Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Technical report on DNC hack [pdf]

us-cert.gov

Post reply on HN
Print view View original

21–30 of 502 posts

Re: Technical report on DNC hack [pdf]

#21

Post by BoringCode »

Dolores12 wrote: post #11
JohnTHaller wrote: post #7

Earlier quoted context omitted.

An intelligence agency won't declassify how they determined who it was. That would compromise their ability to use the same method (informant, vulnerability, etc) in the future. They are standard techniques. It doesn't say they are unique. Just that this hacker relies on these specific standard techniques as opposed to other ones.

>An intelligence agency won't declassify how they determined who it was. Yeah, just like a weapon of mass destruction in Iraq. We can't tell how we got this information, but we know for sure. Then few years later it turns out there is no WMD found. Ooops. Sorry. Give me a reason to trust them again?

You clearly don't understand the intelligence process if this is your critique.

First, the people making the DNC hack report are not the same as the analysts who worked on Iraq. The IC is not a monolith.

Second, the Bush White House saw the intelligence they wanted to see.

Third, burning sources and methods is a very real concern in intelligence gathering. That reality can't be ignored no matter how much you want information to be free and open.

You don't have to trust the IC. In fact you probably shouldn't take what they say at face value. But there are very good reasons for why they operate the way they do.

Re: Technical report on DNC hack [pdf]

#22

Post by 1_2__3 »

cekvenich3 wrote: post #3

'The U.S. Government assesses that information was leaked to the press and publicly disclosed.' Who in US Government? What information was leaked?

Are you under the impression that different parts of the US government typically "speak" with difference voices? This was an official government publication, that means "Who" is "The US Government", period.

Re: Technical report on DNC hack [pdf]

#23

Post by dominotw »

AlexCoventry wrote: post #12
Dolores12 wrote: post #8

This report is a joke. I didn't find any reasoning about attribution. Here is the only valuable part: " rule PAS_TOOL_PHP_WEB_KIT { meta: description = "PAS TOOL PHP WEB KIT FOUND" strings: $php = " 20KB and filesize < 22KB) and #cookie == 2 and #isset == 3 and all of them } "

That and the supporting indicator files[0]. [0] https://www.us-cert.gov/security-publications/GRIZZLY-STEPPE... This would probably be a better link for the OP than the PDF it links.

How do bunch of ip addresses form china/Sweden/germany/canada make this attack attributable to russians .

Re: Technical report on DNC hack [pdf]

#24

Post by okreallywtf »

Dolores12 wrote: post #11
JohnTHaller wrote: post #7

Earlier quoted context omitted.

An intelligence agency won't declassify how they determined who it was. That would compromise their ability to use the same method (informant, vulnerability, etc) in the future. They are standard techniques. It doesn't say they are unique. Just that this hacker relies on these specific standard techniques as opposed to other ones.

>An intelligence agency won't declassify how they determined who it was. Yeah, just like a weapon of mass destruction in Iraq. We can't tell how we got this information, but we know for sure. Then few years later it turns out there is no WMD found. Ooops. Sorry. Give me a reason to trust them again?

Why trust them in the first place, look at the evidence and if you disagree with a conclusion, be able to say why.

This is the whole problem we're dealing with right now - people just decide they do or do not trust something. Don't agree with a fact check? Just call it bogus and move on, even though it might be a 50 point case they make why bother finding a flaw in their reasoning and using that to refute their conclusion when you can just be a cynic and shrug it off. Don't agree with climate change? Just pick the 1 totally debunked study that supports your case and ignore the 1000 that don't that haven't been debunked.

So I ask, in the analyses that have come out (not just this one), what do you disagree with? As far back as June crowdstrike released a report [1], I assume you went through it in detail and can point to flaws in its reasoning as well?

[1] https://www.crowdstrike.com/blog/bears-midst-intrusion-democ...

Re: Technical report on DNC hack [pdf]

#26

Post by sschueller »

The Sony hack had more evidence than this...

Someone explain to me why this is such an issue?

There have been many proven hacks from many states that are far worse (the Chinese Fighter plane that looks almost identical to the F35 come to mind) than exposing the DNC's dirty laundry. No one is denying that the emails are real. This seems like some sort of distraction.

Re: Technical report on DNC hack [pdf]

#27

Post by ryanlol »

alexandercrohde wrote: post #17
ryanlol wrote: post #9

Earlier quoted context omitted.

I guess you missed https://www.us-cert.gov/sites/default/files/publications/JAR...

What exactly is this? A list of IP addresses and countries? It's unclear which attributes from this list associate the hack with Russia, and presumably it's more than IP address seeing as how trivial proxying is.

>What exactly is this? A list of IP addresses and countries?

It's just a list of IOCs. IPs, file hashes, urls, a few traffic samples.

>presumably it's more than IP address seeing as how trivial proxying is.

https://news.ycombinator.com/item?id=13280068

Re: Technical report on DNC hack [pdf]

#28

Post by mundo »

Dolores12 wrote: post #8

This report is a joke. I didn't find any reasoning about attribution. Here is the only valuable part: " rule PAS_TOOL_PHP_WEB_KIT { meta: description = "PAS TOOL PHP WEB KIT FOUND" strings: $php = " 20KB and filesize < 22KB) and #cookie == 2 and #isset == 3 and all of them } "

Is your prior for "The FBI would publicly make an accusation like this without any conclusive technical evidence" really higher than your prior for "The FBI would not include all of the evidence they based the accusation on in the public report"?

Re: Technical report on DNC hack [pdf]

#29

Post by sigmar »

snowwrestler wrote: post #14

Folks, the point of this report is not to justify the punitive actions taken today. It is to provide information that companies can use to protect themselves against similar attacks in the future. So if you judge it by whether it "makes the case" against Russia, it will be lacking. We don't need 100 comments pointing that out.

It seems notable that many of these comments are jumping on this for not providing proof that it was Russia, when that was not the intention of the report.

The first page states-

>This JAR provides technical indicators related to many of these operations, recommended mitigations, suggested actions to take in response to the indicators provided, and information on how to report such incidents to the U.S. Government.

Re: Technical report on DNC hack [pdf]

#30

Post by grandalf »

BoringCode wrote: post #21
Dolores12 wrote: post #11

Earlier quoted context omitted.

>An intelligence agency won't declassify how they determined who it was. Yeah, just like a weapon of mass destruction in Iraq. We can't tell how we got this information, but we know for sure. Then few years later it turns out there is no WMD found. Ooops. Sorry. Give me a reason to trust them again?

You clearly don't understand the intelligence process if this is your critique. First, the people making the DNC hack report are not the same as the analysts who worked on Iraq. The IC is not a monolith. Second, the Bush White House saw the intelligence they wanted to see. Third, burning sources and methods is a very real concern in intelligence gathering. That reality can't be ignored no matter how much you want inf…

> But there are very good reasons for why they operate the way they do.

Indeed there are, and no reasonable person would say that having intelligence agencies is a bad thing.

The issue in this case is that the US intelligence agencies have been leveraged politically to help convince the public to support various policies, when in fact there has not been credible evidence.

A lot of people put their lives on the line to end the cold war, and now we have a faction of US politicians who are trying very hard to galvanize the same historic antagonism. We should be judicious and skeptical, and not let them use the common technique of fake urgency to drive a big decision without adequate forethought.

Post reply on HN