Hacker News Reader

> When it turned out that they were correct, I knew it was not a lucky guess.

And when did that happen? You do realize that the US DoJ charging somebody still isn't "evidence"? Just like claims that some NK agents coded something are mostly based on code heuristics and usually nothing else.

> Attribution isn't simply that the bad packets came from a Chinese IP address.

Where did I ever claim that? It's the whole reason why I pointed out what I did. Even your linked "rant" agrees that much:

> Attribution is not done with single pieces of evidence or a smoking gun it is done as analysis on complex data sets most of which is not even technical

"most of which is not even technical"

Just because you are clustering together a bunch of assumptions still doesn't make them any more than assumptions. Just like companies working in the sector have a vested interest in making it look like they are more certain than they actually are because nobody pays them for "maybes", people pay them with the expectation of getting solid answers.

In that context, it does not really help to harp on about "MOs" and how other security firms totally agreed with some attribution, they are all just wild-guessing based on what they expect the opposition to use and what fits their "MO". Assumptions which are extremely easy to exploit for anybody willing to go the distance.

You have no experience in this. Why do you keep insisting on challenging experts in the field? Clustering assumptions is still not accurate. Give it a rest.

That's rich coming from somebody who claimed Bruce Schneier doesn't know what he's talking about, before linking to a "rant", driving down exactly the same points I made, by a CEO of an InfoSec outfit, a former NSA spook to boot, praising the accuracy of his own service.

Sorry, but let's just agree to disagree, it's clear there ain't anything else left to do here.

Sounds good. You clearly have no idea how this industry works, and don't know who is reputable and who is not.

Rant is the right word, though he makes a rather good summary

>Attribution is not about having a smoking gun. Attribution is a good example of doing true intelligence analysis; there are no certainties and you only can come to an assessment such as low, moderate, or high confidence. Almost every single piece of data put forward in that assessment can and should have counters to it. Very reasonable counters as well.

Which is completely in line with.

> People do this all the time because people working in the sector know [0] that attribution, with anything "cyber", is near impossible, if the attackers know what they are doing it actually is impossible.

And that is plain and simply right. There is no credible way to actually attribute anything cyber. You can make an argument, that something looks like it was done by X, but not that something was actually done by X.

That's not what he's saying at all, and what you are saying is plain and simply wrong.

Please do elaborate.

1. Attribution is not about proofing something, or finding "the one proof", but about verbalizing that there are indications that someone might be responsible. And quantifying this likelihood.

2. Having a reasonable level of attribution of cyber attacks cant ever be realistic if your opponent isnt a moron, as the indications you work with can be artificially created to fool you. There is no way to differentiate between a high likelihood attribution and a clever enough framing. While this is also true for real life attribution, for lets say chemical weapons, it is much easier to create indications in cyber attacks. And the incentives to do so are clear.

You are taking one reasonable critique, that you cant expect a "one proof" in attribution and turn it around to make attribution to something that could actually proof something. The limit of attributions is that you can vocalize, to what degree something looks like it was done by someone. Nothing less but also nothing more.

Having a reasonable level of attribution of cyber attacks cant ever be realistic if your opponent isnt a moron, as the indications you work with can be artificially created to fool you.

You likely aren't aware (because you're speaking from ignorance) but you just called literally every intel agency "a moron" here. Even the NSA TAO has been attributed, beyond any doubt whatsoever, multiple times.

Given that you're digging your heels in and seem to be more interested in making false assertions than learning, I see no need to continue this. You've never worked in attribution or threat intel. Why do you feel the need to have a strong opinion about it? Do you do the same thing for other complex topics that you know little about? It's not a good look.

We do have actual proof of TAO and who used it. Actual evidence which could be used in for example a trial. A high likelihood attribution isnt evidence. There is a limit to how sure you can be with attributions of cyber attacks.

This is directly from the rant you posted.

"Attribution is a good example of doing true intelligence analysis; there are no certainties"

>Why do you feel the need to have a strong opinion about it?

A lot of people try to use attribution as something it isnt is, as evidence. There is no reason to muddy the water and use the misrepresentation of attributions for political means. This nonsense gives the entire field a bad rep. Its intelligence analysis and not forensics.

I find it a bit rich to call others ignorant, when your argument consists of nothing more then the assertion that your counterpart is wrong and unnamed experts would agree with you.

This shows how news orgs will continue to press on with disinformstiin despite having evidence disctediting their claims. Reputable organizations at that.

Yes, that's the first half of the article (and the primary motivation). The "Please Stop Arguing About Attribution Without Expertise In It" is the section I was pointing to.

This is to say nothing about this particular case. I have no idea how solid the attribution is here. But the same comments to dismiss the whole idea of attribution out of hand come up every time, and they don't get it.

We shouldn't take it on blind faith that some attribution is accurate because it appears in the press. But we also should not interject with uninformed speculation about how we think attribution works, and then attack that straw man so they can cast aspersions on the motives of those making said attributions.