Comment by pphysch | Hacker News Reader

Comment by pphysch | Hacker News Reader

Daily reminder that the identity of the victim or allegations of "state-actor" are not reliable pieces of evidence when it comes to determining culpability of a cybercrime.

From the article:

> Wardle found that the software contained code strings in Chinese, such as 安装成功 (Successful installation), and that the command and control server it connected to was located in Hong Kong.

From the CIA:

> In its release, WikiLeaks described the primary purpose of "Marble" as to insert foreign language text into the malware to mask viruses, trojans and hacking attacks, making it more difficult for them to be tracked to the CIA and to cause forensic investigators to falsely attribute code to the wrong nation. The source code revealed that Marble had examples in Chinese, Russian, Korean, Arabic and Persian. These were the languages of the US's main cyber-adversaries – China, Russia, North Korea, and Iran.

https://en.wikipedia.org/wiki/Vault_7#Marble_framework

Yeah, I remember with DNC hacking stuff as well, the evidence was very uncompelling... like a state actor doesn't have the resources to figure out such basic stuff if they want to cover their tracks. Or the Sony one too.

The more compelling case for me was William Binney's point (former Technical Director of NSA) that the timestamps in the Gucifer leak showed that the data was transferred at about the same rate as a usb stick, which was quite a bit faster than the physical connection the email server had (at that time). Basically concluding it was locally copied rather than hacked due to physically being impossible to transfer over the internet connection the server was physically connected to at that time at that speed shown in the timestamps.

Yes, I agree. But the question has become too political for dispassionate consideration, I guess.

Just to make sure I understand correctly... the most compelling piece of evidence for you is the timestamps on the files? Something that's not only trivial to fake, but also would have been overwritten if the files were copied between systems between being stolen and being leaked.

more compelling != most compelling

Context matters. If there are two cases, and one is more compelling than the other, then that one is also most compelling.

I would say that attribution is just extremely difficult to do at all, but there's not much money in giving that answer to your clients.

> Just to make sure I understand correctly... the most compelling piece of evidence for you is the timestamps on the files?

If I understood it correctly, the most compelling evidence was the real data transfer rate of those emails, deduced from the file timestamps, which ruled out their provenance from the server.

> Something that's not only trivial to fake (...)

Well, in this case that would go against the original accusation, therefore it would either be pointless or the explanation would require a conspiracy with double agents planting fake compromising evidence.

Unfortunately looking in, politics blur things and we’re likely never to know.

Political tendencies will allow people to make attributions they agree with and then simultaneously question attributions they disagree with politically.

USB sticks seem to be weird about transfer speeds and they look like they are size dependent. Bunch of small files take longer than one monolithic large file given a total size.

> which was quite a bit faster than the physical connection the email server had (at that time)

What was the connection speed? I've never seen it stated anywhere, and in case the server was hosted in a data center the argument would collapse fairly quickly.

As well as non-state actors.

I thought it was hilarious back in 2016-2017 how people took partisans sides on BOTH wrong answers!

"It was Russia! The President is ignoring intelligence agencies! Disagreeing with me makes you a far right extremist!"

Meanwhile kid in basement in rural Ohio: "top kek"

>> In its release, WikiLeaks described the primary purpose of "Marble" as to insert foreign language text into the malware to mask viruses

This reminds me of Sasser (iirc), which was initially attributed to Russia, as it contained Cyrillic. Turned out it was a German teen and he and his friends put it in there for shits ans giggles and laughed their asses off when "security experts" actually took the bait.

Glad you reminded me that allegations of "state-actor" are not reliable, or I might think you're implying that the CIA is responsible. Also, framing someone else is an ancient part of espionage, not something the CIA recently invented. They're far from the only people who use that tactic.

I'm not going to hold my breath about any party coming clean about who's actually responsible. Until then we can just make guesses about it based on the evidence we have, the targets, the code itself, and the location of the server. It certainly points to a state-actor.

Still, would the CIA burn such valuable exploits for HK activists?

HK activists don't appear to be of much strategic interest to the USA. And where they are I imagine they would just reach out to them directly.

> HK activists don't appear to be of much strategic interest to the USA. And where they are I imagine they would just reach out to them directly.

What? The USG has put a ton of resources into backing HK protestors, through the NED, BRL, and satellite orgs like Amnesty (look at the saga of Kong Tsung-gan/Brian Kern).

As for why the CIA might burn a 0day only to generate articles like this: NatSec threat inflation is a trillion-dollar industry in Washington.

But it just as well might have been a local crime syndicate trying to scrape personal information for financial fraud.

Point is, the article provides virtually zero evidence to determine who is at fault.

In fact, it’s the opposite. Their success is strategic interest.

Then why covertly hack them? Why not supply anti-hacking tools and expertise?

Not saying it's likely or anything, but I think the theory would be a false flag for propaganda purposes.

I’m not saying they did. I’m suggesting it’s quite obvious who has the most incentive to hack them — the country literally waging war on dissent in HK (China)

What makes you think the CIA is the only one developing such tools? I would see it as any group's goal to avoid attribution.

Reply on news.ycombinator.com