https://www.solarwinds.com/securityadvisory#:~:text=.%20We%E....
> We’ve been advised that the nature of this attack indicates that it may have been conducted by an outside nation state, but SolarWinds has not verified the identity of the attacker.
I have no specific knowledge, but essentially, most of the evidence is likely to be circumstantial, with chains of inferences from co-occurences of targets, tools, techniques, and other 'fingerprints', various bits of which may occasionally be confirmed or refuted by humint (which may or may not be reliable).
It is very unlikely that there is any single piece of info that definitively ties the attack to a particular actor (except maybe sigint), and with sufficient effort a false-flag operation can successfully lead to a mistaken conclusion, at least temporarily, but that's harder than it seems.
Any actor that tries to imitate the signature of a different actor by only using stuff from the other guy's bag of tricks is by definition only using tools that have been detected and are known; which means that countermeasures are likely to also be known and in use. Adding anything novel on top of that to increase the chances of the attack's success is incorporating a signal that WON'T be present in the chosen fall-guy's future efforts (unless previously undetected tools can be stolen from the fall-guy), which may (eventually) undermine the desired conclusion.
Figuring out whodunnit requires an essentially Bayesian approach, except the data is usually circumstantial, and priors - themselves always contingent on even earlier data - are of uncertain reliability and must when possible be tested against later assumed-reliable data from other channels for consistency (and when inconsistent, deciding whether new data trumps priors or vice-versa is a bitch).
Nevertheless, given how much data there typically is, it isn't too often that something comes along (like the discovery of a mole, which invalidates assumptions about what the opposition knows, and knows you know, etc.) to upend everything and break or reverse whole chains of inference.
So, while we might eventually find out some of the circumstantial evidence that lead to the attribution to a particular actor, we won't ever be told what other previous evidence (itself circumstantial) ties that evidence to that actor. Eg. "Toolchain X used in this attack is linked to Actor Y, but we can't tell you how we know they are linked. Sorry-not-sorry." ¯\_(ツ)_/¯
But members of the US subcommittee on Cybersecurity have attributed it and asked for the evidence they saw to be declassified.
Having said that, it wouldn't surprise me if in coming days it is able to be positively attributed from non-classified sources. This attack seems very widespread, and while it seems extremely professionally done in the past we've seen how small errors make attribution possible.
Usually it's that an exploit developer reused some supporting infrastructure that has been previously seen and it can be attributed from that.
It's really the other way around, there are a lot of people claiming that it was Russia without any apparent evidence:
https://twitter.com/ggreenwald/status/1339560149799854081
But there is a political subtext here. The red team is rooting for it to be China because it plays into a "Trump was right that China is a problem" narrative and coincides with the Hunter Biden thing and also the recent scandal about Congressman Swalwell (D-CA) having a relationship with a Chinese spy. The blue team correspondingly wants it to be not-China and thereby benefits from preemptively asserting that it was Russia.
This unfortunately makes it less likely that we'll ever know because it's hard enough to figure it out when there isn't a political motive for both sides to fudge the answer.
* Because people on this forum have enough expertise to make decisions themselves, given the evidence.
* Because in the past, when evidence has been presented, we've seen the federal intelligence community claim absolute certainty when they're actually only mostly-sure.
We've also seen them just fabricate things out of whole cloth, e.g. Iraq WMD.
It's generally best to read "according to sources in the intelligence community" as "according to professional liars who are aware you have no way of verifying anything they tell you."
Also keep in mind that revealing real classified intelligence to the media is a federal crime but making stuff up is totally legal.
This all smells extremely suspicious.
There is a big asymmetry here: On the one hand this whole "cyberattack" boils down to a) the password for the build server being <companyname>123 and b) publishing said password on github. The customers, federal agencies including intelligence, failed to find this for a year, which simply is gross incompetence. I mean really: Did the agencies integrate this software into their critical systems without any checks?
Yet these agencies are at the same time so competent that they can reliably attribute usage of the password (this wasn't even a hack) to the Russian government within days?
Edit: It is of course quite possible to be Russia, but hacking is comparatively cheap, so the list of possible culprits is larger than just Russia and China. It could also be way more than just one country, as the password was public for everyone to use for almost a year.
At this point, any evidence pointing to Russia will be met with responses like "I'm still waiting for evidence that Russia is behind this," or "I need to see this quote unquote evidence myself..."
I gotta admit though, they have apparently really honed their English grammar. Can't use that technique to detect them anymore.
Show me it then.
> I gotta admit though, they have apparently really honed their English grammar.
Maybe that's because what you're insinuating is false and you refuse to believe it? Also, you've still not outwardly said what you are insinuating. You're still beating around the bush. So I'll say it for you: "anyone who asks for evidence is a Russian shill." That's what you're getting at, right?
The first story on HN about this linked to an article which said that investigators saw what looked like them to be clearly "Russian" in the techniques used, based on their own previous experience.
I will trust a reporter over a random HN commenter any day of any year.
https://thewire.in/world/chinese-communist-party-members-inf...
They've been doing extensive industrial espionage for decades.
The GOP and right wing types traditionally pulled a hard line against Russia and Russian interest. Then that softened — remember George W Bush “staring into Putin’s soul.” Conservatives picked up an infatuation of sorts with Russia early in the Obama administration. Talk radio personalities took a shine to Mr. Putin because Russia allowed transit of US troops and supplies on Russian railways to Uzbekistan, for example. Policy positions on Syria we’re strange.
It flipped to obsequiousness mysteriously in 2017. Anything critical of Russia suddenly became a tangle of whataboutisms and other nonsense. Old hawks now roost as Russia doves. Senators who are ok with child separation want pardons for Edward Snowden.
This is partly why I find the "no politics" rule on hackernews absolutely hilarious sometimes because it's such an insight into the American psyche where everything is political but also in denial that politics is anything other than a catch-all term for anything involving people, power and any end result other than sex or violence.
The stuff that attracts folks to Trumpism, UFOs or other weird things of the ilk that make little sense appeals to that philosophy. We like mysteries and inside knowledge. We don’t always have the answers, but we know the problems that nobody else understands.
It’s an easy thing for propagandists to exploit. UFOs have been used to conceal weapons programs in plain sight. (In my home area, tomahawk missile testing in the 80s was often linked to that). Now anyone with a little money can mobilize an army of bots and idiots to push any message.
He is the first president in the past 40, 50 years I think, that didn't start any conflict.
Also he been trying to pull out troops, to the point officials lied to him about troop movements to prevent him from pulling more troops (O.o I am surprised people will let that one fly...)
Biden on the other hand already appointed as secretary of defense a guy on the board of Raytheon...
Probable Suspected Alleged Linked Unnamed Probably Highly Likely
I think that sums it up, there are none.
From now until that day, I will simply assume nothing.
FireEye (who discovered the SolarWinds breach when investigating their own breach) have said they are currently unable to attribute it[1]:
"While some have attributed the attack to a state-sponsored Russian group known as APT 29, or Cozy Bear, FireEye had not yet seen sufficient evidence to name the actor [FireEye subsidary VP Carmakal] said"
However US Subcommittee on CyberSecurity member Senator Richard Blumenthal said about it:
"Stunning. Today’s classified briefing on Russia’s cyberattack left me deeply alarmed, in fact downright scared. Americans deserve to know what's going on. Declassify what’s known & unknown"[2]
Having done some work in this field, attribution is definitely possible and fairly reliable with enough data, but releasing that data is usually not done because it shows what data sources you have access to.
I'd be relatively confident that there is classified sources showing it is at least probable[3] that the source is Russian if subcommittee members are tweeting that.
Edit: FireEye/Mandiant has a good primer on how they do their tracking of unknown groups. Attribution is similar: https://www.fireeye.com/blog/products-and-services/2020/12/h...
> Not looking to start political flame bait here just curious what details are out there.
Just wait until you see what happens to this reply. But <shrug>.
[1] https://www.bloomberg.com/news/articles/2020-12-15/fireeye-s...
[2] https://twitter.com/SenBlumenthal/status/1338972186535727105
[3] Probable in the "words of estimative probability" sense. https://en.wikipedia.org/wiki/Words_of_estimative_probabilit... and https://www.cia.gov/library/center-for-the-study-of-intellig...