Wikibooks

Lentis/Cyber-attack Attribution

< Lentis

Cyber-attack Attribution

edit

One of the first steps in mitigating and containing a cyberattack or a breach is attributing its source. Identifying the perpetrators early on and keeping track of their previous campaigns helps understand their motivation, determine the data they are after, and physically locate and apprehend them. On a more global level, associating an attack with a nation state can influence the policymakers in regard to foreign policy. Despite its importance, the current methods for attribution are nowhere near from perfect, and some decisions are made prematurely. This can lead to a variety of implications, and misattribution may cause countermeasures to harm victims rather than cybercriminals [1][2].

Background

edit

What is Attribution

edit

Cyber-attack attribution describes the act of identifying the party responsible for a certain internet attack by correlating various indicators to trace the attack back to its source. Every kind of cyber operation leaves a trail, and analysts use this information, combined with a knowledge of previous events, to attempt identify the malicious actor [3]. Knowing what data the attacker is after allows incident responders to predict the intruder's actions and concentrate their containment, mitigation, and preventative efforts [4]. In terms of policy, it helps law enforcement differentiate criminal activity from state-sponsored attacks and act accordingly.

Attribution Methods

edit

Cyber-attacks generally leave some form of logs on the system, so the information found in them or even the evidence of deleted logs can ring a bell. Any cyber-attack or regular use of a system interact with computer equipment through many services and on various networking levels, leaving some traces in almost every step. These indicators of compromise, such as failed login attempts, anomalous connections outside of business hours, IP addresses, records of traffic leaving a network with sensitive data, etc., point to malicious activity [5]. Additionally, the demonstrated behavior and techniques used to conduct the attack are valuable because habits are harder to change than tools [3]. Human factors such as socio-cultural references, language skills, and timezones help point to a country [6][7].

Attribution Difficulties

edit

There is currently no standardized method for identifying the perpetrator. Attack methods and techniques are constantly evolving, each target system is unique, and both offense and defense require human actions that are difficult to generalize.

  • Pure technical indicators of compromise (such as IP addresses originating from a specific location) are no longer a reliable method of attribution [8]. Threat actors can easily spoof their origin or use de-anonymization services such as the TOR network to make their traces meaningless. In some cases, the attackers may deliberately plant red-herrings to encourage missatribution [9].
  • Attackers reuse methods and tools from others, which leads to false positives. They can be obtained on the dark web or within white-hat hacking communities. For example, an attack called EternalBlue has become the standard method for exploiting Windows SMB service. It has been reportedly developed by the NSA [10].
  • An increased use of so-called "living off the land" tactics has allowed threat actors to perform attacks using only built-in tools already present in the target environment. This makes attacks more difficult to detect and avoids the use of any custom tools that would otherwise serve as valuable artifacts in investigations [11].
  • As internet usage grows, the number of web services increases and companies ramp up their infrastructure. This leads to an explosion of traffic volume that the security teams have to analyze and process. This makes it difficult to distinguish malicious traffic from benign, and automated solutions are not foolproof [12].
  • Attribution may result in disclosure of sensitive evidence or attribution methods, which would give the attacker an opportunity to obscure their trail [13]. On the contrary, lack of released evidence hurts trust in the validity of the attribution.
  • Attribution methods that analyze attacker behavior and correlate independent attacks heavily rely on the knowledge of previous attacks. This requires strong and quick communication within and across the private and the public sectors, which is difficult due to the sensitivity of information, business competition, or reluctance to admit breaches [14][15].

Social Consequences

edit

Lack of government trust

edit

In recent years, there has been a growing rift between the government and their constituents in the United States. According to a recent poll by the Pew Research Center, people are losing trust in the government to serve their best interests [16]. This loss of trust consequently erodes the credibility of the government in the eyes of the public, which raises concerns on the process of cyber-attack attribution. When governments release official statements identifying the attack, many are skeptical [17][18]. This distrust is not unreasonable. From unreasonable dairy consumption recommendations [19] to the Vietnam war disaster [20], there are many historical examples of government dishonesty or poor decision making.

The government agencies are extremely reluctant to reveal their intelligence capabilities, sources, and methods. Some of this information is very sensitive to national security [21]. In the case of the Sony Pictures hack in 2014, this could have revealed the details of NSA's attempts to eavesdrop on the North Korean government [22]. Such disclosures also tell the threat actors what has been found and what needs to fixed in future attacks. Sometimes the public has no choice by to take government agencies at their word.

Findings motivated by political agendas

edit

Political groups take advantage of the inherent difficulty in attributing cyber attacks and use this ambiguity in order to advance their own agendas. With the growing sophistication and aggressiveness of state-sponsored cyber attacks, nations are beginning to prioritize mitigating and responding to the threat of these attacks. This also gives political groups more opportunities to use these attacks in their favor, whether it be through premature attributing the attack to some particular group or implicating their opposition as liable or complicit.

Attributions by private companies

edit

Private companies are gaining responsibility for cyber-attack attribution. This setup benefits government, which would typically be responsible for attributing cyber-attacks, by preserving options to retaliate and keeping intelligence capabilities secret [23]. This setup benefits private security companies as well, since they gain valuable prestige and news coverage when making attributions. Since the standard of evidence to make an attribution is not clearly defined, private companies may make false premature attributions. Additionally, if different firms disagree on an attribution, then the trust and authority of attributions may break down further.

Geopolitical tensions

edit

The power and potential damage of cyber attacks can be compared to that of actual physical weapons, so when a country threatens the US with a cyber attack, it is taken seriously. False accusations could raise unnecessary geopolitical tensions, and in some cases it might be rational to tolerate an attack rather than assign blame publicly and not be certain [24]. In the aftermath of the Sony Hack, the White House proposed a 'proportional response' to North Korea [25] in retribution [26], while many experts were not yet sure about the malicious actor. Another point of contention is that it is difficult to differentiate attacks carried out by a couple of lone hackers from ones backed by a nation-state military, and there is concerns that the government agencies have correlated independent attacks in the past without much evidence [21].

Case Studies

edit

Grizzly Steppe

edit

During the controversy about the 2016 presidential elections, Russia was blamed for meddling in the elections [27]. This has been repeated many times by top government officials, but a lot of the detailed evidence remains unpublished [28], and some are skeptical of whether attribution to Russia is true for every attack [29]. Over the years, there have been numerous reports that attributed individual small attacks to different malicious groups both in Russia and outside, which served as evidence to higher level reports that claimed all of those small attacks were the work of a single group tied to Kremlin [30].

The Department of Homeland Security and FBI did release a join report with a threat advisory containing a list of IP addresses and malware signatures that served as indicators of various Russian attacks [31], which does not constitute evidence. The intention was to help other agencies and private organizations protect themselves by spotting these IP addresses. Upon further analysis, of 875 IP addresses released and attributed to Russia, at least 425 (~49%) are IP addresses that correspond to Tor exit nodes. This means that anyone, any attacker or any benevolent user from any country can easily obtain those IP addresses both accidentally and on purpose [32]. As such, these published indicators were both misleading and may suggest a level of technical inadequacy and a lack of trust in reports from the same agencies. This has led to missatributions as well.

For example, after December 2016 attack on a Vermont facility, officials publicly attributed it to the Russian military and civilian services [33]. Vermont Representative Welch commented on the Russian involvement, "they will hack everywhere, even Vermont, in pursuit of opportunities to disrupt our country. We must remain vigilant, which is why I support President Obama’s sanctions against Russia and its attacks on our country and what it stands for." Despite these allegations, security experts could not claim that the attack was actually performed by the Russians. As a result, this Washington Post article was later modified to say:

"Editor’s Note: An earlier version of this story incorrectly said that Russian hackers had penetrated the U.S. electric grid. Authorities say there is no indication of that so far. The computer at Burlington Electric that was hacked was not attached to the grid."

DNC attack

edit

In 2015 and 2016 the Democratic National Committee (DNC) network was infiltrated through a series of phishing attacks, resulting in thousands of sensitive documents being leaked online [34]. The leaks destabilized Clinton's campaign, and many believe played a role in her eventual loss. In December of 2016, the U.S. Intelligence community concluded that Russian intelligence services were responsible for the leak [30]. In the time before the attack was officially attributed, both candidates in the 2016 election were able to exploit the fact that the attacker's identity was unknown. As the attacks benefited the Republican Party at the expense of the DNC, Clinton continually asserted that Russia was responsible, and that Donald Trump was complicit in this attack. Even though officially the identity of the attacker was unknown, Clinton was able to use this fact to erode the credibility of Trump to further advance her campaign.

CrowdStrike Conspiracy

edit

CrowdStrike, a private security company, revealed the DNC attack when hired to monitor the DNC servers. CrowdStrike then linked the attack to Russian hacking groups [35]. When the FBI investigated the attack, CrowdStrike provided a digital copy of the server to the FBI but not the actual physical server which CrowdStrike themselves never possessed [36]. The CrowdStrike conspiracy believes that CrowdStrike is hiding the physical server from the FBI in Ukraine (the server is physically located in Ukraine) because this physical server may contain evidence the attack came from Ukraine instead of Russia [37]. The conspiracy highlights the potential consequences of mistrust of private company attributions even if the mistrust is unfounded.

Olympic Destroyer attack

edit

The Olympic destroyer attack was a cyber attack against South Korea during the 2018 winter games. Initial reports said that the attack could have come from North Korea of Russia [38]. It took nearly 8 months for researchers to attribute the attack definitively to Russia. The Russian hackers placed false flags to try to pin the attack on North Korea [39]. The Olympic Destroyer attack occurred during a detente of the Korean conflict. Just one month after the Olympic games, the Singapore summit between North Korea and The United States would advance peace further. While misattribution of the Olympic Destroyer attack did not derail these talks, it is conceivable how misattribution could have serious geopolitical consequences in a situation like this.

References

edit
  1. ↑ Laperruque, J. (2015). How CISA's countermeasures authorization threatens security. Center for Democracy and Technology. https://cdt.org/insights/how-cisas-countermeasures-authorization-threatens-security/
  2. ↑ Roberts, P. (2015). The deadly game of cyber mis-attribution. DigitalGuardian. https://digitalguardian.com/blog/deadly-game-cyber-mis-attribution
  3. ↑ a b Office of the Director of National Intelligence. (2018). A Guide to Cyber Attribution. https://www.dni.gov/files/CTIIC/documents/ODNI_A_Guide_to_Cyber_Attribution.pdf
  4. ↑ Raytheon. (2019). Who hacked you?. Raytheon Company. https://www.raytheon.com/news/feature/who-hacked-you
  5. ↑ Shamsi, J. A., Zeadally, S., Sheikh, F., & Flowers, A. (2016). Attribution in cyberspace: techniques and legal implications. Security and Communication Networks, 9(15), 2886-2900. doi:10.1002/sec.1485
  6. ↑ Summers, T. (2017). Hunting hackers: An ethical hacker explains how to track down the bad guys. The Conversation. https://theconversation.com/hunting-hackers-an-ethical-hacker-explains-how-to-track-down-the-bad-guys-70927
  7. ↑ Goodin, D. (2016). 'Guccifer? leak of DNC Trump research has a Russian's fingerprints on it. ArsTechnica. https://arstechnica.com/information-technology/2016/06/guccifer-leak-of-dnc-trump-research-has-a-russians-fingerprints-on-it/
  8. ↑ Maloney, S. (2017). Attack attribution: It's complicated. Cyberreason. https://www.cybereason.com/blog/attack-attribution-its-complicated
  9. ↑ Bartholomew, B., & Guerrero-Saade, J. A. (2016). Wave your false flags! Deception tactics muddying attribution in targeted attacks. In Virus Bulletin Conference 2016. https://www.virusbulletin.com/uploads/pdf/magazine/2016/VB2016-Bartholomew-GuerreroSaade.pdf
  10. ↑ Newman, L. (2018). How leaked NSA spy tool 'EternalBlue' became a hacker favorite. Wired. https://www.wired.com/story/eternalblue-leaked-nsa-spy-tool-hacked-world/
  11. ↑ Goudie, M. (2019). Going beyond malware; the rise of 'living off the land' attacks. CSO Online. https://www.cso.com.au/article/661035/going-beyond-malware-rise-living-off-land-attacks/
  12. ↑ Crossman, P. (2017). Alert: There are too many cybersecurity alerts. American Banker. https://www.americanbanker.com/news/alert-there-are-too-many-cybersecurity-alerts
  13. ↑ Baikalov, I. (2019). Why accurate attack attribution is critical in cybersecurity. SC Media UK, https://www.scmagazineuk.com/article/1525749
  14. ↑ Molnar, A. (2017). The culture of information sharing. Search Explained. https://searchexplained.com/information-sharing-culture/
  15. ↑ Nielsen, K. M. (2018). Secretary Kirstjen M. Nielsen's national cybersecurity summit keynote speech. Department of Homeland Security. https://www.dhs.gov/news/2018/07/31/secretary-kirstjen-m-nielsen-s-national-cybersecurity-summit-keynote-speech
  16. ↑ Pew Research Center. (2019). Public trust in government: 1958-2019. https://www.people-press.org/2019/04/11/public-trust-in-government-1958-2019/
  17. ↑ Carden, J. (2017). Is skepticism treason?. The Nation. https://www.thenation.com/article/is-skepticism-treason/
  18. ↑ Greenberg, A. (2017). Feds' damning report on Russian election hack won’t convince skeptics. Retrieved from https://www.wired.com/2017/01/feds-damning-report-russian-election-hack-wont-convince-skeptics/
  19. ↑ Whoriskey, P. (2015). For decades, the government steered millions away from whole milk. Was that wrong?. The Wasthington Post https://www.washingtonpost.com/news/wonk/wp/2015/10/06/for-decades-the-government-steered-millions-away-from-whole-milk-was-that-wrong/
  20. ↑ Warren, J. A. (2018). Vietnam: the greatest disaster in all of US foreign policy. The Daily Beast. https://www.thedailybeast.com/vietnam-the-greatest-disaster-in-all-of-us-foreign-policy-2
  21. ↑ a b Schneier, B. (2015). The government must show us the evidence that North Korea attacked Sony. Time. https://time.com/3653625/sony-hack-obama-sanctions-north-korea/
  22. ↑ Schneier, B. (2014). Did North Korea really attack Sony?. The Atlantic. https://www.theatlantic.com/international/archive/2014/12/did-north-korea-really-attack-sony/383973/
  23. ↑ Rich, W. G. (2018). The US lets private cybersecurity firms do its dirty work. Wired. https://www.wired.com/story/private-firms-do-government-dirty-work/
  24. ↑ Edwards, B., Furnas, A., Forrest, S., & Axelrod, R. (2017). Strategic aspects of cyberattack, attribution, and blame. Proceedings of the National Academy of Sciences, 114(11), 2825-2830. doi:10.1073/pnas.1700442114
  25. ↑ Brunnstorm, D., & Finkle, J. (2014). U.S. considers 'proportional' response to Sony hacking attack. Reuters. https://www.reuters.com/article/idUSKBN0JW24Z20141218
  26. ↑ Endgame. (2015). The fog of (cyber) war: the attribution problem and jus ad bellum. https://www.endgame.com/blog/technical-blog/fog-cyber-war-attribution-problem-and-jus-ad-bellum
  27. ↑ CNN Editorial Research. (2019). 2016 presidential election investigation fast facts. Retrieved from https://www.cnn.com/2017/10/12/us/2016-presidential-election-investigation-fast-facts/index.html
  28. ↑ Greenberg, A. (2019). The evidence that links Russia's most brazen hacking efforts. Wired. https://www.wired.com/story/sandworm-russia-cyberattack-links/
  29. ↑ Rall, T. (2016). Russia hacking: where's the evidence?. Rasmussen Reports http://www.rasmussenreports.com/public_content/political_commentary/commentary_by_ted_rall/russia_hacking_where_s_the_evidence
  30. ↑ a b Department of Homeland Security & FBI (2016). Grizzly Steppe – Russian malicious cyber activity. https://www.us-cert.gov/sites/default/files/publications/JAR_16-20296A_GRIZZLY%20STEPPE-2016-1229.pdf
  31. ↑ Department of Homeland Security. (2016). Grizzly Steppe technical indicators of compromise [Data file]. https://www.us-cert.gov/sites/default/files/publications/JAR-16-20296A.csv
  32. ↑ Lee, M. (2017). The U.S. government thinks thousands of Russian hackers may be reading my blog. They aren't. The Intercept. https://theintercept.com/2017/01/04/the-u-s-government-thinks-thousands-of-russian-hackers-are-reading-my-blog-they-arent/
  33. ↑ Eilperin, J., & Entous, A. (2016). Russian operation hacked a Vermont utility, showing risk to U.S. electrical grid security, officials say. The Washington Post. https://www.washingtonpost.com/8fc90cc4-ceec-11e6-b8a2-8c2a61b0436f_story.html
  34. ↑ Satter, R. (2017). Inside story: How Russians hacked the Democrats' emails. Associated Press. https://apnews.com/dea73efc01594839957c3c9a6c962b8a
  35. ↑ Stokel-Walker, C. (2017). Hunting the DNC hackers: how Crowdstrike found proof Russia hacked the Democrats. Wired. https://www.wired.co.uk/article/dnc-hack-proof-russia-democrats
  36. ↑ Alpetrovich, D. (2016). Bears in the midst: intrusion into the Democratic National Committee. CrowdStrike. https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/
  37. ↑ Dunleavy, J. (2019). Trump’s Ukraine-CrowdStrike conspiracy theory front and center in impeachment hearing. Washington Examiner. https://www.washingtonexaminer.com/news/analysis-trumps-ukraine-crowdstrike-conspiracy-theory-front-and-center-in-impeachment-hearing
  38. ↑ Neuman, S. (2018). Malware attacks on olympics could have come from Russia and North Korea, experts say. NPR. https://www.npr.org/sections/thetorch/2018/02/13/585297314/
  39. ↑ Greenberg, A. (2018). Russian hacker false flags work even after they're exposed. Wired. https://www.wired.com/story/russia-false-flag-hacks/
Retrieved from "https://en.wikibooks.org/w/index.php?title=Lentis/Cyber-attack_Attribution&oldid=3796870"