Advice Request A new forensic school of thought

[dvlpr]

I wanted to hear some thoughts from people in the cybersecurity world related to the forensic side of hacking.

Up for discussion is finding the reason behind a hack... Ultimately, the mainstream public will always assume malicious intent behind hacks but isn't their room to say that attacks are nothing more than a proof of concept regarding new techniques, technology, etc.? Give it that I do not want to over-credit criminals, but how do we determine the root cause of an attack? Do we just wait it out and see the aftermath? If so, is there a place where we collectively track this pipeline?

Specifically, I want to talk about WannaCry as it has been some time since its surface that we can now truly analyze it. Yes, it was a ransomware that extorted people anywhere from $200-600 and knocked out organizations, but it was the testing of a new exploit at the time - which was EternalBlue. Was there more to the story, or would you think, there is more to the story behind that attack? I believe that there has been no damage outside of money extortion which would leave me to believe that money wasn't the main focus.

The basis of all this is in relation to a case study I have to write over the summer for a cybersecurity class. I decided to write my report on a more psychological approach to hacking, than a malicious approach. I like to believe that aside from criminal activity there is a young scientist who is testing out his new hypothesis.

 

[Yellowing]

I believe that there has been no damage outside of money extortion which would leave me to believe that money wasn't the main focus.

That is not a valid syllogism, I think. (Also people who didn't pay had non-monetary-damage done to them.)

I like to believe that aside from criminal activity there is a young scientist who is testing out his new hypothesis.

You don't write code that resolves around an exploit you discovered when you don't know if it works, imo. It sounds like a huge waste of time. Something is an exploit if it works. There's no reason to test if it does work on millions of computers running the same software as you. You only have to test if you actually have the same/newest software and then you know it will. :X3: (You can also test various security software alongside)

I think you are trying to glorify criminals. I mean, just read that first sentence again that I quoted. And calling them a scientist if they are criminal hackers is a stretch.


PS: I'm not an expert, I don't code malware, but I'm pretty logical, I think.

 

[dvlpr]

That is not a valid syllogism, I think. (Also people who didn't pay had non-monetary-damage done to them.)
You don't write code that resolves around an exploit you discovered when you don't know if it works, imo. It sounds like a huge waste of time. Something is an exploit if it works. There's no reason to test if it does work on millions of computers running the same software as you. You only have to test if you actually have the same/newest software and then you know it will. :X3: (You can also test various security software alongside)

I think you are trying to glorify criminals. I mean, just read that first sentence again that I quoted. And calling them a scientist if they are criminal hackers is a stretch.


PS: I'm not an expert, I don't code malware, but I'm pretty logical, I think.

Give it that I do not want to over-credit criminals...

:emoji_innocent:

 

[illumination]

I wanted to hear some thoughts from people in the cybersecurity world related to the forensic side of hacking.

Up for discussion is finding the reason behind a hack... Ultimately, the mainstream public will always assume malicious intent behind hacks but isn't their room to say that attacks are nothing more than a proof of concept regarding new techniques, technology, etc.? Give it that I do not want to over-credit criminals, but how do we determine the root cause of an attack? Do we just wait it out and see the aftermath? If so, is there a place where we collectively track this pipeline?

Just so you are aware, this is a home/consumer security advising forum.. Home users just are not targeted like corporations/businesses ect, and not something many in this forum would be experienced with.