16 ms·

I have looked through the report. The only useful information was brief description of attack methods, everything else looks like a list of general recommendati

I have looked through the report. The only useful information was brief description of attack methods, everything else looks like a list of general recommendations one can find on the OWASP website. As I understand from report the main methods used were: - sendind emails with executable files that victims for some reason executed - phishing So, they used script kiddie level tools anyone could use (and they are cheap; you don't have to buy expensive zero-day exploits on a black market). But of course this could be done intentionally so it looks amateur-ish. This attacks could be easily mitigated. First, OS and applications should not run unknown files from Internet (because some people got used to double click on everything they get in email), second, we should start using physical cryptographic keys instead of passwords. Common people cannot handle passwords, they either make easily guessed passwords or enter them everywhere without thinking. I hate passwords too because they are hard to remember (and please don't suggest that I should download some software and upload my passwords to a "cloud" in NSA-controlled country). By the way iOS is the only popular operating system I know that doesn't allow to execute files downloaded from web or emails. Apple did it the right way. The report also contains a pretty useless firewall rule named "PAS TOOL PHP WEB KIT FOUND" that can be used to search malware in PHP files. It is interesting that they have replaced digits in 'base64_decode' function name with regexp as if there were any other similar functions.

ryanlol 10y ago
>I have looked through the report. The only useful information was brief description of attack methods, everything else looks like a list of general recommendations one can find on the OWASP website. https://news.ycombinator.com/item?id=13280068 https://news.ycombinator.com/item?id=13280068 Look again, they handed you more than enough information. >The report also contains a pretty useless firewall rule named "PAS TOOL PHP WEB KIT FOUND" that can be used to search malware in PHP files. It is interesting that they have replaced digits in 'base64_decode' function name with regexp as if there were any other similar functions. root@:~/super_secret_govt_malware_samples# grep * -e bas|tail -n2 D285115E97C02063836F1CF8F91669C114052727C39BF4BD3C062AD5B3509E38:<?php $_f___f='base'.(32*2).'_de'.'code';$_f___f=$_f___f(str_replace("\n", '', 'FeBvsTxs6EyYpYb/gJ9ckCbVgYYH9D56SKL+O6KdPjkDV91JgHr1g8WRH7/uYOda3hUgVLO064UXPF5K DA9F2804B16B369156E1B629AD3D2AAC79326B94284E43C7B8355F3DB71912B8:<?php $l___l_='base'.(32*2).'_de'.'code';$l___l_=$l___l_(str_replace("\n", '', 'QbO8tTv2NBoj4kUpujJlanEQeWDR+lrAJa6TWEnQEGF/uIiq3/G4ox/YCpaqsd6+QRNaT2pbpyBIDnlo root@:~/super_secret_govt_malware_samples# Why is everyone trying so desperately to attack and discredit this report?
- codedokode 10y ago
  Ok, you are right, I didn't notice the multiplication sign. This rule really can detect infected PHP files.
- Qworg 10y ago
  It is interesting to see the strongly negative positions that some people take on any of these reports. It is almost like folks can have ulterior motives or know very little about how to protect sources and methods.
- heurist 10y ago
  > Why is everyone trying so desperately to attack and discredit this report? Because half of the US voting population are heavily invested in it being false.
UnoriginalGuy 10y ago
> By the way iOS is the only popular operating system I know that doesn't allow to execute files downloaded from web or emails. Windows 8, 8.1, and 10 don't allow it either. SmartScreen will block unsigned executables by default[0]. Enterprise customers should be using AppLocker which does a lot of what SmartScreen does, but with more flexibility and control. The issue arises when [bad] System Administrators disable SmartScreen because it is a "hassle" and don't deploy AppLocker in its place. This effectively sends their users back to a Windows 7 level of security. If Microsoft forced either SmartScreen OR AppLocker, then we'd have people on here screaming about freedom, Microsoft is evil, "Embrace, extend and extinguish," year of the Linux desktop, and so on. This is the best they can without treating System Admins like babies (even when they're going to use that power for "evil"). [0] https://blogs.msdn.microsoft.com/ie/2012/08/14/microsoft-smartscreen-extended-validation-ev-code-signing-certificates/ https://blogs.msdn.microsoft.com/ie/2012/08/14/microsoft-sma...
- greglindahl 10y ago
  Isn't there a history of signed malicious things? For example: https://www.zscaler.com/blogs/research/yet-another-signed-malware-spymel https://www.zscaler.com/blogs/research/yet-another-signed-ma...
  - UnoriginalGuy 10y ago
    There are a handful of scattered examples. Fortunately because of how signing works it makes malware that is signed incredibly easy to detect, since by the very nature of the signature the malware's contents cannot be altered. Plus signing is costly, and that within itself can make malware attacks uneconomical. It also makes getting a signature rather complex since you need fake identification and payment to avoid being carted off by the authorities. Overall signing requirements are a huge net win for the "good guys." And while it isn't a hard security boundary, it is a damn effective one in the real world.
- codedokode 10y ago
  The problem here is that the system is not secure by default, one needs to hire a qualified specialist to set everything up. By default the user can run executable attachments or files downloaded from browser and it is a wrong design decision made many years ago. Users do not understand what is an "executable file", they got used to click an icon to see the file contents. This is just poorly designed UI that helps to deceive a user. > If Microsoft forced either SmartScreen OR AppLocker, then we'd have people on here screaming about freedom, Microsoft is evil, There could be a separate UI for installing software or even a package manager. Microsoft doens't want to change anything because it is still the leader and earns huge profits.
eropple 10y ago
> This attacks could be easily mitigated. [...] second, we should start using physical cryptographic keys instead of passwords Man--I like the way you think, I really do, but this is not "easy". Technical simplicity and social ease are vastly different, and it's usually the humans who are getting hacked.
- codedokode 10y ago
  If an organization is working with sensitive data maybe they should invest some resources into security. I understand it is not easy because companies like Microsoft have been releasing poorly designed software (with things like autorun for USB drives) for 20 years and it still is the leader. But we have to advance step by step. For every single person needing executable attacments there are maybe million users who can run them without understanding the consequences.
  - ep103 10y ago
    I mean, you're talking about the campaign of a person who was running while being investigated for circumventing security procedures. Regardless of what you think about those topics or their validity, is it that surprising that the campaign wasn't up to par on the security front?
    - koube 10y ago
      The RNC was hacked as well, although they similarly circumvented the same security procedures.
      - jamiesonbecker 10y ago
        That the RNC was also hacked seems to be a popular, but probably false, meme. http://www.cnn.com/2016/12/10/politics/smerconish-spicer-hacked-russian/ http://www.cnn.com/2016/12/10/politics/smerconish-spicer-hac...
        10y ago
gravypod 10y ago
Check out the Mooltipass it's the hardware security device I want but can't afford because of college.
- avn2109 10y ago
  Can experts weigh in on the utility of this thing? To my ignorant eyes it looks excessively complicated. To save you a search it's here: https://www.themooltipass.com/ https://www.themooltipass.com/
  - gravypod 10y ago
    The idea is you put your passwords into this box. This box can only be opened with a Chip&Pin card. This magic box can be backed up and restored if ever lost or stolen. The magic box is also "physically-ish" sperated from the computer. It's Impossible (TM) to compromise the security of all the passwords in the magic box. It goes something like this. Setup goes like this: 1. User buys device which comes with keycards. 2. User selects pin code for their device Usage goes like this: 1. User attempts to login to site 2. Browser plugin requests login details from device 3. User is prompted for chip & pin from the device 4. User puts card into device and inputs pin 5. User clicks a button physically to aprove transaction 6. If correct data is sent to the browser for login 7. Subsiquent chip and pin signins aren't needed for X timeout The interaction is more 'tedious' for some people but it's not meant for the people who are concerned with typing in a 4-digit pin. It's meant for people who would otherwise have to remember 20 digit alpha-num-sym passwords for 30 different accounts for which this is much easier and safer to do. It's also something people know how to do. If you've gone to a super market you are now prompted for Chip & Pin. People are already motivated to learn how this works (want your groceries for the week? Use the chip and pin!). On the other hand, the average person doesn't need code words to get access to a protected resource. Bar "special organizations" I'd say there are very few people who are trained natrually into the concept of passwords. It's simple but it isn't done nearly enough for everyone to understand it which is in stark contrast when compaired to using a credit card with a pin code. Also, they could use similar or even the same pin code as their bank pin if they aren't concerned about security.
cloakandswagger 10y ago
That's the real absurdity of this debacle to me. Many of the whitepapers that I read about the DNC hack listed the attack's "sophistication" as proof that it came from a state actor, yet it was the most routine, simple attack conceivable. No rootkits, no 0 days, just simple phishing and social engineering.
- heartbreak 10y ago
  The sophistication cited by CrowdStrike was the actions taken on the DNC servers, not the initial penetration.
  - randyrand 10y ago
    Could you elaborate? Once you have a password shouldn't it be as easy as just downloading all the emails? Any email client should have the functionality built in. edit: seeing some reports they used "sophisticated" SQL injection... okay...I mean for a lay person it seems sophisticated, sure. But for anyone in the industry it's one of the oldest and easiest tricks in the book. I really suspect news sources are knowingly exaggerating about the sophistication of this "hack" in order to make up-play Russia's role and downplay the DNC's culpability.
    - cloakandswagger 10y ago
      You can read about the backdoors they used here: https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ https://www.crowdstrike.com/blog/bears-midst-intrusion-democ... The summary: One used Powershell modules and Windows Scheduler to run scripts. Another used a combination of Twitter and public sites like Github/Dropbox for command and control. In my opinion, neither is impressively sophisticated, and a skilled application developer could whip up something similar in a week or two. Using popular sites like Twitter/Dropbox for C&C has been common for years, and you can purchase similar backdoors/RATs for less than $100. edit: Another interesting point from the link above: the two exploits stole exactly the same info once inside the DNC network. This would obviously be a big no-no for a sophisticated state actor as it doubles your chance of being compromised, but the author explains it away by claiming that Russia's intelligence agencies are disorganized and adversarial.
zanny 10y ago
It should be noted blocking execution isn't the problem, its the access an unknown executable has to the host system. A well hardened MAC system, which requires no effective user intervention, can limit access of arbitrary programs to a minimal set of files and devices to stop bad actors from actually getting anything without the user having to modify the MAC policy.
StanislavPetrov 10y ago
The "evidence" boils down to: The Hackers drove a truck. Russians drive trucks. The Russians did the hacking. While its insulting that our government would try to pass off this drivel as "evidence", I'm much more dismayed that so many of my fellow Americans will uncritically accept it as such.
- x0x0 10y ago
  This report merely points the finger at Russia; it does not purport to substantiate that allegation. Previous JARs have not attributed malicious cyber activity to specific countries or threat actors. However, public attribution of these activities to RIS is supported by technical indicators from the U.S. Intelligence Community, DHS, FBI, the private sector, and other entities. The report then discusses when the attackers did and mitigation strategies.
  - StanislavPetrov 10y ago
    >This report merely points the finger at Russia; it does not purport to substantiate that allegation. That's the point, its just another completely baseless, unsubstantiated accusation. This report contains nothing that suggests that the Russians were any more likely to be the source of the hack then countless other entities. The problem is that these baseless claims are being presented as evidence and being consumed uncritically as such. Take for example the headline in PcMag: >Hacking Evidence in Hand, Obama Sanctions Russia http://www.pcmag.com/news/350675/hacking-evidence-in-hand-obama-sanctions-russia http://www.pcmag.com/news/350675/hacking-evidence-in-hand-ob...
    - x0x0 10y ago
      This report doesn't claim to substantiate those allegations. It merely repeats them.
      - marxmarv 10y ago
        By the Big Lie theory, what's the diff?
wongarsu 10y ago
>The report also contains a pretty useless firewall rule named "PAS TOOL PHP WEB KIT FOUND" that can be used to search malware in PHP files. It is interesting that they have replaced digits in 'base64_decode' function name with regexp as if there were any other similar functions. If you read that regexp carefully, it's more complicated than that. It doesn't match base64_decode, but it would match `='base'.(32*2).'_de'.'code'`. That's obfuscation in the payload, and in another comment I linked to some code that uses exactly this unusual (and pointless) obfuscation [1] [1] https://news.ycombinator.com/item?id=13281008 https://news.ycombinator.com/item?id=13281008
dfc 10y ago
> The report also contains a pretty useless firewall rule For what it's worth Yara is not a firewall. It's essentially an intelligent grep for incident response. An IOC is an indicator of compromise, so it's after the fact not a preventative measure. http://virustotal.github.io/yara/ http://virustotal.github.io/yara/

ryanlol 10y ago

>I have looked through the report. The only useful information was brief description of attack methods, everything else looks like a list of general recommendations one can find on the OWASP website. https://news.ycombinator.com/item?id=13280068 https://news.ycombinator.com/item?id=13280068 Look again, they handed you more than enough information. >The report also contains a pretty useless firewall rule named "PAS TOOL PHP WEB KIT FOUND" that can be used to search malware in PHP files. It is interesting that they have replaced digits in 'base64_decode' function name with regexp as if there were any other similar functions. root@:~/super_secret_govt_malware_samples# grep * -e bas|tail -n2 D285115E97C02063836F1CF8F91669C114052727C39BF4BD3C062AD5B3509E38:<?php $_f___f='base'.(32*2).'_de'.'code';$_f___f=$_f___f(str_replace("\n", '', 'FeBvsTxs6EyYpYb/gJ9ckCbVgYYH9D56SKL+O6KdPjkDV91JgHr1g8WRH7/uYOda3hUgVLO064UXPF5K DA9F2804B16B369156E1B629AD3D2AAC79326B94284E43C7B8355F3DB71912B8:<?php $l___l_='base'.(32*2).'_de'.'code';$l___l_=$l___l_(str_replace("\n", '', 'QbO8tTv2NBoj4kUpujJlanEQeWDR+lrAJa6TWEnQEGF/uIiq3/G4ox/YCpaqsd6+QRNaT2pbpyBIDnlo root@:~/super_secret_govt_malware_samples# Why is everyone trying so desperately to attack and discredit this report?

codedokode 10y ago
Ok, you are right, I didn't notice the multiplication sign. This rule really can detect infected PHP files.
Qworg 10y ago
It is interesting to see the strongly negative positions that some people take on any of these reports. It is almost like folks can have ulterior motives or know very little about how to protect sources and methods.
heurist 10y ago
> Why is everyone trying so desperately to attack and discredit this report? Because half of the US voting population are heavily invested in it being false.

UnoriginalGuy 10y ago

> By the way iOS is the only popular operating system I know that doesn't allow to execute files downloaded from web or emails. Windows 8, 8.1, and 10 don't allow it either. SmartScreen will block unsigned executables by default[0]. Enterprise customers should be using AppLocker which does a lot of what SmartScreen does, but with more flexibility and control. The issue arises when [bad] System Administrators disable SmartScreen because it is a "hassle" and don't deploy AppLocker in its place. This effectively sends their users back to a Windows 7 level of security. If Microsoft forced either SmartScreen OR AppLocker, then we'd have people on here screaming about freedom, Microsoft is evil, "Embrace, extend and extinguish," year of the Linux desktop, and so on. This is the best they can without treating System Admins like babies (even when they're going to use that power for "evil"). [0] https://blogs.msdn.microsoft.com/ie/2012/08/14/microsoft-smartscreen-extended-validation-ev-code-signing-certificates/ https://blogs.msdn.microsoft.com/ie/2012/08/14/microsoft-sma...

greglindahl 10y ago
Isn't there a history of signed malicious things? For example: https://www.zscaler.com/blogs/research/yet-another-signed-malware-spymel https://www.zscaler.com/blogs/research/yet-another-signed-ma...
- UnoriginalGuy 10y ago
  There are a handful of scattered examples. Fortunately because of how signing works it makes malware that is signed incredibly easy to detect, since by the very nature of the signature the malware's contents cannot be altered. Plus signing is costly, and that within itself can make malware attacks uneconomical. It also makes getting a signature rather complex since you need fake identification and payment to avoid being carted off by the authorities. Overall signing requirements are a huge net win for the "good guys." And while it isn't a hard security boundary, it is a damn effective one in the real world.
codedokode 10y ago
The problem here is that the system is not secure by default, one needs to hire a qualified specialist to set everything up. By default the user can run executable attachments or files downloaded from browser and it is a wrong design decision made many years ago. Users do not understand what is an "executable file", they got used to click an icon to see the file contents. This is just poorly designed UI that helps to deceive a user. > If Microsoft forced either SmartScreen OR AppLocker, then we'd have people on here screaming about freedom, Microsoft is evil, There could be a separate UI for installing software or even a package manager. Microsoft doens't want to change anything because it is still the leader and earns huge profits.

eropple 10y ago

> This attacks could be easily mitigated. [...] second, we should start using physical cryptographic keys instead of passwords Man--I like the way you think, I really do, but this is not "easy". Technical simplicity and social ease are vastly different, and it's usually the humans who are getting hacked.

codedokode 10y ago
If an organization is working with sensitive data maybe they should invest some resources into security. I understand it is not easy because companies like Microsoft have been releasing poorly designed software (with things like autorun for USB drives) for 20 years and it still is the leader. But we have to advance step by step. For every single person needing executable attacments there are maybe million users who can run them without understanding the consequences.
- ep103 10y ago
  I mean, you're talking about the campaign of a person who was running while being investigated for circumventing security procedures. Regardless of what you think about those topics or their validity, is it that surprising that the campaign wasn't up to par on the security front?
  - koube 10y ago
    The RNC was hacked as well, although they similarly circumvented the same security procedures.
    - jamiesonbecker 10y ago
      That the RNC was also hacked seems to be a popular, but probably false, meme. http://www.cnn.com/2016/12/10/politics/smerconish-spicer-hacked-russian/ http://www.cnn.com/2016/12/10/politics/smerconish-spicer-hac...
      - 10y ago

gravypod 10y ago

Check out the Mooltipass it's the hardware security device I want but can't afford because of college.

avn2109 10y ago
Can experts weigh in on the utility of this thing? To my ignorant eyes it looks excessively complicated. To save you a search it's here: https://www.themooltipass.com/ https://www.themooltipass.com/
- gravypod 10y ago
  The idea is you put your passwords into this box. This box can only be opened with a Chip&Pin card. This magic box can be backed up and restored if ever lost or stolen. The magic box is also "physically-ish" sperated from the computer. It's Impossible (TM) to compromise the security of all the passwords in the magic box. It goes something like this. Setup goes like this: 1. User buys device which comes with keycards. 2. User selects pin code for their device Usage goes like this: 1. User attempts to login to site 2. Browser plugin requests login details from device 3. User is prompted for chip & pin from the device 4. User puts card into device and inputs pin 5. User clicks a button physically to aprove transaction 6. If correct data is sent to the browser for login 7. Subsiquent chip and pin signins aren't needed for X timeout The interaction is more 'tedious' for some people but it's not meant for the people who are concerned with typing in a 4-digit pin. It's meant for people who would otherwise have to remember 20 digit alpha-num-sym passwords for 30 different accounts for which this is much easier and safer to do. It's also something people know how to do. If you've gone to a super market you are now prompted for Chip & Pin. People are already motivated to learn how this works (want your groceries for the week? Use the chip and pin!). On the other hand, the average person doesn't need code words to get access to a protected resource. Bar "special organizations" I'd say there are very few people who are trained natrually into the concept of passwords. It's simple but it isn't done nearly enough for everyone to understand it which is in stark contrast when compaired to using a credit card with a pin code. Also, they could use similar or even the same pin code as their bank pin if they aren't concerned about security.

cloakandswagger 10y ago

That's the real absurdity of this debacle to me. Many of the whitepapers that I read about the DNC hack listed the attack's "sophistication" as proof that it came from a state actor, yet it was the most routine, simple attack conceivable. No rootkits, no 0 days, just simple phishing and social engineering.

heartbreak 10y ago
The sophistication cited by CrowdStrike was the actions taken on the DNC servers, not the initial penetration.
- randyrand 10y ago
  Could you elaborate? Once you have a password shouldn't it be as easy as just downloading all the emails? Any email client should have the functionality built in. edit: seeing some reports they used "sophisticated" SQL injection... okay...I mean for a lay person it seems sophisticated, sure. But for anyone in the industry it's one of the oldest and easiest tricks in the book. I really suspect news sources are knowingly exaggerating about the sophistication of this "hack" in order to make up-play Russia's role and downplay the DNC's culpability.
  - cloakandswagger 10y ago
    You can read about the backdoors they used here: https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ https://www.crowdstrike.com/blog/bears-midst-intrusion-democ... The summary: One used Powershell modules and Windows Scheduler to run scripts. Another used a combination of Twitter and public sites like Github/Dropbox for command and control. In my opinion, neither is impressively sophisticated, and a skilled application developer could whip up something similar in a week or two. Using popular sites like Twitter/Dropbox for C&C has been common for years, and you can purchase similar backdoors/RATs for less than $100. edit: Another interesting point from the link above: the two exploits stole exactly the same info once inside the DNC network. This would obviously be a big no-no for a sophisticated state actor as it doubles your chance of being compromised, but the author explains it away by claiming that Russia's intelligence agencies are disorganized and adversarial.

zanny 10y ago

It should be noted blocking execution isn't the problem, its the access an unknown executable has to the host system. A well hardened MAC system, which requires no effective user intervention, can limit access of arbitrary programs to a minimal set of files and devices to stop bad actors from actually getting anything without the user having to modify the MAC policy.

StanislavPetrov 10y ago

The "evidence" boils down to: The Hackers drove a truck. Russians drive trucks. The Russians did the hacking. While its insulting that our government would try to pass off this drivel as "evidence", I'm much more dismayed that so many of my fellow Americans will uncritically accept it as such.

x0x0 10y ago
This report merely points the finger at Russia; it does not purport to substantiate that allegation. Previous JARs have not attributed malicious cyber activity to specific countries or threat actors. However, public attribution of these activities to RIS is supported by technical indicators from the U.S. Intelligence Community, DHS, FBI, the private sector, and other entities. The report then discusses when the attackers did and mitigation strategies.
- StanislavPetrov 10y ago
  >This report merely points the finger at Russia; it does not purport to substantiate that allegation. That's the point, its just another completely baseless, unsubstantiated accusation. This report contains nothing that suggests that the Russians were any more likely to be the source of the hack then countless other entities. The problem is that these baseless claims are being presented as evidence and being consumed uncritically as such. Take for example the headline in PcMag: >Hacking Evidence in Hand, Obama Sanctions Russia http://www.pcmag.com/news/350675/hacking-evidence-in-hand-obama-sanctions-russia http://www.pcmag.com/news/350675/hacking-evidence-in-hand-ob...
  - x0x0 10y ago
    This report doesn't claim to substantiate those allegations. It merely repeats them.
    - marxmarv 10y ago
      By the Big Lie theory, what's the diff?

wongarsu 10y ago

>The report also contains a pretty useless firewall rule named "PAS TOOL PHP WEB KIT FOUND" that can be used to search malware in PHP files. It is interesting that they have replaced digits in 'base64_decode' function name with regexp as if there were any other similar functions. If you read that regexp carefully, it's more complicated than that. It doesn't match base64_decode, but it would match `='base'.(32*2).'_de'.'code'`. That's obfuscation in the payload, and in another comment I linked to some code that uses exactly this unusual (and pointless) obfuscation [1] [1] https://news.ycombinator.com/item?id=13281008 https://news.ycombinator.com/item?id=13281008

dfc 10y ago

> The report also contains a pretty useless firewall rule For what it's worth Yara is not a firewall. It's essentially an intelligent grep for incident response. An IOC is an indicator of compromise, so it's after the fact not a preventative measure. http://virustotal.github.io/yara/ http://virustotal.github.io/yara/