Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise

krebsonsecurity.com

Post reply on HN
Print view View original

331–340 of 350 posts

Re: U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise

#331

Post by dragonsky »

blunte wrote: post #307
La1n wrote: post #196

Earlier quoted context omitted.

Not everyone who questions something is a paid shill.

The beauty, from a nefarious standpoint, is that you don't have to pay people to spread disinformation. You just have to use the right psych techniques on them and ensure they get proper reinforcement. These are the techniques that have turned my family and many of their friends (and clearly a measurable percentage of Americans) into the exact opposite of the values they taught me and demonstrated for decades. They t…

You might want to explain who Limbaugh, Glenn, Orielly, Carlson etc are for those of use outside of the US bubble

Re: U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise

#332

Post by lovecg »

drdeca wrote: post #221
lovecg wrote: post #111

Earlier quoted context omitted.

Though it should be noted those “4 random word” passwords are strong only if the words are truly random (and the string is less likely to be memorable in this case). A password generator that allows retries means people will hit that button until the string is memorable, reducing the entropy.

I was curious how much the entropy is reduced. As a simplifying assumption, assume everyone agrees about which of any 2 strings are more memorable. If someone takes m random samples, and of those, takes the one they find most memorable, how much does this reduce the entropy? If there are N possible strings, and so with a uniform distribution there would be, uh, -log_2(1/N) bits of entropy, I think(?) (because, summin…

Love this! Thanks, it was a casual idea of mine that I didn’t really think through before.

Here’s a slightly different approach to this. Let’s instead assume that the set of “memorable” strings is constant (say of size N/M where N is the number of all strings) and the user hits as many retries as needed to get a string from the memorable set. If the number of retries is a random variable X, then if we know the distribution of X we know M. Since the number of bits lost is something like \log_2(M), we just want to find out how X relates to M.

EX = \sum_{i\geq 0}i(1-1/M)^i(1/M) = WolframAlpha :) = M - 1

So it matches: if your average number of tries is M - 1, you lose something like \log_2(M) bits of entropy.

Makes me feel better about all those times when I hit retry a dozen times.

Re: U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise

#333

Post by slowhand09 »

35fbe7d3d5b9 wrote: post #174
NikolaNovak wrote: post #159

Earlier quoted context omitted.

1. That's impressive 2. My own knowledge of folk rock and subsequent visits to Google and Wikipedia have not helped me interpret this reference, in this context: "Electric Dylan/Pete Seeger with the axe" Help, please :-D

Ha! https://en.wikipedia.org/wiki/Electric_Dylan_controversy http://communityvoices.post-gazette.com/arts-entertainment-l... > The Cliff Notes version is Dylan, whose latest album Bringing It All Back Home had upset many folk purists with its amplified accompaniment, performed at Newport on July 25 with amplified backing by the Paul Butterfield Blues Band, who played the festival on their own. As an offended audience…

TIL! -Bravo!

Re: U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise

#334

Post by jessaustin »

Throwaway1771 wrote: post #323
jeffreyrogers wrote: post #182

Earlier quoted context omitted.

He's not denying Russia does hacking. He's saying there is no evidence that ties this to Russia over any other group. Maybe Russia is most likely based on priors, but I don't think the average HN commenter has an accurate estimate of nation-state hacking frequencies.

"Attribution is hard."

Sometimes it seems there's a related law that has replaced the one you cite: "When in doubt, blame Russia."

Re: U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise

#335

Post by jessaustin »

dukeofdoom wrote: post #246

So was the election hacked too? I'm a little confused how Biden can get 80 million votes, and almost no one watched his acceptance speech today. 40k views on youtube. The 6k vote flipping in Michigan was claimed to be some sort of computer error. But why were the logs deleted? that seems like a hacker thing to do to delete the logs. A judge just released the audit report. https://www.freep.com/story/news/politics/ele…

I wish you would be as concerned about the hundreds of thousands of poor and minority citizens who are denied their votes every election.

https://www.washingtonpost.com/outlook/2020/12/10/voter-supp...

Re: U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise

#336

Post by hn_throwaway_99 »

jiggawatts wrote: post #282
hn_throwaway_99 wrote: post #265

Earlier quoted context omitted.

The best proof that we went to the moon is that we left mirrors there that we use to bounce lasers off of to detect the distance to the moon.

That's difficult for people with poor science educations to fully grasp. For example, they might think that the moon's surface itself could reflect the laser light, etc... Not to mention that unmanned probes could also have placed reflectors without humans ever being sent to the Moon!

Just 2 points to add here:

Scientists have reflected lasers just off the surface, and there are unmanned probes (Russian ones) that placed reflectors on the moon.

But the point should still be that, if anyone cares to learn about the difference, and how we know the difference between all these different types of reflectors, that information is freely available and could easily be understood by most people.

Re: U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise

#337

Post by jessaustin »

dillondoyle wrote: post #297
jessaustin wrote: post #201

Earlier quoted context omitted.

Hell, it could be a different part of the USA government, like those "sonic embassy attacks" were.

What? are you implying that the US government perpetrated attacks on US gov personnel? the amount of insane unfounded crap posted in HN comments is growing and i'm not sure if there is a fix. BTW recent articles say it's microwaves

Yes, one must see the most recent coverage to know the current story. ISTR someone had retired from CIA and was shopping a memoir around; apparently the only exploit he could mention on the record was that one time he got sick. Just his bad luck that in late 2020 we're mostly thinking about a different illness.

The only common element among USA facilities in Havana, Guangzhou, and Tashkent is the USA facilities themselves. Much like the situation described in TFA, those facilities were built by the most corrupt bidders. It will surprise no one when it is revealed that some corner was cut, and American personnel were exposed to harmful amounts of some ghastly chemicals, radiations, etc.

It is literally a conspiracy theory to reject this simplest possible explanation in favor of some outlandish three-way joint venture among the Cubans, the Chinese, and the Uzbeks, three nations not known for ever having done anything together.

Re: U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise

#339

Post by lionkor »

icedistilled wrote: post #161
just_steve_h wrote: post #119

So far I've seen ZERO EVIDENCE. Reuters and the Washington Post have breathless claims of Russian hackers "according to officials familiar with the matter." Uh huh. Saying "APT29" or "CozyBear" doesn't make the accusation any more credible. If multiple US agencies are trumpeting the same story, you really must ask yourself "Why? Why this? Why now?" It's pretty amusing, in a depressing way, to see how quickly so many…

Why are there so many people who absolutely deny Russia does any hacking. It's always some big conspiracy theory that multiple cyber security agencies, all the three letter agencies, and multiple news agencies are in on. I'd bring up tin foil hats, but nowadays we can make fabric faraday cages so we can all be fashionable no matter what we believe.

Russians do a lot of hacking. It doesnt mean its the government or any official body, though. The non-stop, partially unfounded russia bashing and excessive repeated sanctioning is pissing off a LOT of highly skilled russian programmers.

I dont think the russian goverment is behind most attacks.

Re: U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise

#340

Post by lionkor »

DethNinja wrote: post #95
nromiun wrote: post #42

Earlier quoted context omitted.

Am I missing something? Why is everyone so sure that it is Russia? Are they the only ones with access to computers beside US?

Because it definitely couldn’t be China or any other country.

Couldn't be china, they can't access the outside world ;)
Post reply on HN