Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

U.S. Treasury breached by hackers backed by foreign government – sources

reuters.com

Post reply on HN
Print view View original

191–200 of 389 posts

Re: U.S. Treasury breached by hackers backed by foreign government – sources

#191

Post by jedberg »

judge2020 wrote: post #180
hmottestad wrote: post #156

Earlier quoted context omitted.

That might also be a bias because very few companies or organizations use things like open office (or the google suite for that matter) so there would be fewer people interested in attacking those software suites. Also it’s more fun to report on bad stuff that happens to Microsoft then and stuff that happens to some relatively small and unknown software company.

Growth for Google Workspace (previously G Suite) and Office 365 is insane. Office 365 has >258 million paid seats[0], while Google claims they have 2 billion paid seats (or "users")[1]. Soon enough more businesses will be using one of these than those that aren't (as in, those that are using Exchange or another email server). 0: https://office365itpros.com/2020/10/28/teams-115-million-use... . 1: https://www.axios.co…

Google claims 2 billion users across all their cloud services, not paid seats.

For example, if you have a hangout and invite 20 people, that's 20 users. You don't have to be logged in to use a hangout link, so if you join another hangout later, and still aren't logged in, you're a new user.

Re: U.S. Treasury breached by hackers backed by foreign government – sources

#192

Post by chrisseaton »

jjeaff wrote: post #71
delecti wrote: post #47

Earlier quoted context omitted.

I had to look up the difference, and I don't think that distinction is something most people are aware of. I've only ever known "nation state" to mean "country", and suspect I'm in the majority. I don't think most people use that term intentionally, because few countries would qualify. That list gets even shorter when you limit it to countries that might be antagonistic to the US, and even shorter when you get to tho…

Ya, I think I consume far beyond the average for political news and had never heard of that distinction until now. I just always equated nation-state to country.

Why do you think people said 'nation-state' if you thought it meant the same as the shorter and simpler word 'country'?

Re: U.S. Treasury breached by hackers backed by foreign government – sources

#193

Post by 9HZZRfNlpR »

astronautjones wrote: post #181
simias wrote: post #175

Earlier quoted context omitted.

I wish we had more concrete evidence than "according to people familiar with the matter" though. That's kind of my issue: if these attackers are so sophisticated, how can they be sure it's this particular group? I realize that there are probably many good reasons for not sharing deep technical details in such cases, but from the point of view of an external observer it's really hard to know who should be trusted and…

I totally agree with your point (and would trust a hazy dream more than anything coming from this government), but I'd add that even if they claim to identify these parties forensically, they're often using parallel construction through their own espionage. like in the mueller investigation, they had a lot of firsthand knowledge of the IRA's business from inside the building (and the names of everyone that worked the…

Sounds reasonable but I don't remind reading it from the released pdf of the investigation. I actually read the whole thing, it's long but rather interesting from the hacker and espionage spirit.

Re: U.S. Treasury breached by hackers backed by foreign government – sources

#194

Post by falcor84 »

judge2020 wrote: post #180
hmottestad wrote: post #156

Earlier quoted context omitted.

That might also be a bias because very few companies or organizations use things like open office (or the google suite for that matter) so there would be fewer people interested in attacking those software suites. Also it’s more fun to report on bad stuff that happens to Microsoft then and stuff that happens to some relatively small and unknown software company.

Growth for Google Workspace (previously G Suite) and Office 365 is insane. Office 365 has >258 million paid seats[0], while Google claims they have 2 billion paid seats (or "users")[1]. Soon enough more businesses will be using one of these than those that aren't (as in, those that are using Exchange or another email server). 0: https://office365itpros.com/2020/10/28/teams-115-million-use... . 1: https://www.axios.co…

The axios article says:

>Soltero declined to offer a breakdown of how many of those 2 billion users are for products beyond Gmail or how many are paid versus free.

Re: U.S. Treasury breached by hackers backed by foreign government – sources

#196

Post by tialaramex »

simias wrote: post #135

I'm always skeptical of these "nation state" claims, it seems like an easy way out of any tough question about the security of these systems. "No, no, you don't understand, it's not that our systems are insecure, it's that the attackers where highly sophisticated and had the resources of a nation state, otherwise it would never have worked out". I suppose "we think it could be done by a group of two or three teenager…

Right. There are situations where we can see that the only apparent way to do something needed very considerable resources, which suggests a state actor.

Equation Group is presumed to be (a front for) the NSA. It forged a (code signing) certificate that otherwise shouldn't exist, using an MD5 collision. But not the MD5 collision painfully created by researchers a little earlier to demonstrate that MD5 was vulnerable, it used a brand new collision purpose made for this attack. That's a considerable investment.

Then also, we can look at who benefits from what was done. Equation Group's "Flame" malware damaged the Iranian nuclear programme. That's something the US government, Israel, some other countries wanted, but it isn't something a bored teenager wants, or a drug cartel, or most for-profit corporations.

As described so far I don't see either the resource needs or the outcome satisfying this conclusion.

Re: U.S. Treasury breached by hackers backed by foreign government – sources

#197

Post by alexgartrell »

frisco wrote: post #162

All these systems are just too complicated. We keep adding features on features to software without a second thought, because it's invisible and you can't immediately tell from looking at it how insane it is, in a way that you wouldn't be able to ignore if these were mechanical systems. Also, not that it would have prevented this attack, but as a community we desperately need a fully open source FPGA-based ultra simp…

I am a huge open source fanboy, but there's nothing magical about open source that makes it secure against nation states.

Re: U.S. Treasury breached by hackers backed by foreign government – sources

#198

Post by 0xbadcafebee »

frisco wrote: post #162

All these systems are just too complicated. We keep adding features on features to software without a second thought, because it's invisible and you can't immediately tell from looking at it how insane it is, in a way that you wouldn't be able to ignore if these were mechanical systems. Also, not that it would have prevented this attack, but as a community we desperately need a fully open source FPGA-based ultra simp…

> as a community we desperately need a fully open source FPGA-based ultra simple firewall appliance

Firewalls are sort of an anti-pattern. The idea of firewalls to most people is "let's make sure they can't get past this one network control and then we can stop thinking about security." But we've known for a long time that defense-in-depth is the only real black-box security strategy. Yes, it would be nice if we could get high-performance packet inspection and analytics for cheap, but by itself it's next to useless.

More than a "firewall" we need 1) federated authentication+authorization protocols to stick in between the network and application-layer protocols (these basically exist but nobody uses them, so it's time to make something trendy), 2) a standard for ephemeral credentials tied to identities (tied to #1), 3) a standard for supply chain verification in modern technology stacks along with a simple way to certify they've been followed. This ensures better integrity of network boundaries (authn+z rather than network security) and that the software along the way is secure against supply-chain attacks.

I don't know if #3 is even possible, but theoretically it is. Just maybe not with any network we have today.

Re: U.S. Treasury breached by hackers backed by foreign government – sources

#199

Post by technion »

_23sd wrote: post #150
res0nat0r wrote: post #143

Earlier quoted context omitted.

WaPo is reporting that this and the FireEye breach were via Solarwinds: > All of the organizations were breached through a network management system called Solar Winds, according to three people familiar with the matter, who spoke on condition of anonymity because of the issue’s sensitivity. https://www.washingtonpost.com/national-security/russian-gov...

Could have been CVE-2020-7984: https://nvd.nist.gov/vuln/detail/CVE-2020-7984 >SolarWinds N-central before 12.1 SP1 HF5 and 12.2 before SP1 HF2 allows remote attackers to retrieve cleartext domain admin credentials from the Agent & Probe settings, and obtain other sensitive information

The articles are referring to Solarwinds Orion, which is a different product to N-central.

I personally found and reported the unpublished CVE-2019-10690 in N-Central, but that was only local privesc.

Re: U.S. Treasury breached by hackers backed by foreign government – sources

#200

Post by dnhz »

chrisseaton wrote: post #192
jjeaff wrote: post #71

Earlier quoted context omitted.

Ya, I think I consume far beyond the average for political news and had never heard of that distinction until now. I just always equated nation-state to country.

Why do you think people said 'nation-state' if you thought it meant the same as the shorter and simpler word 'country'?

To sound geopolitically sophisticated. To pretend at the language of statecraft.
Post reply on HN