6 ms·

Cyberattack from outside the U.S. hits newspapers across the country

92 points by mwnivek 8y ago

n-gate 8y ago
One thing I'd guaranteed- it's not china. China is very well adept at paying newspapers and tv firms journalists as my friends from south asia tell me and that is a much cleaner approach.
- wybiral 8y ago
  We don't know that it's a nation state at all. Or that they were specifically targeting newspapers. So it seems a bit early to speculate on who it isn't.
- danso 8y ago
  How would that be a cleaner approach, when it requires a conspiracy? Which countries did your friends operate from?
  - daodedickinson 8y ago
    Conspiracies are cleaner, that's why rulers use them, all over the planet and beyond.
walrus01 8y ago
I think it's more likely that some commonly-owned group of newspaper syndicate has been hit by a variety of cryptolocker taking out their windows XP/Vista/7/10 PCs, due to poor network security practices, than they've been maliciously attacked.
neonate 8y ago
https://outline.com/2jWMpj https://outline.com/2jWMpj
prolikewh0a 8y ago
I'm curious how they came to the conclusion that it was foreign? Would a domestic attack not likely be smart enough to hide their location?
gerdesj 8y ago
Cyberattack from outside the U.S. hits newspapers across the country, preventing distribution, source says Let's go in with Occam's Razor: RLY? No. Theory: We don't have useful backups and suffered a IT meltdown. Soz.
- zozbot123 8y ago
  Ah, the "We got hacked!" excuse is growing in popularity...
  - deleted 8y ago
    [deleted]
- mirimir 8y ago
  Right. They arguably have no clue about the source.
  - gerdesj 8y ago
    To be fair: I am only theorising.
- deleted 8y ago
  [deleted]
- newnewpdro 8y ago
  It sounded like they're making the assumption based on the type of malware used: > “Ryuk” attacks are “highly targeted, well-resourced and > planned,” according to an August advisory by the U.S. > Department of Health and Human Services’ cybersecurity > program. Victims are deliberately targeted and “only > crucial assets and resources are infected in each targeted > network.” "well-resourced" I imagine shifts the probability towards the "state sponsored" direction, and they probably know more than they're sharing in the article. I do agree that the headline seems inappropriately assertive of the attack being of foreign origin.
zyxzevn 8y ago
The NSA's logs will show exactly where it came from. I don't think they will let us know, as it could also be a False flag cyber attack to push a cyberwar against NK, Russia or Iran. A strategy that is so common these days.
- wybiral 8y ago
  Or it could have been cyber criminals. There's no indication it's nation state APT or anything. Nice try with the spin there though ;)
- tptacek 8y ago
  So common that there is not one reliably documented case of it ever happening.
  - alsetmusic 8y ago
    > So common that there is not one reliably documented case of it ever happening. Not exactly full of examples up to this very minute, but the history of false flag operations is long and well documented. I see no reason to think that it isn’t in the playbook for modern world powers. https://en.wikipedia.org/wiki/False_flag https://en.wikipedia.org/wiki/False_flag
    - wybiral 8y ago
      But it's excessive to jump to that conclusion so early in situations like this without evidence that it's even a nation state or that it's not a foreign power if it is.
    - orf 8y ago
      Now here is an actual example of a very, very common strategy > Hyperbolic statement to push a narrative > "Please back that statement up" > Silence, or "Not exactly full of examples up to this very minute"
      - tedunangst 8y ago
txcwpalpha 8y ago
This story is so bizarre. Despite the article being 20+ paragraphs, there are hardly any details. It lists a handful of newspapers spread across the country and just says they were delayed. Could it be any more vague? The most concrete detail provided is that the attack "disrupted a shared production platform" that apparently made it hard for the printing presses to work - but what does that mean? Disrupted how? What was the shared platform? Was it targeted at multiple newspapers, or was this an attack on a single platform that just happens to be used by all of these newspapers? Then, in regards to the origin of the attack, the only detail provided is this single line: > The source identified the attacker only as a “foreign entity.” That's it. There is absolutely no other information given about the origin of the attack. And yet it's in the story headline? Talk about fear mongering. They also either didn't report, or even more confusing, don't know if the attack was reported to the FBI. And just to make it even more bizarre, this entire article is written by LA Times staff and posted on the LA Times website, and then talks about the LA Times (one of the affected newspapers) as if they have no idea how the LA Times was affected. Shouldn't they have a lot more information? Overall, this article seems to be written by someone who has very little information about the incident(s), and very little knowledge about technology. It also reeks of knee-jerk "omfg hackers!1!". In reality, based on the few details that are available, it sounds to me like they just got hit by some boring ransomware virus. It likely wasn't even targeted.
- crocodiletears 8y ago
  I too, am leery of accepting this incident as a deliberate attack. The Chicago Tribune wrote a less hyperbolic article, indicating that they were forced to print a stripped down version of their paper[0]. An NBC reporter reached out to Tribune for comment, which seems to shed more light on the nature of the problem. [1] >The computer malware was detected Friday and “impacted some back-office systems which are primarily used to publish and produce newspapers across our properties,” said Marisa Kollias, Tribune communications vice president, in a statement. At this point I don't see any reason to believe that a copy formatter (I don't know the industry term) didn't just happen to be looking at porn during their break, and accidentally clicked the wrong link. The LATime's treatment of the event is lazy and, I suspect, quite misleading. [0]https://www.chicagotribune.com/business/ct-biz-computer-virus-tribune-publishing-20181229-story.html https://www.chicagotribune.com/business/ct-biz-computer-viru... [1]https://www.nbcnews.com/news/us-news/computer-virus-hits-southern-california-newspapers-n953001 https://www.nbcnews.com/news/us-news/computer-virus-hits-sou...
strictnein 8y ago
"Outside the US" is such a weird thing. I regularly VPN out through [insert random country] and then poke at "interesting" websites over Tor. Were am I coming from? It's almost impossible to tell, and for 99.999% of all orgs (including government ones), it basically is impossible.
- r3bl 8y ago
  Venn's diagram between people who can achieve this supposed attack and people dumb enough to use their own IP (or any IP from their own country) is blank.
sschueller 8y ago
Did I misconfigure my nmap port scan again? /s

92 points by mwnivek 8y ago

One thing I'd guaranteed- it's not china. China is very well adept at paying newspapers and tv firms journalists as my friends from south asia tell me and that is a much cleaner approach.

wybiral 8y ago
We don't know that it's a nation state at all. Or that they were specifically targeting newspapers. So it seems a bit early to speculate on who it isn't.
danso 8y ago
How would that be a cleaner approach, when it requires a conspiracy? Which countries did your friends operate from?
- daodedickinson 8y ago
  Conspiracies are cleaner, that's why rulers use them, all over the planet and beyond.

walrus01 8y ago

I think it's more likely that some commonly-owned group of newspaper syndicate has been hit by a variety of cryptolocker taking out their windows XP/Vista/7/10 PCs, due to poor network security practices, than they've been maliciously attacked.

neonate 8y ago

https://outline.com/2jWMpj https://outline.com/2jWMpj

prolikewh0a 8y ago

I'm curious how they came to the conclusion that it was foreign? Would a domestic attack not likely be smart enough to hide their location?

gerdesj 8y ago

Cyberattack from outside the U.S. hits newspapers across the country, preventing distribution, source says Let's go in with Occam's Razor: RLY? No. Theory: We don't have useful backups and suffered a IT meltdown. Soz.

zozbot123 8y ago
Ah, the "We got hacked!" excuse is growing in popularity...
- deleted 8y ago
  [deleted]
mirimir 8y ago
Right. They arguably have no clue about the source.
- gerdesj 8y ago
  To be fair: I am only theorising.
deleted 8y ago
[deleted]
newnewpdro 8y ago
It sounded like they're making the assumption based on the type of malware used: > “Ryuk” attacks are “highly targeted, well-resourced and > planned,” according to an August advisory by the U.S. > Department of Health and Human Services’ cybersecurity > program. Victims are deliberately targeted and “only > crucial assets and resources are infected in each targeted > network.” "well-resourced" I imagine shifts the probability towards the "state sponsored" direction, and they probably know more than they're sharing in the article. I do agree that the headline seems inappropriately assertive of the attack being of foreign origin.

zyxzevn 8y ago

The NSA's logs will show exactly where it came from. I don't think they will let us know, as it could also be a False flag cyber attack to push a cyberwar against NK, Russia or Iran. A strategy that is so common these days.

wybiral 8y ago
Or it could have been cyber criminals. There's no indication it's nation state APT or anything. Nice try with the spin there though ;)
tptacek 8y ago
So common that there is not one reliably documented case of it ever happening.
- alsetmusic 8y ago
  > So common that there is not one reliably documented case of it ever happening. Not exactly full of examples up to this very minute, but the history of false flag operations is long and well documented. I see no reason to think that it isn’t in the playbook for modern world powers. https://en.wikipedia.org/wiki/False_flag https://en.wikipedia.org/wiki/False_flag
  - wybiral 8y ago
    But it's excessive to jump to that conclusion so early in situations like this without evidence that it's even a nation state or that it's not a foreign power if it is.
  - orf 8y ago
    Now here is an actual example of a very, very common strategy > Hyperbolic statement to push a narrative > "Please back that statement up" > Silence, or "Not exactly full of examples up to this very minute"
    - tedunangst 8y ago

txcwpalpha 8y ago

This story is so bizarre. Despite the article being 20+ paragraphs, there are hardly any details. It lists a handful of newspapers spread across the country and just says they were delayed. Could it be any more vague? The most concrete detail provided is that the attack "disrupted a shared production platform" that apparently made it hard for the printing presses to work - but what does that mean? Disrupted how? What was the shared platform? Was it targeted at multiple newspapers, or was this an attack on a single platform that just happens to be used by all of these newspapers? Then, in regards to the origin of the attack, the only detail provided is this single line: > The source identified the attacker only as a “foreign entity.” That's it. There is absolutely no other information given about the origin of the attack. And yet it's in the story headline? Talk about fear mongering. They also either didn't report, or even more confusing, don't know if the attack was reported to the FBI. And just to make it even more bizarre, this entire article is written by LA Times staff and posted on the LA Times website, and then talks about the LA Times (one of the affected newspapers) as if they have no idea how the LA Times was affected. Shouldn't they have a lot more information? Overall, this article seems to be written by someone who has very little information about the incident(s), and very little knowledge about technology. It also reeks of knee-jerk "omfg hackers!1!". In reality, based on the few details that are available, it sounds to me like they just got hit by some boring ransomware virus. It likely wasn't even targeted.

crocodiletears 8y ago
I too, am leery of accepting this incident as a deliberate attack. The Chicago Tribune wrote a less hyperbolic article, indicating that they were forced to print a stripped down version of their paper[0]. An NBC reporter reached out to Tribune for comment, which seems to shed more light on the nature of the problem. [1] >The computer malware was detected Friday and “impacted some back-office systems which are primarily used to publish and produce newspapers across our properties,” said Marisa Kollias, Tribune communications vice president, in a statement. At this point I don't see any reason to believe that a copy formatter (I don't know the industry term) didn't just happen to be looking at porn during their break, and accidentally clicked the wrong link. The LATime's treatment of the event is lazy and, I suspect, quite misleading. [0]https://www.chicagotribune.com/business/ct-biz-computer-virus-tribune-publishing-20181229-story.html https://www.chicagotribune.com/business/ct-biz-computer-viru... [1]https://www.nbcnews.com/news/us-news/computer-virus-hits-southern-california-newspapers-n953001 https://www.nbcnews.com/news/us-news/computer-virus-hits-sou...

strictnein 8y ago

"Outside the US" is such a weird thing. I regularly VPN out through [insert random country] and then poke at "interesting" websites over Tor. Were am I coming from? It's almost impossible to tell, and for 99.999% of all orgs (including government ones), it basically is impossible.

r3bl 8y ago
Venn's diagram between people who can achieve this supposed attack and people dumb enough to use their own IP (or any IP from their own country) is blank.

sschueller 8y ago

Did I misconfigure my nmap port scan again? /s