Schneier on Security

Clive Robinson • February 21, 2024 1:37 AM

@ JTC, ALL,

“Microsoft can now magically determine exactly where the attack came from, even to the Russian intelligence agency. You are liars, Microsoft, pure liars. What did the Russian intelligence agency do, accidentally drop their calling card?”

In a way yes.

First remember Microsoft is a very large organisation with many many different teams, so it would be a very different team investigating the mess than the team that created it in the first place.

Now consider writing code is like writing a story, poem, words to a song or the music it’s self.

With written works you can read the authors style come through the word usage and phraseology it’s why you like their books etc. Same as you can make a good guess at who the composer of a piece of music you’ve not heard before is.

It’s similar with the writing of code, given sufficient quantities the individuals style of writing code comes through.

The problem is not really attributing who wrote the second third or more example of that style of code writing, but the first.

Often in the early days of writing code an individual gives away who they are via a desire for ego food, money, or what ever other reward drives them on. That is they don’t start out an expert in all things so they don’t cover their early tracks well.

Have a read of some of Brian Krebs “chase downs” you will see he has a style in what he looks for, he can not help it any more than most can change the hand they write with. Nor can those he chases hide their mistakes etc.

One of the things LLM systems can do as they are in effect matched filters is recognise style in the training data and match to it.
Unfortunately in so doing they can reverse the process much like you running a wet finger around the rim of a glass can make it resonate. Thus within fairly rapidly expanding limits LLM’s can reproduce the written word, music or code almost as accurately as we can detect it over a certain range/block size.

Thus we have come to a sort of crossroads where an LLM can with enough of your code as input pull out all the basic layers that go into your style of code writing and reproduce it.

In fact we may have got there, we know the CIA had a tool for faking malware such that it looked like the style of different language authors. The tool was not unexpected by those a little ahead of the game in fact it had been talked about as an idea for “false flag attacks” for some years beforehand on this blog, hence the repeated “attribution is hard” comments made here about the ludicrous attributions being made by the likes of Mandiant etc that conveniently fell in line with what the US Gov wanted to hear at the time. Well many have “wised up” as their reputation was getting tarnished and they are way more cautious about attribution (as they should have been originally).

Well take it with a pinch of salt the size of Lot’s Wife, but it’s very recently been claimed that China might not be the friend to Russia Putin thought they were. The details are not yet clear but claims are being made that China are hiding behind Russian Code and routing it out via the same routes as Russians have used. Thus running a false flag operation.

If true, I suspect the give away was not the code but the information sought out which is an even higher layer of “style”.