True Attribution to Cyber Attacks

 The Problems with Seeking and Avoiding True Attribution to Cyber Attacks

 

Attribution to cyber attacks means different things to different audiences. In some cases analysts only care about grouping multiple intrusions together to identify an adversary group or their campaign. This helps analysts identify and search for patterns. In this case analysts often use made up names such as "Sandworm" just to group activity together. To others, attribution means determining the person, organization, or nation-state behind the successful intrusion or attack; this latter type of attribution I will refer to as true attribution. There are many issues with true attribution that I want to explore here. However, there are also those that have pushed back on analysts exploring motives to an attack that I also want to call attention to. When dealing with attribution analysts should avoid the extremes: using true attribution inappropriately or being too hypersensitive to perform analysis and explore motives. Good analysts know when to seek true attribution and when to avoid it.

To explore these concepts I will look at true attribution at the tactical, operational, and strategic level of threat intelligence. While these levels should not be seen as a static category it will help shape the discussion. Tactical threat intelligence often deals with those folks who do the day-to-day security such as performing incident response and hunting for threats in the environment, operational threat intelligence refers to those personnel who work to identify adversary campaigns and often focus on aspects such as information sharing and working through organization knowledge gaps, and the strategic threat intelligence category I'll use to refer to those personnel that sit at senior decision making levels whether it be executives or board of directors members at companies or national government officials and policy makers.

True Attribution at the Tactical Threat Intelligence Level

In my opinion, true attribution at the tactical threat intelligence level is only harmful to good security practices. Trying to identify who was responsible for the attack seems like a good idea to help shape security practices. As an example, an analyst who thinks that China is in their network might begin looking for intellectual property theft and try to shortcut their effort to identify the adversary. But think about that for a moment. Because our hypothetical analyst thought China was in the network, they have begun to look at the data in front of them differently. In this case, attribution has led our analyst to the land of cognitive bias. Cognitive biases are especially dangerous when performing analysis as they bias the way you think ? and analysis leans so heavily on the human thought processes that it can lead us to inappropriate conclusions. Now, instead of keeping an open mind and searching for the threat in the network our analyst is falling prey to confirmation bias where the analyst is looking at the data differently based on their original hypothesis that China is in the network.

This begs the question though, if the analyst has nothing else to go off of shouldn't they look for the tactics, techniques, and procedures of China in the network as a starting place? In my opinion that is the role of those often funky sounding made up campaign names or intrusion set names; this is what others sometimes call attribution but not true attribution. An analyst that thinks they know what "China" looks like really only knows previously observed activity. If I tell you to think about what China would be doing in a network you might think intellectual property theft. If I tell you the threat is Russia you might think of cybercrime or military pre-positioning. If I say Iran maybe you think about data destruction. The problem is, that thought process is tied to previously observed activity and it's also going off of the assumption that previous true attribution you've heard is correct. Even if we assume all the previously true attribution was correct though analysts have only ever heard of or seen some of the campaigns by adversaries. Russia has teams that are interested in intellectual property theft just as China has teams that are interested in military pre-positioning. We are biased in how we view nation-state attribution based on campaigns we have seen before and it is difficult to take into consideration what is unknown. The better tactic is in identifying patterns of activity such as "Sandworm" and thinking to previous observed threats tactics, techniques, and procedures as a starting place in how we search the network for threats. Then tactical level threat intelligence analysts aren't biased by true attribution but can use some element of attribution to learn from threats they've observed before while attempting to avoid cognitive biases.

True Attribution at the Operational Threat Intelligence Level

At the operational threat intelligence level the use of attribution needs to fit the audience. Operational level threat intelligence analysts should always attempt to serve as the bridge between the strategic level players and the tactical level analysts. When using the observations and information from the tactical level to translate to strategic level players there can be a role for true attribution, which we will explore later. When translating the observations at the strategic level and operational level to the tactical level though true attribution then again becomes dangerous. The way threat intelligence is positioned should be determined by the audience consuming it.

Consider this: an operational level threat intelligence analyst has been asked to take the campaigns observed in the community and translate that information for the tactical level folks to use. The indicators of compromise and security recommendations that the tactical level personnel should use are independent of attribution. The security recommendations and fixes are based off of the observed threat to the systems and vulnerabilities not the attribution; or said another way if you have to patch a vulnerability you don't patch it differently if the exploit was Chinese or Russian based.

However, that same operational threat intelligence analyst has been asked to identify the threat landscape, the observed campaigns in the community that are relevant to the organization, and make recommendations for strategic level players that can influence organizational change. Here, the analyst may not be able to prove true attribution based off of observed adversary activity but it is in their best interest to identify patterns and motives to attacks. As an example, if there have been a number of campaigns recently that align with the motives of Chinese actors targeting the analysts' company the recommendation from the operational level analyst to the strategic members might have them take into consideration how they interact with and do business with China. Here the analyst should use language to structure their assessment that the observed threats are Chinese based such as "high confidence", "medium confidence", and "low confidence." Language such as "it is definitively China" should be avoided. Ultimately analysis is based on incomplete data sets (consider the difference between inductive and deductive reasoning) and the provided information is just an assessment.

At the operational level of threat intelligence analysts should be mindful of their audience and be open to putting forth good analysis based on observed activities, threats, and motives without being definitive on true attribution.

True Attribution at the Strategic Threat Intelligence Level

Strategic level audiences often heavily care about true attribution but not always with good reason. Government leaders and company executives want to know their threat landscape and how it might shape how they conduct business or policy. That is a good thing. However, strategic level players should be careful not to use true attribution when it's not required.

As an example, if the organization is facing security challenges and is consistently having intellectual property stolen they need to look at the security culture of the organization and the resource investments needed to increase security and minimize risk. This inward look at the culture and security investments should usually be independent of true attribution. The tactical and operational level impacts are going to be the same whether the previous culprits were China, Iran, Russia, or the North Pole. However, if the organization is taking an outward approach to doing business or policy making they may need to consider true attribution. Because true attribution is usually based off of assessments and not usually definitive it should usually be approached as a continuum.

To look at true attribution especially for this level of threat intelligence I highly recommend two resources. First, a paper by Dr. Thomas Rid and (soon to be Dr. ? congrats Ben!) Ben Buchanan titled Attributing Cyber Attacks. This paper will get you into the right mindset and understanding of attribution for the second paper I would recommend by Jason Healey titled Beyond Attribution. In Beyond Attribution, Jason Healey discusses the concept of responsibility as it applies to attribution. In short, a nation-state has responsibilities with regards to cyber operations especially if they might have been conducted from within its borders. At one side of the scale, a state can take an approach of prohibiting attacks and actually help other nations when an attack has begun. On the other side of the scale a state actually conducts the attack and integrates their attack with third-party proxies such as private companies for hire or hacktivists.

Analysts should be mindful of this spectrum of state responsibility, as Jason calls it, when considering true attribution and the nature of intelligence assessments. It is difficult to have true attribution and true attribution can be harmful to tactical level security. However, identifying motives in attacks and understanding the spectrum of state responsibility to attacks should be considered at the strategic level so that we are not so hypersensitive on the topic of attribution that every adversary gets to operate without consequence.

Case Study: Cyber Attack on the Ukrainian Power Grid

Let's take these concepts and apply it to the cyber attack on the Ukrainian power grid. If you're unfamiliar with the case you can read about it here. In this case, I have been very careful about my wording as I know there are multiple audiences that see my quotes in media or read my reports. On one hand, I teach a threat intelligence course and an ICS/SCADA active defense and incident response course at the SANS Institute. In this capacity most of my audience is tactical and operational level personnel. For those reasons I have often tried to reinforce that attribution in Ukraine doesn't matter for them. Identifying indicators of compromise to hunt throughout the network, preparing the network to make it more defensible, and applying lessons learned from the Ukraine attack are all independent of true attribution. True attribution simply doesn't matter for how we apply the lessons learned for security at those levels.

However, I also deal with strategic level players in my role in academia as a PhD student at Kings College London and as a Non-Resident National Cyber Security Fellow at New America where I work with policy makers. For this audience, it is important for me to note that definitive true attribution has not been obtained in the Ukraine attack and may never be obtained. However, in considering Jason's spectrum of state responsibility we have to look at the attack and realize the potential motives, the larger geo-political setting, and analyze if there are any courses of action strategic level personnel should take. In my opinion, I doubt the Russian government itself carried out the attack. However, the attack on the Ukrainian power grid did not fit any apparent financial motives and the motives aligned with various Russian based actors; whether those are private companies, hacktivists, or senior government officials. Therefore, it is in my opinion and in my analysis that strategic level players should look at the elements of attribution that link to Russian based teams and consider Jason's spectrum of state responsibility. Even if Russia had nothing to do with the attack there should be an investigation into whether or not it occurred from within their borders. If the attack is state-ignored it sets a dangerous precedent. Senior policy makers in other nations should under no circumstance jump to blaming Russia for anything. However, they should look for international cooperation and potentially an investigation as this is a first-of-its-kind cyber attack on civilian infrastructure that led to a power outage. There is a line between espionage and offense; that line was crossed in Ukraine and we must be careful of the precedent it sets.

Conclusion

In conclusion, true attribution is highly abused in the information security community today. Many organizations want true attribution but do not know how to use it appropriately and many private companies are quick to assign definitive attribution to attacks where they simply do not have the appropriate data to support their conclusions. True attribution makes media headlines and the motives for companies to engage in this activity are significant for that reason. Claims of true attribution do increase intentional tension; not as significantly as some would assume but they are individual data points to policy makers and national level leaders. However, being hypersensitive about true attribution enforces a culture in this field where nation-states can ignore responsibility such as investigating attacks or policing their borders as is normal in international law and policy in any other domain other than "cyber." There is a balance to be struck. Knowing how to strike that balance and when to use attribution in the form of group names with no state ties or true attribution in the form of an evolving assessment will help the threat intelligence community move to a more mature point where tactical, operational, and strategic level players can all benefit.



© Kuyasa Mahbub

Tips For Internet Browsing Safely

Internet Safety Tips: How to Avoid Spyware

If you think devious Web sites are the only places where spyware awaits its victims, you are in for a shock. Spyware lurks in many corners of the Internet; often in places where you'd least expect it. All it takes is to be in the wrong place at the wrong time to compromise your Internet browsing safety.

Here’s where the danger lies:

• You open your Web browser and begin browsing
• You visit a site and unknowingly fall into a spyware trap, such as:
  • A pop-up you click on, even to close it
  • A deceptive link that you follow
  • A clickable graphic that leads down a dangerous path
• Spyware loads onto your PC without your knowledge
• Sometimes simply opening a Web page or an HTML email starts the installation
• Your computer is infected and your personal information is at risk

Spyware quickly begins its task of stealing your information (including credit card numbers, usernames and passwords), directing your browser to suspect sites, changing or deleting your files, pummeling you with pop-ups and slowing your PC to a crawl.

Internet browsing safety:

Internet safety can be deceiving. Seemingly reputable sites may contain spyware traps, or the sites themselves may be counterfeit — phishing sites posing as the real thing to lure you into their scams and debacles. The path away from Internet safety often begins innocently enough; however, certain sites are more prone to be a source of spyware, including:

• Adult sites
• File sharing sites
• Social networking sites

Follow these internet safety tips for avoiding spyware and fortify your computer security right away:

• Avoid questionable Web sites
• Only download software from sites you trust. Carefully evaluate free software and file-sharing applications before downloading them.
• Update your operating system regularly
• Increase your browser security settings
• Type in a trusted URL for a company's site into the address bar of your browser to bypass links in an email or instant message
• Make sure that you have the best security software [http://www.webroot.com] products installed on your PC:
• Use antivirus protection and a firewall
• Get antispyware software protection

Stay safe online:

An unprotected computer is like an open door for Web sites that threaten your Internet safety with spyware and computer viruses. Firewalls monitor Internet traffic in and out of your computer and hide your PC from online scammers looking for easy targets. Products like Webroot Internet Security Essentials and Webroot AntiVirus with Spy Sweeper make avoiding spyware easier by thwarting spyware and viruses before they can enter your PC, standing guard at every possible entrance of your computer and fending off threats that try to enter, even the most damaging and devious strains. If a spyware or virus threat is detected, questionable content is quarantined or deleted. While free antispyware and antivirus downloads are available, they just can't keep up with the continuous onslaught of new spyware strains. Previously undetected forms of spyware and viruses can often do the most damage, so it's critical to have up-to-the-minute, guaranteed protection.

© Kuyasa Mahbub

20 Tips To Use Google Search Efficiently

                  20 Tips To Use Google Search Efficiently 

 

Millions of people use Google search every day for a variety of reasons. Students use it for school, business people use it for research, and millions more use it for entertainment. Did you know that you may not be using Google search to its full potential? Here are 20 tips and tricks to maximize your search efficiency.

1. Use the tabs

The first tip is to use the tabs in Google search. On the top of every search are a number of tabs. Usually you’ll see Web, Image, News, and More. Using these tabs, you can help define what kind of search you need to do. If you need images, use the Image tab. If you are looking for a recent news article, use the News tab. It’s rudimentary and most people use the tabs already. If you are not, then it’s highly recommended to get associated with them. They can cut search times dramatically if utilized properly.

2. Use quotes

When searching for something specific, try using quotes to minimize the guesswork for Google search. When you put your search parameters in quotes, it tells the search engine to search for the whole phrase. For instance, if you search for Puppy Dog Sweaters, the engine will search for content that contains those three words in any order. However, if you search “Puppy Dog Sweaters”, it will search for that phrase exactly as you typed it. This can help locate specific information that may be buried under other content if not sorted out correctly.

3. Use a hyphen to exclude words

Sometimes you may find yourself searching for a word with an ambiguous meaning. An example is Mustang. When you Google search for Mustang, you may get results for both the car made by Ford or the horse. If you want to cut one out, use the hyphen to tell the engine to ignore content with one of the other. See the example below.

• Mustang -cars

This tells the search engine to search for mustangs but to remove any results that have the word “car” in it. It can be wildly helpful when finding information about something without getting information about something else.

4. Use a colon to search specific sites

There may be an instance where you need to Google search for articles or content on a certain website. The syntax is very simple and we’ll show you below.

• Sidney Crosby site:nhl.com

This will search for all content about famous hockey player Sidney Crosby, but only on NHL.com. All other search results will be removed. If you need to find specific content on a particular site, this is the shortcut you can use.

5. Find a page that links to another page

This Google search tip is a little obscure. Instead of searching for a specific page, you’re searching for a page that links to a specific page. Think about it this way. If you want to see who cited a New York Times article on their site, you would use this trick to find all the sites that link to it. The syntax is below.

• link:nytimes.com

That will return all pages that link to the New York Times official website. The URL on the right side can be practically anything. Be aware, though, that the more specific it is, the fewer results you’ll get. We know not a lot of people will likely use this Google search trick, but it could be very useful for some.

6. Use the asterisk wildcard

The asterisk wildcard is one of the most useful ones on the list. Here’s how it works. When you use an asterisk in a search term on Google search, it will leave a placeholder that may be automatically filled by the search engine later. This is a brilliant way to find song lyrics if you don’t know all the words. Let’s look at the syntax.

• “Come * right now * me”

To you or me, that may look like nonsense. However, Google search will search for that phrase knowing that the asterisks can be any word. More often than not, you’ll find they are lyrics to The Beatles song “Come Together” and that’s what the search will tell you.

7. Find sites that are similar to other sites

This is a unique one that could be used by practically everyone if they knew it existed. Let’s say you have a favorite website. It can be anything. However, that website is getting a little bit boring and you want to find other websites like it. You would use this trick. Below is the syntax.

• related:amazon.com

If you search that above, you won’t find a link to Amazon. Instead, you’ll find links to online stores like Amazon. Sites like Barnes & Noble, Best Buy, and others that sell physical items online. It’s a powerful Google search tool that can help you find new sites to browse.

8. Use Google search to do math

As a college student, I can attest that I use this one rather frequently. Google search can actually do math for you. This is a rather complex one to describe because it can be used in so many ways. You can ask it basic questions or some more difficult ones. It is important to note that it won’t solve all math problems, but it will solve a good number of them. Here are a couple of examples of the syntax.

• 8 * 5 + 5
• Planck’s Consant

If you search the first one, it’ll return 45. It will also show a calculator that you can use to find answers to more questions. This is handy if you need to do some quick math but don’t want to do it in your head. If you search the second term, it will return the number value of Planck’s Constant. So it can do math, but it can also help you solve math problems by showing values for known mathematical terms.

9. Search for multiple words at once

Google search is flexible. It knows you may not find what you want by searching only a single word or phrase. Thus, it lets you search for multiples. By using this trick, you can search for one word or phrase along with a second word or phrase. This can help narrow down your search to help you find exactly what you’re looking for. Here is the syntax.

• “Best ways to prepare for a job interview” OR “How to prepare for a job interview”

By searching that, you will search both phrases. Remember the quotes tip above? It’s being used here as well. In this instance, these two exact phrases will be searched. It can be done by word too, like the example below.

• chocolate OR white chocolate

This will search for pages that have either chocolate or white chocolate!

10. Search a range of numbers

Searching for a range of numbers is another tip we don’t anticipate a lot of people using. The people that do use it, though, will probably use it quite a bit. People interested in money or statistics will find this tip particularly useful. Essentially, you use two dots and a number to let Google search know you’re looking for a specific range of numbers. Like the syntax below.

• What teams have won the Stanley Cup ..2004
• 41..43

In the first instance, the search will toss back the team that won the Stanley Cup in 2004. The two dots with only one number will tell the search that you don’t need anything before or after 2004. This can help narrow down searches to a specific number to improve search results. In the second, Google will search for the numbers 41, 42, and 43. It is obscure, but wildly useful if you happen to need to search for numbers like this.

11. Keep it simple

Now we’re getting into the general tips. Google search knows how to search for a lot of things. What this means is you don’t need to be too specific. If you need a pizza place nearby, use this to search.

• Pizza places nearby

Google search will grab your location and deliver a variety of results about pizza places that are near you.

12. Gradually add search terms

There will come a time when Google search doesn’t shovel out the results you expect. In this instance, keeping it simple may not be the best option. As Google itself suggests, the best method is to start with something simple then gradually get more complicated. See the example below.

• First try: job interviews
• Second try: prepare for job interviews
• Third try: how to prepare for a job interview

This will gradually refine the search to bring you fewer, more targeted terms. The reason you don’t go straight from the first try to the third try is because you may miss what you’re looking for by skipping the second step. Millions of websites phrase the same information in a number of different ways; using this technique lets you search as many of them as possible to find the best info.

13. Use words that websites would use

This is a very important one. When people use Google search to hunt the web, they generally search for things using the same language that they would use for speaking. Unfortunately, websites don’t say things the way people do; instead, they try to use language that sounds professional. Let’s look at some examples.

• “I have a flat tire” could be replaced by “repair a flat tire.”
• “My head hurts” could be replaced by “headache relief.”

The list goes on and on. When searching, try to use terminology you would find on a professional website. This will help you get more reliable results.

14. Use important words only

The way Google search works is to take what you search for and match it with keywords in online content. When you search for too many words, it may limit your results. That means it may actually take you longer to find what you’re looking for. Thus, it is apropos to use only the important words when searching for something. Let’s see an example.

• Don’t use: Where can I find a Chinese restaurant that delivers.
• Instead try: Chinese restaurants nearby.
• Or: Chinese restaurants near me.

Doing this can help Google find what you need without all the clutter. So remember, keep it simple and use important words only.

15. Google search has shortcuts

A number of commands can be entered to give you instantaneous results. Like the math example above, Google can immediately give you the information you need that is displayed right at the top of the search results. This can save time and effort so you don’t have to click a bunch of bothersome links. Here are a few examples of some commands you can enter into Google.

• Weather *zip code* – This will show you the weather in the given zip code. You can also use town and city names instead of area codes, but it may not be as accurate if there are multiple area codes in the city.
• What is *celebrity name* Bacon Number – This is a fun little one that will tell you how many connections any given celebrity has to famed actor Kevin Bacon. The popular joke, Six Degrees of Kevin Bacon, is that no actor is more than 6 connections away from Kevin Bacon. Mark Zuckerberg has a Bacon Number of 3.
• The math example posted above is another one.
• What is the definition of *word* or Define: *word* – This will display the definition of a word.
• Time *place* – This will display the time in whatever place you type in.
• You can check any stock by typing its ticker name into Google. If you search for GOOG, it will check the stock prices for Google.

These quick commands can take a web search that is usually multiple clicks and condense it into a single search. This is very helpful for information you need repeatedly.

16. Spelling doesn’t necessarily matter

Google search has gotten a lot smarter over the years. These days, you don’t even need to spell words correctly. As long as it’s pretty close, Google can usually figure out what it means. Here are some examples.

• If you search “Nver Gna Gve Yo Up” Google will automatically assume you mean to search for “Never Gonna Give You Up.” If by chance your misspelling was intentional, Google gives you the option to search for the misspelled term instead.

This trick is great if you happen to forget how to spell something or are not altogether sure how something is spelled. It can also be helpful when searching for obscure words. This applies to capitalization and grammar as well.

17. Use descriptive words

Pretty much everything can be described in multiple ways. Take our namesake, the “life hack.” The terminology “hack” refers to a computer programmer breaking security on a network or system. However, when used in conjunction with the word “life”, it alters the meaning to tips and tricks people can use to improve their lives. If you have trouble finding what you’re searching for, keep in mind that people may search or define what you need in a different way than you do.

• You may search “How to install drivers in Ubunut?”
• When you really mean “Troubleshoot driver problems Ubuntu.”

There really isn’t a good specific example for this one. If you search for something and you can’t find an answer, try asking the same question using different words and see if that helps the results.

18. Find a specific file

An often forgotten feature of Google search is the ability to search for a specific file or file type. This can be infinitely useful if you need a specific PDF or PowerPoint file that you previously viewed or need to use for another project. The syntax is quite simple.

• *Search term here* filetype:pdf

In the above example, you simply replace the search term with whatever you’re searching for. Then use the filetype command and enter the extension of any file type you can think of. This can mostly be useful for scholarly purposes, but business presentations and other assorted presentations can benefit from this kind of search as well.

19. Money and unit conversions

Google search can quickly and accurately convert both measurement units and currency value. There are a variety of uses for this, like checking to see the conversion rate between two currencies. If you happen to be a math student, you can use it to convert from feet to meters or from ounces to liters. Here’s how to do it.

• miles to km – This will convert miles to kilometers. You can put numbers in front to convert a certain number. Like “10 miles to km” will show you how many kilometers are in 10 miles.
• USD to British Pound Sterling – This will convert a US dollar to British pounds. Like the measurements above, you can add numbers to find exact conversions for a certain amount of money.

It’s true that this tip is geared toward math students and international business people. However, you’d be surprised how often these tips are used by regular people.

20. Track your packages

Our last trick is to use Google search to find out where your packages are. You can enter any UPS, USPS, or Fedex tracking number directly into the Google search bar, and it’ll show you the tracking information about your package. This is much easier than going to the specific sites, waiting for them to load, then searching for your packages there. No examples are really needed for this one. Just type your tracking number in and see where your package is.

Google Search wrap-up

Google search is a very powerful search tool. Using the tips outlined above, you can find anything and everything you could ever need on the World Wide Web. Whether it’s avoiding Wikipedia for a school essay project, finding the latest stock prices, or even finding song lyrics, there is a way to make Google search work for you.

© Kuyasa Mahbub