Hacker News Reader

Comment by gtrubetskoy | Hacker News Reader

I really do not understand how the origin country of the attack can be so quickly identified, and that based on that it gets attributed to the government of said country. The source IP of attack usually tells you absolutely nothing about the origin, it's typically a hacked server or a desktop which can be in China or in France just the same.

I also heard on the news the so called "security experts" claim that certain "patterns" in the attack allow them to attribute it to a specific group of hackers. Anyone who's dealt with security for real knows that there are no patters (just like there really are no hacker groups).

In 99.9% of these cases the best you can do is identify and close the hole they used and any others they've left behind, assess the damages and notify the affected people. You will never find who did it, from where and why.

View on HN

It could boil down to having other intelligence fingering China, but the US doesn't want to expose and consequently draw attention to the source of the information.

If the US doesn't have some 99.9999% assurance it was China and they made a statement like that with egg still on their face from the breach, it's pretty sad. I don't rule it out, but the US probably has more common sense than that. From a technical perspective, it sure was a fast "investigation".

Because the US government has proven so trust worthy in recent memory with all the secret laws, torture, and murder of innocents.

What an endless parade of jingoists to ever defend the exceptional American empire.

Username checks out.

BURN

Funny particularly because I did not defend America.

Not only did I not defend them, but I actually left open the possibility that they're lying— explicitly! And I suggested they might (hah!) be doing the same thing the Chinese allegedly did (hacking/spying/etc).

So relax with the rhetoric.

Yes, or it could boil down to deliberately repeating a politically convenient lie: "Weapons of Mass Destruction".

We, the people, don't know, but it seems that they are lying about at least some aspect.

The DoD/OPM/FBI would not reveal who the attacker is at all. Think about this for a second, why the hell would they reveal the fact that they could attribute an attack to China? That stuff is kept secret because that's how the intelligence agencies work. The US has a global cybersecurity strategy and so they are setting the precedent that they can hold nations responsible for cyberattacks and this became apparent with the North Korea/Sony attack attribution debacle

s/China/Iraq then reread this comment.

Scary. It's easy to imagine how we go from here into the first major cyber conflict.

Based on the Snowden files, it seems completely plausible that the US has the capability to determine the origin of the hack. Of course, we all know that having a Chinese IP is not proof of origin, but what about network flows? The NSA has sensors all over the world analyzing traffic. They even have a limited history they can query. What if they could determine the endpoint of the data and see that there was nothing connected to that endpoint at the same time, sending the same amount of traffic (using it as a proxy). You might think this would be extremely hard, since there is so much data on the net, but if they had some implants on some routers watching a particular hotspot, they could reasonably make the determination that the attack originated from fingers on a keyboard there.

And let's talk about implants. The NSA has installed malware in China, we can agree on that, right? So if they can see that a known Chinese dumpsite has the stolen data, it's pretty obvious that China was involved somehow. Maybe they have hard drive firmware that constantly scans drives for particular strings and when found, it calls home. Inside the stolen data files were some of those strings.

With all the money spent on the NSA's infrastructure and the stakes involved in agitating a powerful nation, it stands to reason that they have made proper attribution a high priority. These guys aren't just looking at source IPs in a pcap and calling it a day.

>What if they could determine the endpoint of the data and see that there was nothing connected to that endpoint at the same time, sending the same amount of traffic (using it as a proxy).

You say that as if breaking into someone's PC and using their wireless NIC to break into neighboring networks is totally implausible. Commonly known as pivoting.

I don't think that's implausible, but that misses my main point. If they are officially blaming China, they likely have some solid evidence from inside sources, not just an IP from China. Break-ins happen all the time, everyday, but not everything is attributed to someone because they don't have enough to go on. In a case like this, it could be as simple as a captured email from Chinese intelligence saying "Got those d0x you wanted. lol".

This case would not be "99.9% of these cases." It is not quite the same as, for example, the attack on Sony. The main differences are: 1) attack targets intelligence, rather than IP 2) target is US government, rather than private sector company 3) attack targets government infrastructure, rather than corporate infrastructure. I think that in this case the US likely has more resources at its disposal for analyzing the attack than, for example, it could use after the Sony attack, so a quick response is predictable. I also see no reason to doubt China as a possible culprit, as they certainly have both the capability and motivation for this attack.

Also this attack happened last December. The scope of the breach was not fully known until April when some deeper penetration was found then the reports in December initially indicated. The sad thing is this attack could have easily been prevented by using PGP signatures in emails (it was a phishing attack method) but the defense/government is incapable of implementing this

My understanding is that the attack actually started ~August/September, specifically targeting clearance information, but the attack broadened in December to target more information.

Anyone who has worked on cases involving APT from known foreign actors can identify common TTPs and attempt a best guess at the group involved.

Its 100% politics.

Reply on news.ycombinator.com