This looks to be very similar to the warning that Twitter was sending around a while ago. Here:
https://news.ycombinator.com/item?id=10722633
That contains the text in the discussion, and links to the text, etc.
Notifying Our Users of Attacks by Suspected State-Sponsored Actors
21–30 of 46 posts
Re: Notifying Our Users of Attacks by Suspected State-Sponsored Actors
#22Based upon the amount of spam I receive from Yahoo! mail systems, I'm not confident in their ability to detect "attacks by suspected state-sponsored actors" as they apparently don't even have the ability to detect phished/compromised accounts.
At the risk of stating the obvious, a From or Reply-To address of something@yahoo.com doesn't necessarily mean that Yahoo had anything to do with the message.
Re: Notifying Our Users of Attacks by Suspected State-Sponsored Actors
#23Based upon the amount of spam I receive from Yahoo! mail systems, I'm not confident in their ability to detect "attacks by suspected state-sponsored actors" as they apparently don't even have the ability to detect phished/compromised accounts.
Yep, I can't believe that they made John Langford and the team leave from YR, the best guys at scalable machine learning.
Re: Notifying Our Users of Attacks by Suspected State-Sponsored Actors
#24How do Yahoo, Google, Facebook, or others distinguish between state-sponsored actors and non-state-sponsored actors?
non state sponsored are criminals who do it to get money. blackmail / hostage.
State sponsored don't do it for the money.
Re: Notifying Our Users of Attacks by Suspected State-Sponsored Actors
#25Just what middle-America needs, notification that the russkies are coming for their baby pictures.
If that's what's happening, then yes, notification is exactly what middle-America needs. Adults don't need to be protected from the truth.
Re: Notifying Our Users of Attacks by Suspected State-Sponsored Actors
#26How do Yahoo, Google, Facebook, or others distinguish between state-sponsored actors and non-state-sponsored actors?
I want one of these companies to define state-sponsored actors? It's great if one is a dissenter in Egypt and the authorities there go after their Yahoo! account but what about a US citizen's account being attacked by the FBI or NSA?
There's no attack from the FBI or NSA, there's a court order.
Re: Notifying Our Users of Attacks by Suspected State-Sponsored Actors
#27How do Yahoo, Google, Facebook, or others distinguish between state-sponsored actors and non-state-sponsored actors?
They match up the activity they observe with tactics/techniques/procedures (TTPs, an awkward term but it's of old military origin) associated with various known state actor groups. These are widely published by various security firms, although the details are often kept in the industry and behind a paywall. You can find a lot of info just by googling the codenames firms assign to the groups, APT28 is one such group on my mind which has recently had some public reporting: https://www.fireeye.com/content/dam/fireeye-www/global/en/cu...
These TTPs may consist of known attack infrastructure, email payloads, even things as simple as an email subject line if the attacker leaves it fairly static. They may also be as complicated as artifacts of dynamic analysis of malware, software engineering techniques and tools, language use, etc.
Attribution to state actors comes via similar techniques, generally tying attacks back to infrastructure known to be owned by state agencies or companies operated by the same. The line between state actors and higher-end criminal groups can be very blurry, both in that attribution may be difficult and in that the groups actually overlap in many areas. But still, you can often make a pretty confident guess.
These attribution techniques are well-established in the security industry, and I'm not surprised to see these big providers starting to automate it where possible.
Re: Notifying Our Users of Attacks by Suspected State-Sponsored Actors
#28A big source of confusion on this kind of thing is that the HN crowd tends to see "state actor" and think "pervasive surveillance (by the NSA)".
In context, and in the security industry in general, "state actor" refers to active (although often broadly cast) penetration attempts by groups thought to be operated by foreign governments. These groups do not have significant surveillance capabilities, so they're trying to build it by doing things like getting access to the email of potentially interesting people, often via credential stealing malware or plain old phishing. Their methods are often not particularly sophisticated, but they're more persistent and better funded than most other threat actors. On the other hand, their methods sometimes are very sophisticated, so it's good to detect a problem as early as possible, as Yahoo is trying to help users do.
Re: Notifying Our Users of Attacks by Suspected State-Sponsored Actors
#29Based upon the amount of spam I receive from Yahoo! mail systems, I'm not confident in their ability to detect "attacks by suspected state-sponsored actors" as they apparently don't even have the ability to detect phished/compromised accounts.
At the risk of stating the obvious, a From or Reply-To address of something@yahoo.com doesn't necessarily mean that Yahoo had anything to do with the message.
I've got more experience in hunting down spam than is healthy and can read headers.
Receiving SPF, DKIM validated spam from Yahoo's email systems, then discovering there's absolutely no way in hell to kick it back to them, sours one rather rapidly.
Trying to send mail to Yahoo has been roughly equally annoying for about as long.
Re: Notifying Our Users of Attacks by Suspected State-Sponsored Actors
#30A big source of confusion on this kind of thing is that the HN crowd tends to see "state actor" and think "pervasive surveillance (by the NSA)". In context, and in the security industry in general, "state actor" refers to active (although often broadly cast) penetration attempts by groups thought to be operated by foreign governments. These groups do not have significant surveillance capabilities, so they're trying t…
So, what you are saying is we should lose all hope of ever being notified about an NSA attack because they own the networks. Like that made it all-right... REALLY????