Critiques of the DHS and FBI’s Grizzly Steppe Report • Hacker News Board

Re: Critiques of the DHS and FBI’s Grizzly Steppe Report

#91

Post by geggam » Sat, Dec 31, 2016, 3:17 PM UTC

jamesgblaine wrote: post #65

showmeevidence wrote: post #28

Throwaway because I work in a related field. This is a public service announcement: if you haven't seen enough information to prove to you, independent of the claims of the White House, CIA & FBI, that Russia was behind this, you should file a Freedom of Information Act Request for sufficient evidence to independently reach that conclusion. Citizens of the US in particular should do this to hold their government acco…

While there's no harm in filing additional FOIA requests, let's also add some deductive reasoning to the mix. Is this consistent with Russia's actions in other countries and contexts (as well as their own)? Yes. http://warontherocks.com/2016/11/trolling-for-trump-how-russ... Have individuals close to the Kremlin strongly implied they had a role in this and have senior Russian officials stated clearly that they had co…

I am wondering why people think nations have ever stopped attempting to influence others ?

Covert hacking happens everywhere.

The US openly bribes other nations or sends troops to motivate them to change.

Re: Critiques of the DHS and FBI’s Grizzly Steppe Report

#92

Post by the_why_of_y » Sat, Dec 31, 2016, 4:16 PM UTC

rdtsc wrote: post #72

ohwello wrote: post #37

Earlier quoted context omitted.

How on earth did a leak of DNC emails, but no corresponding RNC leak, help people figure out the lesser of two evils or provide a level playing field? Seems obvious that leaks assisting the pro-Putin candidate were not altruistic.

Level is relative here. But remember DNC candidate had 6 or more multibillion dollar mass media corps actively supporting their candidate, POTUS was campaigning for them, had a top strategy team, support from tech giants, Wall St., huge contributions from countries like Saudi Arabia and so on. A few emails leaked I would say still wasn't a level playing field but it was close?

"mass media corps actively supporting their candidate"? How? By wasting hours of coverage on irrelevant emails instead of relevant policy issues?

https://shorensteincenter.org/pre-primary-news-coverage-2016...

Look at figure 7, Clinton media coverage 84% negative in tone, twice the ratio as Trump's!

Now compare that to the many millions worth of free coverage that Trump got, because he knew how to exploit the media's lust for controversy.

http://mediamatters.org/blog/2016/10/26/study-confirms-netwo...

100 minutes of Clinton emails vs. 32 minutes of policy issues for all candidates combined - who do you think benefits from that, the candidate with realistic policy proposals, or the one who wants solve all problems by building a wall?

Re: Critiques of the DHS and FBI’s Grizzly Steppe Report

#93

Post by beowulf_cluster » Sat, Dec 31, 2016, 4:29 PM UTC

ohwello wrote: post #37

j_m_b wrote: post #33

Still lacking any evidence that voting machines were hacked or any part of the electoral process was hijacked. The worst damage? Emails related to the actual rigging of the Democrat Party primaries and the collusion of the media with the Democrat party. Its very hard for me to believe that a state actor is behind such seemingly altruistic actions. Voters saw the worst of Trump and Clinton and choose the lessor of two…

How on earth did a leak of DNC emails, but no corresponding RNC leak, help people figure out the lesser of two evils or provide a level playing field? Seems obvious that leaks assisting the pro-Putin candidate were not altruistic.

To be fair, he called Trump the "lessor" of two evils. Though, that seems like a low-ball figure.

Re: Critiques of the DHS and FBI’s Grizzly Steppe Report

#94

Post by nickpsecurity » Sat, Dec 31, 2016, 4:33 PM UTC

AnthonyMouse wrote: post #62

nickpsecurity wrote: post #55

Earlier quoted context omitted.

"it's an insurance company or government contractor getting software from an individual or a company with nine employees." The good news is high-assurance systems have been built with smaller teams than that. We also have cases like Bernstein's where one person builds all kinds of stuff with provably better security using a bit of brains and methods that work. We also have tools like SPARK for static systems and Rust…

Oh absolutely, it isn't that small teams can't create secure software, it's that product liability isn't the way to do it. Because when the lawyers come for the bad coders they just turn their pockets inside out and then go back to writing bad code, while all the HMOs carry on using OpenSSL and vulnerable XML parsers. > Doesn't solve the DDOS problem which can also be used for extortion, interfering with government o…

"Can you be more specific about your DDOS solution?"

The root cause is 0-days in software or bad configuration of mass-market products in most cases. The former can be detected automatically by many tools. The latter can, given the flaws I've seen so far, be spotted in 5 minute review by an amateur consultant. Mandating such things in a regulation or expecting them as "reasonable, professional standard" during a lawsuit would be a start. Prevents many DDOS bots as a side-effect.

My main solution to DDOS mitigation in the interim & part of long-term package is here:

https://news.ycombinator.com/item?id=13266108

Re: Critiques of the DHS and FBI’s Grizzly Steppe Report

#95

Post by bediger4000 » Sat, Dec 31, 2016, 4:57 PM UTC

anigbrowl wrote: post #35

yarou wrote: post #7

Has Scheiner written anything on this report? I will say this; the Podesta emails revealed a lot about the internal politics of the DNC. Why are we not treating this type of leak with the same level of respect as the Ellsberg leaks? Or for that matter, the Snowden leaks? Who is really controlling the narrative here?

the internal politics of the DNC ...which is not actually part of the government. I expect political parties to have internal politicking, which is somewhat bad. But ultimately parties are private organizations that are subject to quite different laws and obligations than parts of the government.

I'm going to disagree. Both Republican and Democratic parties are effectively part of the government. If you get legalistic, you've got me, legally they're not. But the too-entrenched-to-fail nature of the two parties makes them part of the government. I'll give the example of the Colorado gubernatorial election in 2012. The Republican status quo candidate totally flamed out in the primaries, leaving a weird, not-quite-tea-party R candidate. He sank like a rock in the general due to an amazing number of personal narrative inconsistencies, bizarre public statements and other oddities. Tom Tancredo, noted Republican insurgent, ran on the American Constitution Party ticket, and finished a strong 2nd. The ACP was then a "major party" according to Colorado state law. The ACP got nothing out of it, they were able to make no dent in the next elections. Republican Party assumed it's semi-governmental role in the next elections. The Big Two parties are part of the government for all intents and purposes.

Re: Critiques of the DHS and FBI’s Grizzly Steppe Report

#96

Post by learc83 » Sat, Dec 31, 2016, 6:27 PM UTC

corey_moncure wrote: post #64

bobwaycott wrote: post #45

Earlier quoted context omitted.

First off, while there was an irrefutable bias in the DNC during the primaries, and shitty moves made against Sanders as a result of that bias, that is not the same thing in any way to rigging the primaries. That's a much stronger allegation with no evidence I've yet seen provided. The DNC was deplorable and idiotic in its rejection of Sanders and active working against his campaign. But the primaries were not rigged…

>leaks that targeted a single party and candidate? Is there any evidence to suggest that the DNC was singled out for attack? We should be careful not to fall victim to pernicious media spin. The claims laid out in the Grizzly Steppe report are very specific: 1. In summer 2015, an APT29 spearphishing campaign directed emails containing a malicious link ... 2. ...to over 1,000 recipients, including multiple U.S. Govern…

>stop storing Top Secret material on your home server.

None of the emails on Clinton's email servers were ever compromised, or at least we have no reason to believe they were because no one leaked them.

>Russia putting a targeted hit only on the DNC to swing the election specifically in favor of one candidate is an extraordinary claim and this report doesn't clear the bar IMHO.

This report wasn't meant to provide any evidence of anything.

Re: Critiques of the DHS and FBI’s Grizzly Steppe Report

#97

Post by Natsu » Sat, Dec 31, 2016, 6:52 PM UTC

nl wrote: post #85

Natsu wrote: post #84

Earlier quoted context omitted.

That was an email with a malicious attachment that appeared legit which did nothing obvious to compromise the system. Podesta got an email saying that "someone has your password" and pointing at the IP Address: 134.249.139.239, allegedly in the Ukraine[1]. I can see your point, but one attack is a lot quieter than the other. The usual goal is that they don't know they've been compromised so you retain access over a l…

Sure, there different levels of phishing, depending on the sophistication of the opposition. The GCHQ attacks on Belgacom[1] had a phishing component, but I suspect most people here would have fallen for them too. [1] https://theintercept.com/2014/12/13/belgacom-hack-gchq-insid...

I'm having trouble finding the phishing there? There's a mention of QUANTUM INSERT replacing pages with malicious copies, but that appears to be a man-in-the-middle attack of some kind unless I'm completely misreading it.

It also took them quite long to figure out what was going on.

Re: Critiques of the DHS and FBI’s Grizzly Steppe Report

#98

Post by travmatt » Sat, Dec 31, 2016, 7:50 PM UTC

neuronexmachina wrote: post #86

virtuabhi wrote: post #47

Earlier quoted context omitted.

1) Selling ambassdor positions to the donors (check the xlsx file which has higher paying donors getting 'better' countries) 2) Co-ordinating with Super PAC https://twitter.com/wikileaks/status/807308520546848769

1) This doesn't make it right, but it's a common practice for a President to give a percentage of ambassadorships (typically 30%-40%) to donors and friends. Obama, Clinton, and both Bush's all engaged in this practice. It's unusual though to extend this practice to the Cabinet, as Trump has done.

I could even name some Reagan donors turned unqualified ambassadors.

I can't tell if people hawking such ridiculous ideas are truly naive or are just following a motivated reasoning to reach some post-hoc justification of their dislike.

Re: Critiques of the DHS and FBI’s Grizzly Steppe Report

#99

Post by dang » Sat, Dec 31, 2016, 8:41 PM UTC

rahrahrah wrote: post #22

The poor man's hacking technique worked great. Instead of focusing on the tools, focus on the results. I bet you're one of those people who uses microservices to run his 100 visitors/day blog just because it's the shiniest new paradigm.

We've banned this account for repeatedly violating the HN guidelines.

Please stop creating accounts to break the rules here with.

We detached this subthread from https://news.ycombinator.com/item?id=13288070 and marked it off-topic.

Re: Critiques of the DHS and FBI’s Grizzly Steppe Report

#100

Post by bobwaycott » Sat, Dec 31, 2016, 9:08 PM UTC

hackinthebochs wrote: post #70

bobwaycott wrote: post #45

Earlier quoted context omitted.

First off, while there was an irrefutable bias in the DNC during the primaries, and shitty moves made against Sanders as a result of that bias, that is not the same thing in any way to rigging the primaries. That's a much stronger allegation with no evidence I've yet seen provided. The DNC was deplorable and idiotic in its rejection of Sanders and active working against his campaign. But the primaries were not rigged…

>The DNC was deplorable and idiotic in its rejection of Sanders and active working against his campaign. But the primaries were not rigged. But they didn't do any of that either. It's amazing how out of control this narrative has gotten. And this is precisely why we can't justify these sorts of intrusions so close to an election, the stories become such distorted pictures of reality which is antithetical to to ration…

> But they didn't do any of that either.

They most certainly did. DWS and company actively worked internally to disparage and scuttle the Sanders campaign and push HRC, ultimately resulting in DWS resigning in shame. The DNC leadership's bias was obvious, and the leaked emails that came out before the convention provided sufficient evidence that Sanders' supporters had been right about the DNC not playing fair with the candidates (though still not rigging the primaries). I don't think the narrative about the DNC's pro-Clinton/anti-Sanders bias and internal activity ever got out of control. Seems it stayed pretty level, and it's ultimately a separate matter from the current issue as far as I'm concerned anyway.