4 ms·

You can read about the backdoors they used here: https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ https://www.crowdstrike.

You can read about the backdoors they used here: https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ https://www.crowdstrike.com/blog/bears-midst-intrusion-democ... The summary: One used Powershell modules and Windows Scheduler to run scripts. Another used a combination of Twitter and public sites like Github/Dropbox for command and control. In my opinion, neither is impressively sophisticated, and a skilled application developer could whip up something similar in a week or two. Using popular sites like Twitter/Dropbox for C&C has been common for years, and you can purchase similar backdoors/RATs for less than $100. edit: Another interesting point from the link above: the two exploits stole exactly the same info once inside the DNC network. This would obviously be a big no-no for a sophisticated state actor as it doubles your chance of being compromised, but the author explains it away by claiming that Russia's intelligence agencies are disorganized and adversarial.

cmdrfred 10y ago
I have personally written that exact tool while learning Python. A RAT using Twitter for C & C. Uses PGP for encryption and verification. The twitter handles for the C & C change based on a hash of Googles lastest Doodle so you can access it without fear of account deletion. TIL I'm as good as a state level intelligence team. Hey CIA/NSA we know you are reading this, my contact info is in my profile. Hire me.
- politician 10y ago
  Tomorrow: "Cyberhacker admits to Russian hacker tools" > Yesterday, an Internet cyber hacker using the alias "cmdrfred" claimed on "HackerNews", an elite underground hacker site, that he or she personally built the hacking tools used by Russia to breach the DNC email servers and change the outcome of the recent election. > "I have personally written that exact tool [it] uses ... encryption ... so you can access [the DNC] without fear." > "I'm as good as a state level intelligence team." > cmdrfred went on to taunt American intelligence agencies while admitting that he was aware that elite anti-cyberhacking teams from the NSA and CIA were monitoring his operations. > The owner of HackerNews Paul Graham -- venture capitalist, flamboyant playboy, and known Russian sympathizer -- could not be reached for comment.
- jocro 10y ago
  > TIL I'm as good as a state level intelligence team. Not to totally ignore the pithiness, but I feel like your comment touches on something I see a ton here (and elsewhere): an offhand dismissal of the 'state level' intelligence capacity. At the end of the day, the systems were exploited. That more sophisticated methods went unused should be a measure of efficiency and not necessarily execution. Why break out the trick play if your opponent can't keep from you running it up the middle?
  - avn2109 10y ago
    True. But the absence of sophistication constitutes evidence neither in favor nor against the "State Actor" hypothesis.
    - billions 10y ago
      Until a Russian name or IP address is provided, the accusations fail to hold water. An incomplete proof is equivalent to "'cause we said so"
      - empath75 10y ago
        Spoofing ips is absurdly easy.
        cmdrfred 10y ago
        I agree that IP addresses aren't good evidence but it isn't really possible to spoof TCP in practice. http://security.stackexchange.com/questions/55279/how-easy-is-it-really-to-do-ip-spoofing http://security.stackexchange.com/questions/55279/how-easy-i...
      - stordoff 10y ago
        If you are targeting a US political entity, using a staging server in Russia probably isn't the worst idea, so unless the IP address directly ties to the Russian government/intelligence services, it's still only weak evidence of Russia's involvement.
lern_too_spel 10y ago
Your "summary" leaves out the key points. The SeaDaddy, X-Agent, and X-Tunnel tools used in these attacks have only been used by two groups, using the same control servers each time, on European, American, and World Anti-Doping Agency targets that the Russians had strong motive to attack, with some of the attacks being attributed to Russia by multiple other means. If it turned out that Russia was not behind these attacks, the scale of the bad publicity for Crowdstrike, Fidelis, Palo Alto Networks, etc. would nearly put them out of business. Unlike you, they have skin in the game and don't make these claims lightly.
- elif 10y ago
  The problem with relying upon motive and established MO exclusively is that anyone is therefore capable of framing whomever they like. This is the next generation of warfare, attribution is simply impossible. Even if there existed actual forensic evidence it could not be relied upon. Reacting to purported attacks at face value will leave you like a 1-layer chess player, potentially acting on behalf of your adversary.
  - lern_too_spel 10y ago
    As I said above, the attribution does not rely solely on motive. All private security firms that analyzed the attack have attributed it to Russia, and they would not stake their reputations on such a flimsy argument.
    - unclepresent 10y ago
      all private security firms ? name one, please
      - lern_too_spel 10y ago
        I named three in my first comment above. There are also Mandiant (FireEye) and SecureWorks. Previous attacks with the same malware were attributed to Russia by Threatconnect and Microsoft, who calls the "Fancy Bear" group "Strontium."

cmdrfred 10y ago

I have personally written that exact tool while learning Python. A RAT using Twitter for C & C. Uses PGP for encryption and verification. The twitter handles for the C & C change based on a hash of Googles lastest Doodle so you can access it without fear of account deletion. TIL I'm as good as a state level intelligence team. Hey CIA/NSA we know you are reading this, my contact info is in my profile. Hire me.

politician 10y ago
Tomorrow: "Cyberhacker admits to Russian hacker tools" > Yesterday, an Internet cyber hacker using the alias "cmdrfred" claimed on "HackerNews", an elite underground hacker site, that he or she personally built the hacking tools used by Russia to breach the DNC email servers and change the outcome of the recent election. > "I have personally written that exact tool [it] uses ... encryption ... so you can access [the DNC] without fear." > "I'm as good as a state level intelligence team." > cmdrfred went on to taunt American intelligence agencies while admitting that he was aware that elite anti-cyberhacking teams from the NSA and CIA were monitoring his operations. > The owner of HackerNews Paul Graham -- venture capitalist, flamboyant playboy, and known Russian sympathizer -- could not be reached for comment.
jocro 10y ago
> TIL I'm as good as a state level intelligence team. Not to totally ignore the pithiness, but I feel like your comment touches on something I see a ton here (and elsewhere): an offhand dismissal of the 'state level' intelligence capacity. At the end of the day, the systems were exploited. That more sophisticated methods went unused should be a measure of efficiency and not necessarily execution. Why break out the trick play if your opponent can't keep from you running it up the middle?
- avn2109 10y ago
  True. But the absence of sophistication constitutes evidence neither in favor nor against the "State Actor" hypothesis.
  - billions 10y ago
    Until a Russian name or IP address is provided, the accusations fail to hold water. An incomplete proof is equivalent to "'cause we said so"
    - empath75 10y ago
      Spoofing ips is absurdly easy.
      - cmdrfred 10y ago
        I agree that IP addresses aren't good evidence but it isn't really possible to spoof TCP in practice. http://security.stackexchange.com/questions/55279/how-easy-is-it-really-to-do-ip-spoofing http://security.stackexchange.com/questions/55279/how-easy-i...
    - stordoff 10y ago
      If you are targeting a US political entity, using a staging server in Russia probably isn't the worst idea, so unless the IP address directly ties to the Russian government/intelligence services, it's still only weak evidence of Russia's involvement.

lern_too_spel 10y ago

Your "summary" leaves out the key points. The SeaDaddy, X-Agent, and X-Tunnel tools used in these attacks have only been used by two groups, using the same control servers each time, on European, American, and World Anti-Doping Agency targets that the Russians had strong motive to attack, with some of the attacks being attributed to Russia by multiple other means. If it turned out that Russia was not behind these attacks, the scale of the bad publicity for Crowdstrike, Fidelis, Palo Alto Networks, etc. would nearly put them out of business. Unlike you, they have skin in the game and don't make these claims lightly.

elif 10y ago
The problem with relying upon motive and established MO exclusively is that anyone is therefore capable of framing whomever they like. This is the next generation of warfare, attribution is simply impossible. Even if there existed actual forensic evidence it could not be relied upon. Reacting to purported attacks at face value will leave you like a 1-layer chess player, potentially acting on behalf of your adversary.
- lern_too_spel 10y ago
  As I said above, the attribution does not rely solely on motive. All private security firms that analyzed the attack have attributed it to Russia, and they would not stake their reputations on such a flimsy argument.
  - unclepresent 10y ago
    all private security firms ? name one, please
    - lern_too_spel 10y ago
      I named three in my first comment above. There are also Mandiant (FireEye) and SecureWorks. Previous attacks with the same malware were attributed to Russia by Threatconnect and Microsoft, who calls the "Fancy Bear" group "Strontium."