<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><div>I agree entirely, Allen. The market incentives are huge for a company to discover and report an attack attributed to a nation state, the bar for evidence is negligible, and there's really no way to disprove a claim. Even when someone involved in the attack pops up and says I did it, here's proof, and you're an idiot, that becomes a "disinformation operation" and again, there's no way to disprove that.</div><div><br></div><div>Jeff</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Thu, 16 Jun 2016 21:28:42 -0400<br>
From: Allen <<a href="mailto:multimode1876@gmail.com">multimode1876@gmail.com</a>><br>
To: Adam Shostack <<a href="mailto:adam@shostack.org">adam@shostack.org</a>><br>
Cc: "<a href="mailto:dailydave@lists.immunityinc.com">dailydave@lists.immunityinc.com</a>"<br>
<<a href="mailto:dailydave@lists.immunityinc.com">dailydave@lists.immunityinc.com</a>><br>
Subject: Re: [Dailydave] "When you shoot at the king, you best not<br>
miss."<br>
Message-ID:<br>
<<a href="mailto:CADwYKiY5RYJ5s61QXLf%2BHc7ZrgD1LCNbCcXt5qUsN8hv6c8kRA@mail.gmail.com">CADwYKiY5RYJ5s61QXLf+Hc7ZrgD1LCNbCcXt5qUsN8hv6c8kRA@mail.gmail.com</a>><br>
Content-Type: text/plain; charset="utf-8"<br>
<br>
| It's entirely possible that this is a disinformation campaign, or that<br>
attribution is hard, and Crowdstrike made a mistake<br>
|<br>
<br>
I'm inclined to believe that while attribution may be hard there are<br>
entirely too many market incentives to brand any given attack with one of<br>
the nation state animal totems.<br>
<br>
The fact that attribution is frequently derived from prior intelligence<br>
blended with the fact that all of the source data is confidential only<br>
lends itself to confirmation bias. A small attribution mistake by one<br>
vendor can really snowball.<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="https://lists.immunityinc.com/pipermail/dailydave/attachments/20160616/55ad132a/attachment-0001.html" rel="noreferrer" target="_blank">https://lists.immunityinc.com/pipermail/dailydave/attachments/20160616/55ad132a/attachment-0001.html</a>><br>
<br>
------------------------------<br>
<br>
_______________________________________________<br>
Dailydave mailing list<br>
<a href="mailto:Dailydave@lists.immunityinc.com">Dailydave@lists.immunityinc.com</a><br>
<a href="https://lists.immunityinc.com/mailman/listinfo/dailydave" rel="noreferrer" target="_blank">https://lists.immunityinc.com/mailman/listinfo/dailydave</a><br>
<br>
<br>
End of Dailydave Digest, Vol 55, Issue 12<br>
*****************************************<br>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div style="font-family:arial;font-size:small">Jeffrey Carr (<a href="http://jeffreycarr.com" target="_blank">jeffreycarr.com</a>)</div><div style="font-family:arial;font-size:small">CEO, Taia Global, Inc. (<a href="http://taiaglobal.com/" style="color:rgb(17,85,204)" target="_blank">taiaglobal.com</a>)</div><div style="font-family:arial;font-size:small">Founder, Suits and Spooks (<a href="http://suitsandspooks.com/" style="color:rgb(17,85,204)" target="_blank">suitsandspooks.com</a>)</div><div style="font-family:arial;font-size:small">Author, "Inside Cyber Warfare: Mapping the Cyber Underworld" (O'Reilly Media, 2009, 2011)</div><br><br>THE CONTENTS OF THIS EMAIL ARE FOR THE RECIPIENT'S EYES ONLY AND MAY NOT BE DUPLICATED OR DISTRIBUTED WITHOUT PRIOR PERMISSION.</div></div></div></div>
</div></div>