I don’t know a lot about how states conduct cyber espionage against one another, but it does feel a bit off to be told that this was the work of a nation state with zero proof as to why.

I think sometimes the proof they have isn't proof they're willing to publicly admit they have because they don't want to let on how they know.

After Jamal Khashoggi was assassinated, for example, it turned out audio of the entire murder had been recorded through surveillance. (I'm still not sure we ever found out how exactly it was recorded?) So there were lots of announcements that certain governments "knew" or "suspected" it was Saudi Arabia with little or no substance to back up their claims until the existence of the recording was later leaked.

I think there was similar discussion after MH17 when western governments "knew" Russia-backed rebels had shot down the plane and only later did we learn there was a recording of a conversation about what happened.

I guess even after Snowden governments like to do their best to pretend they don't have the entire world under surveillance at all times.

Some of it is based on analysis of the actors motives - if you have 0-day works on fully patched Office 365, that took months/years to work, and throw it at a US government agency, you're clearly not in it for the money, _and_ you have no qualms about blowing your exploit.

Well if you are targeting Treasury it could be to act on information not yet made public in the stock market.

Don’t they usually have “styles” of intrusion? I’m certain I’ve read in the past where intelligence agencies could differentiate between Russian backed styles of hacking and Chinese backed styles of hacking. I’m sure Americans have their own style of hacking as well.

I would say it’s also quite likely that the US knows who did this or has known who has been doing it for a while. It’s highly unlikely that this press release wasn’t coordinated by the intelligence agencies to play into some advantageous scenario they’ve drawn up.

If there are such styles of exploit, which means it’s public knowledge, sounds like a great way to cover your tracks then. Just make it look like the other person.

Maybe when they hacked it they accidentally left behind a todolist.txt of "First we hack Solarwinds, then we go after Moose and Squirrel..."

It worked (a lack of acknowledgement that identities can be spoofed) for the "Russian hackers / disinformation agents" on Twitter meme, it will likely work just as well here.

Could be just about anyone. Knowing what USA has done, it seems that even this type activity is standard even between "friendly" governments....

Yup. Jon Pollard, for one. He spied for Israel.

Israel certainly has the chops to do something like this, but lots of other "friendly" countries with good geeks wouldn't mind having this kind of info.

I would bet on China, not Israel. Nation-states calculate risk/reward. With Jonathan Pollard, the reward was huge: getting your own nukes. Hacking the treasury? Not sure what Israel would gain from that; the costs of being perceived to attack a friend would be relatively higher. Whereas China has obvious reasons to want to know what US economic policymakers are thinking, and has little to lose in terms of reputation.

> and has little to lose in terms of reputation.

Nothing to lose at all. Deny the attacks and thank the news gods for publicity that distracts from reporting on their ongoing concentration camps.

> the costs of being perceived to attack a friend would be relatively higher.

Don't think israel is really concerned about attacking "friends".

https://en.wikipedia.org/wiki/USS_Liberty_incident

They live by different rules when it comes to the US due to their control/influence over our political parties, media, etc. But you already knew that.

I said they were concerned about the possible reputational loss. I am also skeptical of overblown arguments that Israel "controls the US media". These tend to shade into antisemitic conspiracy theories. The incident you link seems to be a good example: I see little to persuade me that the USS Liberty wasn't sunk by accident.

Yeah, pretty much everyone has been doing this all time, as long as they have the capability...

Attribution is tricky, but nation-state actors have resources that no other threat type (organized crime, hacktivists, etc.) can muster: multiple 0-days, advanced tools, obviously deep field of programming talent, inside info about targeted networks/apps, etc.

Not to mention, that forensic analysis of tactics, tools, etc. often clearly point to borrowing/surveiling of other APTs.

It's a good way to get the people banging war drums and funding defense budgets.