Equation Group is presumed to be (a front for) the NSA. It forged a (code signing) certificate that otherwise shouldn't exist, using an MD5 collision. But not the MD5 collision painfully created by researchers a little earlier to demonstrate that MD5 was vulnerable, it used a brand new collision purpose made for this attack. That's a considerable investment.
Then also, we can look at who benefits from what was done. Equation Group's "Flame" malware damaged the Iranian nuclear programme. That's something the US government, Israel, some other countries wanted, but it isn't something a bored teenager wants, or a drug cartel, or most for-profit corporations.
As described so far I don't see either the resource needs or the outcome satisfying this conclusion.
However the trouble is MD5 collision isn't like that hilarious "Send all zeroes" Microsoft bug from a few weeks back where you just try it a few times then it works because someone was very stupid - the MD5 collision is pretty hard, the Merkle–Damgård construction actually works, your attack avenue is hammering on the compression function, everything else in MD5 (and any other Merkle–Damgård construction) works because of mathematics unless you can break that compression function - so having a program that when you run it spits out an MD5 collision with your preferred shape is great, it's a cryptographic breakthrough - but maybe it'll take 5000 years to run on a typical home PC. If you're a government or a big crime boss then money turns that into 5 days or (if you've enough of it) 5 hours instead, but if you're a bored teenager or small time crook not so much.
And like I said, Flame depends on a never before seen collision, so it isn't like they just re-used work somebody else had done.
The MS article on the collision says the attack required knowledge of, among other things, the predictable serial numbers. They could have had as little as the usual inter-cert issuance time, or in the worst-case scenario with entirely predictable numbers could have had months or more.
Depending on the window the funds required would change dramatically.
https://www.washingtonpost.com/national-security/russian-gov...
I realize that there are probably many good reasons for not sharing deep technical details in such cases, but from the point of view of an external observer it's really hard to know who should be trusted and how solid these claims are.
There are indeed many good reasons why specific people aren't cited in these articles, but who you're trusting is the Washington Post, not these individuals. The trust comes from what the Washington Post does when it finds out it has published false information, and its track record of making sure what it publishes as news is accurate, or corrected when discovered to be false.
As a overly generic rule, trust (or don't) the Institution over the individuals.
Is it "they forgot to switch their VPN on once and we got a direct connection from an IP that belongs to the Russian state" like that other time (still manipulable but fairly conclusive IMO) or is it "that really looks like the modus operandi of those damn russians and we really need somebody to pin it on right now"?
To be clear I'm not making one of those "fake news" pro-russian rants, I can totally believe that Russia would very much do the things being reproached here if given the opportunity, I just have a really hard time taking the word of an anonymous source without concrete elements in these matters because the potential for manipulation is so absolutely tremendous.
So in that spirit I agree with you. What this looks like, so far, is a sophisticated Russian attack. From here, we’re going to learn more, and that new info may change how we understand what’s happened substantially.
Though I will say I personally don’t care much that the source is anonymous, because I trust WaPo to vet what they’ve said with other sources. It’s not a perfect system, but it’s not like journalists are unaware of the groups trying to manipulate them.
The Washington Post's record on verifying the claims of the US national security apparatus is poor. The newspaper uncritically reported false claims by the Bush administration about Iraqi WMD. Many people people at the time found those claims extremely dubious, but critical voices were belittled or shut out of most mainstream reporting. More recently, the Washington Post has been all-in on Russia paranoia. That doesn't mean that everything they publish about Russian hackers is wrong, but it very well may be misinformation leaked by US intelligence officials, or something insignificant blown out of proportion and presented without any context. In December 2016, for example, the Washington Post reported that the Russians had hacked a Vermont utility. That story turned out to be complete nonsense, but the Washington Post never fully retracted it. If you look at the story today, you'll still get the impression that the Russians attempted to hack the utility, even though that aspect of the story completely fell apart. The Washington Post on Russia is a bit like Bloomberg on Chinese hackers (e.g., Supermicro).
That is precisely the same line of reasoning that started the Iraq War based on lies. The New York Times claimed to have intel from anonymous sources showing that Saddam Hussein had nuclear weapons, and their false reporting is what led the US to declare war. That snafu didn't happen all that long ago, and yet most people in 2020 seem to have blocked it out of their minds.
But Russia actually does have a strong black hat culture, with links to the political establishment. Putin is a technologically savvy kind of despot who likes sneaky low-cost high-return actions. So this fits the profile - both as a workable hack and also as a proof of concept for future attacks.
Consider the cost/benefit. Instead of physically blowing up infrastructure and security systems you can cripple them, possibly permanently, for the cost of - what? - 20 or 30 specialists, some PCs, and maybe some supercomputer time. Although even that may be optional.
It's unlikely conclusive evidence will be released, because that might reveal too much information about defence strategies. So circumstantial evidence will be as good as it gets.
But whatever the cause, clearly - clearly - all countries and larger orgs need to work much harder on security. Some decorative pen-testing isn't going to be nearly enough in the 2020s.
At some point you have to trust others to be good at their jobs, and when an org like WaPo demonstrates their proficiency over and over again, their believability rises.
bellingcat has also done a pretty remarkable job of identifying state-employed hackers and spies just through buying russian passport control information and other private information that's out there on the market
Wow, I just looked some stuff up on bellingcat. It appears that Russia is pretty bad at covering its tracks. This is a good example: https://www.bellingcat.com/news/uk-and-europe/2019/11/07/how...
Whoever does such things doesn't exactly sign their exploits to prove ownership. So the evidence might be something like IP addresses in log files: totally convincing if it's your log file, but so easy to manipulate it's useful to convince someone who does not trust you.
When a leading security group (FireEye) says it's a state-level actor, I don't think they are doing PR.
It's fine to be skeptical, but why are you being skeptical? Perhaps it's lost on me but I don't think the claim that PR would look bad _if it were teenagers_ is a good reason to promote widespread distrust of ???.
I see the compromise of SolarWinds Orion software as far more likely to be carried out by state level actors than by script-kiddies. What would script-kiddies stand to gain?
https://www.fireeye.com/blog/threat-research/2020/12/evasive...
If this is not sophisticated, I don't know what is.
Also, the attack was carefully crafted. How could anyone expect or defend against a carefully crafted attack, by a nation state no less.
The idea that there's face saving to be had by blaming it on someone sophisticated just doesn't ring true to me. It still happened, the details specifically about who and how don't make your board, your boss, or Wall St. care.
It's way more relevant how you react to the breach, than it is that the breach took place.
I'm not accusing the WaPo of being distrustful here, I just think that in these cases the potential for manipulation, half-truths and technical mistakes from their sources is very high, and without either knowing who these sources are or what are the concrete element they're using to make their conclusions I find it very hard to blindly trust these sources.
There is a huge divergence in understanding of the purport of recent events, starting with the Wikileaks release of DNC emails in 2016, and continuing through to Hunter Biden's laptop
One camp believes or suspects that Russia is more of a useful bugbear and scapegoat for certain political factions in the US, used cynically as FUD to manipulate public perceptions, than something to be so worried about
The other believes in good faith that Russia is a dangerous and sophisticated adversary with assets in the highest levels of the US government, and finds the first camp to be incomprehensibly obtuse at best
It's difficult for these 2 camps to communicate effectively for some reason
Nihilistic cynicism sounds a lot like smartitude to stupid people.
"No, no, you don't understand, it's not that our systems are insecure, it's that the attackers where highly sophisticated and had the resources of a nation state, otherwise it would never have worked out".
I suppose "we think it could be done by a group of two or three teenagers with decent knowledge of wget" doesn't have the same ring to it.