Hacker News Reader

Comment by citilife | Hacker News Reader

> (NEW YORK) -- Some of the nation's largest airports have been targeted for cyberattacks Monday by an attacker within the Russian Federation, a senior official briefed confirmed to ABC News.

Senior official from what agency / organization are making those claims?

> The attacks have resulted in targeted "denial of public access" to public-facing web domains that report airport wait times and congestion

Why would they be doing DDoS on this service?

> Hartsfield-Jackson Atlanta International Airport reported around 10:30 a.m. ET that its site is back up and running and that "at no time were operations at the airport impacted."

And operations are not being impacted...

I hear "Russia" is doing X and at this point I don't believe it without evidence being presented. Anonymous sources are equivalent to saying "some random person says X". Also why would they do anything with not negative impacts.

This isn't much of a story IMO

View on HN

...the source literally isn't anonymous, it's Mandiant (not Mandian, that's a typo), and Mandiant has released so much evidence to back its claims over the years that if you can't by now at least give some credibility to the Mandiant name, you're not acting rationally.

He also directly states that this group is Russian but not acting on behalf of the Russian government in this case:

> Hultquist said there is no evidence the Russian government was involved in directing this attack.

The fact that they couldn't get the name of Mandiant right does not inspire faith that they have a handle on reporting security news more broadly.

There are two sources. Read the article carefully. There's an anonymous "senior official" and a person from "Mandian" (assuming ABC made a typo - Mandiant).

Only one source has relevant information pertinent to your questions, the named source from Mandiant. The "official" would not be equipped to answer the questions you've asked, and they're more than likely an airport official not a government official (as US airports are almost entirely run by private, for-profit organizations).

But more importantly, neither source said anything about the Russian government doing anything here; if you read carefully at most it's a group within the country of Russia, and that's it. In fact Mandiant directly states that there's no evidence the government of Russia directed the attackers.

Do you want more than a name and a organization? Would you like John’s home address?

> Over a dozen airport websites were impacted by the "denial of service" attack, John Hultquist, head of intelligence analysis at cybersecurity firm Mandian[t], told ABC News. That type of attack essentially overloads sites by jamming them with artificial users.

>” Killnet," a pro-Russian hacker group, is believed to be behind the attack, according to Hultquist. While similar groups have been found to be fronts for state-backed actors, Hultquist said there is no evidence the Russian government was involved in directing this attack.

Serious question:

How do they know that? I assume killnet does not have a static IP address and doesn't leave it's return address

I don’t know about the details in this case, but hacking (particularly DDoS) groups can be remarkably childish: they sometimes intentionally leave their name in requests, knowing that it’ll show up in logs.

The other identifying technique is correlation: if they’re using a network of hacked devices to create a flood of traffic, any previous attacks that saw traffic from those same devices are possibly from the same group. So it’s possible killnet has a public chronology here.

The former of these would easily open the possibility of a false flag. Same with the latter, though it would be harder to pull off

This would be a pretty strange false flag: why bother blaming some random group that hasn’t been linked to the Russian government?

To my mind, the most likely explanation here is the simplest one: airport websites make good testing targets, and Russia doesn’t punish hackers who target non-military resources in the West.

I was speaking generally, but in this case it would be used to simply say "the Russians," regardless of whether or not they are under the Russian government.

Even then, using your own example: imagine you are testing a malicious system that you built that is hitting a public testing target. Wouldn't you want to link it to anyone other than yourself for when it is inevitably detected?

People doing threat intelligence are generally on top of attribution and try to do appropriate, fact-based attribution.

That said, the warnings about Russia interfering with US infrastructure were flowing a bit before the invasion of Ukraine. Russia would be the first suspect on the top of the list, even barring good threat intel.

Hacking groups can have a recognizable fingerprint / strategy [0]

Killnet has claimed responsibility for similar attacks in the past [1]

[0] http://attack.mitre.org/

[1] https://www.cisa.gov/uscert/ncas/alerts/aa22-110a

DDoS a website is probably the most common forms of attacks globally...

I guess it could be a DDoS with the same botnet?

https://www.mandiant.com/resources/blog/how-mandiant-tracks-...

killnet spends a lot of time promoting themselves, 7 hours ago they announced in their telegram channel that they are going to start an attack on USA airport websites and asked everybody to join them

They've also done similar attacks before so they were clearly under radar

> Over a dozen airport websites were impacted by the "denial of service" attack, John Hultquist, head of intelligence analysis at cybersecurity firm Mandian, told ABC News. That type of attack essentially overloads sites by jamming them with artificial users.

That's not a "senior official"; "official" implies government, that's a company.

Yes, I would like to know the government agency official providing this information.

What evidence supports this? IMO it's coming from that unspecified official. And yes, I think evidence needs to be provided before claims are made. They're just saying "I think it's these guys" ... because?

The quote you embedded is attributed to a person and where they work? Perhaps you meant to quote something else?

Mandiants attribution methodology is trivially found on their website: https://www.mandiant.com/resources/blog/how-mandiant-tracks-...

Read the ABC article carefully (as one should always do)

There's mention of a "senior official"

> senior official briefed confirmed to ABC News.

So a source in government confirmed this to ABC (who's that?). Was it just a "could be russia" type comment.

There's a separate person, who's primarily sharing the story:

> Over a dozen airport websites were impacted by the "denial of service" attack, John Hultquist, head of intelligence analysis at cybersecurity firm Mandian, told ABC News.

ABC and many news outlets generally require multiple sources prior to publishing. There's been a lot of stories lately that have the same base source, but they decide to count as "multiple sources" because an official in the government leaks to two different people and those two people confirm. It's called "information laundering"

Anyway, i'd really out of genuine curiosity know how they know this is from Russia. Which agencies are confirming this?

IMO it seems petty and not something a government would do.

> IMO it seems petty and not something a government would do.

By https://news.ycombinator.com/user?id=citilife

Internet actor named "citilife" makes claims about "information laundering".

Who is this individual? Where is the evidence? There should be evidence before such claims are made. What is his name and affiliation? Where can I find this person in the real world? Maybe this actor is wearing a hat? Perhaps it made of sheets of metal? Perhaps tin foil?

To quote the actor to further this inquiry:

>And yes, I think evidence needs to be provided before claims are made. They're just saying "I think it's these guys" ... because?

I think evidence needs to be provided before claims are made. Before "citilife" is just saying "I think it's petty and information laundering". ... because?

> Internet actor named "citilife" makes claims about "information laundering".

I never claimed there was a case of "information laundering", I defined it.

I also am not asserting anything besides what was in that article and inquiring for additional details because the current story doesn't make a whole lot of sense (at least based on the assertion it's "Russia" / "Russian", "hacking" some airline websites via a DDoS attack lol).

Who are you? Where’s the reference for that definition? Under what authority and credentials? Where’s the proof such phenomenon exists?

> "official" implies government

No it doesn't, it means 'office-holder'; that may be a public or private office.

this killnet guys stated that they are starting USA airports DDOS in their telegram channel, they also provided list of airports and their urls they've done similar things before, most of their "hacking" consists of ddosing some sites that they randomly decide are an enemy to Russia

https://amp.knowyourmeme.com/memes/proofster

Reply on news.ycombinator.com