Technical report on DNC hack [pdf] • Hacker News Board

Re: Technical report on DNC hack [pdf]

#131

Post by codedokode » Thu, Dec 29, 2016, 10:14 PM UTC

altendo wrote: post #35

As an aside, for those looking to understand YARA rules, [1] provides a brief introduction and [2] introduces how to write them. I needed to look it up myself, but seems relatively straightforward if you have a programming background. tl;dr: YARA rules are a method of categorizing malware based on their characteristics. So the PDF here released a YARA rule to determine a specific piece of malware used in the hack (it…

This rule is pretty useless. It requires file to be of a specific size and it requires function names not to be obfuscated. One could simply add a space between 'md5' and 'strrev' to bypass this rule.

And they replaced digits in 'base64_decode' with regexp as if there were other similar functions.

Re: Technical report on DNC hack [pdf]

#132

Post by UnoriginalGuy » Thu, Dec 29, 2016, 10:16 PM UTC

codedokode wrote: post #127

I have looked through the report. The only useful information was brief description of attack methods, everything else looks like a list of general recommendations one can find on the OWASP website. As I understand from report the main methods used were: - sendind emails with executable files that victims for some reason executed - phishing So, they used script kiddie level tools anyone could use (and they are cheap;…

> By the way iOS is the only popular operating system I know that doesn't allow to execute files downloaded from web or emails.

Windows 8, 8.1, and 10 don't allow it either. SmartScreen will block unsigned executables by default[0]. Enterprise customers should be using AppLocker which does a lot of what SmartScreen does, but with more flexibility and control.

The issue arises when [bad] System Administrators disable SmartScreen because it is a "hassle" and don't deploy AppLocker in its place. This effectively sends their users back to a Windows 7 level of security.

If Microsoft forced either SmartScreen OR AppLocker, then we'd have people on here screaming about freedom, Microsoft is evil, "Embrace, extend and extinguish," year of the Linux desktop, and so on. This is the best they can without treating System Admins like babies (even when they're going to use that power for "evil").

[0] https://blogs.msdn.microsoft.com/ie/2012/08/14/microsoft-sma...

Re: Technical report on DNC hack [pdf]

#133

Post by eropple » Thu, Dec 29, 2016, 10:17 PM UTC

codedokode wrote: post #127

I have looked through the report. The only useful information was brief description of attack methods, everything else looks like a list of general recommendations one can find on the OWASP website. As I understand from report the main methods used were: - sendind emails with executable files that victims for some reason executed - phishing So, they used script kiddie level tools anyone could use (and they are cheap;…

> This attacks could be easily mitigated. [...] second, we should start using physical cryptographic keys instead of passwords

Man--I like the way you think, I really do, but this is not "easy". Technical simplicity and social ease are vastly different, and it's usually the humans who are getting hacked.

Re: Technical report on DNC hack [pdf]

#134

Post by 15155 » Thu, Dec 29, 2016, 10:18 PM UTC

ryanlol wrote: post #31

dominotw wrote: post #23

Earlier quoted context omitted.

How do bunch of ip addresses form china/Sweden/germany/canada make this attack attributable to russians .

I guess the real question is, why should these IP addresses from those countries make this attack attributable to Russia? Unless you can answer that, yours doesn't really make much sense.

Why would IP addresses _in Russia_ automatically make attacks attributable to Russia?

Re: Technical report on DNC hack [pdf]

#135

Post by porpoisemonkey » Thu, Dec 29, 2016, 10:19 PM UTC

walshemj wrote: post #117

naturally2014 wrote: post #103

Earlier quoted context omitted.

I'd guess a third option, actually: It's just a best guess, but they don't like being questioned. If they had damning evidence it'd be in their interest to release it.

Not if it would give any humint sources away and they may have kicked out people to allow a source to step into their shoes - as the UK did to put there man in as the Resident in London

It's somewhat obvious from the context but for anyone not familiar with military jargon I think the parent post meant to say "humint" instead of "humit" which is short hand for "human intelligence" or in layman's terms "spies".

Re: Technical report on DNC hack [pdf]

#136

Post by greglindahl » Thu, Dec 29, 2016, 10:21 PM UTC

UnoriginalGuy wrote: post #132

codedokode wrote: post #127

I have looked through the report. The only useful information was brief description of attack methods, everything else looks like a list of general recommendations one can find on the OWASP website. As I understand from report the main methods used were: - sendind emails with executable files that victims for some reason executed - phishing So, they used script kiddie level tools anyone could use (and they are cheap;…

> By the way iOS is the only popular operating system I know that doesn't allow to execute files downloaded from web or emails. Windows 8, 8.1, and 10 don't allow it either. SmartScreen will block unsigned executables by default[0]. Enterprise customers should be using AppLocker which does a lot of what SmartScreen does, but with more flexibility and control. The issue arises when [bad] System Administrators disable…

Isn't there a history of signed malicious things? For example:

https://www.zscaler.com/blogs/research/yet-another-signed-ma...

Re: Technical report on DNC hack [pdf]

#137

Post by 15155 » Thu, Dec 29, 2016, 10:22 PM UTC

grandalf wrote: post #25

jbeckham wrote: post #19

Nothing about this supports a Russian attribution.

We're supposed to trust them that it was not just Russian geographically but the Russian government and also the highest levels of the Russian government.

WMDs were in Iraq, too, didn't you hear?

Re: Technical report on DNC hack [pdf]

#138

Post by cookiecaper » Thu, Dec 29, 2016, 10:22 PM UTC

AndrewKemendo wrote: post #75

snowwrestler wrote: post #14

Folks, the point of this report is not to justify the punitive actions taken today. It is to provide information that companies can use to protect themselves against similar attacks in the future. So if you judge it by whether it "makes the case" against Russia, it will be lacking. We don't need 100 comments pointing that out.

You're ignoring the political context in which it was released. 1. Released the same day as the announcement of formal Russian Sanctions 2. Released the same day US made 35 "diplomats" (aka. known Human Intelligence Officers) Persona Non Grata. Which is a big deal. This type of document is not intended to "make the case" because we don't do that. Making a case for something by definition, would reveal sources and met…

It appears to confirm what we knew: the DNC's failure to adhere to basic security protocols, which would be enforced in any corporation with more than a couple dozen employees (edit: or not, see eropple's comment below), allowed its systems to be compromised by script kiddies (for political reasons, the USG insists these script kiddies are sponsored by the Russian government, and insists we take them at their word).

This document says the attack would've failed if the DNC had watched out for SQL injection and if DNC staffers had not fallen for a phishing scheme. We're supposed to believe only a nation-state could've conducted these attacks? This is "Baby's First Hack" level stuff.

This only further proves the government's propaganda policy for dealing with prominent cybersecurity breaches: blame it all on a foreign boogieman, as they did in the case of the Sony leak, so that the public doesn't catch on to just how very vulnerable all their electronic data is to practically anyone with the inclination to attempt to steal it.

Re: Technical report on DNC hack [pdf]

#139

Post by ryanlol » Thu, Dec 29, 2016, 10:23 PM UTC

15155 wrote: post #134

ryanlol wrote: post #31

Earlier quoted context omitted.

I guess the real question is, why should these IP addresses from those countries make this attack attributable to Russia? Unless you can answer that, yours doesn't really make much sense.

Why would IP addresses _in Russia_ automatically make attacks attributable to Russia?

They wouldn't?

Re: Technical report on DNC hack [pdf]

#140

Post by buffasden » Thu, Dec 29, 2016, 10:23 PM UTC

snowwrestler wrote: post #14

Folks, the point of this report is not to justify the punitive actions taken today. It is to provide information that companies can use to protect themselves against similar attacks in the future. So if you judge it by whether it "makes the case" against Russia, it will be lacking. We don't need 100 comments pointing that out.

The report is literally titled: "GRIZZLY STEPPE – Russian Malicious Cyber Activity"

Yet it doesn't actually make a case for Russian Malicious Cyber Activity. People are pointing out the obvious spin on this especially since it's extremely light on technical details or a reason to exist other than propaganda. Reasonable companies don't need to be taught about phishing attacks.