5 ms·

At least they mention it: "None of this new data constitutes a smoking gun that can clearly frame Russia as the culprit" The scam was so generic I'm confused

by dahdum 10y ago

At least they mention it: "None of this new data constitutes a smoking gun that can clearly frame Russia as the culprit" The scam was so generic I'm confused why it has to be Russian government vs individuals, but it doesn't matter much IMO.

rfrank 10y ago
Given the saber rattling going on between the US and Russia at the moment, it would seem to matter very much. Blaming the Russians gives them more room to deflect without acknowledging content of the leaks.
- dahdum 10y ago
  You're right, I'm sure they tested the message "but...but...the Russians". I think HRC wins this easily, but these scandals won't just go away. There's enough meat in them to fuel 1-2 years of republican attacks. I fear she'll be the most ineffective President of my time.
  - rfrank 10y ago
    Time will tell I suppose. Here's a fun one from today: https://i.redd.it/dxedkw7jwosx.png https://i.redd.it/dxedkw7jwosx.png
    - misiti3780 10y ago
      is that real ?
      - rfrank 10y ago
        yes: https://wikileaks.org/podesta-emails/emailid/23199 https://wikileaks.org/podesta-emails/emailid/23199
        misiti3780 10y ago
        can you provide the link to reddit. it is hard to understand what the context is.
        rfrank 10y ago
        here's the link, largely just typical the_donald spam in comments that isn't terribly helpful haha. https://www.reddit.com/r/The_Donald/comments/58j7jn/gentlement_i_believe_we_found_it_diane_feinstein/ https://www.reddit.com/r/The_Donald/comments/58j7jn/gentleme... based on dates in the message, they're likely referring to the hearing on 10/22/15.
        tmzt 10y ago
        A more specfic resource is /r/DNCleaks and seems to be less overtly partisan or pro-candidate.
        eridius 10y ago
        The fact that it's on wikileaks doesn't actually prove it's real. Russia has already been proven to have altered a few documents in a big document dump they did a while back (I actually forget the specifics of this one, but it was on HN fairly recently). And Bruce Schneier wrote an article about this very subject a month ago (https://www.schneier.com/blog/archives/2016/09/organizational_1.html https://www.schneier.com/blog/archives/2016/09/organizationa...).
        zeroer 10y ago
        While technically true, Wikileaks hasn't lied yet in their history.
        nickpsecurity 10y ago
        They used to say they had lots of people with the ability to protect sources back when they were just a few with no such ability. That's a nice start on integrity. Far as leaks, they posted a lot of them over time that people couldn't verify if they wanted to given lack of internal access. So, my claim on them wouldn't go as far as yours.
  - 13years 10y ago
    Why should this fuel just Republican attacks? The number of people that walked out of the DNC convention because of the rigging against Sanders shows there is far more trouble than just Republicans. The movement within the DNC that actually stands against government corruption will only grow stronger.
    - mark_l_watson 10y ago
      Not very important, but: as a lifelong Democrat (voting since about 1970), I have left the Democratic party over the DNC cheating. Fed. Up. In the past I have donated a ton of money to Democratic candidates, so I still get lots of calls; I politely explain each time why I am no longer a Democrat. EDIT: some fundraising callers pretty much hang up on me in anger, but a lot are also sympathetic. Not hard evidence, but I have heard a convincing "I understand" often enough to think that a lot of rank and file Democrates are Fed. Up.
  - zeroer 10y ago
    > I fear she'll be the most ineffective President of my time One could hope ...
tptacek 10y ago
The specific attack vector isn't the only IOC they're working from for these incidents; there are probably dozens of IOCs associated with each attack, some of which are extremely specific to just one or two threat actors. Many of those IOC signatures are non-public; you only get them by being in intelligence or law enforcement, or by being one of the handful of threat intelligence companies deployed at enough giant enterprises to see enough of a cross-section of attackers. So when people say things like "anyone could have carried out this attack" or "these systems are so insecure it could have been anybody who did it", they're not actually addressing the argument.
- dahdum 10y ago
  Makes sense, but at the end of the day didn't he fall for the same basic phishing attack so many others do? If it's so effective and easy I have to imagine the NSA is doing the same. Whole thing makes me really wonder if using insecure email in government is a good idea...
  - eric_h 10y ago
    I think there are countless examples across government, industry and personal accounts that using insecure email is a universally bad idea. Unfortunately it has the strongest network effect at the moment, and no one's come up with a way to get everyone to use encryption/cryptographic signatures yet.
    - jessaustin 10y ago
      Surely an agency like NSA could make such rules?!
  - tptacek 10y ago
    There is no secure email. If you need to send a message securely, don't use email to do it. I agree with you.
  - nickpsecurity 10y ago
    It's long been known not to use insecure endpoints, email, etc in government. NSA used to certify the high-assurance alternatives. Here was one of the early ones with incredibly-strong TCB for the time: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.454.4029&rep=rep1&type=pdf http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.454... Almost all older or modern ones build email processing capabilities onto guards optionally with a proxy on client's side to integrate with common, mail client. Here's an article describing what a guard is along with some examples government uses today: https://en.wikipedia.org/wiki/Guard_(information_security) https://en.wikipedia.org/wiki/Guard_(information_security) Firewalls are knockoffs of guards that were created after businesses and much of government rejected high-assurance systems since they didn't have development pace and [insecure] features of low-security competition. Firewalls were cheap, fast, constantly added features, and totally left off the whole "design it to be nearly unhackable" aspect of guards. Even the guards themselves have lowered their assurance at the TCB and guard software over the years as neither military nor commercial market really care outside a small niche of customers. Remaining ones like Boeing SNS Server and BAE's XTS-400 go for $100,000+ a unit due to limited market + high development & certification costs. So, that's that. Medium-assurance solutions like Nexor's and General Dynamics continue being developed and adopted. They'll get smashed, though, since they're all adopting Linux-based cores & other COTS tech. Such are the market incentives.

by dahdum 10y ago

rfrank 10y ago

Given the saber rattling going on between the US and Russia at the moment, it would seem to matter very much. Blaming the Russians gives them more room to deflect without acknowledging content of the leaks.

dahdum 10y ago
You're right, I'm sure they tested the message "but...but...the Russians". I think HRC wins this easily, but these scandals won't just go away. There's enough meat in them to fuel 1-2 years of republican attacks. I fear she'll be the most ineffective President of my time.
- rfrank 10y ago
  Time will tell I suppose. Here's a fun one from today: https://i.redd.it/dxedkw7jwosx.png https://i.redd.it/dxedkw7jwosx.png
  - misiti3780 10y ago
    is that real ?
    - rfrank 10y ago
      yes: https://wikileaks.org/podesta-emails/emailid/23199 https://wikileaks.org/podesta-emails/emailid/23199
      - misiti3780 10y ago
        can you provide the link to reddit. it is hard to understand what the context is.
        rfrank 10y ago
        here's the link, largely just typical the_donald spam in comments that isn't terribly helpful haha. https://www.reddit.com/r/The_Donald/comments/58j7jn/gentlement_i_believe_we_found_it_diane_feinstein/ https://www.reddit.com/r/The_Donald/comments/58j7jn/gentleme... based on dates in the message, they're likely referring to the hearing on 10/22/15.
        tmzt 10y ago
        A more specfic resource is /r/DNCleaks and seems to be less overtly partisan or pro-candidate.
      - eridius 10y ago
        The fact that it's on wikileaks doesn't actually prove it's real. Russia has already been proven to have altered a few documents in a big document dump they did a while back (I actually forget the specifics of this one, but it was on HN fairly recently). And Bruce Schneier wrote an article about this very subject a month ago (https://www.schneier.com/blog/archives/2016/09/organizational_1.html https://www.schneier.com/blog/archives/2016/09/organizationa...).
        zeroer 10y ago
        While technically true, Wikileaks hasn't lied yet in their history.
        nickpsecurity 10y ago
        They used to say they had lots of people with the ability to protect sources back when they were just a few with no such ability. That's a nice start on integrity. Far as leaks, they posted a lot of them over time that people couldn't verify if they wanted to given lack of internal access. So, my claim on them wouldn't go as far as yours.
- 13years 10y ago
  Why should this fuel just Republican attacks? The number of people that walked out of the DNC convention because of the rigging against Sanders shows there is far more trouble than just Republicans. The movement within the DNC that actually stands against government corruption will only grow stronger.
  - mark_l_watson 10y ago
    Not very important, but: as a lifelong Democrat (voting since about 1970), I have left the Democratic party over the DNC cheating. Fed. Up. In the past I have donated a ton of money to Democratic candidates, so I still get lots of calls; I politely explain each time why I am no longer a Democrat. EDIT: some fundraising callers pretty much hang up on me in anger, but a lot are also sympathetic. Not hard evidence, but I have heard a convincing "I understand" often enough to think that a lot of rank and file Democrates are Fed. Up.
- zeroer 10y ago
  > I fear she'll be the most ineffective President of my time One could hope ...

tptacek 10y ago

The specific attack vector isn't the only IOC they're working from for these incidents; there are probably dozens of IOCs associated with each attack, some of which are extremely specific to just one or two threat actors. Many of those IOC signatures are non-public; you only get them by being in intelligence or law enforcement, or by being one of the handful of threat intelligence companies deployed at enough giant enterprises to see enough of a cross-section of attackers. So when people say things like "anyone could have carried out this attack" or "these systems are so insecure it could have been anybody who did it", they're not actually addressing the argument.

dahdum 10y ago
Makes sense, but at the end of the day didn't he fall for the same basic phishing attack so many others do? If it's so effective and easy I have to imagine the NSA is doing the same. Whole thing makes me really wonder if using insecure email in government is a good idea...
- eric_h 10y ago
  I think there are countless examples across government, industry and personal accounts that using insecure email is a universally bad idea. Unfortunately it has the strongest network effect at the moment, and no one's come up with a way to get everyone to use encryption/cryptographic signatures yet.
  - jessaustin 10y ago
    Surely an agency like NSA could make such rules?!
- tptacek 10y ago
  There is no secure email. If you need to send a message securely, don't use email to do it. I agree with you.
- nickpsecurity 10y ago
  It's long been known not to use insecure endpoints, email, etc in government. NSA used to certify the high-assurance alternatives. Here was one of the early ones with incredibly-strong TCB for the time: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.454.4029&rep=rep1&type=pdf http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.454... Almost all older or modern ones build email processing capabilities onto guards optionally with a proxy on client's side to integrate with common, mail client. Here's an article describing what a guard is along with some examples government uses today: https://en.wikipedia.org/wiki/Guard_(information_security) https://en.wikipedia.org/wiki/Guard_(information_security) Firewalls are knockoffs of guards that were created after businesses and much of government rejected high-assurance systems since they didn't have development pace and [insecure] features of low-security competition. Firewalls were cheap, fast, constantly added features, and totally left off the whole "design it to be nearly unhackable" aspect of guards. Even the guards themselves have lowered their assurance at the TCB and guard software over the years as neither military nor commercial market really care outside a small niche of customers. Remaining ones like Boeing SNS Server and BAE's XTS-400 go for $100,000+ a unit due to limited market + high development & certification costs. So, that's that. Medium-assurance solutions like Nexor's and General Dynamics continue being developed and adopted. They'll get smashed, though, since they're all adopting Linux-based cores & other COTS tech. Such are the market incentives.