Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Winnti: Hackers attacking the heart of German industry

br24.de

Post reply on HN
Print view View original

31–40 of 154 posts

Re: Winnti: Hackers attacking the heart of German industry

#31

Post by hakantan »

yorwba wrote: post #28
hakantan wrote: post #21

Earlier quoted context omitted.

Hi. One of the author(s) of the article here. The plain article with information-only is over here: https://www.tagesschau.de/investigativ/ndr/winnti-101.html We released a longer version, because we do hear very often that people don't understand how these intrusions are actually working. Also, we tried to show the scale. -> both long form and shorter version hope that helps.

Who was the target audience for the long-form article? It has some technical details, but they appear to be used more for decorative effect. E.g. the string daa0 c7cb f4f0 fbcf d6d1 from the hexdump is eventually revealed to correspond to C:\Windows , but isn't actually explained. I was able to come up with the following Python for the obfuscation: [hex((i + 153) ^ ord(c)) for i, c in enumerate(r'C:\Windows')] but mo…

This is a very good question. By now, there is a git repo (https://github.com/br-data/2019-winnti-analyse) for the more technical folks (includes yara, some scripts etc.)

We don't have focus groups, but we want to convey to our readers are certain understanding how these operations work. What threat hunting is, why it is important and all that.

At some point you have to make some certain decisions. One was not to explain what a rolling xor is. So yeah, we had to simplify a lot. The truth is, though, this stuff is hard for most people, myself included.

Hope that helps.

Re: Winnti: Hackers attacking the heart of German industry

#32

Post by iserlohnmage »

lnsru wrote: post #10

As of today we still use shared network drives for everything in major German company. We don’t use slack/irc/Skype/zoom/whatever. Phone calls and conferences(!) from the middle of open office is normal. Asana/Trello/Jira are not known at all. GitHub is paid for, but never used. I am single weirdo in multi department project using github ticket system. The code with prefix is copied for colleagues to project’s shared…

I did internships at some top companies in the automotive industry. I can only confirm that.

Re: Winnti: Hackers attacking the heart of German industry

#33

Post by pjmlp »

est31 wrote: post #27
mschuster91 wrote: post #17

Earlier quoted context omitted.

> treating IT like a cost center that has to be outsourced to wherever is cheaper As if outsourcing wasn't a common trend across Western companies "thanks" to globalization and the utter dominance of US-american neoliberalism. > and companies' tradition of rewarding management incompetence over technical competence Again, quite common - the "old" Soziale Marktwirtschaft moguls with decades-long visions would not let…

I'm a German soon to be CS graduate and right now my favourites are SV and London. I'll try to get into a company that can sponsor L1 visa for SV first and then I'll try London. The German job market is precisely as described by GP: you are competing all the time with remote people in countries with much smaller cost of living and the wages are super low compared to aforementioned places. Germany has great schools, a…

As Portuguese doing consultancy in Germany, the market is way better than in other European countries.

As for the software quality, it is everywhere the same when the main business is not selling software packages.

Companies just care that their use cases are covered, no matter how it looks under the hood.

Re: Winnti: Hackers attacking the heart of German industry

#34

Post by kriro »

lnsru wrote: post #10

As of today we still use shared network drives for everything in major German company. We don’t use slack/irc/Skype/zoom/whatever. Phone calls and conferences(!) from the middle of open office is normal. Asana/Trello/Jira are not known at all. GitHub is paid for, but never used. I am single weirdo in multi department project using github ticket system. The code with prefix is copied for colleagues to project’s shared…

I think there's a pretty big gap between "software first" companies and engineering driven ones (car companies, "Maschinenbau" etc.). Sometimes the cultural gap is pretty shocking to me. I made a career decision to avoid engineering driven companies for software related jobs because the situations are usually similar to your scenario.

Re: Winnti: Hackers attacking the heart of German industry

#35

Post by mehdix »

ChuckNorris89 wrote: post #11
lnsru wrote: post #10

As of today we still use shared network drives for everything in major German company. We don’t use slack/irc/Skype/zoom/whatever. Phone calls and conferences(!) from the middle of open office is normal. Asana/Trello/Jira are not known at all. GitHub is paid for, but never used. I am single weirdo in multi department project using github ticket system. The code with prefix is copied for colleagues to project’s shared…

Germany's tech illiteracy is a self-inflicted consequence of its pitiful salaries in this field, treating IT like a cost center that has to be outsourced to wherever is cheaper and companies' tradition of rewarding management incompetence over technical competence. Consequently, Germany's most brilliant tech minds leave for The Valley, Zurich or London. You reap what you sow.

> companies' tradition of rewarding management incompetence over technical competence

I witnessed this and moved out of the large rich corporate to a small startup to keep my sanity.

Re: Winnti: Hackers attacking the heart of German industry

#36

Post by lnsru »

maze-le wrote: post #30
lnsru wrote: post #10

As of today we still use shared network drives for everything in major German company. We don’t use slack/irc/Skype/zoom/whatever. Phone calls and conferences(!) from the middle of open office is normal. Asana/Trello/Jira are not known at all. GitHub is paid for, but never used. I am single weirdo in multi department project using github ticket system. The code with prefix is copied for colleagues to project’s shared…

>> Packet analysis was seen as the worst thing in the company Wow, that is just insane... "We want you to put a nail in that board but, by god do not even think of using a hammer". That must be the worst case of "security" by obscurity I have ever heard. Was this one of the bigger companies or a smaller firm? I wonder what kind of decision making process leads to such policies.

A big company doing mainly nice white fridges and yellow construction machinery. But they also do parts for planes. After quitting I heard, they were having some military project and had strict rules for it... Same building, same strict rules for everybody.

Re: Winnti: Hackers attacking the heart of German industry

#37

Post by kriro »

adrianN wrote: post #24
ChuckNorris89 wrote: post #11

Earlier quoted context omitted.

Germany's tech illiteracy is a self-inflicted consequence of its pitiful salaries in this field, treating IT like a cost center that has to be outsourced to wherever is cheaper and companies' tradition of rewarding management incompetence over technical competence. Consequently, Germany's most brilliant tech minds leave for The Valley, Zurich or London. You reap what you sow.

I don't think that's the case. I believe the problem is that large German companies tend to be hardware companies. They're used to development cycles that take years and extremely conservative in adopting new methods. Management and company culture is not used to dealing with fast changing development methods (where fast is anything that changes more often than once a decade). Rigid processes for compliance with exte…

Pretty much agree with this sentiment regarding hardware/culture.

Also the salaries are acceptable (imo) compared to fairly high paying US jobs if you compare real working hours (vacation time, real 40h workweeks etc.). With a family there's even more benefits. Cost of living also tends to be fairly low (with a high quality of life) compared to higher paying places.

Re: Winnti: Hackers attacking the heart of German industry

#38

Post by mehdix »

bobjordan wrote: post #16

"Modern-day espionage operations have one big advantage: Instead of painstakingly planting agents in companies, digital spies are simply sending prepared emails." We face this threat in my business - daily fishing attempts or schemes to get employees to open files. It never stops. This is a primary reason when we started designing our new web app at bomquote.com a few years ago, we first focused on communication tool…

Is there any business out there that does not use email?

Re: Winnti: Hackers attacking the heart of German industry

#39

Post by est31 »

pjmlp wrote: post #33
est31 wrote: post #27

Earlier quoted context omitted.

I'm a German soon to be CS graduate and right now my favourites are SV and London. I'll try to get into a company that can sponsor L1 visa for SV first and then I'll try London. The German job market is precisely as described by GP: you are competing all the time with remote people in countries with much smaller cost of living and the wages are super low compared to aforementioned places. Germany has great schools, a…

As Portuguese doing consultancy in Germany, the market is way better than in other European countries. As for the software quality, it is everywhere the same when the main business is not selling software packages. Companies just care that their use cases are covered, no matter how it looks under the hood.

Of course Germany is a better market than say portugal. But that doesn't mean that I'll try to check the globally competitive offers first, to which Germany doesn't seem to belong.
Post reply on HN