Hackers used SolarWinds' dominance against it in sprawling spy campaign

Re:Hackers used SolarWinds' dominance against it in sprawlin... by viraptor on Tuesday December 15, 2020 @09:44PM (#25438434)

This is annoying without knowing the sources. But APT behaviours are repeated, researched, investigated. This could be legitimately mapped to a specific group using details which relevant agencies don't want to make public. Not sure we can deal with it better than acknowledge this is someone's opinion and there's a chance they may have more information, but there's also chance they're playing games.

[ Parent | on HN ]

Re:Hackers used SolarWinds' dominance against it in sprawlin... by sudosysgen on Tuesday December 15, 2020 @10:06PM (#25438581)

A third possibility is that the attacker is pretending to be someone else as misdirection and that whoever is investigating fell into their trap.

[ Parent | on HN ]

Re:Hackers used SolarWinds' dominance against it in sprawlin... by naikrovek on Wednesday December 16, 2020 @12:24AM (#25439396)

This seems very unlikely to me. Not only would the attacker need to know precise detail about the exact methods and steps taken by a russia-sponsored group, the attacker would also need to entirely suppress their own methods and approaches so that they are not identifiable as themselves.

Much easier to simply hide who you are by changing your compromise fingerprint than to try to impersonate someone else's compromise fingerprint.

If a technique is seen in this attack that has been seen in previous attacks which are now known to be by a russia-sponsored group, that is very strong evidence that the same group is responsible. It is not proof, but it is strong evidence.

[ Parent | on HN ]

Re:Hackers used SolarWinds' dominance against it in sprawlin... by sudosysgen on Wednesday December 16, 2020 @12:38AM (#25439451)

If you know what the investigators are looking for (say, after you hacked them), then it might not be that hard.

Given the fact that attribution is so difficult that we haven't seen any lawsuits yet, I'd imagine that entirlely suppressing your own methods if you know what the investigator is expecting from someone else as well as what the methods of others are is feasible.

[ Parent | on HN ]

Re:Hackers used SolarWinds' dominance against it in sprawlin... by jessaustin on Tuesday December 15, 2020 @11:19PM (#25439010)

There were Russian characters in a comment in one of the scripts! Open-and-shut case!

[ Parent | on HN ]