Microsoft confirms Russian spies stole source code, accessed internal systems
theregister.com
theregister.com
Also weird are the comments alleging this is really some US spy op, and not the Russian state.
Russia has the motive and means and unless other evidence comes to light, it seems likely that they are behind it.
They don't know. But it is fashionable to blame the Russians. /s
Some more discussion on official post: https://news.ycombinator.com/item?id=39641953
We were doing that prior to 2017. Thank God someone like China can't ever do that, even nearly a decade after we did and we can trust these sort of accusations at face value and not at all think critically about them.
For data exfiltration, which is like robbing a bank vault, you'll need more than a fake address. It's orders of magnitude more difficult to cover your tracks, and you only need to leave one clue behind to undo all that work.
For the US to have the capability to be aware of that they would have to be engaged in unconstitutional spying on US citizens. A thing they have claimed to have stopped doing.
"Trust us, we are lying"
P.S. this also means the feds have the ability to stop child sexual exploitation that takes place over the internet in its tracks but decided not to.
However, it's important to remember that FBI!=CIA!=NSA
I can understand these breadcrumbs in detail. From easy stuff like TCP and DNS to the design patterns of the radiation hardened firmware running on the communication satellites.
I propose a blinded trial, give me a API with a few terabytes of data I'll have it accessed and the data moved to a third party. Then Microsoft can tell me who that person is right?
As you can imagine, it’s harder to reuse someone else’s infrastructure. Easy to copy code patterns but you can’t exactly reuse domains, listening posts etc.
How is that even possible and how does it help? A computer is like a state machine where a minuscule amount of states are logged. When the state is gone the trace is gone. And you don't control the other involved computers anyway. And what good does accessing "exfiltrated data" do?
Now you need to send the large amounts of data back to yourself, preferably without giving away your own location in the process. That’s the exfiltration phase of the cyber kill chain.
In order to do that, you’ve already established a set of listening posts and command/control sites across the internet. That’s your infrastructure. Setting that up in a pseudo anonymous way is hard, so you don’t do it often and may need to reuse it for multiple targets.
It’s that infrastructure that is hard to replicate if you’re trying to “look like” another threat actor on the Internet.
If there is any world-wide N-to-N statistical analysis of eavesdropped nodes for reentry of the data, it should trivially be able to be defeated by buffering in the nodes.
I don't get how these things can be tracked at all, unless the hackers are quite incompetent.
“Buffering” absolutely happens for a variety of reasons.
Tracking down the money or owning the operations infrastructure of the hosting companies along the way can help. Try to expand past bits on the wire- people set this stuff up at the end of the day.
There is a lot of hand waiving from "security" folks. They are probably about as fraudulent as bullet forensics etc.
Look I can’t summarize how threat actor attribution works in a hacker news comment. Does that mean the people who do it are quacks? Nope. I know people who do it, who build tools to help, and they are exceptionally sharp technical minds.
And I see you have casually dismissed an entire industry because you may not understand how someone could draw conclusions from imperfect data?
Hate to say it but this happens all day every day as human existence is filled with imperfect data. Not everything can be summarized in a neat mathematical form.
Does that mean you don’t try? I choose to try my best and continually improve methods. Otherwise what’s the point? Just give up because we can’t model human behavior and geopolitics as a pure functional state machine?
If the methodology is secret because secret, I as a observer just assumes everything is made up. It is way to convenient for Microsoft to shift blame. There is this smell of the Clinton email leak again.
I mean, you I presume, and I, are programmers. How ludacris would it be to claim it is not a miracle the computer it even boots? It is black box upon black box and the "pink elephant behind my back", in the world of computing, is real.
How do you know Microsoft was even “hacked”? I mean if you want to get super pedantic about this, I haven’t personally seen any proof.
So yes while a computer provides a convenient mathematical abstraction upon which we can reason, we aren’t talking about how a computer boots. We are talking about figuring out - within a certain confidence level - the group of individuals that likely carried out an attack. We are now firmly outside the scope of the neat little mathematical abstraction of the machine. Even within a machine, there’s more nondeterminism than you or I would like to admit. But that’s a topic for another day.
The methodology is not secret, you can google for threat actor attribution. Private companies do this work as well as governments. You are welcome to go join one of those companies or organizations to learn how it works and work to improve the process if you are so passionate about it!
You are the one putting some political agenda on this. China, Russia, as well as North Korea, Israel, Iran, and many other countries have robust offensive cyber capabilities. Attribution is not an exact science, and if you actually read any raw intelligence report it is clearly marked with a confidence level for that exact reason.
I've had a interesting life. I'm a expert in not getting "attributed" if you will. No need.
> Private companies do this work as well as governments.
It's mostly private snake oil vendors.
Famously the FBI used a conclusion a private company, hired by a presidential campaign made, as a pretext to engage in surveillance on their primary opponents campaign a few elections ago. They did no forensics themselves. They didn't even get the full report and what they got was heavily redacted![0]
[0]https://consortiumnews.com/2019/06/17/fbi-never-saw-crowdstr...
Glad you’ve had an interesting life! Best of luck in your future endeavours.
I'm a-political but this is the pattern I see.
It's one thing to point out issues with attribution. It's another to just say since we can't say with 100% certainty let's just make up attributions.
Especially with no knowledge of the attributions certainty, they could be 99.9% sure
This admission is unknown to the general public, they "trust the experts" that it is 100 proven.
> let's just make up attributions.
If you aren't 100% it is Russia and scream Russia, that's what you are doing
So anything attributing attacks to Russia is made up?
I think you've lost the benefit of the doubt I was giving you. The other reply to my post is probably right, you seem to be purposefully spreading disinformation.
X: Russians Chinese Iran (current US enemy)