Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Technical report on DNC hack [pdf]

us-cert.gov

Post reply on HN
Print view View original

191–200 of 502 posts

Re: Technical report on DNC hack [pdf]

#191

Post by wongarsu »

Page 5 lists a YARA signature names "PAS_TOOL_PHP_WEB_KIT" that is supposed to match some kind of payload from the attack. It looks generic but is surprisingly specific.

A quick search reveals that it happens to exactly match [1] (if you fix a few obvious bugs where the github code uses $COOKIE instead of $_COOKIE, or produces base64decode instead of base64_decode. The attackers probably fixed that in production). Apart from the exact combination of three `isset` and two `_COOKIE`, that code starts with the unusual sequence `I just found that within five minutes by searching github. It seems like an encrypted payload that can be executed by visiting the php page while having the password in a POST parameter or in a Cookie.

I'm not an expert, but the encryption looks very simple. Maybe somebody feels up to the challenge to try some statistical analysis or similar on it?

[1] https://github.com/Nu11ers3t/Null/wiki

Re: Technical report on DNC hack [pdf]

#192

Post by mynameisvinn124 »

cloakandswagger wrote: post #156
codedokode wrote: post #127

I have looked through the report. The only useful information was brief description of attack methods, everything else looks like a list of general recommendations one can find on the OWASP website. As I understand from report the main methods used were: - sendind emails with executable files that victims for some reason executed - phishing So, they used script kiddie level tools anyone could use (and they are cheap;…

That's the real absurdity of this debacle to me. Many of the whitepapers that I read about the DNC hack listed the attack's "sophistication" as proof that it came from a state actor, yet it was the most routine, simple attack conceivable. No rootkits, no 0 days, just simple phishing and social engineering.

"Many breach announcements this year pointed to a “sophisticated attacker” as a narrative of their issue. This usually is followed up by criticism when an initial means of their compromise is revealed.

Most breaches begin with spear phishing, commodity exploits, a leaked key, or some other obvious or preventable detail. However, this is almost never the “sophisticated” aspect of a breach worth talking about. It’s easy to point at an embarrassing vector and dismiss the rest of an attack. Thus, do not judge an adversary by the vector they’ve chosen.

An adversary may show you what “sophistication” means after advancing from their beachhead."

* https://medium.com/starting-up-security/learning-from-a-year...

Re: Technical report on DNC hack [pdf]

#193

Post by eropple »

jaibot wrote: post #179
eropple wrote: post #133

Earlier quoted context omitted.

> This attacks could be easily mitigated. [...] second, we should start using physical cryptographic keys instead of passwords Man--I like the way you think, I really do, but this is not "easy". Technical simplicity and social ease are vastly different, and it's usually the humans who are getting hacked.

Can confirm. I did tech at the DNC in 2012. We pushed to get senior staff using 2FA and ran internal phishing drills. Obviously didn't take.

Hmm. Maybe we should chat? Not directly related to this, but I'd love to pick your brain. Email's in my profile.

Re: Technical report on DNC hack [pdf]

#194

Post by cmdrfred »

cloakandswagger wrote: post #182
randyrand wrote: post #170

Earlier quoted context omitted.

Could you elaborate? Once you have a password shouldn't it be as easy as just downloading all the emails? Any email client should have the functionality built in. edit: seeing some reports they used "sophisticated" SQL injection... okay...I mean for a lay person it seems sophisticated, sure. But for anyone in the industry it's one of the oldest and easiest tricks in the book. I really suspect news sources are knowing…

You can read about the backdoors they used here: https://www.crowdstrike.com/blog/bears-midst-intrusion-democ... The summary: One used Powershell modules and Windows Scheduler to run scripts. Another used a combination of Twitter and public sites like Github/Dropbox for command and control. In my opinion, neither is impressively sophisticated, and a skilled application developer could whip up something similar in a w…

I have personally written that exact tool while learning Python. A RAT using Twitter for C & C. Uses PGP for encryption and verification. The twitter handles for the C & C change based on a hash of Googles lastest Doodle so you can access it without fear of account deletion.

TIL I'm as good as a state level intelligence team.

Hey CIA/NSA we know you are reading this, my contact info is in my profile. Hire me.

Re: Technical report on DNC hack [pdf]

#195

Post by paganel »

etcet wrote: post #49
sschueller wrote: post #26

The Sony hack had more evidence than this... Someone explain to me why this is such an issue? There have been many proven hacks from many states that are far worse (the Chinese Fighter plane that looks almost identical to the F35 come to mind) than exposing the DNC's dirty laundry. No one is denying that the emails are real. This seems like some sort of distraction.

> No one is denying that the emails are real. Actually, Donna Brazile, who is inexplicably still the current chair of the DNC, claimed the emails were falsified: https://youtu.be/P_WHsr07cbY?t=458

I wouldn't trust a person like Donna Brazile with running a thing as simple as a banana stand, the fact that she claims the emails were falsified convinces people like myself that they were indeed the real deal.

Re: Technical report on DNC hack [pdf]

#196

Post by BryantD »

droithomme wrote: post #165

Is this more or less reputable than the clear and unambiguous claims of Craig Murray regarding the DNC leak, which he has stated clearly were the result of him personally traveling to DC, acquiring the data dump face to face from a non-Russian DNC insider, and then returning to the UK to give them to Assange himself. If the us-cert.gov report is to be believed, then both Assange and Murray are liars. Both can not be…

Craig Murray said he got the document drop in September, right? Didn't Wikileaks start publishing emails earlier than that? (Sincere question, I don't understand the timeline here.)

Re: Technical report on DNC hack [pdf]

#197

Post by wongarsu »

codedokode wrote: post #127

I have looked through the report. The only useful information was brief description of attack methods, everything else looks like a list of general recommendations one can find on the OWASP website. As I understand from report the main methods used were: - sendind emails with executable files that victims for some reason executed - phishing So, they used script kiddie level tools anyone could use (and they are cheap;…

>The report also contains a pretty useless firewall rule named "PAS TOOL PHP WEB KIT FOUND" that can be used to search malware in PHP files. It is interesting that they have replaced digits in 'base64_decode' function name with regexp as if there were any other similar functions.

If you read that regexp carefully, it's more complicated than that. It doesn't match base64_decode, but it would match `='base'.(32*2).'_de'.'code'`. That's obfuscation in the payload, and in another comment I linked to some code that uses exactly this unusual (and pointless) obfuscation [1]

[1] https://news.ycombinator.com/item?id=13281008

Re: Technical report on DNC hack [pdf]

#198

Post by Qworg »

ryanlol wrote: post #129
codedokode wrote: post #127

I have looked through the report. The only useful information was brief description of attack methods, everything else looks like a list of general recommendations one can find on the OWASP website. As I understand from report the main methods used were: - sendind emails with executable files that victims for some reason executed - phishing So, they used script kiddie level tools anyone could use (and they are cheap;…

>I have looked through the report. The only useful information was brief description of attack methods, everything else looks like a list of general recommendations one can find on the OWASP website. https://news.ycombinator.com/item?id=13280068 Look again, they handed you more than enough information. >The report also contains a pretty useless firewall rule named "PAS TOOL PHP WEB KIT FOUND" that can be used to sear…

It is interesting to see the strongly negative positions that some people take on any of these reports. It is almost like folks can have ulterior motives or know very little about how to protect sources and methods.

Re: Technical report on DNC hack [pdf]

#199

Post by ww520 »

StanislavPetrov wrote: post #169
codedokode wrote: post #127

I have looked through the report. The only useful information was brief description of attack methods, everything else looks like a list of general recommendations one can find on the OWASP website. As I understand from report the main methods used were: - sendind emails with executable files that victims for some reason executed - phishing So, they used script kiddie level tools anyone could use (and they are cheap;…

The "evidence" boils down to: The Hackers drove a truck. Russians drive trucks. The Russians did the hacking. While its insulting that our government would try to pass off this drivel as "evidence", I'm much more dismayed that so many of my fellow Americans will uncritically accept it as such.

The purpose of these "reports" and the retaliation against the Russians is to undermine the legitimacy of the Trump presidency. There's no need for proof, just innuendo and allegation would do. Pretty sick of technology got dragged through the mud for political purpose.

Re: Technical report on DNC hack [pdf]

#200

Post by bsznjyewgd »

sebleblanc wrote: post #171
UnoriginalGuy wrote: post #132

Earlier quoted context omitted.

> By the way iOS is the only popular operating system I know that doesn't allow to execute files downloaded from web or emails. Windows 8, 8.1, and 10 don't allow it either. SmartScreen will block unsigned executables by default[0]. Enterprise customers should be using AppLocker which does a lot of what SmartScreen does, but with more flexibility and control. The issue arises when [bad] System Administrators disable…

"If Microsoft forced either SmartScreen OR AppLocker" Meh, just add a button or clickable link that allows the sysadmin to swiftly disable such warnings. Just make sure to put a scary-enough disclaimer that doing so can expose you to very bad, malicious stuff, from ill-intentioned people. It might get more application publishers to implement signing, just as Vista and 7 got rid of the "run everything as administrator…

Whatever the default level SmartScreen is already has a ding and a warning pop up about unknown executables. But it's amber and not red, and most people just click through it (I know I do).
Post reply on HN