6 ms·
No, this is a first. It's the first time the US has publicly blamed Russia through official channels, as opposed to leaks to the press. The original alert was
by comex 9y ago
No, this is a first. It's the first time the US has publicly blamed Russia through official channels, as opposed to leaks to the press. The original alert was published by US-CERT:
https://www.us-cert.gov/ncas/alerts/TA18-074A https://www.us-cert.gov/ncas/alerts/TA18-074A
and has more interesting technical details.
It's true that both this and previously reports technically involved "anonymous officials in the DHS", in the sense that alert doesn't name any specific officials, but the phrase "anonymous officials" is usually associated with leaks, not official announcements...
- toomuchtodo 9y agoWas eye opening to see that gas turbine SCADA system access had been obtained. I’ve seen unsecured electrical substation and industrial controls, but not actively compromised.
- mike_hearn 9y agoThe story I linked to has statements from multiple elected representatives stating point blank that Russia had hacked the electricity grid. Official statements by representatives is the same thing as "The US Says" as far as the world is concerned.
- comex 9y agoI'd say they're not the same as far as the world is concerned, because the legislative branch is not responsible for diplomacy, and they're also mainly 'downstream' from the agencies actually producing the information. …I was writing a rather long comment that tried to defend the Post story as, in retrospect, probably true, in light of the current report and other more recent showing a pattern. (In particular, the current report actually shows a VNC connection to some kind of generator system, though presumably not Burlington Electric's.) However, the Post's own followup report [1] suggested that (contrary to the company's original statement) the government had not found any indicators on the Burlington Electric laptop that were uniquely linked to Grizzly Steppe: U.S. officials are continuing to investigate the laptop. In the course of their investigation, though, they have found on the device a package of software tools commonly used by online criminals to deliver malware. The package, known as Neutrino, does not appear to be connected with Grizzly Steppe, which U.S. officials have identified as the Russian hacking operation. The FBI, which declined to comment, is continuing to investigate how the malware got onto the laptop. Initially, company officials publicly said they had detected code that had been linked by the Department of Homeland Security to Grizzly Steppe. I still don't think this does much of anything to invalidate the current story. It seems like that was mainly a mistake on the company's part, as they incorrectly treated indicators that were non-uniquely linked to a hacking campaign as evidence it was targeted by that campaign. They then reported this to various authorities, and the information apparently found its way via the state police to one of the state's US senators - probably without the details being vetted by anyone with relevant experience. But both the the US-CERT report and the Symantec report provide evidence of an ongoing, targeted campaign against energy facilities (which, for that matter, was active at the time of the Post report). And one would expect that both reports originate from people that do basically know what they're talking about. [1] https://www.washingtonpost.com/world/national-security/russian-government-hackers-do-not-appear-to-have-targeted-vermont-utility-say-people-close-to-investigation/2017/01/02/70c25956-d12c-11e6-945a-76f69a399dd5_story.html https://www.washingtonpost.com/world/national-security/russi...