Schneier on Security

Clive Robinson • December 13, 2018 12:22 PM

@ Bruce,

I used to have opinions about whether these attributions are true or not. These days, I tend to wait and see.

The evidence against many atributions is at best hearsay, thus it’s best to be skeptical at the best of times.

@ All,

But when I read,

Private investigators looking into the breach have found hacking tools, techniques and procedures previously used in attacks attributed to Chinese hackers, said three sources who were not authorized to discuss the company’s private probe into the attack.

I can tell it’s more like “the worst of times”…

In that first short paragraph I see four things that imeadiatly make me think “cough cough BS cough BS cough”.

The first point is an unnamed Private investigators dear god that’s a very old trick, with a beard longer than mine. Either you put your face to what you claim or you are saying nothing of consequence[1]. At best it’s wallpapering your arse whilst shooting the breeze.

Secondly, previously used in attacks another “here be dragons” warning that you are entering BS la la land. We know the CIA amoungst other US agencies had “False Flag tools” to make it look like a chosen target was doing the attack. I would assume that most IC entities and a good many hackers and “Private investigators” have now built tools with samples of supposadly “attributed attacks”. It’s kind of Hacking 101 these days, like putting on gloves when being a burglar, so any hacker with half a brain wgo does not wish to be caught is doing it, thus about as much use as an indicator as dirt on the floor.

Thirdly, Chinese Oh dear god the US’s current one of four “cyber-existrntial threat” I’ve explained the nonsense that lives behind this, and you can also find it described in George Orwell’s “1984”, Niccolò Machiavelli likewise had a thing or two to say about such things in “The Prince” and “The Art of War”. Speaking of which then there was that ancient Chinese dude and his “Art of War” (depending on who’s copy/translation) it’s either Sun (Wu) Tzu or his descendant Sun Bin. It’s a simple “Political trick” for the sheeple.

Fourthly, sources who were not authorized to discuss So why were they flapping their gums? This is another old “if you knew what we know” nonsense that so many people fall for there must be one born every half second or so…

My advice is it’s more politically motivated than evidence based thus treat it with a very long pole with a sharp point and put a clothes peg on your nose. By all means stir it a little, you never know a little real evidence might bubble up… But I’ve yet to see anything called evidence in the “attribution game” I could not fairly easily fake myself.

And that’s the point realy, things are way way to easy to fake, especially by those supposadly gathering the evidence. Worse there is no “chain of evidence” and the evidence is often obtained by “illegal or tainted methods” thus the “fruit of the poison vine” doctrine applies.

But there is another thing that arises from points 2&3, they say “attributed to Chinese hackers” but are realy trying to imply “Chinese State”. It’s using a long runing build up of a Pavlovian type to make a probably false assumption in peoples heads. Again it’s to try and make what few facts there are fit a frame that is in all probability not valid.

A usefull thing for people to ask themselves is “Of what use is this data?” then ask “Who would use it and why?” If it was the Chinese State there are probably a lot easier ways to get the data that might be of political use…

[1] Though it’s a nice little trick if your are scrabbling for “Government Business”.