Russian State Hackers Rarely Share Code With One Another (zdnet.com) 31
Russia's state-sponsored hacking groups rarely share code with one another, and when they do, it's usually within groups managed by the same intelligence service, a new joint report published today reveals. From a report: This report, co-authored by Check Point and Intezer Labs, is a first of its kind in its field. The two companies looked at nearly 2,000 malware samples that were previously linked to Russia state-sponsored hacking groups, in order to get an idea of how these malware samples related to each other. Their investigation found 22,000 connections and 3.85 million pieces of code that were shared among the malware strains. The conclusion of this vast research effort was the revelation that Russian APTs (advanced persistent threat, a term used to describe government-backed hacking groups) don't usually share code with one another. Furthermore, in the rare instances they do, code reuse usually occurs inside the same intelligence service, showing that Russia's three main agencies that are in charge of foreign cyber-espionage operations don't collaborate for their campaigns.
They don't share? (Score:2)
Maybe that's just what they want us to think.
But, then look at the dick measuring contests between different US agencies local, state and federal.
Re: (Score:2)
They got healthy free market capitalism? (Score:1)
Hold on, gotta pack my freedom bags!
-- Lee Bert Arian
Re: (Score:2)
Also there are counterintelligence considerations (Score:2)
Probably keeps them all sharp and makes it more likely for them to discover new or different vectors because they can't just rely on someone else's code that they probably won't bother to fully understand for themselves if they're like most developers. Maybe it's less efficient, but I'm willing to be that it makes them more effective in the long run.
This is more along the same lines as I was thinking.
However, I think there are also counterintelligence reasons. If the code streams are blended, then it could become much harder to figure out if there's a spy in the soup. You want to keep everything compartmentalized so that if something seems to have been compromised, you can figure out where to look.
(Maybe I've read too many history books about squabbles between the various intelligence agencies? But there was that deep mole in the FBI...)
Redundancy and compartmentalization... (Score:2)
The Russian government has fostered competition among the three agencies, which operate independently from one another, and compete for funds.
This, in turn, has resulted in each group developing and hoarding its tools, rather than sharing toolkits with their counterparts, a common sight among Chinese and North Korean state-sponsored hackers.
"Every actor or organization under the Russain APT umbrella has its own dedicated malware development teams, working for years in parallel on similar malware toolkits and frameworks," researchers said.
"While each actor does reuse its code in different operations and between different malware families, there is no single tool, library or framework that is shared between different actors."
Researchers say these findings suggest that Russia's cyber-espionage apparatus is investing a lot of effort into its operational security.
"By avoiding different organizations re-using the same tools on a wide range of targets, they overcome the risk that one compromised operation will expose other active operations," researchers said.
Good for when you are on the offensive and only attacks you expect are counterattacks reacting to your attacks.
Not so good and rather counterproductive for actual national security or for keeping track of known threats.
See: Every crime movie where cops and the FBI keep tripping over each other and argue over jurisdiction while the criminals get away with their dastardly plan.
Re: (Score:2)
soooo, you think that Hollywood actually knows how local, state and federal agencies interact?
Wow, that is naive.
Well, of course Hollywood knows! They asked the agencies, and the agencies told them.
Re: (Score:1)
Re: They don't share? (Score:3)
Sharing is about trust (Score:5, Insightful)
Re: (Score:2)
Re: (Score:2)
They're also most likely in competition with each other for funding/resources. If Team-A and Team-B share resources too much, and Team-A proves successful then Team-B might find its funding cut, even if Team-B's developments are what allowed Team-A to succeed.
Think about your own workplace. Coworkers are arguably in-competition with each other, and sometimes departments have to make termination or promotion choices based partly on employee performance. As such one has to gauge how much to share with cowo
Russian State Hackers Rarely Share Code With Other (Score:5, Funny)
(... as opposed to: The whisky is agreeable, but the meat has gone bad.)
Why would they? (Score:2)
Re:Why would they? (Score:4, Insightful)
Similar code structures would just be a huge red flag for AV heuristics. Sharing anything beyond vague concepts are just going to get you knocked out faster.
Wait! Wait! Wait! (Score:3, Insightful)
More enlightened minds might question the hypothesis that this malware came from those Russian agencies and might be independently run by individual hacking/piracy groups (possibly still from within Russia)
Re: (Score:1)
In fact, the whole thing is a hoax. See, Russia doesn't actually exist. It's all a fake news construct manufactured just to bring down Trump. Don't believe ANYTHING you see, hear, smell, touch, or taste!
Makes it more difficult to trace (Score:3)
Re: (Score:2)
If they all used the same code it would be a lot easier to trace to the ultimate source.
No, that's backwards. If they all used the same code you only know what country it's coming from. We know that already.
Using multiple source bases reduces the mono-code vulnerability, and also makes it tougher to defend against.
That part is true.
It wouldn't surprise me if they weren't sharing code intentionally.
Well, they're not accidentally not sharing code.
I work for a Red Team (Score:5, Interesting)
Re:I work for a Red Team (Score:5, Funny)
In other words:
In mother Russia, we don't share code, because the code might share you.
Over here, we just call that ... (Score:2)
Google, Amazon, Microsoft, Five Eyes, ... ;)
Because it's just ye olde Russian hackers! (Score:1)
The same that wrote and write all those nice cracks for you that make shared software run.
The state part is just the white line the US ownership needs to snort right now.
Not that the Russian leaders would not employ in it, like the USA, Israel, the UK, China, etc.
But they are not that dumb and plump to leave such rookie traces.
That explains it (Score:3)
Report, co-authored by CIA front group? (Score:1)
OPSEC - Russians have it... (Score:2)
Allegedly.
Elegant disinformation (Score:3)
"Russia's state-sponsored hacking groups rarely share code with one another, and when they do, it's usually within groups managed by the same intelligence service, a new joint report published today reveals".
Joint reports are usually evidence-free concoctions of drug-addled fantasy, often paid for by the wealthy and powerful backed by the Deep State, a comment by Archtech published today reveals.
My "editor" self notes with admiration the elegant way in which the article's first sentence leads with the unproved and unprovable allegation - which thus becomes the whole headline - before admitting, on the second line where some readers will not even notice is, that the source is "a new joint report".
A new joint report by whom? one asks. Check Point and Intezer, it turns out. Check Point is a corporation that makes a great deal of money from the US government, and thus is doubly motivated to smear Russia. Intezer presumably provided the software used to reach the conclusion that Russians were responsible.
"The two companies looked at nearly 2,000 malware samples that were previously linked to Russia state-sponsored hacking groups, in order to get an idea of how these malware samples related to each other".
And those malware samples were "previously linked to Russia" BY WHOM? And WHY? And with what evidence?
An unbiased person, seeing that the malware samples turn out not to be related to each other, would reasonably infer that they were not written or used by the same people.