then the assertion that your counterpart is wrong and unnamed experts would agree with you.
That's why it's important to point out the difficulties of attribution or else people will simply take it as they see it, without even questioning it.
In that context questioning it is not "hedging" anything, it's inquiring about actual evidence, which most rational people should be asking for instead of "hedging" based on political beliefs.
Every attacker makes mistakes. It's not a matter of "knowing what they're doing". They're human.
Unless you want to suggest that on one hand they are sophisticated enough to infiltrate all kinds of hardened systems, but still dumb enough to let themselves get caught in the act while doing so/leaving evidence behind pointing straight back at them.
That's why the vast majority of cyber attribution is rarely based on actual technical evidence, but rather on cui bono assumptions and by ascribing certain tools as exclusively used by certain actors. And because none of this a secret, it's a pretty easy to exploit methodology [0].
[0] https://arstechnica.com/information-technology/2017/04/wikil...