"Lol back at you for thinking my VPN comment was to be taken literal"
Yeah because there was no other way to interpret your comment. You think anyone believes your weak attempt to pretend you meant your statement sarcastically? lolz. Nope. I work in cybersecurity and run into naifs that believe what you did about VPNs all the time. It's also clear from the rest of your comment that you're oblivious to how forensic analysis goes about identifying an attacker. For your sake please stop embarrassing yourself by pretending you meant your VPN comment to be taken as anything but literally.
"What is the evidence besides "pretty clearly?"
The SolarWinds breach has already been identified as coming from APT29 aka "Cozy Bear" which is Russian SVR.
Every attack leaves behind vital information that comprises an "attack signature" no matter how well the attacker may have covered their tracks. Clues like the type of exploit used, the payload and toolkit used to deploy the attack, the scale of the attack, the type of VPN used in the attack (unregulated Russian Federation based VPNs that refuse to comply with US subpoena requests are a big tip-off), how the attacker deployed the attack once inside, down to the semantics in the code of the exploit used in the attack, plus lots of additional attack vector details I haven't even mentioned ... all comprise an "attack signature" and recorded in an industry wide database in order to identify attackers to a high degree of probability. From this data we can determine how sophisticated the attack, whether its coming from a state actor, autonomous collective, or individual one offs, we can narrow the geographic area an attack is originating from and identify the resources involved in deploying the exploit. Has this exploit been used before and by which groups? Is it a published or zero day exploit? This is how we distinguish Russia's capabilities from China's or North Korea's or Iran's capabilities. Their cyber espionage groups all have distinct, unique signatures.
So you're one of those rubes who when Trump claimed the DNC hacker could have been a 400 pound anonymous couch potato in their parents basement and we wouldn't know any better you actually believed him? You are hilarious.
reply
share
brux (14666)
3 years ago
> Every attack leaves behind vital information that comprises an "attack signature" no matter how well the attacker may have covered their tracks.
While that is true, there is no telling what is real, what has been hacked, and what is hacked to look like it's been hacked from another entity - so it is not necessarily true.
reply
share