Doxing

Abstract

The most impressive attribution results are those that identify specific individuals, ideally with their real names and even photos. Objectively speaking, the concrete individuals behind the espionage attacks are usually less relevant than the organization they work for. Nevertheless, at least on an intuitive level, the accountability of the actors becomes much more tangible if real people like “UglyGorilla" are identified as the hackers behind an APT campaign and not just a faceless organization like the Third Department of the Chinese People’s Liberation Army. An important technique for identifying individuals is doxing, i.e. the research of personal data in public sources. This chapter explains how analysts use doxing methods to uncover the identity of APT group members and which factors determine the validity of the results.