13 ms·

US Govt Data Shows Russia Used Outdated Ukrainian PHP Malware

97 points by Natsu 10y ago

matheweis 10y ago
The conclusions are of particular note: "The IP addresses that DHS provided may have been used for an attack by a state actor like Russia. But they don’t appear to provide any association with Russia. They are probably used by a wide range of other malicious actors, especially the 15% of IP addresses that are Tor exit nodes. The malware sample is old, widely used and appears to be Ukrainian. It has no apparent relationship with Russian intelligence and it would be an indicator of compromise for any website."
- gtirloni 10y ago
  That's the conclusion anyone working in the security/network area was bound to arrive at. It's really interesting FBI/DHS would make those claims publicly when the chance of having any hard evidence of that would be minimal. But they still did it. Why?
  - Gustomaximus 10y ago
    To me the ongoing 'Russia rigged elections' smells like propaganda from the other side. And maybe russia did release the DNC emails, but Assange said that wasn't the case and I feel he's more likely to be telling the truth than state players. And even if they did release these emails it's hardly rigging an election. Comneys email announcement at the 11th hour about reopening email investigation was probably a deciding variable and that was hardly Russian lead. Your question of 'why' seems to be the scariest. US lead activities have been encircling Russia and pressing influence right to their borders for some time. For me I feel its too far and they are cornering the bear. Probably there is too much resource in the 'spy' world and they have to do something to justify their position, hence the older generation keep the pressure on Russia from their cold war agenda or they are looking to pick a fight. The latter being very scary. ...but really I'm no expert and just wonder why countries can put more effort to looking after their own populations needs. All this spy/military expenditure seems so wasteful.
    - threeseed 10y ago
      Nobody said Russia rigged the election. The issue was the attempts to influence the election which Russia has a long, documented history of doing so. And the US had an obligation to respond which they did with minimal effect. So claiming all of this was about propaganda really makes no sense given the facts on the ground. And please remember why Russia's relations with almost all of the world deteriorated in the first place. It's because they annexed Crimea (unprecedented for our generation) and allowed soldiers and weapons to flood into Ukraine which then resulted in Flight 117 being shot down. Nobody is looking for a fight with Russia but capitulating and doing nothing is not an answer either. Diplomatic sanctions have been the correct response and I don't see anyone asking for an escalation of that.
      - Natsu 10y ago
        > Nobody said Russia rigged the election. Nobody sensible said that, but I've seen more than a few comments along those lines on various sites, enough to believe that general sentiment is commonplace. As for Comey, I'd say he let her off easy. Take a look at this: https://www.youtube.com/watch?v=bC1Mc6-RDyQ https://www.youtube.com/watch?v=bC1Mc6-RDyQ Then look at the PDF attached here of an email between Colin Powell and Hillary Clinton and ask whether this looks intentional or not: https://wikileaks.org/clinton-emails/emailid/30324 https://wikileaks.org/clinton-emails/emailid/30324
        lern_too_spel 10y ago
        How did Comey let her off easy if she didn't break any laws?
        Natsu 10y ago
        Comey claimed not to have charged Clinton because there was a lack of intent. Gowdy is calling him on that, saying that this makes zero sense and going over all the ways they have to prove intent. His point at the end about "negligence" underscores the fact that the entire line of reasoning is nonsensical: intentional negligence is a contradiction in terms. That which is intentional cannot be negligent and vice versa. The law in question is against negligence (which does not require any intent whatsoever). Just to underscore that, I just linked to a document where Colin Powell describes in detail how they're subverting the law: https://wikileaks.org/clinton-emails/emailid/30324 https://wikileaks.org/clinton-emails/emailid/30324 "However, there is a real danger. If it is public that you have a BlackBerry and it [is] government and you are using it, government or not, to do business, it may become an official record and be subject to the law. Reading about the President's BB rules this morning, it sounds like it won't be as useful as it used to be. Be very careful. I got around it all by not saying much and not using systems that captured the data." I don't think it's reasonable to let our politicians get away with this. Inasmuch as people are worried about Russian influence, it seems strange to me that there's no worry about the very leaders to jeopardize our OPSEC with their hubris. Here is Colin Powell, again, saying things that should make HN readers cringe: "Now, the real issue had to do with PDAs, as we called them a few years ago before BlackBerry became a noun. And the issue was DS would not allow them into the secure spaces, especially up your way. When I asked why not they gave me all kinds of nonsense about how they gave out signals that could be read by spies, etc. Same reason they tried to keep mobile phones out of the suite. I had numerous meetings with them. We even opened one up for them to try to explain to me why it was more dangerous than say, a remote control for one of the many tvs in the suite. Or something embedded in my shoe heel. They never satisfied me and NSA/CIA wouldn't back off. So, we just went about our business and stopped asking. I had an ancient version of a PDA and used it. In general, the suite was so sealed that it is hard to get signals in or out wirelessly." If the law is so toothless that high ranking people of either party (Powell is a Republican) can deliberately subvert them, then we're always going to be at the mercy of every country with half-decent spies. This is a problem in its own right, independent from whatever partisan considerations we have here. === Note: The square brackets in the quote are me fixing typos in the original.
  - threeseed 10y ago
    a) Anyone who thinks this document is the sole source of evidence is deluding themselves. The intelligence agencies are not going to document their capabilities to the world. Which I am sure would include compromised Tor nodes and DPI (including SSL/encrypted traffic) across many of the key sites/switches/cables. b) It has been claimed that this document is more a guide for other companies and government agencies about the type of techniques that Russia allegedly used. General education about security is still pretty low and the US government et al are going to need to more in this area.
    - Natsu 10y ago
      The problem with a line of reasoning that includes secret evidence we'll never get to see is that it can be used to support any conclusion whatsoever. Inasmuch as it's a guide for other agencies, they'd be better served by OWASP recommendations. It's not clear what anyone could do with a report like this. I don't see any great takeaways that one could add to the next revision of their STIG. There are no 0-days for an IAVA. As long as we're going for pure speculation, I think that Kim Dotcom hired Ukranian hackers and I could potentially find weak circumstantial evidence by going through a timeline of his Tweets. I seem to remember that he had foreknowledge of some of the items to be leaked, though that could've been pure BS and I didn't really investigate it at the time. He also has motive based on this administration's treatment of him. EDIT: Found it - https://www.bloomberg.com/politics/articles/2015-05-14/kim-dotcom-julian-assange-will-be-hillary-clinton-s-worst-nightmare-in-2016 https://www.bloomberg.com/politics/articles/2015-05-14/kim-d...
      - Toe-Rag 10y ago
        Interesting theory about Dotcom. He knew something. I also think that Wikileaks has more material than they released and that Dotcom knows it. His tweets during October suggest that he was expecting something more to drop. It could have been BS, as you say, but I think he knew something.
  - gozur88 10y ago
    >It's really interesting FBI/DHS would make those claims publicly when the chance of having any hard evidence of that would be minimal. But they still did it. Why? Occam's razor says it's what the DNC wanted them to say. Politically it's a lot easier cop to being penetrated by a state actor than a group like Anonymous, and it allows the Democrats to deflect the conversation from the content of the emails. Well, to make the attempt, anyway. I'll be curious to see what Trump does with this once he takes office. If there's no compelling evidence of Russian state involvement I suspect he'll direct the relevant agencies to release everything. If he doesn't do that it's going to be difficult for him to cast doubt on the Russian angle.
    - grzm 10y ago
      the DNC Just an observation: I don't recall until very recently the DNC or the RNC to refer to the parties, as opposed to the Democratic Party or Republican Party. I wonder why the shift? The focus on the Podesta/DNC emails? Makes sense during the election, and now it seems to have transferred over to referring to the party as part of the government (e.g., in reference to the FBI or DHS). Last time I remember the DNC being mentioned so much by name was during the Bill Clinton campaigns, in contrast to the Democratic Leadership Council. My memory can be faulty and selective, so I'm wondering if anyone else has noticed this as well. (Anyone else remember Sinbad in Shazam?)
      - nickff 10y ago
        I think people are using 'DNC' and 'RNC' to make it clear that they are referring to the party leadership, not rank-and-file members.
- jaclaz 10y ago
  Before "those" conclusions, I find of most interest the previous "Malware Conclusions": "The PHP malware sample they have provided appears to be P.A.S. version 3.1.0 which is commonly available and the website that claims to have authored it says they are Ukrainian. It is also several versions behind the most current version of P.A.S which is 4.1.1b. One might reasonably expect Russian intelligence operatives to develop their own tools or at least use current malicious tools from outside sources." The last sentence is IMHO even stronger.
crucialfelix 10y ago
The php malware is the least interesting piece of all the alleged activity. Being a version behind isnt significant. Its a simple common hacker tool. My postgresql is a few versions behind. So what ? If RIS had used obvious elite tools with impressive functionality then it would point straight to them. Its much smarter to look amateur. The JAR should have declassified something juicy. They put out this weak report, revealed nothing and now critics will attack and win. Maybe its the US that are a bunch of amateurs.
- matt_wulfeck 10y ago
  The USA puts "hackers" in jail, and the ones they hire might not even get a job if they admit to smoking weed in college. This is a country where you can get prison time for using someone's open wireless network. There's hostility towards hackers here from ignorant judges and lawmakers who come down hard on things they don't understand. They win by pressuring US companies with incentives/contracts (Juniper) or jail time (Qwest) to weaken or backdoor their products for US and foreign buyers. Their own citizens are kept in the dark with secret court orders with dubious constitutionality. "Amateur" is being generous.
jwdunne 10y ago
Anyone who has run a wordpress or vbulletin site has probably seen this at some point in time. Got tonnes of logs from IPs in Ukraine, Russian, China, etc that crawl for holes and if they find one you will find something like this somewhere. VBulletin is the worst - executable code is stored in the database so that's where you'll likely find it. I find it hard to believe this is what a state sponsored attack would look like - in business, we see this all the time. I would love to see some action taken on this, there's probably tonnes of time and post business spent on these attacks. I just don't want to see that solution in the form of slanderous claims that paint it as more than it is.
Lintaris 10y ago
Someone around the GOP could merely have hired a hacker from Eastern Europe or Russia specifically to do the hacking. I find it troubling that this avenue was not explored.
- grzm 10y ago
  I find it troubling that this avenue was not explored. What indication do you have that it wasn't?
- Natsu 10y ago
  If we're going to speculate, I'd say Kim Dotcom is more suspicious based on his tweets. I thought he tweeted some statements indicating foreknowledge of certain leaks, but I never investigated it carefully. EDIT: I'm certainly not claiming he did anything, I read this as just sour grapes, but look for yourself at a sample - http://imgur.com/a/zv174 http://imgur.com/a/zv174 EDIT 2: This is more like it - https://www.bloomberg.com/politics/articles/2015-05-14/kim-dotcom-julian-assange-will-be-hillary-clinton-s-worst-nightmare-in-2016 https://www.bloomberg.com/politics/articles/2015-05-14/kim-d...
  - shimon_e 10y ago
    I don't know why OP is being down voted. Kim Dotcom tweeted he had early access to the leaks. It feels like a more plausible theory to me than the one the Obama administration is pushing. He announced his attention to be "an Internet Freedom fighter" and "Hillary's worse nightmare in 2016" back in 2014. Look at this tweet from 10 hours ago: "My old hacker firm Data Protect hacked 100% of its clients." https://twitter.com/KimDotcom/status/815373371001028608 https://twitter.com/KimDotcom/status/815373371001028608 Another tweet from a few days ago claiming: "I know with 100% certainty that @Russia & @PutinRF_Eng had nothing to do with Clinton related election hacks!" https://twitter.com/KimDotcom/status/814593453963083776 https://twitter.com/KimDotcom/status/814593453963083776 It surely seems like Kim Dotcom wants people to think he is involved.
    - wcummings 10y ago
ryanlol 10y ago
I posted most of this stuff earlier, incl. the actual samples which someone here might be interested in. https://news.ycombinator.com/item?id=13280068 https://news.ycombinator.com/item?id=13280068 Based on the conclusions the authors of the article don't seem to understand the purpose of these IoCs. Individually they aren't all intended to be 100% solid indicators that you were targetted in this campaign, but to be used as a whole.
lngnmn 10y ago
It is ridiculous to think that the Russkies planed and executed these hacks as a deliberate operation with a clear objective to derail the election or whatever it might me. Some guys routinely spreading primitive phishing spam got lucky and got a password or two and gained the access to emails. Just this. No super spy hacking operations. It does not even work that way - chance is the main factor. How the emails turned up on Wikileaks is another questions, but, again, they have been published because they have been already hacked by some primitive phishing gang, not super-intelligent top-tier mega-hackers paid by the evil KGB. The whole idea of deliberate planed KGB operation is an utter nonsense. It were kids with PHP crap. One should look for the brokers. They could have been among the 35 kicked out guys.
- jansenv 10y ago
  Plus it seems clear that many of the leaks were leaks, not hacks. RIP Seth Rich
natch 10y ago
I don't know how much of the HN community is old enough to remember Colin Powell just prior to the first Iraq war, getting up in front of the UN and the whole world for that matter, and asserting that there was ironclad proof that Iraq had weapons of mass destruction (which we came to know as WMD). Different parts of the government had the same talking points and it was all presented as irrefutable facts. But the evidence General Powell laid out was not convincing to me at all, or to many other people. Grainy photos, reports of known arms dealers appearing in coffee shops or hotel lobbies at the same time as other key people.. it was all circumstantial and ended up being utter and complete bullshit. This wave of claims with "incontrovertible" (but secret!) evidence that "Russia hacked the US" seems like the same kind of thing. I doubt they have proof, even if they say they do... even if their claims are made in good faith, they could be dead wrong. And more importantly I doubt the underlying premise, that Russia would even be so stupid as to try such a thing. The American people are stupid enough to vote ourselves into this situation; we didn't need any help from the outside for it to happen. There may have been hacks, but I doubt they were orchestrated by the Russian government and I REALLY doubt the credibility of the US government making claims about this kind of thing after their past record with things like the Iraq WMD.
- deleted 10y ago
  [deleted]
- grzm 10y ago
  Colin Powell just prior to the first Iraq war, getting up in front of the UN I think you mean second, don't you? What's commonly referred to as the First Iraq War would be following the invasion of Kuwait in 1990. https://en.m.wikipedia.org/wiki/Gulf_War https://en.m.wikipedia.org/wiki/Gulf_War
  - 67726e 10y ago
    In the US at least, it's usually referred to as the Gulf War. While I've never personally heard the "first" Gulf War referred to as the first Iraq War I've heard of the current conflict called the second Gulf War. Is that not the norm?
lern_too_spel 10y ago
This is the type of amateur analysis I would expect from a "Wordpress security" professional, certainly not front page worthy. He completely ignored what this malware was used for. The attack was a spearphishing campaign by APT29 that used hosts compromised with this malware to send emails from legitimate government domains to targeted individuals in the DNC and the US Government. The emails themselves contained malware that has only ever been used by APT29. Separately, APT28 ran a spearphishing campaign that directed recipients to a webmail domain hosted on APT28 operational infrastructure to change their passwords. This Joint Analysis Report is telling the government agencies whose infrastructure was used to send the spearphishing emails to secure their Wordpress installations to help reduce the risk of government infrastructure being used to send legitimate-looking spearphishing emails.
Tsiolkovsky 10y ago
This website has no political affiliation; completely unbiased research. Their conclusion: "The IP addresses that DHS provided may have been used for an attack by a state actor like Russia. But they don’t appear to provide any association with Russia. They are probably used by a wide range of other malicious actors, especially the 15% of IP addresses that are Tor exit nodes. The malware sample is old, widely used and appears to be Ukrainian. It has no apparent relationship with Russian intelligence and it would be an indicator of compromise for any website."

97 points by Natsu 10y ago

The conclusions are of particular note: "The IP addresses that DHS provided may have been used for an attack by a state actor like Russia. But they don’t appear to provide any association with Russia. They are probably used by a wide range of other malicious actors, especially the 15% of IP addresses that are Tor exit nodes. The malware sample is old, widely used and appears to be Ukrainian. It has no apparent relationship with Russian intelligence and it would be an indicator of compromise for any website."

gtirloni 10y ago
That's the conclusion anyone working in the security/network area was bound to arrive at. It's really interesting FBI/DHS would make those claims publicly when the chance of having any hard evidence of that would be minimal. But they still did it. Why?
- Gustomaximus 10y ago
  To me the ongoing 'Russia rigged elections' smells like propaganda from the other side. And maybe russia did release the DNC emails, but Assange said that wasn't the case and I feel he's more likely to be telling the truth than state players. And even if they did release these emails it's hardly rigging an election. Comneys email announcement at the 11th hour about reopening email investigation was probably a deciding variable and that was hardly Russian lead. Your question of 'why' seems to be the scariest. US lead activities have been encircling Russia and pressing influence right to their borders for some time. For me I feel its too far and they are cornering the bear. Probably there is too much resource in the 'spy' world and they have to do something to justify their position, hence the older generation keep the pressure on Russia from their cold war agenda or they are looking to pick a fight. The latter being very scary. ...but really I'm no expert and just wonder why countries can put more effort to looking after their own populations needs. All this spy/military expenditure seems so wasteful.
  - threeseed 10y ago
    Nobody said Russia rigged the election. The issue was the attempts to influence the election which Russia has a long, documented history of doing so. And the US had an obligation to respond which they did with minimal effect. So claiming all of this was about propaganda really makes no sense given the facts on the ground. And please remember why Russia's relations with almost all of the world deteriorated in the first place. It's because they annexed Crimea (unprecedented for our generation) and allowed soldiers and weapons to flood into Ukraine which then resulted in Flight 117 being shot down. Nobody is looking for a fight with Russia but capitulating and doing nothing is not an answer either. Diplomatic sanctions have been the correct response and I don't see anyone asking for an escalation of that.
    - Natsu 10y ago
      > Nobody said Russia rigged the election. Nobody sensible said that, but I've seen more than a few comments along those lines on various sites, enough to believe that general sentiment is commonplace. As for Comey, I'd say he let her off easy. Take a look at this: https://www.youtube.com/watch?v=bC1Mc6-RDyQ https://www.youtube.com/watch?v=bC1Mc6-RDyQ Then look at the PDF attached here of an email between Colin Powell and Hillary Clinton and ask whether this looks intentional or not: https://wikileaks.org/clinton-emails/emailid/30324 https://wikileaks.org/clinton-emails/emailid/30324
      - lern_too_spel 10y ago
        How did Comey let her off easy if she didn't break any laws?
        Natsu 10y ago
        Comey claimed not to have charged Clinton because there was a lack of intent. Gowdy is calling him on that, saying that this makes zero sense and going over all the ways they have to prove intent. His point at the end about "negligence" underscores the fact that the entire line of reasoning is nonsensical: intentional negligence is a contradiction in terms. That which is intentional cannot be negligent and vice versa. The law in question is against negligence (which does not require any intent whatsoever). Just to underscore that, I just linked to a document where Colin Powell describes in detail how they're subverting the law: https://wikileaks.org/clinton-emails/emailid/30324 https://wikileaks.org/clinton-emails/emailid/30324 "However, there is a real danger. If it is public that you have a BlackBerry and it [is] government and you are using it, government or not, to do business, it may become an official record and be subject to the law. Reading about the President's BB rules this morning, it sounds like it won't be as useful as it used to be. Be very careful. I got around it all by not saying much and not using systems that captured the data." I don't think it's reasonable to let our politicians get away with this. Inasmuch as people are worried about Russian influence, it seems strange to me that there's no worry about the very leaders to jeopardize our OPSEC with their hubris. Here is Colin Powell, again, saying things that should make HN readers cringe: "Now, the real issue had to do with PDAs, as we called them a few years ago before BlackBerry became a noun. And the issue was DS would not allow them into the secure spaces, especially up your way. When I asked why not they gave me all kinds of nonsense about how they gave out signals that could be read by spies, etc. Same reason they tried to keep mobile phones out of the suite. I had numerous meetings with them. We even opened one up for them to try to explain to me why it was more dangerous than say, a remote control for one of the many tvs in the suite. Or something embedded in my shoe heel. They never satisfied me and NSA/CIA wouldn't back off. So, we just went about our business and stopped asking. I had an ancient version of a PDA and used it. In general, the suite was so sealed that it is hard to get signals in or out wirelessly." If the law is so toothless that high ranking people of either party (Powell is a Republican) can deliberately subvert them, then we're always going to be at the mercy of every country with half-decent spies. This is a problem in its own right, independent from whatever partisan considerations we have here. === Note: The square brackets in the quote are me fixing typos in the original.
- threeseed 10y ago
  a) Anyone who thinks this document is the sole source of evidence is deluding themselves. The intelligence agencies are not going to document their capabilities to the world. Which I am sure would include compromised Tor nodes and DPI (including SSL/encrypted traffic) across many of the key sites/switches/cables. b) It has been claimed that this document is more a guide for other companies and government agencies about the type of techniques that Russia allegedly used. General education about security is still pretty low and the US government et al are going to need to more in this area.
  - Natsu 10y ago
    The problem with a line of reasoning that includes secret evidence we'll never get to see is that it can be used to support any conclusion whatsoever. Inasmuch as it's a guide for other agencies, they'd be better served by OWASP recommendations. It's not clear what anyone could do with a report like this. I don't see any great takeaways that one could add to the next revision of their STIG. There are no 0-days for an IAVA. As long as we're going for pure speculation, I think that Kim Dotcom hired Ukranian hackers and I could potentially find weak circumstantial evidence by going through a timeline of his Tweets. I seem to remember that he had foreknowledge of some of the items to be leaked, though that could've been pure BS and I didn't really investigate it at the time. He also has motive based on this administration's treatment of him. EDIT: Found it - https://www.bloomberg.com/politics/articles/2015-05-14/kim-dotcom-julian-assange-will-be-hillary-clinton-s-worst-nightmare-in-2016 https://www.bloomberg.com/politics/articles/2015-05-14/kim-d...
    - Toe-Rag 10y ago
      Interesting theory about Dotcom. He knew something. I also think that Wikileaks has more material than they released and that Dotcom knows it. His tweets during October suggest that he was expecting something more to drop. It could have been BS, as you say, but I think he knew something.
- gozur88 10y ago
  >It's really interesting FBI/DHS would make those claims publicly when the chance of having any hard evidence of that would be minimal. But they still did it. Why? Occam's razor says it's what the DNC wanted them to say. Politically it's a lot easier cop to being penetrated by a state actor than a group like Anonymous, and it allows the Democrats to deflect the conversation from the content of the emails. Well, to make the attempt, anyway. I'll be curious to see what Trump does with this once he takes office. If there's no compelling evidence of Russian state involvement I suspect he'll direct the relevant agencies to release everything. If he doesn't do that it's going to be difficult for him to cast doubt on the Russian angle.
  - grzm 10y ago
    the DNC Just an observation: I don't recall until very recently the DNC or the RNC to refer to the parties, as opposed to the Democratic Party or Republican Party. I wonder why the shift? The focus on the Podesta/DNC emails? Makes sense during the election, and now it seems to have transferred over to referring to the party as part of the government (e.g., in reference to the FBI or DHS). Last time I remember the DNC being mentioned so much by name was during the Bill Clinton campaigns, in contrast to the Democratic Leadership Council. My memory can be faulty and selective, so I'm wondering if anyone else has noticed this as well. (Anyone else remember Sinbad in Shazam?)
    - nickff 10y ago
      I think people are using 'DNC' and 'RNC' to make it clear that they are referring to the party leadership, not rank-and-file members.
jaclaz 10y ago
Before "those" conclusions, I find of most interest the previous "Malware Conclusions": "The PHP malware sample they have provided appears to be P.A.S. version 3.1.0 which is commonly available and the website that claims to have authored it says they are Ukrainian. It is also several versions behind the most current version of P.A.S which is 4.1.1b. One might reasonably expect Russian intelligence operatives to develop their own tools or at least use current malicious tools from outside sources." The last sentence is IMHO even stronger.

crucialfelix 10y ago

The php malware is the least interesting piece of all the alleged activity. Being a version behind isnt significant. Its a simple common hacker tool. My postgresql is a few versions behind. So what ? If RIS had used obvious elite tools with impressive functionality then it would point straight to them. Its much smarter to look amateur. The JAR should have declassified something juicy. They put out this weak report, revealed nothing and now critics will attack and win. Maybe its the US that are a bunch of amateurs.

matt_wulfeck 10y ago
The USA puts "hackers" in jail, and the ones they hire might not even get a job if they admit to smoking weed in college. This is a country where you can get prison time for using someone's open wireless network. There's hostility towards hackers here from ignorant judges and lawmakers who come down hard on things they don't understand. They win by pressuring US companies with incentives/contracts (Juniper) or jail time (Qwest) to weaken or backdoor their products for US and foreign buyers. Their own citizens are kept in the dark with secret court orders with dubious constitutionality. "Amateur" is being generous.

jwdunne 10y ago

Anyone who has run a wordpress or vbulletin site has probably seen this at some point in time. Got tonnes of logs from IPs in Ukraine, Russian, China, etc that crawl for holes and if they find one you will find something like this somewhere. VBulletin is the worst - executable code is stored in the database so that's where you'll likely find it. I find it hard to believe this is what a state sponsored attack would look like - in business, we see this all the time. I would love to see some action taken on this, there's probably tonnes of time and post business spent on these attacks. I just don't want to see that solution in the form of slanderous claims that paint it as more than it is.

Lintaris 10y ago

Someone around the GOP could merely have hired a hacker from Eastern Europe or Russia specifically to do the hacking. I find it troubling that this avenue was not explored.

grzm 10y ago
I find it troubling that this avenue was not explored. What indication do you have that it wasn't?
Natsu 10y ago
If we're going to speculate, I'd say Kim Dotcom is more suspicious based on his tweets. I thought he tweeted some statements indicating foreknowledge of certain leaks, but I never investigated it carefully. EDIT: I'm certainly not claiming he did anything, I read this as just sour grapes, but look for yourself at a sample - http://imgur.com/a/zv174 http://imgur.com/a/zv174 EDIT 2: This is more like it - https://www.bloomberg.com/politics/articles/2015-05-14/kim-dotcom-julian-assange-will-be-hillary-clinton-s-worst-nightmare-in-2016 https://www.bloomberg.com/politics/articles/2015-05-14/kim-d...
- shimon_e 10y ago
  I don't know why OP is being down voted. Kim Dotcom tweeted he had early access to the leaks. It feels like a more plausible theory to me than the one the Obama administration is pushing. He announced his attention to be "an Internet Freedom fighter" and "Hillary's worse nightmare in 2016" back in 2014. Look at this tweet from 10 hours ago: "My old hacker firm Data Protect hacked 100% of its clients." https://twitter.com/KimDotcom/status/815373371001028608 https://twitter.com/KimDotcom/status/815373371001028608 Another tweet from a few days ago claiming: "I know with 100% certainty that @Russia & @PutinRF_Eng had nothing to do with Clinton related election hacks!" https://twitter.com/KimDotcom/status/814593453963083776 https://twitter.com/KimDotcom/status/814593453963083776 It surely seems like Kim Dotcom wants people to think he is involved.
  - wcummings 10y ago

ryanlol 10y ago

I posted most of this stuff earlier, incl. the actual samples which someone here might be interested in. https://news.ycombinator.com/item?id=13280068 https://news.ycombinator.com/item?id=13280068 Based on the conclusions the authors of the article don't seem to understand the purpose of these IoCs. Individually they aren't all intended to be 100% solid indicators that you were targetted in this campaign, but to be used as a whole.

lngnmn 10y ago

It is ridiculous to think that the Russkies planed and executed these hacks as a deliberate operation with a clear objective to derail the election or whatever it might me. Some guys routinely spreading primitive phishing spam got lucky and got a password or two and gained the access to emails. Just this. No super spy hacking operations. It does not even work that way - chance is the main factor. How the emails turned up on Wikileaks is another questions, but, again, they have been published because they have been already hacked by some primitive phishing gang, not super-intelligent top-tier mega-hackers paid by the evil KGB. The whole idea of deliberate planed KGB operation is an utter nonsense. It were kids with PHP crap. One should look for the brokers. They could have been among the 35 kicked out guys.

jansenv 10y ago
Plus it seems clear that many of the leaks were leaks, not hacks. RIP Seth Rich

natch 10y ago

I don't know how much of the HN community is old enough to remember Colin Powell just prior to the first Iraq war, getting up in front of the UN and the whole world for that matter, and asserting that there was ironclad proof that Iraq had weapons of mass destruction (which we came to know as WMD). Different parts of the government had the same talking points and it was all presented as irrefutable facts. But the evidence General Powell laid out was not convincing to me at all, or to many other people. Grainy photos, reports of known arms dealers appearing in coffee shops or hotel lobbies at the same time as other key people.. it was all circumstantial and ended up being utter and complete bullshit. This wave of claims with "incontrovertible" (but secret!) evidence that "Russia hacked the US" seems like the same kind of thing. I doubt they have proof, even if they say they do... even if their claims are made in good faith, they could be dead wrong. And more importantly I doubt the underlying premise, that Russia would even be so stupid as to try such a thing. The American people are stupid enough to vote ourselves into this situation; we didn't need any help from the outside for it to happen. There may have been hacks, but I doubt they were orchestrated by the Russian government and I REALLY doubt the credibility of the US government making claims about this kind of thing after their past record with things like the Iraq WMD.

deleted 10y ago
[deleted]
grzm 10y ago
Colin Powell just prior to the first Iraq war, getting up in front of the UN I think you mean second, don't you? What's commonly referred to as the First Iraq War would be following the invasion of Kuwait in 1990. https://en.m.wikipedia.org/wiki/Gulf_War https://en.m.wikipedia.org/wiki/Gulf_War
- 67726e 10y ago
  In the US at least, it's usually referred to as the Gulf War. While I've never personally heard the "first" Gulf War referred to as the first Iraq War I've heard of the current conflict called the second Gulf War. Is that not the norm?

lern_too_spel 10y ago

This is the type of amateur analysis I would expect from a "Wordpress security" professional, certainly not front page worthy. He completely ignored what this malware was used for. The attack was a spearphishing campaign by APT29 that used hosts compromised with this malware to send emails from legitimate government domains to targeted individuals in the DNC and the US Government. The emails themselves contained malware that has only ever been used by APT29. Separately, APT28 ran a spearphishing campaign that directed recipients to a webmail domain hosted on APT28 operational infrastructure to change their passwords. This Joint Analysis Report is telling the government agencies whose infrastructure was used to send the spearphishing emails to secure their Wordpress installations to help reduce the risk of government infrastructure being used to send legitimate-looking spearphishing emails.

Tsiolkovsky 10y ago

This website has no political affiliation; completely unbiased research. Their conclusion: "The IP addresses that DHS provided may have been used for an attack by a state actor like Russia. But they don’t appear to provide any association with Russia. They are probably used by a wide range of other malicious actors, especially the 15% of IP addresses that are Tor exit nodes. The malware sample is old, widely used and appears to be Ukrainian. It has no apparent relationship with Russian intelligence and it would be an indicator of compromise for any website."