11 ms·

Critiques of the DHS and FBI’s Grizzly Steppe Report

100 points by kushti 10y ago

eduren 10y ago
I agree with the assessment. While parts of this official communication were well written and intentioned, it feels like others weren't. > at least in a vendor report you usually only get 1 page of marketing instead of 8 That was also my reaction when I scrolled down past page 4-5. It almost feels like they could have split this particular report into: 1)public-and-media-facing high level technical overview 2)actionable intelligence information for defenders With 3) being the attribution and evidence coming at some point down the road.
sigmar 10y ago
The white house and the document itself never list attribution as the goal. Robert M Lee seems to think because it refers to the attackers as Russia, it is confusing readers. The summary at the beginning makes it clear to me that the document is presupposing the attacker is Russia as to be consistent with all future public reports. I don't think this is the best written report, but his conjecture around completely leaving out attribution if it doesn't include evidence seems rooted in playing to the lowest common denominator (ie poor media coverage of what this report entails)
- Gargoyle 10y ago
  The timing of the release of this document, at the same time as the announcement of sanctions on Russia for the hacking, can't be overlooked. It's quite reasonable to assume the release of this report was intended to create the impression of evidence for attribution, even if it actually contains no such thing. Otherwise why not release it on any other day to avoid confusion? It looks to me like the confusion was quite intentional.
  - drvdevd 10y ago
    It also can be seen as a meaningful signal of attribution capability to certain parties. Think of the form - an official document intended for public consumption - as not really being intended for consumption by the general public.
  - sigmar 10y ago
    White House stated pretty clearly why the Grizzly Steppe report went out: "to better help network defenders in the United States and abroad identify, detect, and disrupt Russia’s global campaign of malicious cyber activities." https://www.whitehouse.gov/the-press-office/2016/12/29/fact-sheet-actions-response-russian-malicious-cyber-activity-and https://www.whitehouse.gov/the-press-office/2016/12/29/fact-... Attribution is sexy and the media likes to talk about it. I don't believe the confusion was intentional. The White House is pretty bad at PR and 'never ascribe to malice that which can be explained by incompetence'
    - Natsu 10y ago
      > The White House is pretty bad at PR They have a press secretary whose job is, literally, to manage the media. I'm honestly not sure if your post was intended as satire. The meat of the report might as well have been copy pasted from OWASP. So if it's not to provide political cover for the yet-to-be-proven claims that Russia did it, they didn't get the message out.
- rrggrr 10y ago
  I question the importance of attribution on this issue. The Office of Personnel Management hack seems far worse than this report's conclusions, but there was a fraction of the outrage. Sadly, the problem is not confined to one state actor. INFOSEC is systemically broken and although the solution is starring Congress in the face, I suspect software/hardware lobbyists will prevent meaningful legislation.
  - mistermann 10y ago
    What is the solution?
    - rrggrr 10y ago
      Tort reform that extend products liability to sodtware and hardware developers and their partners. The problem is too complex for corporate or individual end users to manage. This plus retooling NSA through SBA conduit to provide protections to small businesses, law firms, health providers.
mundo 10y ago
> But why is this so bad? Because it does not follow the intent laid out by the White House and confuses readers to think that this report is about attribution and not the intended purpose of helping network defenders. Looking at the comments in yesterdays' thread[1], this is absolutely true - many, many people posted some variation of "What? There's no evidence proving Russian involvement in here at all!" 1. https://news.ycombinator.com/item?id=13279600 https://news.ycombinator.com/item?id=13279600
- rahrahrah 10y ago
  That's right, I was one of those confused people. I assumed this would be the WH presenting what evidence they have. Sooo... still no public evidence that Russia leaked the DNC and Podesta's e-mails?
  - normaljoe 10y ago
    Read the original CloudStrike report. Not the government report but the private security firm report. The government report is really just a restatement of that report. You don't track hackers for a decade to suddenly be wrong because of a governments political stance.
    - rahrahrah 10y ago
      No idea why you're bringing politics into this. All I said was no evidence has been made public by the government.
      - meowface 10y ago
        Correct, no evidence has been made public by the government (yet). Much of their evidence is probably classified. However, see here for evidence from private sector firms: https://www.reddit.com/r/NeutralPolitics/comments/52uj5c/do_we_have_any_evidence_that_the_recent_political/d814uzj/ https://www.reddit.com/r/NeutralPolitics/comments/52uj5c/do_...
deleted 10y ago
[deleted]
yarou 10y ago
Has Scheiner written anything on this report? I will say this; the Podesta emails revealed a lot about the internal politics of the DNC. Why are we not treating this type of leak with the same level of respect as the Ellsberg leaks? Or for that matter, the Snowden leaks? Who is really controlling the narrative here?
- stefantalpalaru 10y ago
  > Has Scheiner written anything on this report? Don't get your hopes up. Bruce Schneier drank the Kool-Aid and is completely on board with the "ruskies did it because experts agree" narrative: https://www.schneier.com/blog/archives/2016/08/hacking_the_vot.html https://www.schneier.com/blog/archives/2016/08/hacking_the_v... Look at how he calls whistleblowing "organizational doxing" and he urges a swift and exemplary response to the "national security threat". Somewhere along the way, the respectable security writer became a silly neo-mccarthyist pundit.
- firasd 10y ago
  What was the public interest in his lobster recipe? Or creating a paranoid frenzy that got shots fired at a Pizza place? Randomly dumping personal emails isn't the same as Ellsberg and Snowden working with reporters to blow the whistle on specific transgressions in war and mass surveillance. Interesting article exploring this issue of exercising discretion and developing new ethics in the age of leaks: http://www.nytimes.com/2016/11/05/opinion/what-were-missing-while-we-obsess-over-john-podestas-email.html http://www.nytimes.com/2016/11/05/opinion/what-were-missing-...
  - yarou 10y ago
    Obviously the pizzagate stuff is stupid and unfounded. It does a great disservice to people that were victims of real sexual abuse. But can't you see the vast amount of corruption? The DNC rigged the primary for one candidate. We need to hold our political parties accountable for their actions.
    - mullingitover 10y ago
rrggrr 10y ago
This is theatre. Were Congress to expand tort law to mandate standards and consequences similar to products liability regulations for other products, then the attack surface available to state and non-state actors would meaningfully shrink. If there is one thing the plaintiff's lawyers excel at, it is inflicting extensive expenses and pain on parties who negligently or fraudulently create, fund creation, or use products that injure property or person; thereby creating effective incentives to harden products. You will know the USGOV is serious about INFOSEC when they stop issuing reports and start legislating, regulating and enforcing meaningful standards, as they already do for automobiles, drugs, machinery, etc.
- firasd 10y ago
  Agreed. I wrote this on FB last year when people were calling hacks 'cyberwar': I’m still not sure what to think of the Sony hack. I instantly rejected the idea that it amounted to “cyber war”, but beyond that, I think governments can take a legitimate interest in digital attacks on private companies, same as law enforcement would get involved in a physical attack on a corporate building. I think the main response to IT breaches has to be “defensive”; secure code and networks. You can’t find and retaliate towards every hacker. And the benefit is that unlike retaliatory policy responses, good network security is designed to protect against all third parties, whether it’s your own government, random financial criminals, James Bond villains, whatever the entity or motive.
  - rrggrr 10y ago
    The Sony hack is a great example. The shareholders, employees and other stakeholders should have enjoyed legal remedies that could have rocked the corporate world into enacting meaningful INFOSEC practices. Instead I've seen reports they paid only $8m USD in a class action settlement. Its not enough to serve the public policy need.
- wilde 10y ago
  But if we did that, it would be harder to spy on other people, no? sigh
- 10y ago
slitaz 10y ago
So it was just spearfishing, the poor man's hacking technique. The techniques that NSA and MI6 use are far more advanced. Taking advantage of the networking equipment and injecting traffic.
- bsder 10y ago
  > So it was just spearfishing, the poor man's hacking technique. Just because someone walked in through an unlocked window does not make them any less an effective burglar.
- jerkstate 10y ago
  So this document was written by security professionals. It's intended for an audience of security professionals. We read it and say, "wait a minute, this is basic script kiddie stuff, this is how the Russian intelligence services operate?" - the breathless description of how advanced the basic tactics are is something I would expect from a security firm who trades on fear. Maybe the unspoken message here is "it's just script kiddies." After all, a major political party is a hell of a get, especially with the amount of dirt in there.
- nl 10y ago
  The NSA used spearphishing to compromise the North Korean networks prior to Sony hack. See http://securityaffairs.co/wordpress/32592/intelligence/nsa-compromised-systems-north-korea.html http://securityaffairs.co/wordpress/32592/intelligence/nsa-c...
rahrahrah 10y ago
The poor man's hacking technique worked great. Instead of focusing on the tools, focus on the results. I bet you're one of those people who uses microservices to run his 100 visitors/day blog just because it's the shiniest new paradigm.
- Natsu 10y ago
  The results are that someone got into Podesta's gmail for some few days. The pros use methods that allow them to keep long term access and which keep you from knowing that you have been hacked to begin with. Look at the NSA's TAO catalog for examples of how the pros work. You can wipe your servers and still be hacked. I don't seriously believe that the NSA is out there sending phishing emails. They're too busy using ECHELON to hunt down sysadmins who are using their social media accounts, then taking over from there.
  - ganoushoreilly 10y ago
    The right tool for the right job.
  - deleted 10y ago
    [deleted]
  - facetube 10y ago
    No, the results are that the United States is deep shit, having just elected a serial liar and sexual offender with a little nudge from Russia and Comey. The damage Trump can do is potentially infinite. It's incalculable. If you're Putin, there's never been a bigger payoff for such little effort.
  - rahrahrah 10y ago
    The results of getting into "Podesta's gmail for some days" is you take the elections. But no, you think it's smarter getting into some nobody sysadmin's social media accounts. Got it.
    - Natsu 10y ago
deleted 10y ago
[deleted]
showmeevidence 10y ago
Throwaway because I work in a related field. This is a public service announcement: if you haven't seen enough information to prove to you, independent of the claims of the White House, CIA & FBI, that Russia was behind this, you should file a Freedom of Information Act Request for sufficient evidence to independently reach that conclusion. Citizens of the US in particular should do this to hold their government accountable -- we can not let it be accepted that because POTUS says something, and maybe has confirmation from "anonymous sources" within the CIA & FBI (e.g. as reported by the NYTimes[1]), that it must be true. Muckrock[2] makes it dirt-simple to file a FOIA request. Hold the government accountable -- they work for us. 1: http://www.nytimes.com/2016/12/09/us/obama-russia-election-hack.html?_r=1 http://www.nytimes.com/2016/12/09/us/obama-russia-election-h... 2: https://www.muckrock.com https://www.muckrock.com
- wavefunction 10y ago
  I don't really care that much about this specific event. It's a bunch of liars (Russian government, various US intelligence services, Russian and American politicians) trying to tell me that "the other guy" is a liar and did something bad. My life continues as it does, working against all those listed above because none of them particularly deserve my assistance or respect.
  - digler999 10y ago
    on top of that, the leaks were real. If they were "leaking" phony information, I might have an issue. But this "hack" gives high-ranking politicians a taste of their own medicine. What POTUS calls a "hack", I prefer to call "warrant-less wiretapping". and it's for "security". I'm 'secure' from hillary clinton's corruption, therefore, violating her right to privacy is ok. same thing they do to each US citizen
- jamesgblaine 10y ago
  While there's no harm in filing additional FOIA requests, let's also add some deductive reasoning to the mix. Is this consistent with Russia's actions in other countries and contexts (as well as their own)? Yes. http://warontherocks.com/2016/11/trolling-for-trump-how-russia-is-trying-to-destroy-our-democracy/ http://warontherocks.com/2016/11/trolling-for-trump-how-russ... Have individuals close to the Kremlin strongly implied they had a role in this and have senior Russian officials stated clearly that they had contact with the Trump campaign during the election? Yes. http://www.haaretz.com/world-news/u-s-election-2016/1.752386 http://www.haaretz.com/world-news/u-s-election-2016/1.752386 Did Russia even object today on the grounds that the allegations about their role were false? On the contrary, they were practically doing a victory lap. There are plenty of debates still very worth having about whether the actions taken today are appropriate, whether a hostile stance towards Russia is merited, etc. But I've seen enough to convince me that Russia was engaged in an information operations campaign to cast doubt about the U.S. election and help Trump on the margins.
j_m_b 10y ago
Still lacking any evidence that voting machines were hacked or any part of the electoral process was hijacked. The worst damage? Emails related to the actual rigging of the Democrat Party primaries and the collusion of the media with the Democrat party. Its very hard for me to believe that a state actor is behind such seemingly altruistic actions. Voters saw the worst of Trump and Clinton and choose the lessor of two evils. Wikileaks and "the Russians" simply provided a level playing field.
- ohwello 10y ago
  How on earth did a leak of DNC emails, but no corresponding RNC leak, help people figure out the lesser of two evils or provide a level playing field? Seems obvious that leaks assisting the pro-Putin candidate were not altruistic.
  - AnthonyMouse 10y ago
    Assuming Clinton had those dirty secrets and Trump had nothing equivalent, that's what a level playing field looks like. If you want to assume there were also some dirty Trump secrets that didn't come out then it seems like the only way to "level the playing field" would be for e.g. Venezuela to hack the Republicans and air their dirty laundry too. And people are running around saying how terrible this is and asking "what if everybody did this?" But it seems like the answer to that question is, then people would know more relevant information about their political candidates. Or politicians would get better at computer security. Which of those is supposed to be bad?
    - coolgeek 10y ago
      > Assuming Clinton had those dirty secrets and Trump had nothing equivalent Those are two rather incredulous assumptions considering that: - Clinton released all of her tax returns, whereas Trump didn't release any - The Clinton Foundation has been audited by at least three well respected, independent, organizations (garnering top ratings from all), whereas we know comparatively little about the Trump Foundation (or whatever it's called), yet it's admitted within the last six months to several inappropriate expenditures or donations, and is likely being investigated for more - Trump sits atop a network of literally hundreds (if not thousands) of "independent" corporations designed solely to evade disclosure, liability, taxes or some combination thereof
memracom 10y ago
Seems to me that the DNC had really sloppy security and that many groups could have compromised their servers. If the government has proof that Russian actors did so, they do not appear to have any proof that the info was used maliciously. The whole report, and media coverage, and statements by public officials are so confused and confusing that they are useless in regards to security. I have to compare this to the FDA's HIPAA regulations which mostly are just instructions on how to correctly secure servers and applications. However, I wish that HIPAA did not have these regs in it because they are susceptible to falling out of date. Rather, I think the public would be better served by an official security standard that can be updated weekly with new advice and requirements. Then an org like the FDA can have one regulation covering security that says something like "all systems must be secured according to Federal Infosec Guidelines level B3 or higher". The specifics of what B3 might mean and higher levels of securing servers and apps, can be in a single document that would, I am sure, become a core part of the curriculum for developers and system administrators. Moaning and whining about water under the bridge is a waste of energy and of public funds. This is a fixable problem if only someone in leadership is willing to act. Not grandstand or apportion blame, but act to improve infosecurity for everyone. A well drafted set of infosec guidelines by industry experts along with a process for keeping it up to date will have incredible multiplier effects throughout industry as well as government, because it makes it much easier for management to order that things be secured, and it makes it much easier to get a consultant to validate that the guidelines have been correctly implemented.
- equalunique 10y ago
  Such federal standards have existed for decades now. Have you heard of the NIST Special Publication 800 series? They are quite comprehensive, although prohibitively complex for smaller agencies to implement stand-alone.

100 points by kushti 10y ago

I agree with the assessment. While parts of this official communication were well written and intentioned, it feels like others weren't. > at least in a vendor report you usually only get 1 page of marketing instead of 8 That was also my reaction when I scrolled down past page 4-5. It almost feels like they could have split this particular report into: 1)public-and-media-facing high level technical overview 2)actionable intelligence information for defenders With 3) being the attribution and evidence coming at some point down the road.

sigmar 10y ago

The white house and the document itself never list attribution as the goal. Robert M Lee seems to think because it refers to the attackers as Russia, it is confusing readers. The summary at the beginning makes it clear to me that the document is presupposing the attacker is Russia as to be consistent with all future public reports. I don't think this is the best written report, but his conjecture around completely leaving out attribution if it doesn't include evidence seems rooted in playing to the lowest common denominator (ie poor media coverage of what this report entails)

Gargoyle 10y ago
The timing of the release of this document, at the same time as the announcement of sanctions on Russia for the hacking, can't be overlooked. It's quite reasonable to assume the release of this report was intended to create the impression of evidence for attribution, even if it actually contains no such thing. Otherwise why not release it on any other day to avoid confusion? It looks to me like the confusion was quite intentional.
- drvdevd 10y ago
  It also can be seen as a meaningful signal of attribution capability to certain parties. Think of the form - an official document intended for public consumption - as not really being intended for consumption by the general public.
- sigmar 10y ago
  White House stated pretty clearly why the Grizzly Steppe report went out: "to better help network defenders in the United States and abroad identify, detect, and disrupt Russia’s global campaign of malicious cyber activities." https://www.whitehouse.gov/the-press-office/2016/12/29/fact-sheet-actions-response-russian-malicious-cyber-activity-and https://www.whitehouse.gov/the-press-office/2016/12/29/fact-... Attribution is sexy and the media likes to talk about it. I don't believe the confusion was intentional. The White House is pretty bad at PR and 'never ascribe to malice that which can be explained by incompetence'
  - Natsu 10y ago
    > The White House is pretty bad at PR They have a press secretary whose job is, literally, to manage the media. I'm honestly not sure if your post was intended as satire. The meat of the report might as well have been copy pasted from OWASP. So if it's not to provide political cover for the yet-to-be-proven claims that Russia did it, they didn't get the message out.
rrggrr 10y ago
I question the importance of attribution on this issue. The Office of Personnel Management hack seems far worse than this report's conclusions, but there was a fraction of the outrage. Sadly, the problem is not confined to one state actor. INFOSEC is systemically broken and although the solution is starring Congress in the face, I suspect software/hardware lobbyists will prevent meaningful legislation.
- mistermann 10y ago
  What is the solution?
  - rrggrr 10y ago
    Tort reform that extend products liability to sodtware and hardware developers and their partners. The problem is too complex for corporate or individual end users to manage. This plus retooling NSA through SBA conduit to provide protections to small businesses, law firms, health providers.

mundo 10y ago

> But why is this so bad? Because it does not follow the intent laid out by the White House and confuses readers to think that this report is about attribution and not the intended purpose of helping network defenders. Looking at the comments in yesterdays' thread[1], this is absolutely true - many, many people posted some variation of "What? There's no evidence proving Russian involvement in here at all!" 1. https://news.ycombinator.com/item?id=13279600 https://news.ycombinator.com/item?id=13279600

rahrahrah 10y ago
That's right, I was one of those confused people. I assumed this would be the WH presenting what evidence they have. Sooo... still no public evidence that Russia leaked the DNC and Podesta's e-mails?
- normaljoe 10y ago
  Read the original CloudStrike report. Not the government report but the private security firm report. The government report is really just a restatement of that report. You don't track hackers for a decade to suddenly be wrong because of a governments political stance.
  - rahrahrah 10y ago
    No idea why you're bringing politics into this. All I said was no evidence has been made public by the government.
    - meowface 10y ago
      Correct, no evidence has been made public by the government (yet). Much of their evidence is probably classified. However, see here for evidence from private sector firms: https://www.reddit.com/r/NeutralPolitics/comments/52uj5c/do_we_have_any_evidence_that_the_recent_political/d814uzj/ https://www.reddit.com/r/NeutralPolitics/comments/52uj5c/do_...

deleted 10y ago

[deleted]

yarou 10y ago

Has Scheiner written anything on this report? I will say this; the Podesta emails revealed a lot about the internal politics of the DNC. Why are we not treating this type of leak with the same level of respect as the Ellsberg leaks? Or for that matter, the Snowden leaks? Who is really controlling the narrative here?

stefantalpalaru 10y ago
> Has Scheiner written anything on this report? Don't get your hopes up. Bruce Schneier drank the Kool-Aid and is completely on board with the "ruskies did it because experts agree" narrative: https://www.schneier.com/blog/archives/2016/08/hacking_the_vot.html https://www.schneier.com/blog/archives/2016/08/hacking_the_v... Look at how he calls whistleblowing "organizational doxing" and he urges a swift and exemplary response to the "national security threat". Somewhere along the way, the respectable security writer became a silly neo-mccarthyist pundit.
firasd 10y ago
What was the public interest in his lobster recipe? Or creating a paranoid frenzy that got shots fired at a Pizza place? Randomly dumping personal emails isn't the same as Ellsberg and Snowden working with reporters to blow the whistle on specific transgressions in war and mass surveillance. Interesting article exploring this issue of exercising discretion and developing new ethics in the age of leaks: http://www.nytimes.com/2016/11/05/opinion/what-were-missing-while-we-obsess-over-john-podestas-email.html http://www.nytimes.com/2016/11/05/opinion/what-were-missing-...
- yarou 10y ago
  Obviously the pizzagate stuff is stupid and unfounded. It does a great disservice to people that were victims of real sexual abuse. But can't you see the vast amount of corruption? The DNC rigged the primary for one candidate. We need to hold our political parties accountable for their actions.
  - mullingitover 10y ago

rrggrr 10y ago

This is theatre. Were Congress to expand tort law to mandate standards and consequences similar to products liability regulations for other products, then the attack surface available to state and non-state actors would meaningfully shrink. If there is one thing the plaintiff's lawyers excel at, it is inflicting extensive expenses and pain on parties who negligently or fraudulently create, fund creation, or use products that injure property or person; thereby creating effective incentives to harden products. You will know the USGOV is serious about INFOSEC when they stop issuing reports and start legislating, regulating and enforcing meaningful standards, as they already do for automobiles, drugs, machinery, etc.

firasd 10y ago
Agreed. I wrote this on FB last year when people were calling hacks 'cyberwar': I’m still not sure what to think of the Sony hack. I instantly rejected the idea that it amounted to “cyber war”, but beyond that, I think governments can take a legitimate interest in digital attacks on private companies, same as law enforcement would get involved in a physical attack on a corporate building. I think the main response to IT breaches has to be “defensive”; secure code and networks. You can’t find and retaliate towards every hacker. And the benefit is that unlike retaliatory policy responses, good network security is designed to protect against all third parties, whether it’s your own government, random financial criminals, James Bond villains, whatever the entity or motive.
- rrggrr 10y ago
  The Sony hack is a great example. The shareholders, employees and other stakeholders should have enjoyed legal remedies that could have rocked the corporate world into enacting meaningful INFOSEC practices. Instead I've seen reports they paid only $8m USD in a class action settlement. Its not enough to serve the public policy need.
wilde 10y ago
But if we did that, it would be harder to spy on other people, no? sigh
10y ago

slitaz 10y ago

So it was just spearfishing, the poor man's hacking technique. The techniques that NSA and MI6 use are far more advanced. Taking advantage of the networking equipment and injecting traffic.

bsder 10y ago
> So it was just spearfishing, the poor man's hacking technique. Just because someone walked in through an unlocked window does not make them any less an effective burglar.
jerkstate 10y ago
So this document was written by security professionals. It's intended for an audience of security professionals. We read it and say, "wait a minute, this is basic script kiddie stuff, this is how the Russian intelligence services operate?" - the breathless description of how advanced the basic tactics are is something I would expect from a security firm who trades on fear. Maybe the unspoken message here is "it's just script kiddies." After all, a major political party is a hell of a get, especially with the amount of dirt in there.
nl 10y ago
The NSA used spearphishing to compromise the North Korean networks prior to Sony hack. See http://securityaffairs.co/wordpress/32592/intelligence/nsa-compromised-systems-north-korea.html http://securityaffairs.co/wordpress/32592/intelligence/nsa-c...

rahrahrah 10y ago

The poor man's hacking technique worked great. Instead of focusing on the tools, focus on the results. I bet you're one of those people who uses microservices to run his 100 visitors/day blog just because it's the shiniest new paradigm.

Natsu 10y ago
The results are that someone got into Podesta's gmail for some few days. The pros use methods that allow them to keep long term access and which keep you from knowing that you have been hacked to begin with. Look at the NSA's TAO catalog for examples of how the pros work. You can wipe your servers and still be hacked. I don't seriously believe that the NSA is out there sending phishing emails. They're too busy using ECHELON to hunt down sysadmins who are using their social media accounts, then taking over from there.
- ganoushoreilly 10y ago
  The right tool for the right job.
- deleted 10y ago
  [deleted]
- facetube 10y ago
  No, the results are that the United States is deep shit, having just elected a serial liar and sexual offender with a little nudge from Russia and Comey. The damage Trump can do is potentially infinite. It's incalculable. If you're Putin, there's never been a bigger payoff for such little effort.
- rahrahrah 10y ago
  The results of getting into "Podesta's gmail for some days" is you take the elections. But no, you think it's smarter getting into some nobody sysadmin's social media accounts. Got it.
  - Natsu 10y ago

deleted 10y ago

[deleted]

showmeevidence 10y ago

Throwaway because I work in a related field. This is a public service announcement: if you haven't seen enough information to prove to you, independent of the claims of the White House, CIA & FBI, that Russia was behind this, you should file a Freedom of Information Act Request for sufficient evidence to independently reach that conclusion. Citizens of the US in particular should do this to hold their government accountable -- we can not let it be accepted that because POTUS says something, and maybe has confirmation from "anonymous sources" within the CIA & FBI (e.g. as reported by the NYTimes[1]), that it must be true. Muckrock[2] makes it dirt-simple to file a FOIA request. Hold the government accountable -- they work for us. 1: http://www.nytimes.com/2016/12/09/us/obama-russia-election-hack.html?_r=1 http://www.nytimes.com/2016/12/09/us/obama-russia-election-h... 2: https://www.muckrock.com https://www.muckrock.com

wavefunction 10y ago
I don't really care that much about this specific event. It's a bunch of liars (Russian government, various US intelligence services, Russian and American politicians) trying to tell me that "the other guy" is a liar and did something bad. My life continues as it does, working against all those listed above because none of them particularly deserve my assistance or respect.
- digler999 10y ago
  on top of that, the leaks were real. If they were "leaking" phony information, I might have an issue. But this "hack" gives high-ranking politicians a taste of their own medicine. What POTUS calls a "hack", I prefer to call "warrant-less wiretapping". and it's for "security". I'm 'secure' from hillary clinton's corruption, therefore, violating her right to privacy is ok. same thing they do to each US citizen
jamesgblaine 10y ago
While there's no harm in filing additional FOIA requests, let's also add some deductive reasoning to the mix. Is this consistent with Russia's actions in other countries and contexts (as well as their own)? Yes. http://warontherocks.com/2016/11/trolling-for-trump-how-russia-is-trying-to-destroy-our-democracy/ http://warontherocks.com/2016/11/trolling-for-trump-how-russ... Have individuals close to the Kremlin strongly implied they had a role in this and have senior Russian officials stated clearly that they had contact with the Trump campaign during the election? Yes. http://www.haaretz.com/world-news/u-s-election-2016/1.752386 http://www.haaretz.com/world-news/u-s-election-2016/1.752386 Did Russia even object today on the grounds that the allegations about their role were false? On the contrary, they were practically doing a victory lap. There are plenty of debates still very worth having about whether the actions taken today are appropriate, whether a hostile stance towards Russia is merited, etc. But I've seen enough to convince me that Russia was engaged in an information operations campaign to cast doubt about the U.S. election and help Trump on the margins.

j_m_b 10y ago

Still lacking any evidence that voting machines were hacked or any part of the electoral process was hijacked. The worst damage? Emails related to the actual rigging of the Democrat Party primaries and the collusion of the media with the Democrat party. Its very hard for me to believe that a state actor is behind such seemingly altruistic actions. Voters saw the worst of Trump and Clinton and choose the lessor of two evils. Wikileaks and "the Russians" simply provided a level playing field.

ohwello 10y ago
How on earth did a leak of DNC emails, but no corresponding RNC leak, help people figure out the lesser of two evils or provide a level playing field? Seems obvious that leaks assisting the pro-Putin candidate were not altruistic.
- AnthonyMouse 10y ago
  Assuming Clinton had those dirty secrets and Trump had nothing equivalent, that's what a level playing field looks like. If you want to assume there were also some dirty Trump secrets that didn't come out then it seems like the only way to "level the playing field" would be for e.g. Venezuela to hack the Republicans and air their dirty laundry too. And people are running around saying how terrible this is and asking "what if everybody did this?" But it seems like the answer to that question is, then people would know more relevant information about their political candidates. Or politicians would get better at computer security. Which of those is supposed to be bad?
  - coolgeek 10y ago
    > Assuming Clinton had those dirty secrets and Trump had nothing equivalent Those are two rather incredulous assumptions considering that: - Clinton released all of her tax returns, whereas Trump didn't release any - The Clinton Foundation has been audited by at least three well respected, independent, organizations (garnering top ratings from all), whereas we know comparatively little about the Trump Foundation (or whatever it's called), yet it's admitted within the last six months to several inappropriate expenditures or donations, and is likely being investigated for more - Trump sits atop a network of literally hundreds (if not thousands) of "independent" corporations designed solely to evade disclosure, liability, taxes or some combination thereof

memracom 10y ago

Seems to me that the DNC had really sloppy security and that many groups could have compromised their servers. If the government has proof that Russian actors did so, they do not appear to have any proof that the info was used maliciously. The whole report, and media coverage, and statements by public officials are so confused and confusing that they are useless in regards to security. I have to compare this to the FDA's HIPAA regulations which mostly are just instructions on how to correctly secure servers and applications. However, I wish that HIPAA did not have these regs in it because they are susceptible to falling out of date. Rather, I think the public would be better served by an official security standard that can be updated weekly with new advice and requirements. Then an org like the FDA can have one regulation covering security that says something like "all systems must be secured according to Federal Infosec Guidelines level B3 or higher". The specifics of what B3 might mean and higher levels of securing servers and apps, can be in a single document that would, I am sure, become a core part of the curriculum for developers and system administrators. Moaning and whining about water under the bridge is a waste of energy and of public funds. This is a fixable problem if only someone in leadership is willing to act. Not grandstand or apportion blame, but act to improve infosecurity for everyone. A well drafted set of infosec guidelines by industry experts along with a process for keeping it up to date will have incredible multiplier effects throughout industry as well as government, because it makes it much easier for management to order that things be secured, and it makes it much easier to get a consultant to validate that the guidelines have been correctly implemented.

equalunique 10y ago
Such federal standards have existed for decades now. Have you heard of the NIST Special Publication 800 series? They are quite comprehensive, although prohibitively complex for smaller agencies to implement stand-alone.