Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Technical report on DNC hack [pdf]

us-cert.gov

Post reply on HN
Print view View original

471–480 of 502 posts

Re: Technical report on DNC hack [pdf]

#471

Post by jessaustin »

lern_too_spel wrote: post #449
jessaustin wrote: post #390

Earlier quoted context omitted.

Here you're using a common everyday definition of the verb "rig". Observe that this definition excludes e.g. publicizing a political candidate's banal episodes of tawdriness to the scrutiny of voters, so it's not the definition in wide use in USA news media over the last month or so.

I'm using rig in a broad sense. The DNC didn't publicize banal episodes of tawdriness to the scrutiny of voters. If you're talking about the NGP VAN data access, that hit the news on 12/17/2015 when Michael Briggs (Sanders's communications aide) talked about it to BuzzFeed, and the story blew up on 12/18 when the Sanders campaign filed a lawsuit against the DNC over temporarily shutting down their access to the syste…

That's the point. Rigging an election consists of stuffing ballot boxes or intimidating voters or something like that. Phishing John Podesta is the sort of thing that used to be called "opposition research" (assuming arguendo that the phishing party actually cared who won).

Re: Technical report on DNC hack [pdf]

#472

Post by mistermann »

mundo wrote: post #461
wyager wrote: post #450

Earlier quoted context omitted.

That's not how Occam's razor works. You don't pick the most likely single outcome and then just assume that to be true with 100% confidence. Occam's razor is just an informal statement of the fact that you should assign a higher a priori probability to simpler hypotheses. It doesn't mean you should ignore any marginally less likely hypothesis.

Please stop accusing people of being 100% confident. It's such a weak, insulting tactic. What is the alternate hypothesis that's "marginally less likely"? (Please remember what question we're trying to answer. It is not "Who hacked the DNC?". We are not in a position to know; hell, we don't even know there was a hack. It is also not "Is the FBI trustworthy?" Of course they're not. It is "Why are US intelligence agenc…

Alternative hypotheses are that they don't like to have their activities monitored, and they like people that can be manipulated with propaganda. Trump seems potentially problematic in both respects.

If these organizations are involved in questionable undertakings (it's their job, so I think we can agree the answer is yes), it's not much of a stretch of the imagination that they like to operate without supervision.

Re: Technical report on DNC hack [pdf]

#473

Post by burkaman »

boomboomsubban wrote: post #381
burkaman wrote: post #355

Earlier quoted context omitted.

What does the intelligence community have to gain by perpetrating this hack?

Billions of dollars plus whatever power comes from picking the president and presumably having a potential deepthroat if they don't behave. And remember, the intelligence community is not unified. Even though Obama has been a huge ally of the intelligence community, not all branches got the same deal.

Ok I guess I meant specifically, is there any reason to think the intelligence community would prefer Trump? Presumably they would prefer someone who was more interested in foreign involvement, and less likely to provoke mass donations to privacy and civil rights organizations.

Re: Technical report on DNC hack [pdf]

#474

Post by showmeevidence »

Throwaway because I work in a related field.

Folks, now is the time that we need to make it clear that posturing and PR statements do not constitute valid, independently verifiable evidence. As a citizen of the United States, I am beyond terrified that our government has made public statements, buttressed by newspaper articles supported by nothing but anonymous sources[1], vilifying Russia for a nation-state-level cyberattack. The support for such claims, as presented, is the "sophistication" of the attack, which is not evidenced here (phishing is not a particularly sophisticated means of entry). At best, this is a mistake, and at worst, it wreaks of anti-Russia propaganda that will only serve to escalate tensions between the two countries. Every single person who absorbs a report like this without seeking supporting evidence (note that this report immediately starts by claiming Russia's involvement, and never provides support) is, to some extent, culpable in a hypothetical reality where the US Government is blatantly wrong about this one.

There's only one thing we can do at this point: File Freedom of Information requests. The fine folks at Muckrock[2] make this absurdly easy. Send requests to the CIA and FBI -- hold them accountable to their statements, which have to date been unsupported, that Russia as a nation-state entity was behind anything.

1: http://www.nytimes.com/2016/12/09/us/obama-russia-election-h... 2: https://www.muckrock.com

Re: Technical report on DNC hack [pdf]

#475

Post by dv_dt »

sqeaky wrote: post #149
dv_dt wrote: post #99

Earlier quoted context omitted.

This does not increase my confidence or trust in abstract assurances from intelligence agencies. > In five of six incidents in which troops were wounded by chemical agents, the munitions appeared to have been designed in the United States, manufactured in Europe and filled in chemical agent production lines built in Iraq by Western companies.

I understand why that might superficially decrease you trust in the claims, but consider the perspective of the totalitarian trying to spin up a chemical weapons program. Wouldn't leveraging existing expertise and contractors be a good way to get the weapons you wanted? Why wouldn't a dictator hire outsiders to build weapons? Having his experts check them for traps after the construction sounds much cheaper than buil…

I'm thinking at worst our intelligence agencies were intentionally looking the other way during a time period when Saddam was in favor with the US - and at best they missed it and did not stop the weapon assembly at the time...

Re: Technical report on DNC hack [pdf]

#476

Post by lern_too_spel »

jessaustin wrote: post #471
lern_too_spel wrote: post #449

Earlier quoted context omitted.

I'm using rig in a broad sense. The DNC didn't publicize banal episodes of tawdriness to the scrutiny of voters. If you're talking about the NGP VAN data access, that hit the news on 12/17/2015 when Michael Briggs (Sanders's communications aide) talked about it to BuzzFeed, and the story blew up on 12/18 when the Sanders campaign filed a lawsuit against the DNC over temporarily shutting down their access to the syste…

That's the point. Rigging an election consists of stuffing ballot boxes or intimidating voters or something like that. Phishing John Podesta is the sort of thing that used to be called "opposition research" (assuming arguendo that the phishing party actually cared who won).

I'm sorry, but I don't see what phishing Podesta has to do with fleitz's claim that the DNC rigged the primaries.

Re: Technical report on DNC hack [pdf]

#477

Post by CWuestefeld »

CountSessine wrote: post #271
ethbro wrote: post #239

Earlier quoted context omitted.

Exactly, why burn zero-days when you're targeting a technologically unsophisticated adversary with a huge organizational attack surface? Sure, HDD firmware hacks are cool, but in terms of R&D time far less efficient if you're willing to spam attempts to get in the front door. And I'd say they chose the appropriate level of sophistication given the success of the penetration. The DNC isn't exactly an air-gapped Irania…

Exactly, why burn zero-days when you're targeting a technologically unsophisticated adversary with a huge organizational attack surface? Then how is this evidence of a 'state-sponsored actor'? And how did the narrative of this story ever get derailed from what it should have been, which was, "The DNC, and John Podesta in particular who had both his gmail and his Twitter accounts hacked, are incompetent", to "this is…

this is Russian interference in a US election

Although the media and many in politics are saying this, it's plainly false. There is no serious claim that the Russians interfered in our election.

The claims are that the Russians interfered in a presidential campaign. There's a huge difference between the process of campaigning, versus the election process of casting and counting votes.

Sowing this confusion is useful on at least two levels. Most obviously, it serves to undermine the legitimacy of the incoming President. But it's also useful in setting stage for future debate about campaign finance laws. It's important in that debate to keep separate the ideas of election - which the government must protect to ensure its faithfulness to the voters - versus the idea of campaigning, which the government may never interfere with, which is the primary purpose of the First Amendment.

Re: Technical report on DNC hack [pdf]

#478

Post by stefantalpalaru »

cenkemuygurt wrote: post #469
EthanHeilman wrote: post #270

Earlier quoted context omitted.

The report just didn't get into that much detail but they did say: "the code delivers Remote Access Tools (RATs) and evades detection using a range of techniques." A "range of techniques" includes things like rootkits. >No rootkits, The attackers did use stealthy persistence techniques often called 'rootkits". "the SeaDaddy implant developed in Python and compiled with py2exe and another Powershell backdoor with pers…

Just to add to this, Crowdstrike is on the DNC's payroll. Any conclusions they provide should either be met with skepticism or discredited to a degree.

The Crowdstrike co-founder and CTO is also a Senior Fellow at a think tank that seems particularly giddy about the new Cold War: http://www.atlanticcouncil.org/about/experts/list/dmitri-alp...

Re: Technical report on DNC hack [pdf]

#479

Post by jessaustin »

lern_too_spel wrote: post #476
jessaustin wrote: post #471

Earlier quoted context omitted.

That's the point. Rigging an election consists of stuffing ballot boxes or intimidating voters or something like that. Phishing John Podesta is the sort of thing that used to be called "opposition research" (assuming arguendo that the phishing party actually cared who won).

I'm sorry, but I don't see what phishing Podesta has to do with fleitz's claim that the DNC rigged the primaries.

Perhaps you've missed the last month of news media output; congratulations! There has been a great deal of innuendo about hackers rigging our election under V. Putin's direct command. Here's the top of Google News just now when I checked: [0] This fine polemic starts with a lamentation of Podesta's email security, mumbles through some baseless speculation about fake news and voting machine hacks, then admits to that baselessness before winding up to this breezy pronouncement: "The bottom line is that as dangerous as actual attempts to compromise voter outcome are, the perception that voting results are flawed is also capable of delegitimizing the democratic process. If citizens believe the vote has been rigged, then why bother voting at all?"

One might note that this author stops short of saying rather than merely insinuating that "publishing emails" constitutes "rigging an election", but he sure wrote a lot of words in that effort.

[0] http://www.cnbc.com/2016/12/29/russia-election-hack-obama-re...

Re: Technical report on DNC hack [pdf]

#480

Post by [deleted] »

lern_too_spel wrote: post #449
jessaustin wrote: post #390

Earlier quoted context omitted.

Here you're using a common everyday definition of the verb "rig". Observe that this definition excludes e.g. publicizing a political candidate's banal episodes of tawdriness to the scrutiny of voters, so it's not the definition in wide use in USA news media over the last month or so.

I'm using rig in a broad sense. The DNC didn't publicize banal episodes of tawdriness to the scrutiny of voters. If you're talking about the NGP VAN data access, that hit the news on 12/17/2015 when Michael Briggs (Sanders's communications aide) talked about it to BuzzFeed, and the story blew up on 12/18 when the Sanders campaign filed a lawsuit against the DNC over temporarily shutting down their access to the syste…

[deleted]
Post reply on HN