Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An inside look at NSA tactics, techniques and procedures from China's lens

inversecos.com

Post reply on HN
Print view View original

11–20 of 76 posts

Re: An inside look at NSA tactics, techniques and procedures from China's lens

#11

Post by formerly_proven »

rdtsc wrote: post #4

> No attacks occurred during Memorial Day and Independence Day holidays which were unique American holidays. Simple but effective. A good non-NSA agency should also learn from this to be able to effectively false-flag as NSA, as long as they are flexible enough to allow off-hours and overtime pay and remember to respect the US federal holidays. > Two zero-days were used to breach any company with SunOS-exposed system…

Assuming they mean Solaris, it's still technically maintained, at least in the Oracle sense (of both "technically" and "maintained").

Re: An inside look at NSA tactics, techniques and procedures from China's lens

#12

Post by zdragnar »

rdtsc wrote: post #4

> No attacks occurred during Memorial Day and Independence Day holidays which were unique American holidays. Simple but effective. A good non-NSA agency should also learn from this to be able to effectively false-flag as NSA, as long as they are flexible enough to allow off-hours and overtime pay and remember to respect the US federal holidays. > Two zero-days were used to breach any company with SunOS-exposed system…

The same strategy is used to attribute attacks against US based targets by Russian, N.Korean and Iranian and other state or state sponsored actors. Time of day, holidays, etc. are (in tandem with other evidence) considered to be surprisingly reliable.

If I were in charge of things I'd like to think that this sort of thing would be the first step I'd take to cover my tracks, but I still hear cyber security firms using it in their attributions.

Re: An inside look at NSA tactics, techniques and procedures from China's lens

#16

Post by rdtsc »

formerly_proven wrote: post #11
rdtsc wrote: post #4

> No attacks occurred during Memorial Day and Independence Day holidays which were unique American holidays. Simple but effective. A good non-NSA agency should also learn from this to be able to effectively false-flag as NSA, as long as they are flexible enough to allow off-hours and overtime pay and remember to respect the US federal holidays. > Two zero-days were used to breach any company with SunOS-exposed system…

Assuming they mean Solaris, it's still technically maintained, at least in the Oracle sense (of both "technically" and "maintained").

I assumed that much, SunOS is pretty ancient, last version was what, in early 1990s? Though, Solaris still would report a SunOS 5.$solarisver version or something like that. So I guess we can say it is a "SunOS" box if we wanted to.

Re: An inside look at NSA tactics, techniques and procedures from China's lens

#17

Post by kokx »

zdragnar wrote: post #12
rdtsc wrote: post #4

> No attacks occurred during Memorial Day and Independence Day holidays which were unique American holidays. Simple but effective. A good non-NSA agency should also learn from this to be able to effectively false-flag as NSA, as long as they are flexible enough to allow off-hours and overtime pay and remember to respect the US federal holidays. > Two zero-days were used to breach any company with SunOS-exposed system…

The same strategy is used to attribute attacks against US based targets by Russian, N.Korean and Iranian and other state or state sponsored actors. Time of day, holidays, etc. are (in tandem with other evidence) considered to be surprisingly reliable. If I were in charge of things I'd like to think that this sort of thing would be the first step I'd take to cover my tracks, but I still hear cyber security firms using…

The type of work the people working at an APT do, is mainly office work, while it still is very much "hands-on-keyboard" work (so you cannot set an action to automatically occur when nobody is checking the results in the middle of the night). You might want to try shuffling this up when you are in charge, but your (usually highly skilled and expensive) employees probably don't want to be working weird shifts all the time. Especially when they have families.

It also may not be worth it. Generally APT's want to stay under the radar while they are executing. But after the goals have been reached, most of the time it doesn't matter much if they get attributed. We have yet to see real consequences against any APT's. So paying your employees more to work night shifts, likely doesn't stack up against the consequences of attribution.

Re: An inside look at NSA tactics, techniques and procedures from China's lens

#19

Post by viccis »

rdtsc wrote: post #4

> No attacks occurred during Memorial Day and Independence Day holidays which were unique American holidays. Simple but effective. A good non-NSA agency should also learn from this to be able to effectively false-flag as NSA, as long as they are flexible enough to allow off-hours and overtime pay and remember to respect the US federal holidays. > Two zero-days were used to breach any company with SunOS-exposed system…

>A good non-NSA agency should also learn from this to be able to effectively false-flag as NSA

It seems like such a lapse in tradecraft that, absent other indicators, I would just assume it's a crude false flag attempt.

Re: An inside look at NSA tactics, techniques and procedures from China's lens

#20

Post by boston_clone »

thaumasiotes wrote: post #15

> These insights stem from extensive research I did on Weixin Someone doing extensive research on Weixin might ordinarily realize that it's called "Wechat" in English.

Wechat is the internationalized version; Weixin is for mainland China.

https://duckduckgo.com/?q=weixin+vs+wechat

Post reply on HN