Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Technical report on DNC hack [pdf]

us-cert.gov

Post reply on HN
Print view View original

161–170 of 502 posts

Re: Technical report on DNC hack [pdf]

#161

Post by koube »

ep103 wrote: post #155
codedokode wrote: post #144

Earlier quoted context omitted.

If an organization is working with sensitive data maybe they should invest some resources into security. I understand it is not easy because companies like Microsoft have been releasing poorly designed software (with things like autorun for USB drives) for 20 years and it still is the leader. But we have to advance step by step. For every single person needing executable attacments there are maybe million users who c…

I mean, you're talking about the campaign of a person who was running while being investigated for circumventing security procedures. Regardless of what you think about those topics or their validity, is it that surprising that the campaign wasn't up to par on the security front?

The RNC was hacked as well, although they similarly circumvented the same security procedures.

Re: Technical report on DNC hack [pdf]

#162

Post by gizmodo59 »

coldcode wrote: post #148

Jeez people, read the report, it isn't any kind of justification of anything, its just a fairly generic don't do this, like I see 100 times a week at work. The real details were likely shown to congress and the senate (or at least a portion of it). Those are the only people who can say if the actual attack was real or imagined. Do you think the British and Americans were going to publish stories about Enigma back in…

I don't think 'Do you think the British and Americans were going to publish stories about Enigma back in WW2 in the Times during the war?' is a fair comparison to what's happening now.

Given the credibility of some three letter agency, it is reasonable that people who are technically adept or otherwise have doubt over this report. Even when you just look at the report without the credibility, it still lacks so much for anyone to pinpoint the acts to Russian state. While the report itself does not claim that, the media hype is otherwise.

Re: Technical report on DNC hack [pdf]

#163

Post by heartbreak »

cloakandswagger wrote: post #156
codedokode wrote: post #127

I have looked through the report. The only useful information was brief description of attack methods, everything else looks like a list of general recommendations one can find on the OWASP website. As I understand from report the main methods used were: - sendind emails with executable files that victims for some reason executed - phishing So, they used script kiddie level tools anyone could use (and they are cheap;…

That's the real absurdity of this debacle to me. Many of the whitepapers that I read about the DNC hack listed the attack's "sophistication" as proof that it came from a state actor, yet it was the most routine, simple attack conceivable. No rootkits, no 0 days, just simple phishing and social engineering.

The sophistication cited by CrowdStrike was the actions taken on the DNC servers, not the initial penetration.

Re: Technical report on DNC hack [pdf]

#165

Post by droithomme »

Is this more or less reputable than the clear and unambiguous claims of Craig Murray regarding the DNC leak, which he has stated clearly were the result of him personally traveling to DC, acquiring the data dump face to face from a non-Russian DNC insider, and then returning to the UK to give them to Assange himself. If the us-cert.gov report is to be believed, then both Assange and Murray are liars. Both can not be true. Who is more credible? Perhaps we can compare the history of truth reliability in claims from each party? Would that be a reasonable approach to ascertain who is lying here and who is telling the truth?

Re: Technical report on DNC hack [pdf]

#166

Post by jamiesonbecker »

eropple wrote: post #133
codedokode wrote: post #127

I have looked through the report. The only useful information was brief description of attack methods, everything else looks like a list of general recommendations one can find on the OWASP website. As I understand from report the main methods used were: - sendind emails with executable files that victims for some reason executed - phishing So, they used script kiddie level tools anyone could use (and they are cheap;…

> This attacks could be easily mitigated. [...] second, we should start using physical cryptographic keys instead of passwords Man--I like the way you think, I really do, but this is not "easy". Technical simplicity and social ease are vastly different, and it's usually the humans who are getting hacked.

Well, we've been working on making it pretty easy over at Userify! but, truthfully, we're only tackling one piece of the puzzle (SSH keys). Your point is well taken about websites/web apps designed for mere mortals.

TLS client auth is really pretty much a dead letter: it's not easy at all. The biggest impediment for widespread TLS client auth seems to be that CA's are involved.

U2F might help.. and widespread MFA/2FA. Maybe we shouldn't be just tossing out passwords just yet, but just pushing for full MFA support for mission critical apps.

Re: Technical report on DNC hack [pdf]

#167

Post by codedokode »

ryanlol wrote: post #16

~ grep IPV4 JAR-16-20296.csv|awk -F ',' '{print $1}'|sed 's/[][]//g'|sort -u|grep -f exits -c 191 ~ grep IPV4 JAR-16-20296.csv|awk -F ',' '{print $1}'|sed 's/[][]//g'|sort -u|wc -l 876 At least 191 of the IOC IPs are (probably random) Tor exit nodes :) The actual number may very well be higher, I just grabbed current exit node list from https://check.torproject.org/exit-addresses Here's the PHP backdoor the YARA rule…

> The obfuscation used in the russian PHP shells looked awfully familiar

I have seen similar obfusaction many times before. Generally most PHP backdoors look like eval($_POST['something']) and here eval is replaced with create_function (by the way I know several other functions that can be used instead of eval). This method of obfuscation (eval + gzip/base64_decode and other functions) is also sometimes used in legitimate scripts.

Re: Technical report on DNC hack [pdf]

#168

Post by jamiesonbecker »

koube wrote: post #161
ep103 wrote: post #155

Earlier quoted context omitted.

I mean, you're talking about the campaign of a person who was running while being investigated for circumventing security procedures. Regardless of what you think about those topics or their validity, is it that surprising that the campaign wasn't up to par on the security front?

The RNC was hacked as well, although they similarly circumvented the same security procedures.

That the RNC was also hacked seems to be a popular, but probably false, meme.

http://www.cnn.com/2016/12/10/politics/smerconish-spicer-hac...

Re: Technical report on DNC hack [pdf]

#169

Post by StanislavPetrov »

codedokode wrote: post #127

I have looked through the report. The only useful information was brief description of attack methods, everything else looks like a list of general recommendations one can find on the OWASP website. As I understand from report the main methods used were: - sendind emails with executable files that victims for some reason executed - phishing So, they used script kiddie level tools anyone could use (and they are cheap;…

The "evidence" boils down to:

The Hackers drove a truck.

Russians drive trucks.

The Russians did the hacking.

While its insulting that our government would try to pass off this drivel as "evidence", I'm much more dismayed that so many of my fellow Americans will uncritically accept it as such.

Re: Technical report on DNC hack [pdf]

#170

Post by randyrand »

heartbreak wrote: post #163
cloakandswagger wrote: post #156

Earlier quoted context omitted.

That's the real absurdity of this debacle to me. Many of the whitepapers that I read about the DNC hack listed the attack's "sophistication" as proof that it came from a state actor, yet it was the most routine, simple attack conceivable. No rootkits, no 0 days, just simple phishing and social engineering.

The sophistication cited by CrowdStrike was the actions taken on the DNC servers, not the initial penetration.

Could you elaborate? Once you have a password shouldn't it be as easy as just downloading all the emails? Any email client should have the functionality built in.

edit: seeing some reports they used "sophisticated" SQL injection... okay...I mean for a lay person it seems sophisticated, sure. But for anyone in the industry it's one of the oldest and easiest tricks in the book.

I really suspect news sources are knowingly exaggerating about the sophistication of this "hack" in order to make up-play Russia's role and downplay the DNC's culpability.

Post reply on HN