APT Rosetta Stone or A Plea To The Industry For Shared Names

Last night one of my CTI sharing groups was discussing a report from FireEye regarding APT29 and domain fronting (https://www.fireeye.com/blog/threat-research/2017/03/apt29_domain_frontin.html) when we all realized we had no clue who APT29 is in our own internal systems. 

One member finally shared this mess:


Nobody can agree on names. Even to the untrained eye it's obvious that there's a communication issue present here. The most amazing thing is how simple it would be to fix all of this, but none of these vendors have because #branding #sorrynotsorry #aptlolwut. The excuse "but we'd have to rename everything" is silly, because if you want to present the image of being a quality threat intelligence organization, then you should have a quality intelligence management system where this should be no more difficult than updating a single entry in a database somewhere.

So please, CTI vendors, stop giving things ridiculous names. And CloudStrike, please stop using your regional prefixes? If you haven't already made a attribution mistake, then one day you surely will, and then you're going to be in trouble.

Comments

Post a Comment

Popular posts from this blog

Yara and Rich Headers are full of win

Rich Headers are awesome and you should read about them here: http://www.ntcore.com/files/richsign.htm I was looking at a sample recently and, being the good analyst I am, attempted to automate my DFIR processes using the tools I had handy. Step 1: Get the Rich Headers for the malicious binary. Let's use 9e6658fab423d9b3fabc3578ac5482bf4f21f6fb98949d8ef4f3cad349862b82, a known RAMNIT ransomware sample. $ laika.py 9e6658fab423d9b3fabc3578ac5482bf4f21f6fb98949d8ef4f3cad349862b82 | jq '.scan_result[].moduleMetadata | select(.META_PE) | .META_PE."Rich Header"' { "Checksum": 3183276661, "Hashes": { "SHA1": "dd0f0861bc67028b3cab0d6cdc55a29cc2822f64", "SHA256": "8fd544eee7389c64a29440555f5b968ae0632ed3b989a63402b6d43934a8973e", "MD5": "8451f317057b289c04b2c5b202c09715" }, "Rich Header Values": [ { "Count": 6, "Version": ...
Read more

[repost] Cyberespionage, and the Need for Norms

This is a quick one, but I wanted to call out a piece shared with me by a peer in the industry: http://harvardpolitics.com/covers/cyberespionage-need-norms/ A truly key point here: [C]onsider how almost every recent cybercrime is called a “cyberattack” by the media. North Korea’s hack into Sony Pictures, China’s theft of American personnel records, and Russia’s attack on Estonian online infrastructure were all dubbed "cyberattacks," despite their significant differences. The repeated use of this simplistic label has muddied dialogue surrounding this issue by obscuring the unique qualities of different cybercrimes—making it difficult to keep track of what actions warrant retaliation. This has been a pain-point of mine for a few years now, but I have yet to convince many others in my field that computer/network espionage (CNE) is explicitly NOT an attack. Also, I hate the prefix cyber. It has no meaning. For more info on this, see: http://willusingtheprefixcybermakem...
Read more

"It's Not All Black And White" or "Why You Should Switch From Blacklisting To Whitelisting"

I think the title says a lot here: if you want to defend your information systems, you should switch from blacklisting to whitelisting. But what does that mean? Most people hear "whitelisting" in terms of CND and think "application whitelisting". But there's so many more places to do it! You already hopefully do outbound whitelisting on your firewall. You aren't really  allowing any system to talk out on TCP/3389, right? You do have a DEFAULT:DENY or DENY ANY,ANY down at the bottom of your firewall rules, right? But have you considered whitelisting outbound web traffic at your proxy as well? Most people think of their web proxy reputation lists as block lists, and for good reason: most of them are incomplete. But did you ever consider that maybe that incompleteness as a defensive measure? If you block unknown websites at your web proxy, you're going to block a huge amount of malicious websites. You're probably thinking to yourself but what abou...
Read more