That big list of code names is a hoot, it seems they mixed the names of soldiers from metal gear solid 5 with a list of names they got off a small IRC server as well as some codenames out of James Bond novels Ian Fleming never wrote plus some fragments of mime headings salted with just a little bit of line noise.
Technical report on DNC hack [pdf]
241–250 of 502 posts
Re: Technical report on DNC hack [pdf]
#242Earlier quoted context omitted.
"Many breach announcements this year pointed to a “sophisticated attacker” as a narrative of their issue. This usually is followed up by criticism when an initial means of their compromise is revealed. Most breaches begin with spear phishing, commodity exploits, a leaked key, or some other obvious or preventable detail. However, this is almost never the “sophisticated” aspect of a breach worth talking about. It’s eas…
Valid point, but I should clarify my original comment: I don't find either aspect of the attack--the entry or the payload--to be particularly sophisticated. Everything I've read indicates the bulk of work was done by Powershell scripts, along with a backdoor process running in the open. If you told me that the backdoor was a kernel level rootkit or something similar then I could get onboard, but as it stands I don't…
Who else could have forced the DNC to rig the primaries? It's very clear from the collusion between CNN and the Hillary campaign that state level actors were involved.
Re: Technical report on DNC hack [pdf]
#243Earlier quoted context omitted.
The "evidence" boils down to: The Hackers drove a truck. Russians drive trucks. The Russians did the hacking. While its insulting that our government would try to pass off this drivel as "evidence", I'm much more dismayed that so many of my fellow Americans will uncritically accept it as such.
The actual evidence is probably closer to 'we have moles in the kremlin and taps on their phones' but they're not exactly going to publish that are they.
Wasn't the NSA spying on the whole Internet or something? Are you telling me the NSA saw no evidence of Russia hacking the DNC servers? They wouldn't necessarily have to reveal their "methods" that it was the Russians if it was the NSA catching them and not some Kremlin CIA spy.
But who knows, maybe they are too busy spying on hundreds of millions of Regular Joes to watch out for all of the Russian attacks.
Re: Technical report on DNC hack [pdf]
#244I have looked through the report. The only useful information was brief description of attack methods, everything else looks like a list of general recommendations one can find on the OWASP website. As I understand from report the main methods used were: - sendind emails with executable files that victims for some reason executed - phishing So, they used script kiddie level tools anyone could use (and they are cheap;…
The "evidence" boils down to: The Hackers drove a truck. Russians drive trucks. The Russians did the hacking. While its insulting that our government would try to pass off this drivel as "evidence", I'm much more dismayed that so many of my fellow Americans will uncritically accept it as such.
This (complaining about the lack of evidence) just seems ludicrous to me. Does the FBI have a history of declassifying stuff like this so that randos on the internet can independently verify its conclusions? When high-level intelligence people collude to lie to the American people and discredit a president, do they usually do it via press release clearly written by a PIO?
The accusation that people who find this credible are uncritical is unfounded and insulting. The question is not "would someone in a government agency lie for political reasons," it is "would this many people, in a bunch of different agencies that have a history of lying to and competing with and distrusting each other, all sign on to the same lie, publicly, even though it's almost certain to be disproven in a few months."
Meanwhile, here's the alternative theory:
1. Some Russian intelligence agency hacked the DNC's email servers
2. They left behind evidence
3. The FBI/NSA//DHS/etc found that evidence
4. They classified it and aren't going to put it in a press release
None of those are the least bit hard to believe, and they are collectively WAY easier to swallow than this hypothetical vast, high-level conspiracy to discredit Trump or whatever it's supposed to be for.
Re: Technical report on DNC hack [pdf]
#245Earlier quoted context omitted.
You can read about the backdoors they used here: https://www.crowdstrike.com/blog/bears-midst-intrusion-democ... The summary: One used Powershell modules and Windows Scheduler to run scripts. Another used a combination of Twitter and public sites like Github/Dropbox for command and control. In my opinion, neither is impressively sophisticated, and a skilled application developer could whip up something similar in a w…
I have personally written that exact tool while learning Python. A RAT using Twitter for C & C. Uses PGP for encryption and verification. The twitter handles for the C & C change based on a hash of Googles lastest Doodle so you can access it without fear of account deletion. TIL I'm as good as a state level intelligence team. Hey CIA/NSA we know you are reading this, my contact info is in my profile. Hire me.
> TIL I'm as good as a state level intelligence team.
Not to totally ignore the pithiness, but I feel like your comment touches on something I see a ton here (and elsewhere): an offhand dismissal of the 'state level' intelligence capacity.
At the end of the day, the systems were exploited. That more sophisticated methods went unused should be a measure of efficiency and not necessarily execution. Why break out the trick play if your opponent can't keep from you running it up the middle?
Re: Technical report on DNC hack [pdf]
#246Earlier quoted context omitted.
The actual evidence is probably closer to 'we have moles in the kremlin and taps on their phones' but they're not exactly going to publish that are they.
Wasn't the NSA spying on the whole Internet or something? Are you telling me the NSA saw no evidence of Russia hacking the DNC servers? They wouldn't necessarily have to reveal their "methods" that it was the Russians if it was the NSA catching them and not some Kremlin CIA spy. But who knows, maybe they are too busy spying on hundreds of millions of Regular Joes to watch out for all of the Russian attacks.
Haven't the NSA already said they believe it was the Russians? As you suggest, they would be the ones to know.
Re: Technical report on DNC hack [pdf]
#247Earlier quoted context omitted.
The "evidence" boils down to: The Hackers drove a truck. Russians drive trucks. The Russians did the hacking. While its insulting that our government would try to pass off this drivel as "evidence", I'm much more dismayed that so many of my fellow Americans will uncritically accept it as such.
The purpose of these "reports" and the retaliation against the Russians is to undermine the legitimacy of the Trump presidency. There's no need for proof, just innuendo and allegation would do. Pretty sick of technology got dragged through the mud for political purpose.
I completely disagree.
This isn't about Trump winning. Nobody disputes that. This is about Russia interfering with the US Election and intentionally trying to undermined western society.
Russia has launched a War against the US and Europe. Sponsoring Right Wing Groups with millions in cash to Cyber warfare against Government institutions.
Re: Technical report on DNC hack [pdf]
#248Earlier quoted context omitted.
Could you elaborate? Once you have a password shouldn't it be as easy as just downloading all the emails? Any email client should have the functionality built in. edit: seeing some reports they used "sophisticated" SQL injection... okay...I mean for a lay person it seems sophisticated, sure. But for anyone in the industry it's one of the oldest and easiest tricks in the book. I really suspect news sources are knowing…
RNC got hacked but nothing was leaked.
Source?
Re: Technical report on DNC hack [pdf]
#249I have looked through the report. The only useful information was brief description of attack methods, everything else looks like a list of general recommendations one can find on the OWASP website. As I understand from report the main methods used were: - sendind emails with executable files that victims for some reason executed - phishing So, they used script kiddie level tools anyone could use (and they are cheap;…
>I have looked through the report. The only useful information was brief description of attack methods, everything else looks like a list of general recommendations one can find on the OWASP website. https://news.ycombinator.com/item?id=13280068 Look again, they handed you more than enough information. >The report also contains a pretty useless firewall rule named "PAS TOOL PHP WEB KIT FOUND" that can be used to sear…
> Why is everyone trying so desperately to attack and discredit this report?
Because half of the US voting population are heavily invested in it being false.
Re: Technical report on DNC hack [pdf]
#250Earlier quoted context omitted.
This does not increase my confidence or trust in abstract assurances from intelligence agencies. > In five of six incidents in which troops were wounded by chemical agents, the munitions appeared to have been designed in the United States, manufactured in Europe and filled in chemical agent production lines built in Iraq by Western companies.
I understand why that might superficially decrease you trust in the claims, but consider the perspective of the totalitarian trying to spin up a chemical weapons program. Wouldn't leveraging existing expertise and contractors be a good way to get the weapons you wanted? Why wouldn't a dictator hire outsiders to build weapons? Having his experts check them for traps after the construction sounds much cheaper than buil…
We knew that Iraq had WMDs because a number of western countries sold them some a few decades ago to drop on Iran on our behalf. That's not a secret, and if I recall correctly they were tightly secured and probably degraded to the point of ineffectiveness by that point. The claim that justified invasion was that they had new chemical weapons programs, and that seems to be categorically untrue and without evidence.