Comment by nexuist | Hacker News Reader

Comment by nexuist | Hacker News Reader

Parent Full thread

As with most things, it's hard to prove what actually happened definitively, but there are clues you can piece together to make a claim within a reasonable degree of probability. Things like what type of binaries were installed, what servers were reached out to, even what commands were run...if you collect enough data, it is possible to see patterns in how certain attackers (like USCC) operate, and if we assume a teenager in her parents' basement doesn't have access to the same tools and procedures as USCC does, then it becomes pretty obvious it wasn't her.

To a certain degree, if your server has malware X, and you can identify malware X (or something very similar) as belonging to actor A, and you know actors B, C, and D don't have X in their arsenal, then you can guess with high probability that you were attacked by A.

Intelligence is probably the most high stakes guessing game in history, and there are definitely smart people at the top who know that simple IP correlation is not enough to make this claim - but they likely have access to sensitive (confidential) data that further justifies that claim.

>> doesn't have access to the same tools and procedures as USCC does

If she's well connected, she does have access to almost everything that's available, short of something that offers no plausible deniablity because it's custom made for a particular system, like Stuxnet, or something that's full of zero days nobody else knows about yet. And the only thing you can conclude in these two cases is that you're _probably_ dealing with a state-level attacker, but you can't say which state unless there's something to further narrow things down, such as unfettered access to controlled nuclear technology in the case of Stuxnet.

Notice also how we are always expected to accept these reports on faith, and no _verifiable_ evidence is ever presented.

No verifiable evidence is presented because it shows your hand. If you show the enemy what you don't know, they could figure out what you weren't able to find out, and use that to their advantage. If they can trace the evidence back to a particular source, they can crack down on it and prevent future evidence from being collected through that pipeline. At best this means they change their security procedures, at worst it means they murder your spies.

>> because it shows your hand

Then why talk about it at all? I'll tell you why. It's propaganda. Someone is trying to shit into someone else's head.

It is, indeed, propaganda. But propaganda does not always have to be blatantly wrong - even a broken clock is right twice a day, etc.

> Intelligence is probably the most high stakes guessing game in history

Nope. Propaganda has higher stakes.

What's the guessing in propaganda? It's the complete opposite of sophisticated targeted attacks, basically propaganda is an iterative brute force.

Case and point. Most have no idea how sophisticated propaganda can be. At the highest levels, it washes over you without a trace. The PR industry has been perfecting it for 100 years. You'll never see it.

Reply on news.ycombinator.com