Slashdot Mirror
Cyberattacks: Do Motives and Attribution Matter?
An anonymous reader writes: Whenever people think of APTs and targeted attacks, they ask: who did it? What did they want? While those questions may well be of some interest, a potentially more useful question to ask is: what information about the attacker can help organizations protect themselves better? Let's look at things from the perspective of a network administrator trying to defend an organization. If someone wants to determine who was behind an attack, maybe the first thing they'll do is use IP address locations to try and determine the location of an attacker. However, say an attack was traced to a web server in Korea. What's not to say that whoever was responsible for the attack also compromised that server? What makes you think that site's owner will cooperate with your investigation?
A while ago my employer came under DoS attack. We weren't the actual target - following a recent router replacement** the copying of configuration had been done wrong and left us with an open DNS resolver, we were just being used as an amplifier to attack some Russian websites. All the source IPs came from China, but many different organisations within China - a university, a factory, a local government office, and so on. Obviously a botnet, probably based on a Chinese-language trojan as that would explain the geographic clustering.
I identified every source address, blocked it at our firewall, looked up whois on the IP, found the abuse email, and informed the responsible party with tcpdump output to show what was going on.
Almost every email I sent came back as undeliverable. I had to muddle through Chinese customer service pages to find someone to contact on those, and not one of them ever got a reply. The packets kept on coming too until they all ceased together suddenly, probably at the point the responsible party realized I'd fixed the open resolver problem.
So why bother? You can dance around waving flags and shouting 'you've been hacked!' and a lot of organizations just don't want to know.
**If you ever upgrade a Smoothwall appliance, watch out for this!
If it's some script-kiddie, you have the little bastard locked up.
If it's a "professional" foreign intelligence agency, you sigh a heavy sigh and realize there is bugger all you can do about it.
I do not fail; I succeed at finding out what does not work.
1337-speak for "Advanced Persistent Threat".
In plain English, it means "someone trying to hack you who won't go away".
"What makes you think that site's owner will cooperate with your investigation?"
To be very clear: we are talking about an intermediate site that has themselves been hacked, rather than the origin of the attacks.
In the absolute freaking limit? No holds barred?
Because, if they are in Korea, they are extraterritorial to everyone but Koreans, and I will just hire Russians or some other third party to take them down more or less permanently if they choose not to cooperate. Or even better: I will pay the third party to cause their site to host illegal-in-Korea content, and then wait several weeks before having them reported to Korean authorities for their content through a side channel, and then the site's owner gets arrested.
Or did you think "active defense" or "strike-back" doesn't happen?
Articles: should they have some actual content, or just a load of speculative waffle that two guys sipping beer could come up with?
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
When you have the capability to drop bombs.
Religion is what happens when nature strikes and groupthink goes wrong.
I have to say the motives do matter. A DDOS vs. a targeted attack to collect data. Then what is the motivation behind the data, stolen. Is it just to sell off to make money, or will it be used for blackmail, perhaps they are trying to search for abuse in the system. Is the system attacking you just an unwilling system, probably due to the server under the desk, type of setup, where an outside IT guy is called only when there is a noticeable problem. Or is it from a location where there is a large IT Staff running a full time network. Then if there is a target to your hack vs. a general find any system open.
Say you choose to attack a Hospital, with the intent of getting PHI so you can sell it off for Identity Theft and/or blackmail individuals with embarrassing medical issues that may affect their electability or position in society. Now this is the digital equivalent of a targeted bombing of a hospital where the health and safety of the people are at risk, all for a petty motive of making some money.
In justice motives do matter, That is why our legal system differentiates Murder, Manslaughter, Wrongful death and Self defence. The outcome is the same, however it is the motives which determine the outcome and the degree of punishment.
In term of protecting your institution the motives are not necessarily important, however if you know your organization has data that may make it more vulnerable to a targeted attack you may need to put more effort into protecting the information.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
Mod parent up! And mod entire story down. This is so much a Trend researcher making an MBO or cash payout for blogging, with some marketing person checking that the wording is correct, but having no context to know if the content is blog-worthy.
I still think that moderators, en-masse, ought to be able to mod an entire story down.
We utilize some automation to handle the load. We have a few honey-pots. We also monitor our dark IPs. We learned to distinguish DoS backscatter, and the various types of frequently spoofed attacks. We thought that an enterprising hacker would attempt to spoof an important Internet resource and cause us to auto-immune ourselves to death. So we whitelisted a bunch of critical external IPs and looked for critical spoofing. In the last 10 years the amount of spoofed attack has dropped drastically. We recently found an incident where an attacker spoofed a critical Google resource and tried to get us to block it. That is the only time we have detected that kind of spoofed attack.
We have found that most attackers (even governments) don't like to have their attack methods documented and publicized. We have found that some ISPs turn evil and knowingly host attack, but they are quickly and easily blocked until they go broke or come to their senses.
We have found many institutional scans. The best of these groups provide timely assistance to those who are making mistakes. In our view, the best groups include the ShadowServer Foundation, EFF, and the Chaos Computer Club. The worst of these groups are simply feeding on the mistakes of others. The worst groups provide no assistance to others. The worst groups actually have motivation to preserve or enhance the problems of others.
More info is available here: