Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Technical report on DNC hack [pdf]

us-cert.gov

Post reply on HN
Print view View original

171–180 of 502 posts

Re: Technical report on DNC hack [pdf]

#171

Post by sebleblanc »

UnoriginalGuy wrote: post #132
codedokode wrote: post #127

I have looked through the report. The only useful information was brief description of attack methods, everything else looks like a list of general recommendations one can find on the OWASP website. As I understand from report the main methods used were: - sendind emails with executable files that victims for some reason executed - phishing So, they used script kiddie level tools anyone could use (and they are cheap;…

> By the way iOS is the only popular operating system I know that doesn't allow to execute files downloaded from web or emails. Windows 8, 8.1, and 10 don't allow it either. SmartScreen will block unsigned executables by default[0]. Enterprise customers should be using AppLocker which does a lot of what SmartScreen does, but with more flexibility and control. The issue arises when [bad] System Administrators disable…

"If Microsoft forced either SmartScreen OR AppLocker"

Meh, just add a button or clickable link that allows the sysadmin to swiftly disable such warnings. Just make sure to put a scary-enough disclaimer that doing so can expose you to very bad, malicious stuff, from ill-intentioned people. It might get more application publishers to implement signing, just as Vista and 7 got rid of the "run everything as administrator" mentality through the use of UAC warnings.

Re: Technical report on DNC hack [pdf]

#172

Post by walshemj »

porpoisemonkey wrote: post #135
walshemj wrote: post #117

Earlier quoted context omitted.

Not if it would give any humint sources away and they may have kicked out people to allow a source to step into their shoes - as the UK did to put there man in as the Resident in London

It's somewhat obvious from the context but for anyone not familiar with military jargon I think the parent post meant to say "humint" instead of "humit" which is short hand for "human intelligence" or in layman's terms "spies".

oops my bad

Re: Technical report on DNC hack [pdf]

#173

Post by ryanlol »

codedokode wrote: post #167
ryanlol wrote: post #16

~ grep IPV4 JAR-16-20296.csv|awk -F ',' '{print $1}'|sed 's/[][]//g'|sort -u|grep -f exits -c 191 ~ grep IPV4 JAR-16-20296.csv|awk -F ',' '{print $1}'|sed 's/[][]//g'|sort -u|wc -l 876 At least 191 of the IOC IPs are (probably random) Tor exit nodes :) The actual number may very well be higher, I just grabbed current exit node list from https://check.torproject.org/exit-addresses Here's the PHP backdoor the YARA rule…

> The obfuscation used in the russian PHP shells looked awfully familiar I have seen similar obfusaction many times before. Generally most PHP backdoors look like eval($_POST['something']) and here eval is replaced with create_function (by the way I know several other functions that can be used instead of eval). This method of obfuscation (eval + gzip/base64_decode and other functions) is also sometimes used in legit…

>I have seen similar obfusaction many times before.

If you look at it carefully you'll very quickly realize that you haven't. This isn't at all like your typical base64 silliness, and it's certainly very uncommon.

This actually uses a cookie to decrypt the encrypted shell before executing it. Pretty obvious, but very few things actually do it.

Re: Technical report on DNC hack [pdf]

#174

Post by codedokode »

eropple wrote: post #159
codedokode wrote: post #144

Earlier quoted context omitted.

If an organization is working with sensitive data maybe they should invest some resources into security. I understand it is not easy because companies like Microsoft have been releasing poorly designed software (with things like autorun for USB drives) for 20 years and it still is the leader. But we have to advance step by step. For every single person needing executable attacments there are maybe million users who c…

"Maybe" they should. But almost none of them do . That's why it's a social problem, not a technical problem, yeah?

I think it is rather the problem of poorly designed software. It is impossible to make millions of users to set up some secure configuration, install firewalls etc.

The software should have secure default settings, if a user is not a computer engineer he should not be able to execute files from email attachments.

Re: Technical report on DNC hack [pdf]

#175

Post by cookiecaper »

eropple wrote: post #143
cookiecaper wrote: post #138

Earlier quoted context omitted.

It appears to confirm what we knew: the DNC's failure to adhere to basic security protocols, which would be enforced in any corporation with more than a couple dozen employees (edit: or not, see eropple's comment below), allowed its systems to be compromised by script kiddies (for political reasons, the USG insists these script kiddies are sponsored by the Russian government, and insists we take them at their word).…

> which would be enforced in any corporation with more than a couple dozen employees No they wouldn't, and you are one of the people here who I would say should very well know it. :p The DNC screwed up, but the overwhelming majority of everybody else screws up to this level or worse on the regular.

Yeah, you are completely right, and I completely agree, as I imply later in the post. Such mistakes are extremely common across the spectrum, at companies large and small alike (remember when American Express accidentally exposed an internal debugging application? [0] :O). Cybersecurity is still very difficult for everyone, and I don't mean to imply any differently.

My quip was meant to emphasize that the security breaches described are basic, and likely could've been blocked if the DNC had, at the time, been following good security practice. Many corporations withstand such attacks routinely (and as you note, many don't).

The penetration of the DNC was not something that required professional-level skill, let alone the resources of a nation-state.

[0] http://www.securityweek.com/amex-developers-leave-debug-tool...

Re: Technical report on DNC hack [pdf]

#176

Post by jamoes »

altendo wrote: post #35

As an aside, for those looking to understand YARA rules, [1] provides a brief introduction and [2] introduces how to write them. I needed to look it up myself, but seems relatively straightforward if you have a programming background. tl;dr: YARA rules are a method of categorizing malware based on their characteristics. So the PDF here released a YARA rule to determine a specific piece of malware used in the hack (it…

A file with the following text would activate the rule:
Basically, in the filesize must be between 20bk and 22kb, all of the defined strings must be found, and the cookie and isset strings must occur exactly 2 and 3 times respectively.

Re: Technical report on DNC hack [pdf]

#177

Post by perseusprime11 »

cookiecaper wrote: post #138
AndrewKemendo wrote: post #75

Earlier quoted context omitted.

You're ignoring the political context in which it was released. 1. Released the same day as the announcement of formal Russian Sanctions 2. Released the same day US made 35 "diplomats" (aka. known Human Intelligence Officers) Persona Non Grata. Which is a big deal. This type of document is not intended to "make the case" because we don't do that. Making a case for something by definition, would reveal sources and met…

It appears to confirm what we knew: the DNC's failure to adhere to basic security protocols, which would be enforced in any corporation with more than a couple dozen employees (edit: or not, see eropple's comment below), allowed its systems to be compromised by script kiddies (for political reasons, the USG insists these script kiddies are sponsored by the Russian government, and insists we take them at their word).…

Also the report doesn't say anything about not having your password literally be password!

Re: Technical report on DNC hack [pdf]

#178

Post by jonknee »

dv_dt wrote: post #63
turnip123942 wrote: post #43

Earlier quoted context omitted.

It was the timing of the exposure that could have interfered with the results of the Presidential election which is a major news event in the US that many people perceive to have a higher impact on their lives vs. a quietly disclosed hack/coincidence (F-35 example). Plus in some people's minds a private defense contractor being "hacked" is more along the lines of industrial espionage instead of a major political part…

There was barely any coverage when the Office of Personnel Management was hacked and the personal data of millions of people holding security clearances was taken. The hue and cry about the social engineering hack of the email of a political party campaign manager seems far in excess of the response for that...

Is it really surprising that a Presidential election is a juicier press coverage topic than the Office of Personnel Management? The House released a comprehensive and scathing report on the OPM hack:

https://oversight.house.gov/wp-content/uploads/2016/09/The-O...

Countries gather intelligence about each other all the time, the interesting part of the hacks surrounding the elections is that the information was made public in an attempt to influence the results. If you recall form the 2008 election both the Obama and McCain campaigns were hacked by China, but it was a conventional information gathering operation. It was in the news, but fell off quickly because nothing was released to try and influence the election.

Re: Technical report on DNC hack [pdf]

#179

Post by jaibot »

eropple wrote: post #133
codedokode wrote: post #127

I have looked through the report. The only useful information was brief description of attack methods, everything else looks like a list of general recommendations one can find on the OWASP website. As I understand from report the main methods used were: - sendind emails with executable files that victims for some reason executed - phishing So, they used script kiddie level tools anyone could use (and they are cheap;…

> This attacks could be easily mitigated. [...] second, we should start using physical cryptographic keys instead of passwords Man--I like the way you think, I really do, but this is not "easy". Technical simplicity and social ease are vastly different, and it's usually the humans who are getting hacked.

Can confirm. I did tech at the DNC in 2012. We pushed to get senior staff using 2FA and ran internal phishing drills. Obviously didn't take.

Re: Technical report on DNC hack [pdf]

#180

Post by cmurf »

RachelF wrote: post #154
mundo wrote: post #85

Earlier quoted context omitted.

The "evidence" cited is not the handful of unclassified details included, it's the fact that the FBI and DHS are willing to go on record publicly accusing Russia. There are no asterisks or weasel-words or "allegedly"s. Just a clear "Russia did it." There are only two possible explanations for that: 1) A massive conspiracy in which the leaders of practically the entirety of the US military/intelligence community are w…

With option 1, it will be hard for the new administration to unravel it without confirming the bias that they are in the pay of Russia. However this level of subtlety may be beyond Trump. Perhaps Obama is trying to make Trump's new administration look illegitimate?

Option 1's problem is far less anyone in the new administration is in the pay of Russia, but that the GOP for more than a decade has been claiming government is totally incompetent, cannot be trusted to do anything, should not be trusted, and could not investigate itself. This is hardly any different than the surveillance state, creating that infrastructure puts it right into the hands of political adversaries when the political winds change, and now creating distrust in government generally rather than just political enemies means the distrust is inherited when political winds change. It's deeply damaging to have this concept of "saying things makes them true/untrue" rather than appeal to facts.
Post reply on HN