5 ms·

The report just didn't get into that much detail but they did say: "the code delivers Remote Access Tools (RATs) and evades detection using a range of techniqu

The report just didn't get into that much detail but they did say: "the code delivers Remote Access Tools (RATs) and evades detection using a range of techniques." A "range of techniques" includes things like rootkits. >No rootkits, The attackers did use stealthy persistence techniques often called 'rootkits". "the SeaDaddy implant developed in Python and compiled with py2exe and another Powershell backdoor with persistence accomplished via Windows Management Instrumentation (WMI) system,[..] The Powershell backdoor is ingenious in its simplicity and power" [0] >no 0 days The same group used six 0-days in 2015. Either they didn't need to use them in this attack or they used them and deleted the evidence. Senit is APT28 see quote below: "One of the striking characteristics of the Sednit group is its ability to come up with brand-new 0-day vulnerabilities regularly. In 2015, the group exploited no fewer than six 0-day vulnerabilities" [1] >yet it was the most routine, simple attack conceivable. The attack involved multiple pieces of custom written software and carefully researched spearfishing, the attackers spent time and effort to hide their tracks, maintain persistence and exfil data without detection. This level of effort and time does not qualify as routine, some intelligence agencies can't even write their own RATs. [0]: https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ https://www.crowdstrike.com/blog/bears-midst-intrusion-democ... [1]: http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part1.pdf http://www.welivesecurity.com/wp-content/uploads/2016/10/ese...

smsm42 10y ago
Can't one just buy a RAT? Also, the WMI think they describe doesn't look like rootkit, more like cron analogue for Windows. I.e. on Unix it would be like installing a command inside crontab. That's not what is usually called a rootkit - a tool that is designed to conceals its presence (and other tools presence) from regular OS tools.
- EthanHeilman 10y ago
  You can buy RATs. The several RATs used in this campaign were never for sale. For example the RAT named X-Agent was one of several used in the DNC hack. It has never been put up for sale and it was used in previous Russian intelligence operations (for example tracking Ukraine artillery[0]). >That's not what is usually called a rootkit It doesn't appear that anyone has reverse engineered the PC version of X-Agent but the android variant (which may be very different from the one used in the DNC hack) does take some steps to hide itself. Granted nothing suggests anything like kernel syscall hooking but those sorts of rootkit techniques are overrated because they leave obvious and detectable patterns of compromise. [0]: https://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-update-ios-espionage-app-found/ https://blog.trendmicro.com/trendlabs-security-intelligence/...
  - deleted 10y ago
    [deleted]
  - candiodari 10y ago
    So essentially someone hacked the DNC, and it's "advanced" because some custom software was written just for this particular target ? I've written custom software (which was a lot harder to find than some python WMI hooks) for hacking a lot lower profile organisations. I've consulted for organisations that were hacked by Chinese hackers for bitcoin ransom that had custom software written too. I mean, high profile target, more effort can be expected. It does not mean the government is involved (although a lot of hacking groups seem to have government sidelines in China, though it does not appear to be their primary activity. I mean unless the Chinese government is itself into bitcoin ransoming). But more seriously, if a component of our government that is this central to our democracy can be hacked by sending emails "open this exe", then ... I mean seriously. Sorry to say, but if that works, you deserve what happens. Is this really the level of competency in the people that are currently organising the government ? Also the main thing this report does is validate that the information leaked to the press is indeed true (I figured as much, I mean why put so much effort into fighting fake news unless the real target information is not fake ?). So Hillary and the DNC is in fact in the pocket of wall street. She DID use the DNC organisation to sabotage Bernie Sanders. There are in fact foreign donors to Hillary and the DNC that are illegal under rules that Hillary's government department is supposed to enforce ... this report mostly confirms that this is indeed the view that the top of the DNC has.
    - Redoubts 10y ago
      > Is this really the level of competency in the people that are currently organizing the government ? Garrett Graff ... Hillary seems to actually be a very persnickety technology user. She is not very comfortable with most technology, only liked to use a BlackBerry and, more specifically, only liked to use a specific type of increasingly older and more out-of-date BlackBerry. She doesn't know how to use a desktop computer. She-- Sean Cole Wait, wait, wait. Back up. Back up. She doesn't know how to use a desktop computer. Garrett Graff Hillary Clinton, the Democratic presidential nominee in 2016, does not know how to use a desktop computer, according to multiple sources interviewed by the FBI. Sean Cole How is that possible? Garrett Graff The short answer is, I don't know... https://www.thisamericanlife.org/radio-archives/episode/601/transcript https://www.thisamericanlife.org/radio-archives/episode/601/...
- deleted 10y ago
  [deleted]
cenkemuygurt 10y ago
Just to add to this, Crowdstrike is on the DNC's payroll. Any conclusions they provide should either be met with skepticism or discredited to a degree.
- stefantalpalaru 10y ago
  The Crowdstrike co-founder and CTO is also a Senior Fellow at a think tank that seems particularly giddy about the new Cold War: http://www.atlanticcouncil.org/about/experts/list/dmitri-alperovitch http://www.atlanticcouncil.org/about/experts/list/dmitri-alp...

smsm42 10y ago

Can't one just buy a RAT? Also, the WMI think they describe doesn't look like rootkit, more like cron analogue for Windows. I.e. on Unix it would be like installing a command inside crontab. That's not what is usually called a rootkit - a tool that is designed to conceals its presence (and other tools presence) from regular OS tools.

EthanHeilman 10y ago
You can buy RATs. The several RATs used in this campaign were never for sale. For example the RAT named X-Agent was one of several used in the DNC hack. It has never been put up for sale and it was used in previous Russian intelligence operations (for example tracking Ukraine artillery[0]). >That's not what is usually called a rootkit It doesn't appear that anyone has reverse engineered the PC version of X-Agent but the android variant (which may be very different from the one used in the DNC hack) does take some steps to hide itself. Granted nothing suggests anything like kernel syscall hooking but those sorts of rootkit techniques are overrated because they leave obvious and detectable patterns of compromise. [0]: https://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-update-ios-espionage-app-found/ https://blog.trendmicro.com/trendlabs-security-intelligence/...
- deleted 10y ago
  [deleted]
- candiodari 10y ago
  So essentially someone hacked the DNC, and it's "advanced" because some custom software was written just for this particular target ? I've written custom software (which was a lot harder to find than some python WMI hooks) for hacking a lot lower profile organisations. I've consulted for organisations that were hacked by Chinese hackers for bitcoin ransom that had custom software written too. I mean, high profile target, more effort can be expected. It does not mean the government is involved (although a lot of hacking groups seem to have government sidelines in China, though it does not appear to be their primary activity. I mean unless the Chinese government is itself into bitcoin ransoming). But more seriously, if a component of our government that is this central to our democracy can be hacked by sending emails "open this exe", then ... I mean seriously. Sorry to say, but if that works, you deserve what happens. Is this really the level of competency in the people that are currently organising the government ? Also the main thing this report does is validate that the information leaked to the press is indeed true (I figured as much, I mean why put so much effort into fighting fake news unless the real target information is not fake ?). So Hillary and the DNC is in fact in the pocket of wall street. She DID use the DNC organisation to sabotage Bernie Sanders. There are in fact foreign donors to Hillary and the DNC that are illegal under rules that Hillary's government department is supposed to enforce ... this report mostly confirms that this is indeed the view that the top of the DNC has.
  - Redoubts 10y ago
    > Is this really the level of competency in the people that are currently organizing the government ? Garrett Graff ... Hillary seems to actually be a very persnickety technology user. She is not very comfortable with most technology, only liked to use a BlackBerry and, more specifically, only liked to use a specific type of increasingly older and more out-of-date BlackBerry. She doesn't know how to use a desktop computer. She-- Sean Cole Wait, wait, wait. Back up. Back up. She doesn't know how to use a desktop computer. Garrett Graff Hillary Clinton, the Democratic presidential nominee in 2016, does not know how to use a desktop computer, according to multiple sources interviewed by the FBI. Sean Cole How is that possible? Garrett Graff The short answer is, I don't know... https://www.thisamericanlife.org/radio-archives/episode/601/transcript https://www.thisamericanlife.org/radio-archives/episode/601/...
deleted 10y ago
[deleted]

cenkemuygurt 10y ago

Just to add to this, Crowdstrike is on the DNC's payroll. Any conclusions they provide should either be met with skepticism or discredited to a degree.

stefantalpalaru 10y ago
The Crowdstrike co-founder and CTO is also a Senior Fellow at a think tank that seems particularly giddy about the new Cold War: http://www.atlanticcouncil.org/about/experts/list/dmitri-alperovitch http://www.atlanticcouncil.org/about/experts/list/dmitri-alp...