Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Hack Attack Was Ultra Sophisticated, New Details Show

wired.com

Post reply on HN
Print view View original

81–90 of 116 posts

Re: Google Hack Attack Was Ultra Sophisticated, New Details Show

#81

Post by onedognight »

Slashed wrote: post #72

I don't really get the part with Russian nested dolls. Was it like this?: For example, there is a code which is encrypted three times. And that crypt-code by itself is executable which decrypts itself into another executable, and so on. If this is true - I'm really impressed.

I'm not impressed with the Russian doll encryption. Like with DRM, you have to give away the keys to your users. So the analysts had to work a little more than usual to examine the code. Big deal. There was never a question of if they would be able to analyse it, but just how long it would take. There must be something else they have not disclosed that is making them take notice.

Re: Google Hack Attack Was Ultra Sophisticated, New Details Show

#82

Post by gcb »

joe_the_user wrote: post #55
jbooth wrote: post #41

Earlier quoted context omitted.

Linux security assumes source code visibility, Windows doesn't?

Yes, Windows' closed-source nature has allowed MS to rely on security-though-obscurity . Now that one of the entities MS has taken behind it's golden screen has turned out to be a black hat, MS' approach is looking foolish.

now?

Re: Google Hack Attack Was Ultra Sophisticated, New Details Show

#83

Post by gcb »

lt wrote: post #6

I find the fact that Adobe got hacked by a pdf vulnerability kinda funny.

What about inside job?

most companies have offices in india, china. And even risking a moral point here, all companies have chinese employees.

Hell, when I worked for a shady company here [regret] most employees used to sell the email database.

what about the oposite? use employees to insert vulnerabilities instead of selling data.

Will anyone run `cvs blame` on the IE4 source code?

Re: Google Hack Attack Was Ultra Sophisticated, New Details Show

#84

Post by gcb »

tfh wrote: post #66
ra wrote: post #12

I find the fact that the targets were source code repos very interesting. If you are a super-smart black-hat villain who wants to plan a mass global attack, what better place to start than with Google and Adobe's source code?

> what better place to start than with Google and Adobe's source code? I wonder if Microsoft was targeted too.

i'm dropping linux and going to use openbsd as my desktop. see ya.

Re: Google Hack Attack Was Ultra Sophisticated, New Details Show

#85

Post by nfnaaron »

jimbokun wrote: post #79
tfh wrote: post #66

Earlier quoted context omitted.

> what better place to start than with Google and Adobe's source code? I wonder if Microsoft was targeted too.

What's the point, when the Chinese government already has all their source code?

Ah, I guess that's why most of my router scans come from China: it's worth it.

Re: Google Hack Attack Was Ultra Sophisticated, New Details Show

#86

Post by awa »

joe_the_user wrote: post #55
jbooth wrote: post #41

Earlier quoted context omitted.

Linux security assumes source code visibility, Windows doesn't?

Yes, Windows' closed-source nature has allowed MS to rely on security-though-obscurity . Now that one of the entities MS has taken behind it's golden screen has turned out to be a black hat, MS' approach is looking foolish.

Microsoft does gives out source code for some of its software (including parts of windows) to various universities for research purposes. Ofcourse, there are NDAs involved but that shows they aren't shy to share the code in certain. situations.

Re: Google Hack Attack Was Ultra Sophisticated, New Details Show

#87

Post by nfnaaron »

onedognight wrote: post #81
Slashed wrote: post #72

I don't really get the part with Russian nested dolls. Was it like this?: For example, there is a code which is encrypted three times. And that crypt-code by itself is executable which decrypts itself into another executable, and so on. If this is true - I'm really impressed.

I'm not impressed with the Russian doll encryption. Like with DRM, you have to give away the keys to your users. So the analysts had to work a little more than usual to examine the code. Big deal. There was never a question of if they would be able to analyse it, but just how long it would take. There must be something else they have not disclosed that is making them take notice.

Maybe the point of triple encryption was to make it less likely for scanners to find it in a routine scan? The people who did this certainly knew that once they were found it was over; they were just trying to delay being found a bit.

[Edit: added 2nd sentence.]

Re: Google Hack Attack Was Ultra Sophisticated, New Details Show

#88

Post by zyb09 »

est wrote: post #35

Another aspect perhaps most of people ignored is: Chinese government has all the source code of Windows systems: http://news.cnet.com/2100-1016_3-5083458.html Including: Windows Vista, Windows XP, Windows Server 2003, windows 2000, Windows CE 6.0/5.0/4.2(PSK), Microsoft Office Pro 2003, Microsoft Office Systems It's reviewed by top three Chinese universities and other three government agencies. The Party is the new o…

Say what? Microsoft gave away the Windows source code to Chinese official for inspections? I'm absolutely stunned they would do that, never would've thought they agree to something like that.

Re: Google Hack Attack Was Ultra Sophisticated, New Details Show

#89

Post by Estragon »

spoiledtechie wrote: post #44

In other news, I was just sent an Email by Bank of America... Said my card was compromised, I called in and they said their systems were hacked and he gave the name and location of the system... You might not know it, but sounds like BoA was compromised as well.

Wow. How did they word the subject line to avoid you immediately writing it off as phishing spam?

Re: Google Hack Attack Was Ultra Sophisticated, New Details Show

#90

Post by sketerpot »

gojomo wrote: post #48
ra wrote: post #12

I find the fact that the targets were source code repos very interesting. If you are a super-smart black-hat villain who wants to plan a mass global attack, what better place to start than with Google and Adobe's source code?

what better place to start than with Google and Adobe's source code? Indeed -- and especially their auto-upgrade mechanisms. There may yet be more to Google's anger that's not yet been revealed. What if the attackers didn't just look around, but changed (or tried to change) Google content/code at the source?

Google's auto-update code is open source:

http://code.google.com/p/omaha/

Post reply on HN