Microsoft confirms Russian spies stole source code, accessed internal systems
1–10 of 38 posts
Re: Microsoft confirms Russian spies stole source code, accessed internal systems
#2Remember when we all learned from the vault 7 leaks that the US government has the ability to create cyberattacks that appear to investigators to have come from another nation?
We were doing that prior to 2017. Thank God someone like China can't ever do that, even nearly a decade after we did and we can trust these sort of accusations at face value and not at all think critically about them.
Re: Microsoft confirms Russian spies stole source code, accessed internal systems
#3Remember when we all learned from the vault 7 leaks that the US government has the ability to create cyberattacks that appear to investigators to have come from another nation? We were doing that prior to 2017. Thank God someone like China can't ever do that, even nearly a decade after we did and we can trust these sort of accusations at face value and not at all think critically about them.
So is there any evidence for it being done by China beside that its been done by the US before?
Re: Microsoft confirms Russian spies stole source code, accessed internal systems
#4Remember when we all learned from the vault 7 leaks that the US government has the ability to create cyberattacks that appear to investigators to have come from another nation? We were doing that prior to 2017. Thank God someone like China can't ever do that, even nearly a decade after we did and we can trust these sort of accusations at face value and not at all think critically about them.
Attributions are about more than the code flow. You also need infrastructure to funnel exfiltrated data back to yourself.
As you can imagine, it’s harder to reuse someone else’s infrastructure. Easy to copy code patterns but you can’t exactly reuse domains, listening posts etc.
Re: Microsoft confirms Russian spies stole source code, accessed internal systems
#5Remember when we all learned from the vault 7 leaks that the US government has the ability to create cyberattacks that appear to investigators to have come from another nation? We were doing that prior to 2017. Thank God someone like China can't ever do that, even nearly a decade after we did and we can trust these sort of accusations at face value and not at all think critically about them.
So is there any evidence for it being done by China beside that its been done by the US before?
No that's why we all can naively say it isn't happening even though many of us here could do it ourselves as a fun side project.
Re: Microsoft confirms Russian spies stole source code, accessed internal systems
#6Earlier quoted context omitted.
So is there any evidence for it being done by China beside that its been done by the US before?
No that's why we all can naively say it isn't happening even though many of us here could do it ourselves as a fun side project.
Nobody in this thread is saying that but you, atm. I was just wondering if you were speculating or had any evidence. Id even be interested to hear more about your logic because "its possible and has been done before by other actors" isnt enough to convince me
Re: Microsoft confirms Russian spies stole source code, accessed internal systems
#7Remember when we all learned from the vault 7 leaks that the US government has the ability to create cyberattacks that appear to investigators to have come from another nation? We were doing that prior to 2017. Thank God someone like China can't ever do that, even nearly a decade after we did and we can trust these sort of accusations at face value and not at all think critically about them.
Attributions are about more than the code flow. You also need infrastructure to funnel exfiltrated data back to yourself. As you can imagine, it’s harder to reuse someone else’s infrastructure. Easy to copy code patterns but you can’t exactly reuse domains, listening posts etc.
> Attributions are about more than the code flow. You also need infrastructure to funnel exfiltrated data back to yourself.
How is that even possible and how does it help? A computer is like a state machine where a minuscule amount of states are logged. When the state is gone the trace is gone. And you don't control the other involved computers anyway. And what good does accessing "exfiltrated data" do?
Re: Microsoft confirms Russian spies stole source code, accessed internal systems
#8Earlier quoted context omitted.
So is there any evidence for it being done by China beside that its been done by the US before?
No that's why we all can naively say it isn't happening even though many of us here could do it ourselves as a fun side project.
So you just are wildly speculating and assume this one technique you know about completely defeats teams of specialists with the budget of the richest country in the world
It's one thing to point out issues with attribution. It's another to just say since we can't say with 100% certainty let's just make up attributions.
Especially with no knowledge of the attributions certainty, they could be 99.9% sure
Re: Microsoft confirms Russian spies stole source code, accessed internal systems
#9Earlier quoted context omitted.
Attributions are about more than the code flow. You also need infrastructure to funnel exfiltrated data back to yourself. As you can imagine, it’s harder to reuse someone else’s infrastructure. Easy to copy code patterns but you can’t exactly reuse domains, listening posts etc.
> Attributions are about more than the code flow. You also need infrastructure to funnel exfiltrated data back to yourself. How is that even possible and how does it help? A computer is like a state machine where a minuscule amount of states are logged. When the state is gone the trace is gone. And you don't control the other involved computers anyway. And what good does accessing "exfiltrated data" do?
Take this wildly simplified example. You are the attacker. You already have access to internal systems at Microsoft.
Now you need to send the large amounts of data back to yourself, preferably without giving away your own location in the process. That’s the exfiltration phase of the cyber kill chain.
In order to do that, you’ve already established a set of listening posts and command/control sites across the internet. That’s your infrastructure. Setting that up in a pseudo anonymous way is hard, so you don’t do it often and may need to reuse it for multiple targets.
It’s that infrastructure that is hard to replicate if you’re trying to “look like” another threat actor on the Internet.
Re: Microsoft confirms Russian spies stole source code, accessed internal systems
#10Earlier quoted context omitted.
> Attributions are about more than the code flow. You also need infrastructure to funnel exfiltrated data back to yourself. How is that even possible and how does it help? A computer is like a state machine where a minuscule amount of states are logged. When the state is gone the trace is gone. And you don't control the other involved computers anyway. And what good does accessing "exfiltrated data" do?
Take this wildly simplified example. You are the attacker. You already have access to internal systems at Microsoft. Now you need to send the large amounts of data back to yourself, preferably without giving away your own location in the process. That’s the exfiltration phase of the cyber kill chain. In order to do that, you’ve already established a set of listening posts and command/control sites across the internet…
What happens after the first node is hit? You more or less need to control the network stack around it to know were it in turn sends data. If the NSA or whatever do control virtually every network stack they can access politically, every lead will end in countries which does not comply, right?
If there is any world-wide N-to-N statistical analysis of eavesdropped nodes for reentry of the data, it should trivially be able to be defeated by buffering in the nodes.
I don't get how these things can be tracked at all, unless the hackers are quite incompetent.