5 ms·

The articles establish that the attacks came from Russia. But, I'm also under the impression that Russia is a hot bed for hacks in general, so the assertion tha

by josho 10y ago

The articles establish that the attacks came from Russia. But, I'm also under the impression that Russia is a hot bed for hacks in general, so the assertion that the attacks originated from Russia isn't saying much. I found the SecureWorks article had excellent detail but even they only had 'moderate confidence' that the attacks were sponsored by the Russian Government. Regardless, I find it interesting that the rhetoric is that a 'nation state was influencing the election', rather than our own security practices are so weak that our political organizations were infiltrated repeatedly.

scarmig 10y ago
A concerted attack by a nation state actor is very hard to fend off, even by the likes of Google and the NSA (indeed, there was a hack of the NSA by Russia a couple months ago). That can't be blamed on bad security practices.
- belorn 10y ago
  If we hear someone claiming that there was a zero-day exploit, then I will agree with the assertion that it can't be blamed on bad security practices. If not, which mean either bad passwords, bad support practice or known vulnerable software, then the nation state angle is just an incentive issue that describe who has an incentive to spread the hacked data.
  - scarmig 10y ago
    These particular hacks were concerted spear fishing over months, IIRC. That's a hard threat to defend against.
    - belorn 10y ago
      Spear fishing attacks are hard, and quite common (https://www.firmex.com/thedealroom/spear-phishing-whos-getting-caught/ https://www.firmex.com/thedealroom/spear-phishing-whos-getti...). It doesn't seem that spear fishing is any proof of nation-state complexity to the attack. Just a few months ago, a large mmorpg gaming company had a developer account hacked through spear fishing. The attacker went in, danced around a bit, and gave out free items. Not really the behavior of a nation-state actor. The company, contrary to most other, admitted the fault and that security practices (and basic sense to not ask in the office why the "developer" needed to reset the password) had not been followed in this case, and that human error resulted in the breach. They did not claim that the attack was some complex hacking trick for which can't be defended and thus they be faulted for. It raised my respect for them, and it is something I hope more victims of social engineering would do.
    - josho 10y ago
      Isn't it trivial to guard against once you've setup 2FA? After the US conducted its own cyberattacks, they've been beating the drum on cyber security (I've personally seen one presentation from a high level official on beefing up security). Is it not reasonable to expect that the government and two official political parties have a minimum security requirement to protect against common attacks? I suppose I'm just surprised that the rhetoric is 'boo Russia they interfered with our election' as opposed to 'wake up America, our cyber security is weak'.
  - euyyn 10y ago
    The Chinese government famously infiltrated Google and other tech companies in 2009? without using a zero-day exploit. Your argument expects the DNC to have a better chance at defending themselves than Google, which apparently uses "bad security practices". It's wrong.
sigmar 10y ago
>so the assertion that the attacks originated from Russia isn't saying much. You seem to have a prejudice that you are not willing to challenge. TreatConnect: >This discovery strengthens our ongoing assessment that Guccifer 2.0 is a Russian propaganda effort and not an independent actor.
- josho 10y ago
  Yes, I confess that I am prejudiced and believe that black hat hackers per capita is greater in Russia than US. I believe that because of their looser laws around hacking than the US. Though, if you have evidence otherwise I'm open to it. Either way, I don't really care, no country has a monopoly on hackers. > a Russian propaganda effort and not an independent actor Let's unpack that statement. Yes, this was clearly propaganda, hack originated in Russia, so sure Russian propaganda. Not an independent actor, ok, so a hacking group then, or a hacker plus wikileaks? I'm not seeing where they connected the dots to the Russian government. Look, the US created Stuxnet and destroyed industrial equipment. Meanwhile internal emails are published using phishing attacks and we suddenly call this meddling and are incensed that someone would dare do this to us?

by josho 10y ago

scarmig 10y ago

A concerted attack by a nation state actor is very hard to fend off, even by the likes of Google and the NSA (indeed, there was a hack of the NSA by Russia a couple months ago). That can't be blamed on bad security practices.

belorn 10y ago
If we hear someone claiming that there was a zero-day exploit, then I will agree with the assertion that it can't be blamed on bad security practices. If not, which mean either bad passwords, bad support practice or known vulnerable software, then the nation state angle is just an incentive issue that describe who has an incentive to spread the hacked data.
- scarmig 10y ago
  These particular hacks were concerted spear fishing over months, IIRC. That's a hard threat to defend against.
  - belorn 10y ago
    Spear fishing attacks are hard, and quite common (https://www.firmex.com/thedealroom/spear-phishing-whos-getting-caught/ https://www.firmex.com/thedealroom/spear-phishing-whos-getti...). It doesn't seem that spear fishing is any proof of nation-state complexity to the attack. Just a few months ago, a large mmorpg gaming company had a developer account hacked through spear fishing. The attacker went in, danced around a bit, and gave out free items. Not really the behavior of a nation-state actor. The company, contrary to most other, admitted the fault and that security practices (and basic sense to not ask in the office why the "developer" needed to reset the password) had not been followed in this case, and that human error resulted in the breach. They did not claim that the attack was some complex hacking trick for which can't be defended and thus they be faulted for. It raised my respect for them, and it is something I hope more victims of social engineering would do.
  - josho 10y ago
    Isn't it trivial to guard against once you've setup 2FA? After the US conducted its own cyberattacks, they've been beating the drum on cyber security (I've personally seen one presentation from a high level official on beefing up security). Is it not reasonable to expect that the government and two official political parties have a minimum security requirement to protect against common attacks? I suppose I'm just surprised that the rhetoric is 'boo Russia they interfered with our election' as opposed to 'wake up America, our cyber security is weak'.
- euyyn 10y ago
  The Chinese government famously infiltrated Google and other tech companies in 2009? without using a zero-day exploit. Your argument expects the DNC to have a better chance at defending themselves than Google, which apparently uses "bad security practices". It's wrong.

sigmar 10y ago

>so the assertion that the attacks originated from Russia isn't saying much. You seem to have a prejudice that you are not willing to challenge. TreatConnect: >This discovery strengthens our ongoing assessment that Guccifer 2.0 is a Russian propaganda effort and not an independent actor.

josho 10y ago
Yes, I confess that I am prejudiced and believe that black hat hackers per capita is greater in Russia than US. I believe that because of their looser laws around hacking than the US. Though, if you have evidence otherwise I'm open to it. Either way, I don't really care, no country has a monopoly on hackers. > a Russian propaganda effort and not an independent actor Let's unpack that statement. Yes, this was clearly propaganda, hack originated in Russia, so sure Russian propaganda. Not an independent actor, ok, so a hacking group then, or a hacker plus wikileaks? I'm not seeing where they connected the dots to the Russian government. Look, the US created Stuxnet and destroyed industrial equipment. Meanwhile internal emails are published using phishing attacks and we suddenly call this meddling and are incensed that someone would dare do this to us?