I'm actually curious, if there is anyone here that's actually an expert on this stuff can you explain
(1) How do you tell a state actor from just hackers looking to make money?
(2) Is this a solvable problem?
I can't imagine most state agencies, hospitals, doctors offices, small businesses, being able to afford good experienced IT staff. I can't imagine outsourcing it to nearly any company and trusting that company. Exceptions might be Google or Apple but neither company provides more than email/docs/spreadsheets. They don't supply bookkeeping, appointments, medical record management, etc... and AFAICT, all the suppliers for those kinds of services have terrible security practices. And, even if Apple and Google could do a good job there's still social engineering.
(1) You really can't. The Mirai botnet was initially attributed to some state actor due to its massive DDoS attacks, but in the end it was just a bunch of teenagers.
I think this is important to keep in mind, media will attribute back to the ‘enemy of the day’ but the actual evidence is scant.
the recent Ministry of Defence, UK hack was blamed on China, but if you actually dig into it that’s just a hypothesis and it really could have been anyone. If this was happening straight after 9/11 we’d be blaming terrorists, etc.
These companies can work on building and then actually distributing more secure operating systems. This won't fix problems like social engineering, but it will prevent/harden a ton of other attack vectors.
If these don't make it to the mainstream, it is the responsibility of FAANG companies that at least the concepts/mechanisms contained in them do, in other systems. To provide the world with a secure computing substrate.
Assuming the source of the attribution is acting with pure intentions, it is usually a preponderance of (mostly circumstantial) evidence. Does the malware and MO look similar to past known attacks? Did they leave any localized strings in the binary file, if yes does that nation have an interest in hacking the target? Does the malware use a stack of 0-days and labour-intensive obfuscation techniques (indicating a large amount of resources)? Does the whole picture make sense when you put it all together?
The above is in an ideal world, in reality almost all attributions are political and based on almost nothing. Even if they were based on some other intelligence source, how could a random member of the public verify that?
On top of the difficulty of gathering evidence, there is an incentive alignment between the heads of hacked organizations and intelligence agencies. The hacked company will look better as the victim of a "cyberattack" or a "chinese cyberattack" then as the victim of "random.ransomware.0238023". The intelligence agency can get more funding and PR by proclaiming the same.
> 1) How do you tell a state actor from just hackers looking to make money?
Why do you think those governments are not just trying to make money? You should check how much crypto DPRK made from ransomware. Krebs and others wrote about it
(1) How do you tell a state actor from just hackers looking to make money?
(2) Is this a solvable problem?
I can't imagine most state agencies, hospitals, doctors offices, small businesses, being able to afford good experienced IT staff. I can't imagine outsourcing it to nearly any company and trusting that company. Exceptions might be Google or Apple but neither company provides more than email/docs/spreadsheets. They don't supply bookkeeping, appointments, medical record management, etc... and AFAICT, all the suppliers for those kinds of services have terrible security practices. And, even if Apple and Google could do a good job there's still social engineering.