Winnti: Hackers attacking the heart of German industry • Hacker News Board

Re: Winnti: Hackers attacking the heart of German industry

#61

Post by noir_lord » Wed, Jul 24, 2019, 2:03 PM UTC

lnsru wrote: post #10

As of today we still use shared network drives for everything in major German company. We don’t use slack/irc/Skype/zoom/whatever. Phone calls and conferences(!) from the middle of open office is normal. Asana/Trello/Jira are not known at all. GitHub is paid for, but never used. I am single weirdo in multi department project using github ticket system. The code with prefix is copied for colleagues to project’s shared…

England checking in, that all sounds strangely familiar even down to the network shares.

Honestly security at this point is a myth, we can't close the door after the horse bolted as the barn is currently on fire and the horse has been gone so long it's settled down and raised a family.

Re: Winnti: Hackers attacking the heart of German industry

#62

Post by yorwba » Wed, Jul 24, 2019, 2:13 PM UTC

hakantan wrote: post #31

yorwba wrote: post #28

Earlier quoted context omitted.

Who was the target audience for the long-form article? It has some technical details, but they appear to be used more for decorative effect. E.g. the string daa0 c7cb f4f0 fbcf d6d1 from the hexdump is eventually revealed to correspond to C:\Windows , but isn't actually explained. I was able to come up with the following Python for the obfuscation: [hex((i + 153) ^ ord(c)) for i, c in enumerate(r'C:\Windows')] but mo…

This is a very good question. By now, there is a git repo ( https://github.com/br-data/2019-winnti-analyse ) for the more technical folks (includes yara, some scripts etc.) We don't have focus groups, but we want to convey to our readers are certain understanding how these operations work. What threat hunting is, why it is important and all that. At some point you have to make some certain decisions. One was not to e…

I didn't expect you to deliver a crash course that would allow even non-technical readers to understand all details, so I realize that you had to leave out a lot. That puts you in an awkward spot where your explanation probably creates more new questions than it answers.

Some news websites hesitate to put external links in their articles because they lead readers off the site, but I think they can be helpful to provide jumping-off points for the interested reader. For example, the git repository could be linked somewhere in the article, or as part of the "about the project" section at the end.

PS: The top-level comment of this thread was flagged and hidden, so most users won't see your replies here. You might want to post another top-level comment with the additional information you provided here, or maybe ask the mods via hn@ycombinator.com to make your replies visible.

Re: Winnti: Hackers attacking the heart of German industry

#63

Post by L_226 » Wed, Jul 24, 2019, 2:15 PM UTC

lnsru wrote: post #10

As of today we still use shared network drives for everything in major German company. We don’t use slack/irc/Skype/zoom/whatever. Phone calls and conferences(!) from the middle of open office is normal. Asana/Trello/Jira are not known at all. GitHub is paid for, but never used. I am single weirdo in multi department project using github ticket system. The code with prefix is copied for colleagues to project’s shared…

We're hiring for software at Stenon, we make a portable soil analysis device for real time agricultural nutrient analysis [0][1]. Based in Potsdam, Brandenburg (30 minutes on the train from Berlin), and yes, we use git :)

[0] - https://stenon.io [1] - https://stenon.io/en/career/

Re: Winnti: Hackers attacking the heart of German industry

#64

Post by nosianu » Wed, Jul 24, 2019, 2:25 PM UTC

est31 wrote: post #27

mschuster91 wrote: post #17

Earlier quoted context omitted.

> treating IT like a cost center that has to be outsourced to wherever is cheaper As if outsourcing wasn't a common trend across Western companies "thanks" to globalization and the utter dominance of US-american neoliberalism. > and companies' tradition of rewarding management incompetence over technical competence Again, quite common - the "old" Soziale Marktwirtschaft moguls with decades-long visions would not let…

I'm a German soon to be CS graduate and right now my favourites are SV and London. I'll try to get into a company that can sponsor L1 visa for SV first and then I'll try London. The German job market is precisely as described by GP: you are competing all the time with remote people in countries with much smaller cost of living and the wages are super low compared to aforementioned places. Germany has great schools, a…

> I'm a German soon to be CS graduate

As someone who was in that position ca. 20 years ago and then moved to SV for almost a decade: I don't think I would have dare to make such a sweeping claim as you:

> The German job market is precisely as described by GP

As a completely new entry into the job market, despite plenty of real work experience (during the last two years of my study the study was "secondary", I managed to make all major university projects about things I needed to do at work anyway), how could I possibly have know enough? I know I never had that feeling.

I actually did move to SV immediately so I can understand what draws you, no argument there. Still, I returned after almost a decade.

I think you are waayyyyyy overvaluing your own experience level. Where does such confidence come from? You cannot know even 1% of the German IT job market given how many medium sized of importance there are. Even in the US there is a large number of software businesses nobody has ever heard of because they are in a niche. For example, I once consulted for a company in Fort Worth (TX) where software for giants like Walmart was written. I think even here in this forum very few people would have heard of that company.

Occasionally someone, often magazines, ask about-to-be-finished students where they want to work. Inevitably the top ten are a handful of major names. That says a lot about students knowledge about potential employers, which seems to consist of only a few names of the already well-known few big companies. It says nothing at all about the reality of the far more diverse job market and the myriad of interesting options at thousands of other interesting companies.

Example: Top companies to work for,

- Students of business: https://www.arbeitgeber-ranking.de/rankings/studenten/bereic...

- Students of engineering: https://www.arbeitgeber-ranking.de/rankings/studenten/bereic...

If you just drive through Germany blindly, without a map, you'll find company after company that would never be listed here because they are not a mass-market brand.

So by all means, do go to SV, it's certainly a great experience. Just don't overvalue your own experience, and question why you are so confident in your claims and generalizing your own very limited experience.

Re: Winnti: Hackers attacking the heart of German industry

#65

Post by yorwba » Wed, Jul 24, 2019, 2:26 PM UTC

solarkraft wrote: post #23

Good article. I am not so bothered by the effects, I think they complement the article well. I sure like that what may seem like decoration to some readers is actually real - I find it very interesting to find out that they find the malware using nmap. Now where do I get that script? More detail would of course always be nice.

Git repo was linked by OP in this [dead] subthread: https://news.ycombinator.com/item?id=20514267

The nmap script was written by ThyssenKrupp's security division and can be found here: https://github.com/TKCERT/winnti-nmap-script/blob/master/win...

Re: Winnti: Hackers attacking the heart of German industry

#66

Post by est31 » Wed, Jul 24, 2019, 2:28 PM UTC

kayoone wrote: post #43

est31 wrote: post #27

Earlier quoted context omitted.

I'm a German soon to be CS graduate and right now my favourites are SV and London. I'll try to get into a company that can sponsor L1 visa for SV first and then I'll try London. The German job market is precisely as described by GP: you are competing all the time with remote people in countries with much smaller cost of living and the wages are super low compared to aforementioned places. Germany has great schools, a…

come to Berlin, nothing of what you say applies there imo. Salaries might be substantially lower than in SV, but it's also far far cheaper. Eg. as a Senior 70-90k EUR is realistic in Berlin (without management), allowing you a very good quality of live in a city that is nowhere near SV/London in terms of rent and many other expenses.

IDK I'm not a very consumption oriented person. In the phase of life following my graduation I plan to save my money so "how much can you save" is the metric I compare places by. Yes, SV has a higher cost of living and I'm not an extremist like this very frugal guy who lived in a van for his mountain view internship (cool trick though!). But from my assessment even if you rent a room/condo, SV/London are still more attractive than Germany.

If your lifestyle is to spend most of your paycheck (which is a fine lifestyle btw, I don't want to be judgemental), then I think Berlin is much greater than SV. The fewer money you get is at the same time more powerful in Berlin. If you have children, even more so.

But you know you maybe want to buy a flat or house, but for that you need money. It's hard and takes years to use your SV/London wage to buy SV/London flats. It's hard to use your Berlin wage to buy Berlin flats. It is comparatively easy though to use your SV/London wage to buy a Berlin flat.

Germany is not unattractive for me on a permanent basis, but I think in the current situation I'm in, other places are more attractive.

Also I might be wrong, I'll conduct a final assessment once I graduated and have concrete job and wage offers and can do cost of living calculations and how much I'll be able to save after deducing all costs I expend.

Re: Winnti: Hackers attacking the heart of German industry

#67

Post by ChuckNorris89 » Wed, Jul 24, 2019, 2:29 PM UTC

mschuster91 wrote: post #19

bflesch wrote: post #13

Earlier quoted context omitted.

Problem is that you are forced to pay three times the price of Spotify/Netflix per month for this stuff in Germany, as this website (and many others) is financed by a mandatory fee.

So what? With 210€ a year it's not much more expensive than the 162€ in UK, for example. At least they're politically neutral and stick to facts and solid journalistic work, compared to private TV stations or the Axel Springer Verlag...

Except the BBC produces much more high quality content, consumed worldwide(former Top Gear) on a smaller budget than Germany which has little to show for in quality content of international or even national succes.

Re: Winnti: Hackers attacking the heart of German industry

#68

Post by odiroot » Wed, Jul 24, 2019, 2:30 PM UTC

paganel wrote: post #46

lnsru wrote: post #10

As of today we still use shared network drives for everything in major German company. We don’t use slack/irc/Skype/zoom/whatever. Phone calls and conferences(!) from the middle of open office is normal. Asana/Trello/Jira are not known at all. GitHub is paid for, but never used. I am single weirdo in multi department project using github ticket system. The code with prefix is copied for colleagues to project’s shared…

The state of the German IT industry outside of a few select places (Berlin, mostly) is what makes me very pessimistic about the future of its car industry. They (meaning the big 3: VW, BMW and Mercedes) apparently still think that building the best engines/transmissions and being the best at putting them all together is all it takes in order to make a modern car, unfortunately I think EVs will be more about software…

> The state of the German IT industry outside of a few select places (Berlin, mostly)

If Berlin IT industry is a golden standard I'm really not very hopeful for Germany.

Re: Winnti: Hackers attacking the heart of German industry

#69

Post by TulliusCicero » Wed, Jul 24, 2019, 2:35 PM UTC

kriro wrote: post #37

adrianN wrote: post #24

Earlier quoted context omitted.

I don't think that's the case. I believe the problem is that large German companies tend to be hardware companies. They're used to development cycles that take years and extremely conservative in adopting new methods. Management and company culture is not used to dealing with fast changing development methods (where fast is anything that changes more often than once a decade). Rigid processes for compliance with exte…

Pretty much agree with this sentiment regarding hardware/culture. Also the salaries are acceptable (imo) compared to fairly high paying US jobs if you compare real working hours (vacation time, real 40h workweeks etc.). With a family there's even more benefits. Cost of living also tends to be fairly low (with a high quality of life) compared to higher paying places.

High paying American bigcorps mostly have perfectly fine work life balance.

Getting double the vacation time (6 weeks instead of 3) when I moved from the US to Germany was very nice, but going back I'll have 5 weeks, which isn't too bad.

Re: Winnti: Hackers attacking the heart of German industry

#70

Post by odiroot » Wed, Jul 24, 2019, 2:35 PM UTC

adrianN wrote: post #24

ChuckNorris89 wrote: post #11

Earlier quoted context omitted.

Germany's tech illiteracy is a self-inflicted consequence of its pitiful salaries in this field, treating IT like a cost center that has to be outsourced to wherever is cheaper and companies' tradition of rewarding management incompetence over technical competence. Consequently, Germany's most brilliant tech minds leave for The Valley, Zurich or London. You reap what you sow.

I don't think that's the case. I believe the problem is that large German companies tend to be hardware companies. They're used to development cycles that take years and extremely conservative in adopting new methods. Management and company culture is not used to dealing with fast changing development methods (where fast is anything that changes more often than once a decade). Rigid processes for compliance with exte…

> Salary for developers really isn't that much of an issue.

Yes, it absolutely is. And Berlin is the best example; we're even underpaid by German standards.