Cyber Attribution – A fundamental concept in cybersecurity and digital forensics is the fact that it is sometimes extremely difficult after a cyberattack to definitively name a perpetrator. Hackers have a lot of technical tools at their disposal to cover their tracks. And even when analysts figure out which computer a hacker used, going from there to who used it is very difficult. This is known as the attribution problem.
The [Cyber] Attribution problem is the idea that identifying the source of a cyber attack or cyber crime is often complicated and difficult because there is no physical act to observe and attackers can use digital tools to extensively cover their tracks.
—WIRED, “Hacker Lexicon: What Is the Attribution Problem?”
There is no universally agreed upon definition of the term Attribution in the field of information assurance (IA).
This paper defines “[Cyber] Attribution” as “determining the identity or location of an attacker or an attacker’s intermediary.” A resulting identity may be a person’s name, an account, an alias, or similar information associated with a person. A location may include physical (geographic) location, or a virtual location such as an IP address or Ethernet address.
This definition includes intermediaries, and not just the attacker. An ideal attribution process would always identify the original attacker’s identity and location. Unfortunately, clever attackers can often make themselves difficult to directly attribute (and/or providing misleading information to hide the true attacker). However, even if only an intermediary is identified, that information can still be useful. For example, blocking an attack may be more effective if an intermediary is known.
An attribution process may also provide additional information, such as the path used to perform the attack and the timing of the attack, but these cannot always be determined. In particular, it is worth noting that it can be difficult to determine by technical means the motivation for an attack.
A related term is traceback, which will be defined in this paper as “any attribution technique that begins with the defending computer and recursively steps backwards in the attack path toward the attacker.” Thus, traceback techniques are a subset of attribution techniques. The term “traceback” is common in the public literature on this topic.
—Institute for Defense Analysis, “Techniques for Cyber Attack Attribution“
The White House was quick to publicly blame Russia for a cyberattack against Ukraine, the latest sign that cyber attribution is a crucial tool in the American arsenal.
The US is unmasking Russian hackers faster than ever Read More