Show this thread
A highly significant move by NSA & GCHQ >>> “By gaining access to the Iranian infrastructure, Turla [likely FSB] was able to use APT34's ‘command and control’ systems to deploy its own malicious code, GCHQ and the NSA said in a public advisory”https://mobile.reuters.com/article/amp/idUSKBN1X00AK?__twitter_impression=true …
-
-
-
Okay the internet spoiled everything, including old-school spy drama—but GCHQ catching Russian spies camouflaging as Iranian intel & using their gear is basically the digital equivalent of busting a crafty double agent in a third country, embarrassing *two* adversaries in one go.
Show this thread -
Both GCHQ & NSA are using the phrase "weight of evidence" here, without providing specifics on how they attributed (hint: it was "very difficult"). Another case of high-profile attribution (see NotPetya) with insufficient detail—a very problematic trend https://media.defense.gov/2019/Oct/18/2002197242/-1/-1/0/NSA_CSA_TURLA_20191021%20VER%203%20-%20COPY.PDF …pic.twitter.com/4cjZyS3GkX
Show this thread -
Noteworthy new context on the NSA’s rationale to expose false flags. Some actors appear to be improving their counter-attribution tradecraft. https://mobile.reuters.com/article/amp/idUSKBN1X00AK?__twitter_impression=true …pic.twitter.com/cdH582sHtt
Show this thread -
After an insightful private exchange I'd like to restate what I stated above as a question: is GCHQ/NSA attribution without significant detail to support the attribution claim really that problematic? — Perhaps that is no longer the case. A lot has changed in the past five years.
Show this thread -
Counter-arguments: —own intelligence consumers/allies get it: disclosing sources/TTPs is a hard tradeoff; —adversaries get it: you know you got caught, no matter the public forensics; —scholars get it: high-confidence attribution has been done many times, even with "just" SIGINT.
Show this thread End of conversation
New conversation -
-
- This Tweet is unavailable.
-
FT: “[Turla] could benefit from the operations of Oilrig. They could collect some of their operational output” — don’t the US even call this fourth party intelligence?
End of conversation
-
-
- Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
Wasn’t Trump’s re-election campaign hacked by Iran ?https://www.google.com/amp/s/mobile.reuters.com/article/amp/idUSKBN1WJ1ZM …
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.