11 ms·

"Many breach announcements this year pointed to a “sophisticated attacker” as a narrative of their issue. This usually is followed up by criticism when an initi

"Many breach announcements this year pointed to a “sophisticated attacker” as a narrative of their issue. This usually is followed up by criticism when an initial means of their compromise is revealed. Most breaches begin with spear phishing, commodity exploits, a leaked key, or some other obvious or preventable detail. However, this is almost never the “sophisticated” aspect of a breach worth talking about. It’s easy to point at an embarrassing vector and dismiss the rest of an attack. Thus, do not judge an adversary by the vector they’ve chosen. An adversary may show you what “sophistication” means after advancing from their beachhead." * https://medium.com/starting-up-security/learning-from-a-year-of-security-breaches-ed036ea05d9b#.e602eepey https://medium.com/starting-up-security/learning-from-a-year...

cloakandswagger 10y ago
Valid point, but I should clarify my original comment: I don't find either aspect of the attack--the entry or the payload--to be particularly sophisticated. Everything I've read indicates the bulk of work was done by Powershell scripts, along with a backdoor process running in the open. If you told me that the backdoor was a kernel level rootkit or something similar then I could get onboard, but as it stands I don't think the attack's complexity is a solid argument for "Russia did it"
- codedokode 10y ago
  The main arguments might be not technical. The political emails are pretty boring stuff for an outsider so it should be some government or politician bothering to get them. I also remember that some gmail accounts of people from DNC staff were hacked. Gmail probably has logged what IP addresses were used when logging in with stolen passwords and they could be used as a hint too (though most probably they point to cheap VPS bought by some anonymous person or Tor node, I doubt anyone would use a stolen password from their real IP address).
  - unclepresent 10y ago
    nobody except complete amateurs is using its own computer to do hacking. there are thousands if not millions of compromized computers in aws cloud and similar hosting services that in turn work as robot-hackers to compromise other sites. it is like a self building hacking network where each cell works to infect other cells. so atack, if it was any atack (as document does not have any evidence that it was one) was unlikely be runnig from a real IP but from a random AWS instance registered by some junior software developer from India who bought it to deploy a pet project that was hacked without him even knowing this weeks ago before the event.
- fleitz 10y ago
  Who else could have forced the DNC to rig the primaries? It's very clear from the collusion between CNN and the Hillary campaign that state level actors were involved.
  - lern_too_spel 10y ago
    Please don't spread fake news about primary rigging, even if tongue-in-cheek. Stick to discussing the article.
    - 464192002d7fe1c 10y ago
      How is primary rigging fake news? Its very obvious from reading the wiki leaks emails that the DNC was brazenly biased towards Hillary and against Sanders.
      - praxulus 10y ago
        Because there's absolutely no evidence that it was rigged? Just because the DNC preferred the lifelong Democrat to the lifelong independent (who could have guessed that?) doesn't mean they couldn't still have operated a fair primary.
        travmatt 10y ago
        But your facts and reasoning regretfully interrupts the circle jerk of the Bernie bros who are convinced their democratic socialist was on the brink of revolutionizing the American political system and finally delivering us to a Denmarkian utopia. Never mind the fact that Sanders was treated much more gently by the Clinton campaign than Obama was in '08, the only salient fact is that minority voters should have yielded their preference for a man who has spent 30+ years in Washington and yet has largely failed to build any power base.
        epmaybe 10y ago
        I'm confused by the last sentence. Are you suggesting that more minority voters went for Sanders over Clinton in the primaries? I had thought the exact opposite.
avn2109 10y ago
>> "An adversary may show you what “sophistication” means after advancing from their beachhead." Sure, that's obviously true in general, but given the current absence of evidence of "sophistication," there is no reason to assume its presence.

cloakandswagger 10y ago

Valid point, but I should clarify my original comment: I don't find either aspect of the attack--the entry or the payload--to be particularly sophisticated. Everything I've read indicates the bulk of work was done by Powershell scripts, along with a backdoor process running in the open. If you told me that the backdoor was a kernel level rootkit or something similar then I could get onboard, but as it stands I don't think the attack's complexity is a solid argument for "Russia did it"

codedokode 10y ago
The main arguments might be not technical. The political emails are pretty boring stuff for an outsider so it should be some government or politician bothering to get them. I also remember that some gmail accounts of people from DNC staff were hacked. Gmail probably has logged what IP addresses were used when logging in with stolen passwords and they could be used as a hint too (though most probably they point to cheap VPS bought by some anonymous person or Tor node, I doubt anyone would use a stolen password from their real IP address).
- unclepresent 10y ago
  nobody except complete amateurs is using its own computer to do hacking. there are thousands if not millions of compromized computers in aws cloud and similar hosting services that in turn work as robot-hackers to compromise other sites. it is like a self building hacking network where each cell works to infect other cells. so atack, if it was any atack (as document does not have any evidence that it was one) was unlikely be runnig from a real IP but from a random AWS instance registered by some junior software developer from India who bought it to deploy a pet project that was hacked without him even knowing this weeks ago before the event.
fleitz 10y ago
Who else could have forced the DNC to rig the primaries? It's very clear from the collusion between CNN and the Hillary campaign that state level actors were involved.
- lern_too_spel 10y ago
  Please don't spread fake news about primary rigging, even if tongue-in-cheek. Stick to discussing the article.
  - 464192002d7fe1c 10y ago
    How is primary rigging fake news? Its very obvious from reading the wiki leaks emails that the DNC was brazenly biased towards Hillary and against Sanders.
    - praxulus 10y ago
      Because there's absolutely no evidence that it was rigged? Just because the DNC preferred the lifelong Democrat to the lifelong independent (who could have guessed that?) doesn't mean they couldn't still have operated a fair primary.
      - travmatt 10y ago
        But your facts and reasoning regretfully interrupts the circle jerk of the Bernie bros who are convinced their democratic socialist was on the brink of revolutionizing the American political system and finally delivering us to a Denmarkian utopia. Never mind the fact that Sanders was treated much more gently by the Clinton campaign than Obama was in '08, the only salient fact is that minority voters should have yielded their preference for a man who has spent 30+ years in Washington and yet has largely failed to build any power base.
        epmaybe 10y ago
        I'm confused by the last sentence. Are you suggesting that more minority voters went for Sanders over Clinton in the primaries? I had thought the exact opposite.

avn2109 10y ago

>> "An adversary may show you what “sophistication” means after advancing from their beachhead." Sure, that's obviously true in general, but given the current absence of evidence of "sophistication," there is no reason to assume its presence.