Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Google warned me that a state organized hacking group targeted me

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 43 posts

Re: Ask HN: Google warned me that a state organized hacking group targeted me

#21

Post by amingilani »

herbst wrote: post #9
amingilani wrote: post #7

Earlier quoted context omitted.

Absolutely use a password manager, and a strong passphrase for the master password [1] Why would you say not? I'm not trying to be rude or anything. Let's have a discussion, and if I can convince you to do use one, I'd have made one more person safer. [1] I made this for a dead simple way to make passphrases: https://amingilani.github.io/password-maker/

Not OP but open for a chance. Last time I checked the popular password managers saved the passwords in one way or another. Which personally simply sounds like a bad idea to begin with. Even if in theorie they are safe. Even the slight chance that a single failure could lead to all my passwords getting in the wrong hands at once just is to scary.

They do, but that's not such a bad idea. For an exhaustive read, I wrote this[1] a while back, but I'll try to make the point here too:

1. Are all your passwords unique?

2. If I discovered some of your passwords, will the rest of your passwords stay secure?

3. Were all your passwords created using at least 32 bits of entropy?

4. Are your passwords stored only in encrypted form?

5. Do you perfectly remember every single password you’ve used when signing up?

6. Do you turn up positive for a password leak at this website?

If you answer "no" to any of these questions, you'll benefit from a password manager.

About storing passwords, I use LastPass and they use client-side encryption[1], which means even they don't have the decryption key to read my passwords. So, you'll be fine as long as you have a secure passphrase and 2FA :)

https://lastpass.com/support.php?cmd=showfaq&id=6926

[1]: Please skip to "Strategy No. 1: Proper Password Management" @ https://www.toptal.com/remote/best-security-practices-for-re...

Re: Ask HN: Google warned me that a state organized hacking group targeted me

#22

Post by huntsman »

My team at Google is responsible for identifying the users we give these warnings to. Here's what I wrote last year to provide a bit more context: https://security.googleblog.com/2017/03/reassuring-our-users...

The most important point is that this indicates signs of targeting not compromise. Also,like all systems there are false positives especially for security researchers and the similar types but we hope it is a useful indicator to reassess your security posture.

Re: Ask HN: Google warned me that a state organized hacking group targeted me

#23

Post by pimlottc »

huntsman wrote: post #22

My team at Google is responsible for identifying the users we give these warnings to. Here's what I wrote last year to provide a bit more context: https://security.googleblog.com/2017/03/reassuring-our-users... The most important point is that this indicates signs of targeting not compromise. Also,like all systems there are false positives especially for security researchers and the similar types but we hope it is a…

Thanks for the extra context. One thing I didn’t see addressed that I’m curious about is how does Google distinguish a “government-backed” attack vs your normal everyday hackers? Is it a function of the specific methods used, the depth and breadth of resources deployed, source ip ranges, or what?

Re: Ask HN: Google warned me that a state organized hacking group targeted me

#24

Post by Bombthecat »

meganibla wrote: post #16
fwdpropaganda wrote: post #6

This is when you know you've "made it", when state intel is trying to get to you :-) Seriously now, even though you're not famous or a jounalist you might have some type of valuable access in your life? Or maybe it's just a false positive from google. Or maybe you weren't being especially targetted, and instead your e-mail ended up in some list of valuable e-mails (rightly or wrongly).

Yeah but they’re not going to let you know if the NSA or the CIA targets you. So the message can be read more like: a non-allied state actor has targeted your email and we are notifying you to show how good we are. Please note we will not reveal when you are targeted by an allied state intelligence. Privacy is relative, mostly an illusion. Thank you for your cooperation.

Jeah,my thought were along that line to.

It's not America. More likely is Russia,China,Japan, Germany or God knows...

Re: Ask HN: Google warned me that a state organized hacking group targeted me

#25

Post by Bombthecat »

fwdpropaganda wrote: post #6

This is when you know you've "made it", when state intel is trying to get to you :-) Seriously now, even though you're not famous or a jounalist you might have some type of valuable access in your life? Or maybe it's just a false positive from google. Or maybe you weren't being especially targetted, and instead your e-mail ended up in some list of valuable e-mails (rightly or wrongly).

Another user here noted that Google also tells you if you were just in a circle.

But they didn't tell me...

Re: Ask HN: Google warned me that a state organized hacking group targeted me

#27

Post by huntsman »

pimlottc wrote: post #23
huntsman wrote: post #22

My team at Google is responsible for identifying the users we give these warnings to. Here's what I wrote last year to provide a bit more context: https://security.googleblog.com/2017/03/reassuring-our-users... The most important point is that this indicates signs of targeting not compromise. Also,like all systems there are false positives especially for security researchers and the similar types but we hope it is a…

Thanks for the extra context. One thing I didn’t see addressed that I’m curious about is how does Google distinguish a “government-backed” attack vs your normal everyday hackers? Is it a function of the specific methods used, the depth and breadth of resources deployed, source ip ranges, or what?

It's a range of factors. Basically this warning means that what we detected ties in some way to wider activity that looks government backed. There's some border cases, but in practice the targeted campaigns of governments look very different in both technique, volume and targeting to say a widespread cybercrime phishing campaign. It's not a perfect science, but we believe its worth calling out separately the activity that does fall into this bucket.

Re: Ask HN: Google warned me that a state organized hacking group targeted me

#28

Post by docdeek »

supergirl wrote: post #15
_8j50 wrote: post #13

Earlier quoted context omitted.

Advanced Persistent Threat (APT aka Nation state) actors are tracked using known indicators of compromise. These indicators can include infrastructure identifiers such as domain names and ip addresses that maybe used in a phishing url or post-compromise for command-and-control or to download other malware. Other indicators can include malware sample hashes or actor-specific detection rules (Example: YARA,Snort or Net…

also why do people like to use the term nation state when it involves hacking. just to sound fancier? according to wiki nation state has a precise meaning and it’s not equivalent to the term country

I wrote my doctorate thesis in international relations theory and taught Intro to IR courses where the difference between country, state, nation, and nation state were covered in week one. You're right that there's a difference between country and nation state (and a difference between nation state and both nation and state, too) but in popular use - including politicians who should know better - the terms are interchangeable.

Re: Ask HN: Google warned me that a state organized hacking group targeted me

#29

Post by Bombthecat »

huntsman wrote: post #27
pimlottc wrote: post #23

Earlier quoted context omitted.

Thanks for the extra context. One thing I didn’t see addressed that I’m curious about is how does Google distinguish a “government-backed” attack vs your normal everyday hackers? Is it a function of the specific methods used, the depth and breadth of resources deployed, source ip ranges, or what?

It's a range of factors. Basically this warning means that what we detected ties in some way to wider activity that looks government backed. There's some border cases, but in practice the targeted campaigns of governments look very different in both technique, volume and targeting to say a widespread cybercrime phishing campaign. It's not a perfect science, but we believe its worth calling out separately the activity…

But Google would tell me if they were successful,right?

Also: should I tell my coworkers what happened?

Re: Ask HN: Google warned me that a state organized hacking group targeted me

#30

Post by huntsman »

Bombthecat wrote: post #29
huntsman wrote: post #27

Earlier quoted context omitted.

It's a range of factors. Basically this warning means that what we detected ties in some way to wider activity that looks government backed. There's some border cases, but in practice the targeted campaigns of governments look very different in both technique, volume and targeting to say a widespread cybercrime phishing campaign. It's not a perfect science, but we believe its worth calling out separately the activity…

But Google would tell me if they were successful,right? Also: should I tell my coworkers what happened?

If we detected your account was compromised Google would have given you a different notification at that time and forced you to change your password.
Post reply on HN