40 ms·

FBI didn’t tell US targets as Russian hackers hunted emails

60 points by oblib 9y ago

oblib 9y ago
The thing that's missing in this article is the "attacks" were done by phishing with email attachments and if one didn't know about that risk they had to ignore thousands of warnings about it over a lot years. Back in 2000 I woke up with an email in my box with the subject "I love you" with an attachment. I took one look at it and deleted it. I thought about calling my partner at the time and warning him about it but he'd been coding with me for a few years so I figured he'd know what he was looking at. I was wrong. He clicked on it and it deleted thousands of photos off his computer. How people fall for that two decades later is not related to "warning" them. We've all been warned for decades.
- x1798DE 9y ago
  It's not a huge difference, but there is a softened between phishing and spear-phishing. It's a lot easier for a specifically crafted spear-phishing campaign to get through whatever mental heuristics you use to identify scams than the broad phishing campaigns you usually see. "Dear X, This email is to set up a meeting to discuss Kaylee's performance in school. Please click here to sign in to our new parent conference scheduling software. Signed, Y, Kaylee's School, Principal"
  - oblib 9y ago
    Yes, that kind of scam can suck some in but it's up to management to educate employees on what to be aware of and how to detect and react to it. The threat is so constant and pervasive though that it's hard for me to imagine that management in any government agency hasn't educated employees about how to deal with these kinds of threats, but not impossible because I don't have to imagine someone did bite. I just can't make the leap that the FBI is to blame though. That's just a leap too far.
    - weaksauce 9y ago
      They share some of the blame. The FBI could have said to the parties involved, "you are going to be targeted by scammers looking to get your emails, be extra vigilant with what you click on." It's a difference between targeted attacking and fish net hacking or phishing without a target.
Overtonwindow 9y ago
Nearly 80 interviews with Americans targeted by Fancy Bear, a Russian government-aligned cyberespionage group, turned up only two cases in which the FBI had provided a heads-up. If you were targeted by Russian hackers, and you happened to be a high level government official, would YOU admit to it? This is like asking a room full of thieves if they robbed the bank. I think it's more likely the FBI DID notify many of them that they had been targeted, but like the DNC, it either got lost through the cracks, was ignored, or possibly seen as some political ploy.
- dragonwriter 9y ago
  > If you were targeted by Russian hackers, and you happened to be a high level government official, would YOU admit to it? This is like asking a room full of thieves if they robbed the bank. Its more like asking a bunch of banks if the FBI has warned them of plots by thieves.
  - tonyztan 9y ago
    It's more like asking a bunch of robbed banks if the FBI has warned them of plots by thieves.
- dragonwriter 9y ago
  > If you were targeted by Russian hackers, and you happened to be a high level government official, would YOU admit to it? This is like asking a room full of thieves if they robbed the bank. Its more like asking a bunch of banks if the FBI has warned them of plots by thieves. Being targeted by hackers (or being informed of that by the FBI) isn't analogous to thievery.
chisleu 9y ago
They are not responsible for crime prevention, but there are many private Intel forms that do notify. (Former senior software engineer for one such firm here)
- Spooky23 9y ago
  Where would one look for such a service? What are the magic words?
  - dsl 9y ago
    "threat intelligence," but beware it has become a bit of an industry buzzword now. :/
ianhawes 9y ago
This is probably an unpopular opinion here, but I think the FBI cybercrime division should be completely defunded and shutdown. A new federal agency with the sole focus of combating cybercrime should be created operating outside the DoJ. The FBI treats cybercrime too much like a janitorial service. The special agents involved in cybercrime have only some general cybercrime training; their training is still overly broad, including firearms and combat training. Part of the problem is that the FBI is also an intelligence organization, so information that feeds into the FBI is almost never disseminated outside the agency, and when it does it is almost always too late. Their reasoning is "sources and methods". What the Russians taught us in the 2016 Election is that it's no longer enough to just _have_ information. You must act on it in innovative new ways. This disruptive behavior (a la Wikileaks) has turned the US IC on it's head. If we had an agency with a sole focus on cybercrime investigation and prevention prior to the 2016 Election, we would probably have a different President right now.
- oblib 9y ago
  As far as I am aware, the DNC hasn't shown any proof of a phishing email being the cause of their emails being stolen. They've only claimed "the Russians did it". Podesta, on the other hand, and as I recall, did get his emails stolen by clicking on a baited link. Aside from that, I think your suggestion for a new federal agency dedicated to dealing with this is a great idea. The hurdle there is the NSA that works on ways to crack into our computers and then leaves the exploits where they can be found and used against us by others too. "Clusterfk" would be an appropriately descriptive word for this sort of situation.
- belorn 9y ago
  The 2016 Election had two major leaks, the emails about clinton/DNC and the video about trump. The Washington Post was happy to distribute the video from the NBC Studios parking lot, while Wikileaks distributed the emails about Clinton. Both did this in order to influence the election. We will never know what kind of President would sit on the throne if neither leak had happened and the wast majority of the top 100 read news articles wasn't about scandals. What I do find interesting however is why the Russian hackers picked wikileaks rather than giving the emails to a right wing news paper. Could have just anonymously mailed a few USB drive to each journalist and I bet one would have published it. I would guess this has something to do with Assange personal vendetta against Hillary Clinton which he has been rather open with ever since the US investigation against him, the reported discussion between US diplomats and Swedish investigators, the "assassination"/drone comments, and the closing of bank accounts.
sigmar 9y ago
One of the journalists of this AP piece (Satter) also wrote a medium post containing a short Q&A about the "notification gap... between what’s known privately about cyberespionage and what’s said publicly" https://medium.com/@rsatter/the-notification-gap-69895c93b053 https://medium.com/@rsatter/the-notification-gap-69895c93b05...

60 points by oblib 9y ago

The thing that's missing in this article is the "attacks" were done by phishing with email attachments and if one didn't know about that risk they had to ignore thousands of warnings about it over a lot years. Back in 2000 I woke up with an email in my box with the subject "I love you" with an attachment. I took one look at it and deleted it. I thought about calling my partner at the time and warning him about it but he'd been coding with me for a few years so I figured he'd know what he was looking at. I was wrong. He clicked on it and it deleted thousands of photos off his computer. How people fall for that two decades later is not related to "warning" them. We've all been warned for decades.

x1798DE 9y ago
It's not a huge difference, but there is a softened between phishing and spear-phishing. It's a lot easier for a specifically crafted spear-phishing campaign to get through whatever mental heuristics you use to identify scams than the broad phishing campaigns you usually see. "Dear X, This email is to set up a meeting to discuss Kaylee's performance in school. Please click here to sign in to our new parent conference scheduling software. Signed, Y, Kaylee's School, Principal"
- oblib 9y ago
  Yes, that kind of scam can suck some in but it's up to management to educate employees on what to be aware of and how to detect and react to it. The threat is so constant and pervasive though that it's hard for me to imagine that management in any government agency hasn't educated employees about how to deal with these kinds of threats, but not impossible because I don't have to imagine someone did bite. I just can't make the leap that the FBI is to blame though. That's just a leap too far.
  - weaksauce 9y ago
    They share some of the blame. The FBI could have said to the parties involved, "you are going to be targeted by scammers looking to get your emails, be extra vigilant with what you click on." It's a difference between targeted attacking and fish net hacking or phishing without a target.

Overtonwindow 9y ago

Nearly 80 interviews with Americans targeted by Fancy Bear, a Russian government-aligned cyberespionage group, turned up only two cases in which the FBI had provided a heads-up. If you were targeted by Russian hackers, and you happened to be a high level government official, would YOU admit to it? This is like asking a room full of thieves if they robbed the bank. I think it's more likely the FBI DID notify many of them that they had been targeted, but like the DNC, it either got lost through the cracks, was ignored, or possibly seen as some political ploy.

dragonwriter 9y ago
> If you were targeted by Russian hackers, and you happened to be a high level government official, would YOU admit to it? This is like asking a room full of thieves if they robbed the bank. Its more like asking a bunch of banks if the FBI has warned them of plots by thieves.
- tonyztan 9y ago
  It's more like asking a bunch of robbed banks if the FBI has warned them of plots by thieves.
dragonwriter 9y ago
> If you were targeted by Russian hackers, and you happened to be a high level government official, would YOU admit to it? This is like asking a room full of thieves if they robbed the bank. Its more like asking a bunch of banks if the FBI has warned them of plots by thieves. Being targeted by hackers (or being informed of that by the FBI) isn't analogous to thievery.

chisleu 9y ago

They are not responsible for crime prevention, but there are many private Intel forms that do notify. (Former senior software engineer for one such firm here)

Spooky23 9y ago
Where would one look for such a service? What are the magic words?
- dsl 9y ago
  "threat intelligence," but beware it has become a bit of an industry buzzword now. :/

ianhawes 9y ago

This is probably an unpopular opinion here, but I think the FBI cybercrime division should be completely defunded and shutdown. A new federal agency with the sole focus of combating cybercrime should be created operating outside the DoJ. The FBI treats cybercrime too much like a janitorial service. The special agents involved in cybercrime have only some general cybercrime training; their training is still overly broad, including firearms and combat training. Part of the problem is that the FBI is also an intelligence organization, so information that feeds into the FBI is almost never disseminated outside the agency, and when it does it is almost always too late. Their reasoning is "sources and methods". What the Russians taught us in the 2016 Election is that it's no longer enough to just _have_ information. You must act on it in innovative new ways. This disruptive behavior (a la Wikileaks) has turned the US IC on it's head. If we had an agency with a sole focus on cybercrime investigation and prevention prior to the 2016 Election, we would probably have a different President right now.

oblib 9y ago
As far as I am aware, the DNC hasn't shown any proof of a phishing email being the cause of their emails being stolen. They've only claimed "the Russians did it". Podesta, on the other hand, and as I recall, did get his emails stolen by clicking on a baited link. Aside from that, I think your suggestion for a new federal agency dedicated to dealing with this is a great idea. The hurdle there is the NSA that works on ways to crack into our computers and then leaves the exploits where they can be found and used against us by others too. "Clusterfk" would be an appropriately descriptive word for this sort of situation.
belorn 9y ago
The 2016 Election had two major leaks, the emails about clinton/DNC and the video about trump. The Washington Post was happy to distribute the video from the NBC Studios parking lot, while Wikileaks distributed the emails about Clinton. Both did this in order to influence the election. We will never know what kind of President would sit on the throne if neither leak had happened and the wast majority of the top 100 read news articles wasn't about scandals. What I do find interesting however is why the Russian hackers picked wikileaks rather than giving the emails to a right wing news paper. Could have just anonymously mailed a few USB drive to each journalist and I bet one would have published it. I would guess this has something to do with Assange personal vendetta against Hillary Clinton which he has been rather open with ever since the US investigation against him, the reported discussion between US diplomats and Swedish investigators, the "assassination"/drone comments, and the closing of bank accounts.

sigmar 9y ago

One of the journalists of this AP piece (Satter) also wrote a medium post containing a short Q&A about the "notification gap... between what’s known privately about cyberespionage and what’s said publicly" https://medium.com/@rsatter/the-notification-gap-69895c93b053 https://medium.com/@rsatter/the-notification-gap-69895c93b05...