Forest Global Training Partners

Cyber Risks · Krebs on Security

Blowing the Whistle on Bad Attribution

Summary: The New York Times ran a story on Ukrainian programmer "Profexer" whose P.A.S. Web shell tool was cited as part of the arsenal used in the DNC hack, but Crowdstrike - called in to examine the DNC servers - said the Web shell was not on its list of malware found in the breach. The Times cited the December 2016 GRIZZLYSTEPPE report, which published technical indicators from multiple Russian threat groups but did not say which indicators appeared in the DNC hack; the Times later rewrote the paragraph after Dragos founder Robert M. Lee challenged the conclusions.

Bottom line: Indicators of compromise tell you a network may be compromised, not who did it - as Matt Tait of UT Austin's Strauss Center put it, there is "absolutely no tie" between the DNC hack and the P.A.S. Web shell, and the same GRIZZLYSTEPPE signatures had already forced The Washington Post to walk back a story about a Vermont utility.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related