Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Technical report on DNC hack [pdf]

us-cert.gov

Post reply on HN
Print view View original

141–150 of 502 posts

Re: Technical report on DNC hack [pdf]

#141

Post by _cereal »

altendo wrote: post #35

As an aside, for those looking to understand YARA rules, [1] provides a brief introduction and [2] introduces how to write them. I needed to look it up myself, but seems relatively straightforward if you have a programming background. tl;dr: YARA rules are a method of categorizing malware based on their characteristics. So the PDF here released a YARA rule to determine a specific piece of malware used in the hack (it…

> (it's not clear to me what it identifies, other than a PHP script)

It seems obfuscated code. The $base64decode string seems a regular expression to generate the PHP `base64_decode()` function.

At some point the script would read a base64 string, which would be an encoded PHP script retrieved from remote or included in the script. The output is then executed through the `eval()` function. Like in this example: http://ideone.com/awhqOg

Re: Technical report on DNC hack [pdf]

#143

Post by eropple »

cookiecaper wrote: post #138
AndrewKemendo wrote: post #75

Earlier quoted context omitted.

You're ignoring the political context in which it was released. 1. Released the same day as the announcement of formal Russian Sanctions 2. Released the same day US made 35 "diplomats" (aka. known Human Intelligence Officers) Persona Non Grata. Which is a big deal. This type of document is not intended to "make the case" because we don't do that. Making a case for something by definition, would reveal sources and met…

It appears to confirm what we knew: the DNC's failure to adhere to basic security protocols, which would be enforced in any corporation with more than a couple dozen employees (edit: or not, see eropple's comment below), allowed its systems to be compromised by script kiddies (for political reasons, the USG insists these script kiddies are sponsored by the Russian government, and insists we take them at their word).…

> which would be enforced in any corporation with more than a couple dozen employees

No they wouldn't, and you are one of the people here who I would say should very well know it. :p

The DNC screwed up, but the overwhelming majority of everybody else screws up to this level or worse on the regular.

Re: Technical report on DNC hack [pdf]

#144

Post by codedokode »

eropple wrote: post #133
codedokode wrote: post #127

I have looked through the report. The only useful information was brief description of attack methods, everything else looks like a list of general recommendations one can find on the OWASP website. As I understand from report the main methods used were: - sendind emails with executable files that victims for some reason executed - phishing So, they used script kiddie level tools anyone could use (and they are cheap;…

> This attacks could be easily mitigated. [...] second, we should start using physical cryptographic keys instead of passwords Man--I like the way you think, I really do, but this is not "easy". Technical simplicity and social ease are vastly different, and it's usually the humans who are getting hacked.

If an organization is working with sensitive data maybe they should invest some resources into security. I understand it is not easy because companies like Microsoft have been releasing poorly designed software (with things like autorun for USB drives) for 20 years and it still is the leader. But we have to advance step by step. For every single person needing executable attacments there are maybe million users who can run them without understanding the consequences.

Re: Technical report on DNC hack [pdf]

#145

Post by eropple »

_cereal wrote: post #141
altendo wrote: post #35

As an aside, for those looking to understand YARA rules, [1] provides a brief introduction and [2] introduces how to write them. I needed to look it up myself, but seems relatively straightforward if you have a programming background. tl;dr: YARA rules are a method of categorizing malware based on their characteristics. So the PDF here released a YARA rule to determine a specific piece of malware used in the hack (it…

> (it's not clear to me what it identifies, other than a PHP script) It seems obfuscated code. The $base64decode string seems a regular expression to generate the PHP `base64_decode()` function. At some point the script would read a base64 string, which would be an encoded PHP script retrieved from remote or included in the script. The output is then executed through the `eval()` function. Like in this example: http:…

This is a pretty common PHP payload idiom, yup yup. (It also is common with proprietary PHP applications, CMS extensions, etc. that are happy to burn your system performance to "protect their IP". I've been unwinding them since I was twelve.)

Re: Technical report on DNC hack [pdf]

#146

Post by UnoriginalGuy »

__jal wrote: post #51

This is a magic report. Over the next 24 hours, it will transform a huge number of people into experts on intelligence reporting requirements, hacking, sources and methods, and diplomacy.

Respectfully, do you feel this is constructive discourse?

Because to me the purpose of your comment is to drag down other comments, even yet unmade ones, into the mud. Invalidating everyone's opinion on this subject except 0.1% of the population (namely very specific experts). Even politicians or professional political commentators wouldn't meet your high bar.

And to the people who do feel like the bar should be set at "only experts are allowed an opinion" then why stop on this issue? Why not branch it out to every major political issue? Plus seemingly being well read on a topic is no longer enough to have an informed opinion, qualifications are the only metric by which we can measure an argument rather than the qualities of the argument itself.

My point is that this is a dangerous argument that only seeks to result in the silence of commentators. It only detracts rather than adds to the discussion's value.

Re: Technical report on DNC hack [pdf]

#147

Post by smitherfield »

acjohnson55 wrote: post #124
downandout wrote: post #46

It seems unlikely that email hacking will stop in the future. If the leaked emails actually influenced the elections, it was because of their content. I've heard exactly zero credible claims that the leaked emails were falsified in any way. Perhaps if political candidates/party executives are going to do unethical/illegal things, they shouldn't discuss them over email. Edit: changed "zero claims" to "zero credible cl…

It's rather naive to think these things didn't have an effect. The problem isn't the truth of the claims, it's that the illicitly gained information was strategically released to disrupt one specific campaign, effectively destabilizing our election. Much like Comey's last minute email announcement revealed nothing new, yet allowed the email narrative to renew its currency in the last days of the campaign. Imagine if…

> Imagine if the IRS "accidentally" released Trump's tax returns or been hacked to allow this data to come out.

The NYT did publish Trump's stolen tax return, and were quite self-congratulatory about having done so...

> Or if the alleged tapes went public of Donald Trump making openly racist remarks on his TV shows outtakes.

...and, the stories about the hacked material were outnumbered probably 100-1 by the simultaneous coverage of the stolen backstage Access Hollywood tape (which was doubly illegal because California is a "two-party consent" state).

Which is not to say either of those things weren't newsworthy, or shouldn't have been reported on, but: it's completely, blatantly hypocritical to say that illegally-obtained information should not be allowed to affect the election when it hurts one candidate, but is fair game to use to hurt the other.

Re: Technical report on DNC hack [pdf]

#148

Post by coldcode »

Jeez people, read the report, it isn't any kind of justification of anything, its just a fairly generic don't do this, like I see 100 times a week at work. The real details were likely shown to congress and the senate (or at least a portion of it). Those are the only people who can say if the actual attack was real or imagined. Do you think the British and Americans were going to publish stories about Enigma back in WW2 in the Times during the war? There were like a handful of people in the world who knew the details.

While we technical folks would love to see all the details that's not how intelligence works. Some things have to be secret even though these days everything becomes a conspiracy and a political controversy and a tweet storm.

That said I doubt anyone in either party committee had any idea how security works; even worse is that much of the US government is (and will be) lead by political benefactors with an axe to grind and not people with a real clue about modern security either so expect nothing much different in the future until someone hacks the nuclear "football".

Re: Technical report on DNC hack [pdf]

#149

Post by sqeaky »

dv_dt wrote: post #99
Tech1 wrote: post #90

Earlier quoted context omitted.

I'm an ex Army bomb technician, let me help you. You know WMDs were found in Iraq right? ..Unless we're not calling stockpiled chemical weapons WMDs anymore. http://www.nytimes.com/interactive/2014/10/14/world/middleea...

This does not increase my confidence or trust in abstract assurances from intelligence agencies. > In five of six incidents in which troops were wounded by chemical agents, the munitions appeared to have been designed in the United States, manufactured in Europe and filled in chemical agent production lines built in Iraq by Western companies.

I understand why that might superficially decrease you trust in the claims, but consider the perspective of the totalitarian trying to spin up a chemical weapons program. Wouldn't leveraging existing expertise and contractors be a good way to get the weapons you wanted? Why wouldn't a dictator hire outsiders to build weapons?

Having his experts check them for traps after the construction sounds much cheaper than building his own design teams.

Re: Technical report on DNC hack [pdf]

#150

Post by gravypod »

codedokode wrote: post #127

I have looked through the report. The only useful information was brief description of attack methods, everything else looks like a list of general recommendations one can find on the OWASP website. As I understand from report the main methods used were: - sendind emails with executable files that victims for some reason executed - phishing So, they used script kiddie level tools anyone could use (and they are cheap;…

Check out the Mooltipass it's the hardware security device I want but can't afford because of college.
Post reply on HN