Richard Bejtlich writes on network security monitoring, incident response, security strategy, and book reviews.
Commenters recommend it as a good security blog and call the author one of the most knowledgeable incident response experts.
Read the Kapersky analysis, it starts to answer your questions regarding the reuse of Shamoon by NK.
Doesn't matter though, my point was, this was not the media regurgitating a US gov opinion as the comment I replied to claimed.
I agree that the publically available evidence is never 100%, but the malware samples and c&c infrastructure point to NK. If you have evidence that someone else did it, that would be interesting. As it stands, NK has a very strong motive for the timing of this move, so that plus just the public info, and the FBI claim based on nonpublic info is enough to convince me they are responsible.
However, the spectrum of "responsibility" is quite broad: http://taosecurity.blogspot.com/2014/12/what-does-responsibility-mean-for.html?m=1
The Cuckoo's Egg is a fantastic book and definitely worth a read for regardless of forensic interest. It's very well written and a great story.
The slide author is one of the most knowledgeable experts on incident response today, his blog[1] is definitely worth a read now and again.
If you want to see what large scale operations look like today, the Ghostnet report[2] makes for compelling reading.
[1] - http://taosecurity.blogspot.com/
[2] - http://www.scribd.com/doc/13731776/Tracking-GhostNet-Investigating-a-Cyber-Espionage-Network
Yes. And they're not shy about it either.
"The way in which the J-20 was unveiled also reflects China’s use and control of information technology to support national interests. The test airfield is located in the city of Chengdu and is not secure, with many public viewing points. Photography is technically forbidden, but reports suggest that patrols have been permitting the use of cell phone cameras."
http://taosecurity.blogspot.com/2011/01/more-on-chinese-stealth-fighter-and-apt.html
Quite a few:
http://slashdot.org
http://serverfault.com
http://securityfocus.com
http://sucuri.net
http://matasano.com/log (well, while it was up and I hope it comes back)..
http://taosecurity.blogspot.com
http://linux.com
Kind of a funny choice of names, "dark visitor" is a common English translation of 黑客, the title of a book[1] about hacking in China, for example.
1: https://taosecurity.blogspot.com/2008/02/review-of-dark-visitor.html
This is the primary reason I use ad blocking. Privacy is another (e.g., http://taosecurity.blogspot.com/2013/10/mozilla-lightbeam-add-on-shows-risk-of.html). I don't mind ads so much as I mind surveillance.