3 ms·

A concerted attack by a nation state actor is very hard to fend off, even by the likes of Google and the NSA (indeed, there was a hack of the NSA by Russia a co

by scarmig 10y ago

A concerted attack by a nation state actor is very hard to fend off, even by the likes of Google and the NSA (indeed, there was a hack of the NSA by Russia a couple months ago). That can't be blamed on bad security practices.

belorn 10y ago
If we hear someone claiming that there was a zero-day exploit, then I will agree with the assertion that it can't be blamed on bad security practices. If not, which mean either bad passwords, bad support practice or known vulnerable software, then the nation state angle is just an incentive issue that describe who has an incentive to spread the hacked data.
- scarmig 10y ago
  These particular hacks were concerted spear fishing over months, IIRC. That's a hard threat to defend against.
  - belorn 10y ago
    Spear fishing attacks are hard, and quite common (https://www.firmex.com/thedealroom/spear-phishing-whos-getting-caught/ https://www.firmex.com/thedealroom/spear-phishing-whos-getti...). It doesn't seem that spear fishing is any proof of nation-state complexity to the attack. Just a few months ago, a large mmorpg gaming company had a developer account hacked through spear fishing. The attacker went in, danced around a bit, and gave out free items. Not really the behavior of a nation-state actor. The company, contrary to most other, admitted the fault and that security practices (and basic sense to not ask in the office why the "developer" needed to reset the password) had not been followed in this case, and that human error resulted in the breach. They did not claim that the attack was some complex hacking trick for which can't be defended and thus they be faulted for. It raised my respect for them, and it is something I hope more victims of social engineering would do.
  - josho 10y ago
    Isn't it trivial to guard against once you've setup 2FA? After the US conducted its own cyberattacks, they've been beating the drum on cyber security (I've personally seen one presentation from a high level official on beefing up security). Is it not reasonable to expect that the government and two official political parties have a minimum security requirement to protect against common attacks? I suppose I'm just surprised that the rhetoric is 'boo Russia they interfered with our election' as opposed to 'wake up America, our cyber security is weak'.
- euyyn 10y ago
  The Chinese government famously infiltrated Google and other tech companies in 2009? without using a zero-day exploit. Your argument expects the DNC to have a better chance at defending themselves than Google, which apparently uses "bad security practices". It's wrong.

by scarmig 10y ago

belorn 10y ago

If we hear someone claiming that there was a zero-day exploit, then I will agree with the assertion that it can't be blamed on bad security practices. If not, which mean either bad passwords, bad support practice or known vulnerable software, then the nation state angle is just an incentive issue that describe who has an incentive to spread the hacked data.

scarmig 10y ago
These particular hacks were concerted spear fishing over months, IIRC. That's a hard threat to defend against.
- belorn 10y ago
  Spear fishing attacks are hard, and quite common (https://www.firmex.com/thedealroom/spear-phishing-whos-getting-caught/ https://www.firmex.com/thedealroom/spear-phishing-whos-getti...). It doesn't seem that spear fishing is any proof of nation-state complexity to the attack. Just a few months ago, a large mmorpg gaming company had a developer account hacked through spear fishing. The attacker went in, danced around a bit, and gave out free items. Not really the behavior of a nation-state actor. The company, contrary to most other, admitted the fault and that security practices (and basic sense to not ask in the office why the "developer" needed to reset the password) had not been followed in this case, and that human error resulted in the breach. They did not claim that the attack was some complex hacking trick for which can't be defended and thus they be faulted for. It raised my respect for them, and it is something I hope more victims of social engineering would do.
- josho 10y ago
  Isn't it trivial to guard against once you've setup 2FA? After the US conducted its own cyberattacks, they've been beating the drum on cyber security (I've personally seen one presentation from a high level official on beefing up security). Is it not reasonable to expect that the government and two official political parties have a minimum security requirement to protect against common attacks? I suppose I'm just surprised that the rhetoric is 'boo Russia they interfered with our election' as opposed to 'wake up America, our cyber security is weak'.
euyyn 10y ago
The Chinese government famously infiltrated Google and other tech companies in 2009? without using a zero-day exploit. Your argument expects the DNC to have a better chance at defending themselves than Google, which apparently uses "bad security practices". It's wrong.