Hacker News Reader

Comment by cf141q5325 | Hacker News Reader

Rant is the right word, though he makes a rather good summary

>Attribution is not about having a smoking gun. Attribution is a good example of doing true intelligence analysis; there are no certainties and you only can come to an assessment such as low, moderate, or high confidence. Almost every single piece of data put forward in that assessment can and should have counters to it. Very reasonable counters as well.

Which is completely in line with.

> People do this all the time because people working in the sector know [0] that attribution, with anything "cyber", is near impossible, if the attackers know what they are doing it actually is impossible.

And that is plain and simply right. There is no credible way to actually attribute anything cyber. You can make an argument, that something looks like it was done by X, but not that something was actually done by X.

View on HN

That's not what he's saying at all, and what you are saying is plain and simply wrong.

Please do elaborate.

1. Attribution is not about proofing something, or finding "the one proof", but about verbalizing that there are indications that someone might be responsible. And quantifying this likelihood.

2. Having a reasonable level of attribution of cyber attacks cant ever be realistic if your opponent isnt a moron, as the indications you work with can be artificially created to fool you. There is no way to differentiate between a high likelihood attribution and a clever enough framing. While this is also true for real life attribution, for lets say chemical weapons, it is much easier to create indications in cyber attacks. And the incentives to do so are clear.

You are taking one reasonable critique, that you cant expect a "one proof" in attribution and turn it around to make attribution to something that could actually proof something. The limit of attributions is that you can vocalize, to what degree something looks like it was done by someone. Nothing less but also nothing more.

Having a reasonable level of attribution of cyber attacks cant ever be realistic if your opponent isnt a moron, as the indications you work with can be artificially created to fool you.

You likely aren't aware (because you're speaking from ignorance) but you just called literally every intel agency "a moron" here. Even the NSA TAO has been attributed, beyond any doubt whatsoever, multiple times.

Given that you're digging your heels in and seem to be more interested in making false assertions than learning, I see no need to continue this. You've never worked in attribution or threat intel. Why do you feel the need to have a strong opinion about it? Do you do the same thing for other complex topics that you know little about? It's not a good look.

We do have actual proof of TAO and who used it. Actual evidence which could be used in for example a trial. A high likelihood attribution isnt evidence. There is a limit to how sure you can be with attributions of cyber attacks.

This is directly from the rant you posted.

"Attribution is a good example of doing true intelligence analysis; there are no certainties"

>Why do you feel the need to have a strong opinion about it?

A lot of people try to use attribution as something it isnt is, as evidence. There is no reason to muddy the water and use the misrepresentation of attributions for political means. This nonsense gives the entire field a bad rep. Its intelligence analysis and not forensics.

I find it a bit rich to call others ignorant, when your argument consists of nothing more then the assertion that your counterpart is wrong and unnamed experts would agree with you.

Reply on news.ycombinator.com