Answer by baldPrussian for How are attacks and APTs attributed?
There's one thing to keep in mind as well: the simple fact that hackers are hackers. Some work for governments directly yet moonlight for organized crime; some work for organized crime and are...
View ArticleAnswer by WhiteWinterWolf for How are attacks and APTs attributed?
Computer-based attack attribution works like the attribution of any other illegal activity: it requires a significant amount of investigation, gathering clues, corroborating information, attempting to...
View ArticleAnswer by Steve Sether for How are attacks and APTs attributed?
There is no good way to determine clearly who made an attack, or even if an attack was performed by a nation-state, or as Bruce Schneier puts it "A couple of guys". That we live in the world where we...
View ArticleAnswer by schroeder for How are attacks and APTs attributed?
As someone who runs personal honeypots and used to defend a massive global corporation, I can tell you that any attack leaves fingerprints. Styles of commands or command sequence, coding style of...
View ArticleAnswer by user67862 for How are attacks and APTs attributed?
My answer is based upon a home network being attacked. Cross-referencing time stamps, analyzing hops, motive, payoff, method (MD5 and SHA1 of malware used). From my work in attribution, I look at the...
View ArticleHow are attacks and APTs attributed?
It's increasingly common to see major attacks on governments and corporations attributed to a specific country or group. Typically we don't know for certain, but it's at least suspected. Given the...
View ArticleAnswer by nobody for How are attacks and APTs attributed?
From the sophistication of the malware codeState-sponsored groups are backed by governments which are usually willing to invest a lot more money than an individual or even a group of criminals will...
View Article