There's more to it than that, and often attribution is the result of the "bigger picture" of multiple clues, rather than a single smoking gun. Group operations develop patterns over time that are much greater than just a timestamp somewhere. Also, identifying a 0-day exploit somewhere often allows you to discover previous deployments of the same exploit, which have their own blast radius of evidence, contributing to these patterns that are identified over time.

>but surely a competent hacker could pull of a hack and trivially modify the evidence to implicate any nation/state who's modus operandi are known in hacking circles, no?

>Deliberately engineering your attack to mimic one from another group is an excellent way to keep people off your trail...

Yes, misdirection is the name of the game here, all bets are off and nothing is off limits. But covering your tracks leaves tracks of its own, and again, even when an attacker thinks all their bases are covered, they will never be sure there wasn't something somewhere they left behind that points back to them.

> and these are hackers we're talking about, after all.

Who do you think "hacker-hunters" are, if not hackers themselves?

It's interesting - it's people who know a little bit who are doubtful about attribution, while those who actually know this understand it's possible to be pretty confident in many cases. It's hard to tell in this case, but the Crowdstrike report gives a lot of evidence which would persuade most in the field.

Generally speaking the best form of evidence is unique binaries which have been used in other attacks. Then you cluster attacks based on this information and other signatures. It's pretty hard to fake all of the required signatures at once, and most of the time a group doesn't really care.

It's much more robust than you seem to think - spoofing it occasionally is viable for a once-off attack, but doing the spoofing usually burns your access and methods so it's really expensive. It's not the kind of thing one burns on something like this attack or the DNC hack.

The DNC hack is a good example really - they had no idea how effective the misinformation campaign would be at the time, so why would they complicate it by trying to make it misattributable.

The attribution was already solid without that, but that’s icing on the cake.

1. How much evidence do we have?

2. How hard would it be for the hackers fake this evidence?

3. Are there any signs of forgeries? For instance logs that don't agree, file system artifacts, etc...

4. What were the capabilities of the attacker?

The longer a hack goes on and the larger its scale the harder it gets to forge 100% of the evidence.

>All of this makes a convincing story for media and laymen, but surely a competent hacker could pull of a hack and trivially modify the evidence to implicate any nation/state who's modus operandi are known in hacking circles, no?

I would say no, doing that is very difficult and is not trivial to do. All cases I've read up on, such as stuxnet, flame, APT-1 etc..., had clues as to the origin of the malware and such clues were left in the malware accidentally.

But guess what, they're human and they fail, sometimes, not always.

Attribution becomes a playable game once you're a nation state, thanks to many "unfair advantages".

... In the end, many thing gets known.

In for a penny, in for a pound?

In any case, the fact that "anti vaxxers" use certain lines of questioning doesn't mean that the truth seeking methods are themselves suspect. Some people are pessimists, and rightly so; isn't that what hacking is all about?

The specialty here isn't software, really. It's intelligence. That's a very different field and knowing something generally about how computers work might not translate into as much relevant expertise as one could hope for.

I know my expertise in software security doesn't equip me to do this kind of intelligence analysis. IMO, that doesn't leave me with a lot of standing to comment substantively on many - even most - aspects of such analysis.