Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US Govt Data Shows Russia Used Outdated Ukrainian PHP Malware

wordfence.com

Post reply on HN
Print view View original

81–90 of 120 posts

Re: US Govt Data Shows Russia Used Outdated Ukrainian PHP Malware

#81

Post by appleflaxen »

ChuckMcM wrote: post #69
natch wrote: post #55

I don't know how much of the HN community is old enough to remember Colin Powell just prior to the first Iraq war, getting up in front of the UN and the whole world for that matter, and asserting that there was ironclad proof that Iraq had weapons of mass destruction (which we came to know as WMD). Different parts of the government had the same talking points and it was all presented as irrefutable facts. But the evi…

I think it is reasonable to be skeptical of government claims but it is also important to clearly distinguish between these two cases. In the WMD situation the government was analyzing the actions of two third parties (the Hussein government and arms dealers) engaged in activities outside of the US. In this hacking situation these are actions being taken against US entities. I don't believe anyone disputes that the D…

> So unlike the WMD scenario it seems incontrovertibly clear that some actor did do this.

what are you basing that on?

based on the USG's own best evidence (in this article), this was a canned wordpress exploit that isn't even really that new.

So why, exactly, is it necessary to invoke an adversary with state-level resources?

edit: citation

Re: US Govt Data Shows Russia Used Outdated Ukrainian PHP Malware

#82

Post by natch »

ChuckMcM wrote: post #69
natch wrote: post #55

I don't know how much of the HN community is old enough to remember Colin Powell just prior to the first Iraq war, getting up in front of the UN and the whole world for that matter, and asserting that there was ironclad proof that Iraq had weapons of mass destruction (which we came to know as WMD). Different parts of the government had the same talking points and it was all presented as irrefutable facts. But the evi…

I think it is reasonable to be skeptical of government claims but it is also important to clearly distinguish between these two cases. In the WMD situation the government was analyzing the actions of two third parties (the Hussein government and arms dealers) engaged in activities outside of the US. In this hacking situation these are actions being taken against US entities. I don't believe anyone disputes that the D…

The level of gullibility displayed here is stunning. I completely agree that the fact of a hack existing is undisputed. However, electronic records, perhaps more than any records, lend themselves to being faked.

It's amusing that you would cite the example of the style of code keying of amateur radio operators. In WWII this was know as the "fist" of the operator. I refer you to appendix one of Leo Marks' excellent book "Between Silk and Cyanide" for just one account of how the opposing sides were able to study and fake each others' styles to create subterfuge. (You can thank me later for turning you on to a fantastic read.)

There may not be actual "fists" involved here but the point is more general: if an MO can be studied and understood, it can also be faked. For whatever reason. It could be part of a false flag operation. Alternatively, maybe it's not fake, but is done by rogue actors who carry their signature activities with them whether they are working for one interest or another.

Even with direct access to all the actual purported evidence, which we do not have, I still doubt we would know. And without seeing the evidence, I have to fall back on what I have learned about people in the US government, which is that they are often interested in saving face and finding scapegoats, even if it means inflicting collateral damage.

Re: US Govt Data Shows Russia Used Outdated Ukrainian PHP Malware

#83

Post by ChuckMcM »

appleflaxen wrote: post #81
ChuckMcM wrote: post #69

Earlier quoted context omitted.

I think it is reasonable to be skeptical of government claims but it is also important to clearly distinguish between these two cases. In the WMD situation the government was analyzing the actions of two third parties (the Hussein government and arms dealers) engaged in activities outside of the US. In this hacking situation these are actions being taken against US entities. I don't believe anyone disputes that the D…

> So unlike the WMD scenario it seems incontrovertibly clear that some actor did do this. what are you basing that on? based on the USG's own best evidence (in this article), this was a canned wordpress exploit that isn't even really that new. So why, exactly, is it necessary to invoke an adversary with state-level resources? edit: citation

The word 'actor' does not in my vernacular assume 'state level' only that it was was a willful act by some person or group of persons.

Re: US Govt Data Shows Russia Used Outdated Ukrainian PHP Malware

#84

Post by Tsiolkovsky »

This website has no political affiliation; completely unbiased research. Their conclusion:

"The IP addresses that DHS provided may have been used for an attack by a state actor like Russia. But they don’t appear to provide any association with Russia. They are probably used by a wide range of other malicious actors, especially the 15% of IP addresses that are Tor exit nodes. The malware sample is old, widely used and appears to be Ukrainian. It has no apparent relationship with Russian intelligence and it would be an indicator of compromise for any website."

Re: US Govt Data Shows Russia Used Outdated Ukrainian PHP Malware

#85

Post by ChuckMcM »

natch wrote: post #82
ChuckMcM wrote: post #69

Earlier quoted context omitted.

I think it is reasonable to be skeptical of government claims but it is also important to clearly distinguish between these two cases. In the WMD situation the government was analyzing the actions of two third parties (the Hussein government and arms dealers) engaged in activities outside of the US. In this hacking situation these are actions being taken against US entities. I don't believe anyone disputes that the D…

The level of gullibility displayed here is stunning. I completely agree that the fact of a hack existing is undisputed. However, electronic records, perhaps more than any records, lend themselves to being faked. It's amusing that you would cite the example of the style of code keying of amateur radio operators. In WWII this was know as the "fist" of the operator. I refer you to appendix one of Leo Marks' excellent bo…

Hmm, I don't nominally think of my self as "stunningly gullible."

lets unpack this statement though: However, electronic records, perhaps more than any records, lend themselves to being faked.

It is certainly true that someone can edit and change electronic records and the tampering of such records, unless explicitly protected against, can be made indistinguishable from untampered records. But what is much more difficult is to tamper with records from a wide variety of unrelated sources to show the same thing.

For example, it is certainly possible for me to construct a record that says my "source IP" is KREMVAX[1] and to even have the source IP "logged" at the destination site as the origination point. But it is not possible for me to easily alter the s-flow records at Cogent which shows that the packet originated on a port on a router which is sitting in California. Yes, I can by a VPS in the Ukraine using bitcoin that has gone through several mixers but I cannot completely erase all of the packet sources that lead to that VPS. Yes, I can build an "IP over DNS" tunnel to disguise my traffic to the VPS as "harmless" DNS traffic but I cannot disguise how those DNS packets are propagated in the larger web.

The point I'm trying to make is that if you are a state actor (like the 17 intelligence agencies of the US) and the events leave traces (which they do), it is entirely feasible to unwind packet traces, money paths, and network events to the exact origin point. I was at Google when they Chinese did it to Google and got to watch on the sidelines the amazing amount of resource that could be brought to bear on the problem. And what it more, that incident and others less well publicized have lead to still more infrastructure which is completely passive and observational and captures all packet flows and meta data.

As a result, I find it completely believable that the origin of those attacks can be identified with certainty.

I believe it is reasonable to be skeptical about motivations and or command chain that lead to the attacks.

[1] A stand in for some IP Block allocated to Russia

Re: US Govt Data Shows Russia Used Outdated Ukrainian PHP Malware

#86

Post by natch »

ChuckMcM wrote: post #85
natch wrote: post #82

Earlier quoted context omitted.

The level of gullibility displayed here is stunning. I completely agree that the fact of a hack existing is undisputed. However, electronic records, perhaps more than any records, lend themselves to being faked. It's amusing that you would cite the example of the style of code keying of amateur radio operators. In WWII this was know as the "fist" of the operator. I refer you to appendix one of Leo Marks' excellent bo…

Hmm, I don't nominally think of my self as "stunningly gullible." lets unpack this statement though: However, electronic records, perhaps more than any records, lend themselves to being faked. It is certainly true that someone can edit and change electronic records and the tampering of such records, unless explicitly protected against, can be made indistinguishable from untampered records. But what is much more diffi…

I wasn't just thinking of records tampered after the fact. There is also the problem of genuine records created by the orchestrated actions of an imposter conducting a ruse. This would be the false flag possibility. I'm not saying I believe this is a likely scenario; just that it's a possible one.

And yes it would be hard for an imposter to leave all the right evidence. But if there is a hunt for a scapegoat and easy evidence is left in plain sight, there's a great temptation to just cherry pick that evidence, even if it's incomplete.

I don't know that the US isn't cherry picking and distorting whatever evidence they have. Sometimes the interests of multiple entities in government all align such that they put all their weight behind promoting one particular scapegoat. What you saw at Google must have been fascinating... is there a writeup? I was in the courtroom for the Wen Ho Lee hearings and got to watch (and privy to some behind the scenes stuff) the amazing amount of resources that could be brought to bear against an innocent scapegoat, and the contortions government actors would bend to in order to omit countervailing evidence and advance their false narrative.

False narratives have happened in other cases too... example, compare the New Yorker account of the killing of Osama bin Laden: http://www.newyorker.com/magazine/2011/08/08/getting-bin-lad... with Seymour Hersh's revisiting of the same episode, which tells a completely different story: http://www.lrb.co.uk/v37/n10/seymour-m-hersh/the-killing-of-... -- sometimes political expediency drives the investigation, more so than analysis of real facts.

>As a result, I find it completely believable that the origin of those attacks can be identified with certainty.

Strong statement. I was under the impression that TAO had tools which allowed them to hack many routers (potentially then rewriting the logs you speak of?) And I would expect they would not be alone in this. But even if you're right that they (on the inside of the investigation) can know with certainty, and even if going a step farther they DO know with certainty, we (on the outside) probably never will know. Too bad, because it would be nice to be able to trust our own government.

Edit: >have lead to still more infrastructure which is completely passive and observational and captures all packet flows and meta data.

OK that is kind of cool... or scary... depending on whether you are a black hat or not in whatever realm you're living under.

Re: US Govt Data Shows Russia Used Outdated Ukrainian PHP Malware

#87

Post by Toe-Rag »

lern_too_spel wrote: post #78
Natsu wrote: post #77

Earlier quoted context omitted.

Comey claimed not to have charged Clinton because there was a lack of intent. Gowdy is calling him on that, saying that this makes zero sense and going over all the ways they have to prove intent. His point at the end about "negligence" underscores the fact that the entire line of reasoning is nonsensical: intentional negligence is a contradiction in terms. That which is intentional cannot be negligent and vice versa…

You don't understand what intent means as it relates to the law. The particular law you are referring to is the Espionage Act. The case law (in particular, Gorin v. United States ) establishes a bright line of scienter for application of this law, highlighting the text that says the defendant must have "intent or reason to believe that the information to be obtained is to be used to the injury of the United States, o…

Intent to harm the United States (or another nation) was not the intent Comey was looking for. It was intent to share national security information with people not authorized to receive it.

Re: US Govt Data Shows Russia Used Outdated Ukrainian PHP Malware

#88

Post by Toe-Rag »

lern_too_spel wrote: post #56
Gustomaximus wrote: post #5

Earlier quoted context omitted.

To me the ongoing 'Russia rigged elections' smells like propaganda from the other side. And maybe russia did release the DNC emails, but Assange said that wasn't the case and I feel he's more likely to be telling the truth than state players. And even if they did release these emails it's hardly rigging an election. Comneys email announcement at the 11th hour about reopening email investigation was probably a decidin…

How would Assange know who released the DNC emails? They were publicly released by Guccifer 2.0. Assange merely downloaded the public dump and indexed it on WikiLeaks.

Guccifer 2.0 released different material from Wikileaks. He/she/it did not release emails.

Re: US Govt Data Shows Russia Used Outdated Ukrainian PHP Malware

#89

Post by Toe-Rag »

Natsu wrote: post #12
threeseed wrote: post #6

Earlier quoted context omitted.

a) Anyone who thinks this document is the sole source of evidence is deluding themselves. The intelligence agencies are not going to document their capabilities to the world. Which I am sure would include compromised Tor nodes and DPI (including SSL/encrypted traffic) across many of the key sites/switches/cables. b) It has been claimed that this document is more a guide for other companies and government agencies abo…

The problem with a line of reasoning that includes secret evidence we'll never get to see is that it can be used to support any conclusion whatsoever. Inasmuch as it's a guide for other agencies, they'd be better served by OWASP recommendations. It's not clear what anyone could do with a report like this. I don't see any great takeaways that one could add to the next revision of their STIG. There are no 0-days for an…

Interesting theory about Dotcom. He knew something. I also think that Wikileaks has more material than they released and that Dotcom knows it. His tweets during October suggest that he was expecting something more to drop. It could have been BS, as you say, but I think he knew something.

Re: US Govt Data Shows Russia Used Outdated Ukrainian PHP Malware

#90

Post by IvarTheHomeless »

lisivka wrote: post #50
whitemale wrote: post #16

Earlier quoted context omitted.

> So claiming all of this was about propaganda really makes no sense given the facts on the ground. Where are those facts? please show hard evidence. So far I haven't seen any hard evidence that proves it was the state of Russia who orchestrated the hacks. > And please remember why Russia's relations with almost all of the world deteriorated in the first place. It's because they annexed Crimea (unprecedented for our…

I suspect you are Russian. Can I ask a dumb question? Russian language started to be used by civilians in 16 century. Before that, it used in churches only. (See Wikipedia for details). What language your grand....grand parents are used before 16 century?

I'm not a time traveler or the poster you are asking but I suggest you watch this, history of the evolvement of Russian

https://www.youtube.com/watch?v=Y4cXIyyc-L0

Post reply on HN