Under false flag:using technical artifacts for cyber attack attribution  

作　　者：Florian Skopik Timea Pahi 

机构地区：[1]Center for Digital Safety and Security,AIT Austrian Institute of Technology,Austria,Giefinggasse 4,Vienna,Austria

出　　处：《Cybersecurity》2020年第1期103-122,共20页网络空间安全科学与技术（英文）

基　　金：This work was partly funded by the Austrian security-research programme FORTE and by the Austrian Ministry for Transport,Innovation and Technology(BMvit)through the FFG project CADSP(873425).

摘　　要：The attribution of cyber attacks is often neglected.The consensus still is that little can be done to prosecute the perpetrators–and unfortunately,this might be right in many cases.What is however only of limited interest for the private industry is in the center of interest for nation states.Investigating if an attack was carried out in the name of a nation state is a crucial task for secret services.Many methods,tools and processes exist for network-and computer forensics that allow the collection of traces and evidences.They are the basis to associate adversarial actions to threat actors.However,a serious problem which has not got the appropriate attention from research yet,are false flag campaigns,cyber attacks which apply covert tactics to deceive or misguide attribution attempts–either to hide traces or to blame others.In this paper we provide an overview of prominent attack techniques along the cyber kill chain.We investigate traces left by attack techniques and which questions in course of the attribution process are answered by investigating these traces.Eventually,we assess how easily traces can be spoofed and rate their relevancy with respect to identifying false flag campaigns.

关 键 词：Actor attribution Advanced persistent threats Technical indicators False flag campaigns 

分 类 号：TP393.081[自动化与计算机技术—计算机应用技术]