Cyberattacks: Do Motives and Attribution Matter? 44
An anonymous reader writes: Whenever people think of APTs and targeted attacks, they ask: who did it? What did they want? While those questions may well be of some interest, a potentially more useful question to ask is: what information about the attacker can help organizations protect themselves better? Let's look at things from the perspective of a network administrator trying to defend an organization. If someone wants to determine who was behind an attack, maybe the first thing they'll do is use IP address locations to try and determine the location of an attacker. However, say an attack was traced to a web server in Korea. What's not to say that whoever was responsible for the attack also compromised that server? What makes you think that site's owner will cooperate with your investigation?
Why bother? (Score:5, Interesting)
A while ago my employer came under DoS attack. We weren't the actual target - following a recent router replacement** the copying of configuration had been done wrong and left us with an open DNS resolver, we were just being used as an amplifier to attack some Russian websites. All the source IPs came from China, but many different organisations within China - a university, a factory, a local government office, and so on. Obviously a botnet, probably based on a Chinese-language trojan as that would explain the geographic clustering.
I identified every source address, blocked it at our firewall, looked up whois on the IP, found the abuse email, and informed the responsible party with tcpdump output to show what was going on.
Almost every email I sent came back as undeliverable. I had to muddle through Chinese customer service pages to find someone to contact on those, and not one of them ever got a reply. The packets kept on coming too until they all ceased together suddenly, probably at the point the responsible party realized I'd fixed the open resolver problem.
So why bother? You can dance around waving flags and shouting 'you've been hacked!' and a lot of organizations just don't want to know.
**If you ever upgrade a Smoothwall appliance, watch out for this!
Re: (Score:1)
But this anecdote ties in neatly with "who did it? What did they want?"
Most of the case the answer will be a botnet that is out fishing for known vulnerabilities.
For most companies there is no risk of a targeted attack. In the vast majority of the cases the competitors aren't willing to break the law to bring you down.
The attacks you will see on daily basis are script kiddies that don't know who you are and your security holes will consists of badly written third party libraries or tools that "gets the job
Motives matter. (Score:3)
I have to say the motives do matter. A DDOS vs. a targeted attack to collect data. Then what is the motivation behind the data, stolen. Is it just to sell off to make money, or will it be used for blackmail, perhaps they are trying to search for abuse in the system. Is the system attacking you just an unwilling system, probably due to the server under the desk, type of setup, where an outside IT guy is called only when there is a noticeable problem. Or is it from a location where there is a large IT Staff
Re: (Score:1)
Re: (Score:2)
We weren't hacked. We just made an error in configuration that let someone use us as an amplifier.
Re: (Score:2)
(Psst... this is the point where a normal well-adjusted person would make a clarification, maybe even say something like "my mistake, I should have made that more clear". I know this is too much to expect from you, but that is what respectability would look like.)
Re: (Score:2)
Whenr I write about OpenDNS (note no space between Open & DNS)? I write it as above, no spaces. When I refer to Open DNS servers used maliciously?? I put in a space.
* Got that, you pitiful little fuck? Good...
APK
P.S.=> Keep "running" there, 'Forrest' -> http://slashdot.org/comments.p... [slashdot.org] AND http://slashdot.org/comments.p... [slashdot.org] ... apk
See when you read books once in a while (rather than making Time Cube-style rants about hosts, hosts, oh yeah and more hosts) you realize certain nuances of the English language. One of those is the fact that "open" is not a proper noun when used that way. As such, it should not be capitalized unless of course you intended to refer to Cisco's Open DNS service, which, being a name, happens to be a proper noun. You're welcome!
I'm sure you do so much better with the stricter nuances of things like progra
Very weak administration (Score:1)
Most of the IT admin in China are poorly run, and many of their machines have been compromised - resulting in China IPs keep showing up in many cyberhacking incidents
The problem is that most of the IT staffs in China do not prioritize security - to them as long as the things run they are happy
It boils down to mindset - security / safety isn't something Chinese care too much about
I know, I am a Chinese
Difficult jump (Score:2)
The jump from "what" and "wherefrom" - e.g. an ip address, Korea - to the "whom" and "why" seems hardly to be feasible in a purely machine-based way. IMHO, you're pretty soon going to hit the limits of what a sysadmin can do, both technically and professionally. There are corporations and individuals specialized in this kind of work, which has many traits of the criminal investigator's.
Then again, to the sysadmin or the CTO, does the "why" really matter ?
Of course motives matter (Score:4, Insightful)
If it's some script-kiddie, you have the little bastard locked up.
If it's a "professional" foreign intelligence agency, you sigh a heavy sigh and realize there is bugger all you can do about it.
Re: (Score:3)
1337-speak for "Advanced Persistent Threat".
In plain English, it means "someone trying to hack you who won't go away".
"What makes you think that site's owner ..." (Score:5, Interesting)
"What makes you think that site's owner will cooperate with your investigation?"
To be very clear: we are talking about an intermediate site that has themselves been hacked, rather than the origin of the attacks.
In the absolute freaking limit? No holds barred?
Because, if they are in Korea, they are extraterritorial to everyone but Koreans, and I will just hire Russians or some other third party to take them down more or less permanently if they choose not to cooperate. Or even better: I will pay the third party to cause their site to host illegal-in-Korea content, and then wait several weeks before having them reported to Korean authorities for their content through a side channel, and then the site's owner gets arrested.
Or did you think "active defense" or "strike-back" doesn't happen?
Re: (Score:3)
"Or even better: I will pay the third party to cause their site to"
You end up spending ressources to undo what someone did with an automated script
You are presuming that I do not hire them to implement an automated script to go on a seek-and-destroy for *ALL* the compromised systems attacking mine. I'm well aware of amplification techniques. Doing that, however, risks attacking intermediary systems in the same jurisdiction as yourself, which tends to be more legally dangerous, if a connection is ever proven. But if the government isn't willing to go after the perpetrators of a botnet, they are even more unlikely to go after a company engaging in th
Re: (Score:2)
GitHub or it didn't happen
Re: (Score:2)
Gareth Williams.
Unless you actually believe he accidentally locked himself in the North Face bag, which was padlocked from the outside?
Re: (Score:3)
> To be very clear: we are talking about an intermediate site that has themselves been hacked, rather than the origin of the attacks.
And they _will not_ cooperate. Even if their technical staff wish to, I'm afraid that if any manager or corporate attorney gets involved, the investigation will be sealed off and no more information shared. They may request a subpoena to to turn over information, but those subpoenas are very difficult to obtain, especially in a timely fashion while the attack is ongoing and
The root cause of computer insecurity (Score:1)
The deep root cause of all of this is that we trust our code to do what it says on the tin... we need to fork everything to invert this assumption [blogspot.com] and trust nothing (except the OS kernel)... it's a lot of work, but it can be done.
Articles. (Score:5, Insightful)
Articles: should they have some actual content, or just a load of speculative waffle that two guys sipping beer could come up with?
Mod story down. (Score:2, Insightful)
Mod parent up! And mod entire story down. This is so much a Trend researcher making an MBO or cash payout for blogging, with some marketing person checking that the wording is correct, but having no context to know if the content is blog-worthy.
I still think that moderators, en-masse, ought to be able to mod an entire story down.
Mod story down. (Score:1)
Attribution matters (Score:3)
When you have the capability to drop bombs.
Re: (Score:2)
When you have the capability to drop bombs.
Only if justice matters to you. Dropping bombs, virtual or physical on the most immediate source of the attack will certainly solve the immediate problem.
Will the attackers find another victim to try and use against you, sure probably and likely sooner rather than later but if you haven't got the ability to locate the real source but have the ability to swat down the intermediaries, unwitting though they may be, what should you do?
Re: (Score:2)
When you have the capability to drop bombs.
Only if justice matters to you. Dropping bombs, virtual or physical on the most immediate source of the attack will certainly solve the immediate problem.
Will the attackers find another victim to try and use against you, sure probably and likely sooner rather than later but if you haven't got the ability to locate the real source but have the ability to swat down the intermediaries, unwitting though they may be, what should you do?
It would teach the intermediaries the virtue of not going cheap on their IT budgets.
Emotional security. (Score:2)
targets and collateral (Score:2)
Motive and attribution definitely matter if the organization attacked deserves to be attacked.
Not all "organizations" are blameless.
The benefits of handling attack. (Score:5, Interesting)
We utilize some automation to handle the load. We have a few honey-pots. We also monitor our dark IPs. We learned to distinguish DoS backscatter, and the various types of frequently spoofed attacks. We thought that an enterprising hacker would attempt to spoof an important Internet resource and cause us to auto-immune ourselves to death. So we whitelisted a bunch of critical external IPs and looked for critical spoofing. In the last 10 years the amount of spoofed attack has dropped drastically. We recently found an incident where an attacker spoofed a critical Google resource and tried to get us to block it. That is the only time we have detected that kind of spoofed attack.
We have found that most attackers (even governments) don't like to have their attack methods documented and publicized. We have found that some ISPs turn evil and knowingly host attack, but they are quickly and easily blocked until they go broke or come to their senses.
We have found many institutional scans. The best of these groups provide timely assistance to those who are making mistakes. In our view, the best groups include the ShadowServer Foundation, EFF, and the Chaos Computer Club. The worst of these groups are simply feeding on the mistakes of others. The worst groups provide no assistance to others. The worst groups actually have motivation to preserve or enhance the problems of others.
More info is available here: