Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Technical report on DNC hack [pdf]

us-cert.gov

Post reply on HN
Print view View original

31–40 of 502 posts

Re: Technical report on DNC hack [pdf]

#31

Post by ryanlol »

dominotw wrote: post #23
AlexCoventry wrote: post #12

Earlier quoted context omitted.

That and the supporting indicator files[0]. [0] https://www.us-cert.gov/security-publications/GRIZZLY-STEPPE... This would probably be a better link for the OP than the PDF it links.

How do bunch of ip addresses form china/Sweden/germany/canada make this attack attributable to russians .

I guess the real question is, why should these IP addresses from those countries make this attack attributable to Russia?

Unless you can answer that, yours doesn't really make much sense.

Re: Technical report on DNC hack [pdf]

#32

Post by sigmar »

Dolores12 wrote: post #8

This report is a joke. I didn't find any reasoning about attribution. Here is the only valuable part: " rule PAS_TOOL_PHP_WEB_KIT { meta: description = "PAS TOOL PHP WEB KIT FOUND" strings: $php = " 20KB and filesize < 22KB) and #cookie == 2 and #isset == 3 and all of them } "

Did you read the first page? This report has nothing to do with detailing or justifying attribution

Re: Technical report on DNC hack [pdf]

#33

Post by supergeek133 »

sigmar wrote: post #29
snowwrestler wrote: post #14

Folks, the point of this report is not to justify the punitive actions taken today. It is to provide information that companies can use to protect themselves against similar attacks in the future. So if you judge it by whether it "makes the case" against Russia, it will be lacking. We don't need 100 comments pointing that out.

It seems notable that many of these comments are jumping on this for not providing proof that it was Russia, when that was not the intention of the report. The first page states- >This JAR provides technical indicators related to many of these operations, recommended mitigations, suggested actions to take in response to the indicators provided, and information on how to report such incidents to the U.S. Government.

The funny part about all of this to me, is that if most companies with data to lose aren't already taking these recommendations.. then they've already been cracked.

Most of this report is pretty simple social engineering tactics/table stakes.

Re: Technical report on DNC hack [pdf]

#34

Post by [deleted] »

sschueller wrote: post #26

The Sony hack had more evidence than this... Someone explain to me why this is such an issue? There have been many proven hacks from many states that are far worse (the Chinese Fighter plane that looks almost identical to the F35 come to mind) than exposing the DNC's dirty laundry. No one is denying that the emails are real. This seems like some sort of distraction.

[deleted]

Re: Technical report on DNC hack [pdf]

#35

Post by altendo »

As an aside, for those looking to understand YARA rules, [1] provides a brief introduction and [2] introduces how to write them. I needed to look it up myself, but seems relatively straightforward if you have a programming background.

tl;dr: YARA rules are a method of categorizing malware based on their characteristics. So the PDF here released a YARA rule to determine a specific piece of malware used in the hack (it's not clear to me what it identifies, other than a PHP script).

For convenience, here's the YARA rule presented in the PDF formatted to be more readable:

rule PAS_TOOL_PHP_WEB_KIT {

  meta:
    description = "PAS TOOL PHP WEB KIT FOUND"

  strings:
    $php = " 20KB and filesize
}

[1] https://securityintelligence.com/signature-based-detection-w...

[2] http://yara.readthedocs.io/en/v3.5.0/writingrules.html

EDIT: formatting

Re: Technical report on DNC hack [pdf]

#36

Post by parktheredcar »

sigmar wrote: post #29
snowwrestler wrote: post #14

Folks, the point of this report is not to justify the punitive actions taken today. It is to provide information that companies can use to protect themselves against similar attacks in the future. So if you judge it by whether it "makes the case" against Russia, it will be lacking. We don't need 100 comments pointing that out.

It seems notable that many of these comments are jumping on this for not providing proof that it was Russia, when that was not the intention of the report. The first page states- >This JAR provides technical indicators related to many of these operations, recommended mitigations, suggested actions to take in response to the indicators provided, and information on how to report such incidents to the U.S. Government.

The bloomberg article I read (http://archive.is/j5wRd) presented it as evidence. Maybe other publications are doing the same.

>As part of the administration’s response, the FBI and Homeland Security Department also released a report with technical evidence intended to prove Russia’s military and civilian intelligence services were behind the hacking and to expose some of their most sensitive hacking infrastructure.

Re: Technical report on DNC hack [pdf]

#37

Post by crb002 »

I've done security remediation for the U.S. Govt. About the same vulns you would expect on 2003 PHP apps that haven't been updated since (OS or otherwise). Congress doesn't budget for server/app maintenance, simple as that.

Re: Technical report on DNC hack [pdf]

#38

Post by cylinder »

sschueller wrote: post #26

The Sony hack had more evidence than this... Someone explain to me why this is such an issue? There have been many proven hacks from many states that are far worse (the Chinese Fighter plane that looks almost identical to the F35 come to mind) than exposing the DNC's dirty laundry. No one is denying that the emails are real. This seems like some sort of distraction.

The entire thing has been a politicized distraction and propaganda campaign ... the level of discourse in America is now at a terrifying and dangerous quality; we used to mock the propaganda of the Soviets, China, etc. but we are descending into their grade.

Re: Technical report on DNC hack [pdf]

#40

Post by davexunit »

[deleted] wrote: post #34
sschueller wrote: post #26

The Sony hack had more evidence than this... Someone explain to me why this is such an issue? There have been many proven hacks from many states that are far worse (the Chinese Fighter plane that looks almost identical to the F35 come to mind) than exposing the DNC's dirty laundry. No one is denying that the emails are real. This seems like some sort of distraction.

[deleted]

Delete your account.
Post reply on HN