15 ms·

Russian government hackers penetrated DNC, stole opposition research on Trump

108 points by uptown 10y ago

ams6110 10y ago
State sponsored attackers had "thoroughly compromised" access for over a year and were "expelled" over a weekend? Not bloody likely.
- jandrese 10y ago
  Maybe the weekend was spent burning all of their equipment?
  - astrodust 10y ago
    Finally decommissioned that old SharePoint server?
    - jandrese 10y ago
      I'm not sure fire is sufficient for a SharePoint server.
mtgx 10y ago
But some people still hope for online voting. This is a preview of how other countries could decide your elections if you switch to online voting now (and that's assuming your own intelligence agencies don't compromise it first to support whoever is more favorable to them and to an expansion of their powers).
- feklar 10y ago
  Chinese state actors even get involved in municipal council politics in Canada http://www.theglobeandmail.com/news/politics/government-infiltrated-by-spies-csis-boss-says/article4392618/?service=mobile http://www.theglobeandmail.com/news/politics/government-infi... Insecure online voting would be icing on the cake
- Jtsummers 10y ago
  This is not about online voting. Though I'm in agreement that it's certainly not going to be securely implemented in the near future, especially given the way government (state and federal) IT contracts are generally handled (read: poorly).
- NN88 10y ago
  Bingo. If you can't be bothered to vote in person, which I will argue needs to have fewer obstacles in its' own right, then I don't care about your vote.
- unclebucknasty 10y ago
  E-voting machines are already generally internet accessible though right?
touristtam 10y ago
Very little technical information. Still interesting article in its own right.
- r3bl 10y ago
  I would say more than usual. We have the info about how long were they inside of the network, we have some basic idea about how they are discovered to be connected to Russia (basically groups were previously linked to Russia, and now they were probably discovered by analyzing the code style and/or by re-using some of the code), we got to know how the incident response went, we discovered that they used 0 days targeting Windows, that they masked their traffic as legit Windows services, that they have created some kind of pattern analyzing tool that analyzes the code they got on every machine so they could detect if the attackers try breaching into the system again... I'd say that this is a pretty hefty amount of information we got from a single article when it's not really a post mortem by the company, but an article on Washington Post.
- fizbin 10y ago
  Some more technical information is available on CrowdStrike's blog: http://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ http://www.crowdstrike.com/blog/bears-midst-intrusion-democr...
ck2 10y ago
So this submission is about politics and crime, is okay? But over 100 people shot is not okay. Very confusing.
- NikolaNovak 10y ago
  I'm not a moderator but FWIW: This link is regarding a technical exploit of an IT system. Whether the goal of this exploit is profit, blackmail, political, activism, curiosity, etc -- there is nonetheless definitely a technical/IT angle that makes it interesting for visitors like myself.
- kbenson 10y ago
  I imagine HN wanted to protect it's community from something they viewed as tangential to their focus but possibly highly vitriolic in content (to the degree that they influenced the submission, which I'm not sure the level of). Alternatively, it could have been a community self-policing, by flagging articles that they thought were poisonous, or that were viewed as promoting misinformation (do the degree that happened. I haven't followed this closely, but that seems to be a common occurrence shortly after a disaster).
  - ams6110 10y ago
    I may have missed something but the one comment I saw from dang was that any flagging of stories about the Orlando events was done by users, not mods.
- pessimizer 10y ago
  You can't see a difference between hackers talking about a hacking story and hackers talking about a shooting story, or are you just being facetious?
  - ck2 10y ago
    Before you finish that thought, let me point out that PRINCE was on the front page of HN So Price overdosing = okay. 100 people being shot = not okay. Trump on the front page of HN = okay. 100 people being shot = not okay. I still cannot figure out why.
tptacek 10y ago
The only thing interesting about this story is that whoever did it got caught. Sort of. Is there anyone here who really believes that every major campaign organization since, say, 2004 hasn't been completely owned up? What, you think the people that build the software and IT environments for campaigns --- sites that by design have millions of users with persistent accounts, and thousands of staff members at varying levels of privilege --- are the creme de la creme of software security talent? Because, sure, I mean, everyone I know in software security and pentesting tells me "my first career choice is to go work in IT for the DNC and the GOP", but somehow along the way Google manages after a mighty struggle to outbid the 70k/year cost-center IT organizations offer for security talent. If there was any interesting "oppo research" on McCain in the DNC servers during the '08 election, I will bet all the money in my pocket versus all the money in yours that the Chinese read all of it long before everyone on the official CC list did.
- kbenson 10y ago
  > What, you think the people that build the software and IT environments for campaigns ... are the creme de la creme of software security talent? No, but I've always considered the competence of the IT people to likely fluctuate wildly from person to person, as I assumed many were politically motivated and donating at least some of their expected compensation level. I think the bigger problem would be in an organization with lots of volunteers, at least at the lower levels, and that gets at least partially rebuilt every few years, operational security is probably very hard to enforce for multiple reasons.
- stillsut 10y ago
  Is blase indifference how we respond to national level security breaches now? If this was somebody's health records, the organization responsible for the disclosure would be under serious investigation (HIPPA), and throwing down retainers to every law firm in town. Thomas, is it your opinion that those responsible for securing this data shouldn't be held responsible?
  - tptacek 10y ago
    I think it's awfully silly to pretend that campaign IT organizations should be falling on their swords when the largest, most-talented, best-funded software security organizations in the industry do only a marginally better job when evaluated by outcome. But, more importantly: I meant what I said. The only interesting thing about this story is that whoever hacked the DNC got attributed. You think the GOP isn't owned up?
odesian 10y ago
“It’s the job of every foreign intelligence service to collect intelligence against their adversaries,...” Hah. Translation: We've a firm foothold in their systems as well.
- knodi123 10y ago
  Yeah, but the problem with their systems is, it's all written in chinese. Our systems store information in english, which is a much easier language to read. So they have a natural advantage there...
  - gruez 10y ago
    And the us doesn't have native Chinese speakers?
    - knodi123 10y ago
      guess this wasn't the thread for deadpan humor.
      - Nadya 10y ago
        I didn't read any humor in it. It came off as something a stereotypical single language speaker (typically English) would say. Or in other words: 说话像一个男人谁不说第二语言
        knodi123 10y ago
        Have you ever heard the old joke about the country bumpkin who argues against bilingual education by saying "If English was good enough for Jesus, then it's good enough for our schoolchildren"?
        Nadya 10y ago
        I've had the pleasure of speaking to people who have actually said that - or something along the lines. "Why are you studying Japanese? Don't they teach English in Japanese schools? You can just speak English with Japanese people." I enjoy introducing English-only speakers to "The Chaos" by Gerard Nolst Trenité. It gives them a good idea of how terrible English can be - as even people who consider themselves "fluent" in English will struggle through the poem and mispronounce many of the words. ( http://ncf.idallen.com/english.html http://ncf.idallen.com/english.html )
NN88 10y ago
What does it look like when a Russian downloads these files? Is it PDFs? Text files? What do they see?
daveloyall 10y ago
Why wouldn't the intruders change anything while they were there? For example, filtering out some important emails, with a goal of hamstringing the organization. Also... The older I get, the more I realize that adults are just kids with very fancy tree houses. MY treehouse doesn't have rats. Get your leaders from here, not from there.
lifeisstillgood 10y ago
There was a time when if you wanted to transport yourself or your goods across say Europe or China, you needed to hire mercenaries and they would protect your business from bandits on the way. At various times (Mongols, US Navy vs pirates etc) governments stepped in and provided that protection (for a lesser price) and trade grew. I'm not too sure how governments can provide protection in the online realm. Perhaps by providing minimal standards of security? (I know the standards exists but enforcing them?) However, now my iPhone is FBI-resistant, and public keys are fairly easy to share, it seems that secure peer to peer communication is feasible. So the shape of a more secure, bandit free internet is clearer - hardened mobile devices, and much much stricter standards that are enforced, but it seems an odd new world.

108 points by uptown 10y ago

State sponsored attackers had "thoroughly compromised" access for over a year and were "expelled" over a weekend? Not bloody likely.

jandrese 10y ago
Maybe the weekend was spent burning all of their equipment?
- astrodust 10y ago
  Finally decommissioned that old SharePoint server?
  - jandrese 10y ago
    I'm not sure fire is sufficient for a SharePoint server.

mtgx 10y ago

But some people still hope for online voting. This is a preview of how other countries could decide your elections if you switch to online voting now (and that's assuming your own intelligence agencies don't compromise it first to support whoever is more favorable to them and to an expansion of their powers).

feklar 10y ago
Chinese state actors even get involved in municipal council politics in Canada http://www.theglobeandmail.com/news/politics/government-infiltrated-by-spies-csis-boss-says/article4392618/?service=mobile http://www.theglobeandmail.com/news/politics/government-infi... Insecure online voting would be icing on the cake
Jtsummers 10y ago
This is not about online voting. Though I'm in agreement that it's certainly not going to be securely implemented in the near future, especially given the way government (state and federal) IT contracts are generally handled (read: poorly).
NN88 10y ago
Bingo. If you can't be bothered to vote in person, which I will argue needs to have fewer obstacles in its' own right, then I don't care about your vote.
unclebucknasty 10y ago
E-voting machines are already generally internet accessible though right?

touristtam 10y ago

Very little technical information. Still interesting article in its own right.

r3bl 10y ago
I would say more than usual. We have the info about how long were they inside of the network, we have some basic idea about how they are discovered to be connected to Russia (basically groups were previously linked to Russia, and now they were probably discovered by analyzing the code style and/or by re-using some of the code), we got to know how the incident response went, we discovered that they used 0 days targeting Windows, that they masked their traffic as legit Windows services, that they have created some kind of pattern analyzing tool that analyzes the code they got on every machine so they could detect if the attackers try breaching into the system again... I'd say that this is a pretty hefty amount of information we got from a single article when it's not really a post mortem by the company, but an article on Washington Post.
fizbin 10y ago
Some more technical information is available on CrowdStrike's blog: http://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ http://www.crowdstrike.com/blog/bears-midst-intrusion-democr...

ck2 10y ago

So this submission is about politics and crime, is okay? But over 100 people shot is not okay. Very confusing.

NikolaNovak 10y ago
I'm not a moderator but FWIW: This link is regarding a technical exploit of an IT system. Whether the goal of this exploit is profit, blackmail, political, activism, curiosity, etc -- there is nonetheless definitely a technical/IT angle that makes it interesting for visitors like myself.
kbenson 10y ago
I imagine HN wanted to protect it's community from something they viewed as tangential to their focus but possibly highly vitriolic in content (to the degree that they influenced the submission, which I'm not sure the level of). Alternatively, it could have been a community self-policing, by flagging articles that they thought were poisonous, or that were viewed as promoting misinformation (do the degree that happened. I haven't followed this closely, but that seems to be a common occurrence shortly after a disaster).
- ams6110 10y ago
  I may have missed something but the one comment I saw from dang was that any flagging of stories about the Orlando events was done by users, not mods.
pessimizer 10y ago
You can't see a difference between hackers talking about a hacking story and hackers talking about a shooting story, or are you just being facetious?
- ck2 10y ago
  Before you finish that thought, let me point out that PRINCE was on the front page of HN So Price overdosing = okay. 100 people being shot = not okay. Trump on the front page of HN = okay. 100 people being shot = not okay. I still cannot figure out why.

tptacek 10y ago

The only thing interesting about this story is that whoever did it got caught. Sort of. Is there anyone here who really believes that every major campaign organization since, say, 2004 hasn't been completely owned up? What, you think the people that build the software and IT environments for campaigns --- sites that by design have millions of users with persistent accounts, and thousands of staff members at varying levels of privilege --- are the creme de la creme of software security talent? Because, sure, I mean, everyone I know in software security and pentesting tells me "my first career choice is to go work in IT for the DNC and the GOP", but somehow along the way Google manages after a mighty struggle to outbid the 70k/year cost-center IT organizations offer for security talent. If there was any interesting "oppo research" on McCain in the DNC servers during the '08 election, I will bet all the money in my pocket versus all the money in yours that the Chinese read all of it long before everyone on the official CC list did.

kbenson 10y ago
> What, you think the people that build the software and IT environments for campaigns ... are the creme de la creme of software security talent? No, but I've always considered the competence of the IT people to likely fluctuate wildly from person to person, as I assumed many were politically motivated and donating at least some of their expected compensation level. I think the bigger problem would be in an organization with lots of volunteers, at least at the lower levels, and that gets at least partially rebuilt every few years, operational security is probably very hard to enforce for multiple reasons.
stillsut 10y ago
Is blase indifference how we respond to national level security breaches now? If this was somebody's health records, the organization responsible for the disclosure would be under serious investigation (HIPPA), and throwing down retainers to every law firm in town. Thomas, is it your opinion that those responsible for securing this data shouldn't be held responsible?
- tptacek 10y ago
  I think it's awfully silly to pretend that campaign IT organizations should be falling on their swords when the largest, most-talented, best-funded software security organizations in the industry do only a marginally better job when evaluated by outcome. But, more importantly: I meant what I said. The only interesting thing about this story is that whoever hacked the DNC got attributed. You think the GOP isn't owned up?

odesian 10y ago

“It’s the job of every foreign intelligence service to collect intelligence against their adversaries,...” Hah. Translation: We've a firm foothold in their systems as well.

knodi123 10y ago
Yeah, but the problem with their systems is, it's all written in chinese. Our systems store information in english, which is a much easier language to read. So they have a natural advantage there...
- gruez 10y ago
  And the us doesn't have native Chinese speakers?
  - knodi123 10y ago
    guess this wasn't the thread for deadpan humor.
    - Nadya 10y ago
      I didn't read any humor in it. It came off as something a stereotypical single language speaker (typically English) would say. Or in other words: 说话像一个男人谁不说第二语言
      - knodi123 10y ago
        Have you ever heard the old joke about the country bumpkin who argues against bilingual education by saying "If English was good enough for Jesus, then it's good enough for our schoolchildren"?
        Nadya 10y ago
        I've had the pleasure of speaking to people who have actually said that - or something along the lines. "Why are you studying Japanese? Don't they teach English in Japanese schools? You can just speak English with Japanese people." I enjoy introducing English-only speakers to "The Chaos" by Gerard Nolst Trenité. It gives them a good idea of how terrible English can be - as even people who consider themselves "fluent" in English will struggle through the poem and mispronounce many of the words. ( http://ncf.idallen.com/english.html http://ncf.idallen.com/english.html )

NN88 10y ago

What does it look like when a Russian downloads these files? Is it PDFs? Text files? What do they see?

daveloyall 10y ago

Why wouldn't the intruders change anything while they were there? For example, filtering out some important emails, with a goal of hamstringing the organization. Also... The older I get, the more I realize that adults are just kids with very fancy tree houses. MY treehouse doesn't have rats. Get your leaders from here, not from there.

lifeisstillgood 10y ago

There was a time when if you wanted to transport yourself or your goods across say Europe or China, you needed to hire mercenaries and they would protect your business from bandits on the way. At various times (Mongols, US Navy vs pirates etc) governments stepped in and provided that protection (for a lesser price) and trade grew. I'm not too sure how governments can provide protection in the online realm. Perhaps by providing minimal standards of security? (I know the standards exists but enforcing them?) However, now my iPhone is FBI-resistant, and public keys are fairly easy to share, it seems that secure peer to peer communication is feasible. So the shape of a more secure, bandit free internet is clearer - hardened mobile devices, and much much stricter standards that are enforced, but it seems an odd new world.