15 ms·
Sealed U.S. Court Records Exposed in SolarWinds Breach
- darig 6y agoThe U.S. is a failed state, unable to protect the rights of citizens.
- ChrisMarshallNY 6y agoOoohhh...that's gonna leave a mark. They can wreak all kinds of havoc with that information.
- x86_64Ubuntu 6y agoLike what? I'm not a lawyer, but I can only think that if they have any intelligence assets that were about to get slapped with charges, they can whisk them out before the alphabet soup boys come and round them up.
- tyxodiwktis 6y agoThey could go to anyone important who is under investigation/has been indicted but doesn’t know it yet, tell them, then have them do things (data dump from your employer, etc) in exchange for help fleeing the US to Russia.
- dannyw 6y agoRussians aren’t dumb: it would be absurd to think they’re not doing it, right now.
- consumer451 6y agoThere is even a special word for that in Russian. https://en.wikipedia.org/wiki/Kompromat https://en.wikipedia.org/wiki/Kompromat
- newacct583 6y agoBlackmail. Virtually all sealed court records are sealed because someone would be harmed if revealed. How many elected officials are out there with sealed depositions alleging sexual assault, etc...?
- ransom1538 6y ago"Like what?" Like the article mentioned "informant names" seems pretty nuts.
- cheaprentalyeti 6y agoI wonder if it was anything interesting.
- skoskie 6y agoHey devs! The article indicates jetbrains software might be compromised.
- bredren 6y agoI was also alarmed by this but am less so after I looked into discussion from yesterday: https://news.ycombinator.com/item?id=25662385 https://news.ycombinator.com/item?id=25662385
- complexworld 6y agoJetbrains says they had not been contacted by law enforcement. On yesterday's thread it said that Team city was only used, in the intended fashion, as the delivery mechanism for the malicious payload. Kinda like blaming ftp when a hacker uses it to upload a payload. https://blog.jetbrains.com/teamcity/2021/01/statement-on-the-story-from-the-new-york-times-regarding-jetbrains-and-solarwinds/ https://blog.jetbrains.com/teamcity/2021/01/statement-on-the...
- eternalban 6y agoStop believing your lying eyes. The New Times says they are under investigations, and that should be good enough for you ..
- dilyevsky 6y agoOnly when it’s setup by solarwinds ops team apparently
- SpaceRaccoon 6y agoStop spreading misinformation.
- boomboomsubban 6y agoThough they've provided no reason to suspect JetBrains, nor have they said who is "investigating" the company, the article does say they may be compromised. If you rely on their software, it's probably a good idea to make sure you have a mitigation plan ready.
- hikerclimb 6y agoGood.
- boringg 6y agoThis solarwinds breach feels like it might spiral into one of the major new stories this year with it’s likely legs. Really depends on how much data was snapped up. It’s like an onion each layer bringing more tears.
- tru3_power 6y agoI’m wondering if solarwinds will survive all of this. Must be crazy working there right now.
- natas 6y ago175 jobs open now, let's check in a few months? https://www.solarwinds.jobs/jobs?page=1 https://www.solarwinds.jobs/jobs?page=1
- nradov 6y agoMost large companies have some zombie job postings for positions which are no longer budgeted but haven't been removed from the web site yet.
- dheera 6y ago... and even startups who don't yet have the budget but are trying to raise money and create an fake aura of momentum with investors.
- vaxman 6y ago..and companies looking to bolster their "need" for H1Bs'ers
- Scoundreller 6y agoEven big orgs in decline have done this.
- baxtr 6y ago
- nelson_muntz69 6y agoThis breach should be the end of Wintel
- snomad 6y ago> Under the AO’s new procedures, highly sensitive court documents filed with federal courts will be accepted for filing in paper form or via a secure electronic device, such as a thumb drive Aren't thumb drives (USB) also vulnerable?
- sailfast 6y agoEncrypted drives like Iron Keys (tm) are typically used as a "secure" way of doing this.
- deleted 6y ago[deleted]
- deleted 6y ago[deleted]
- dannyw 6y agoProperly access controlled physical devices CAN be used as a secure way of doing things. See: hardware cryptocurrency wallets, trusted access modules, etc.
- pxeboot 6y ago> Aren't thumb drives (USB) also vulnerable? Yes. I wonder if it is also possible to find a vulnerability in OCR software that could be triggered by a scanning maliciously formated sheet of paper.
- colejohnson66 6y agoRelated: JBIG2[0]. Xerox had some scanners that compressed the image to JBIG2, but the compression algorithm was so aggressive, numbers would be corrupted. Very bad for things dealing with money. [0]: https://en.wikipedia.org/wiki/JBIG2 https://en.wikipedia.org/wiki/JBIG2
- m463 6y ago(off-topic) Speaking of money, modern copiers are supposed to detect and refuse to copy us currency. (haven't tried it personally)
- vmception 6y agooooh I have a shopping list of court cases!
- zug_zug 6y agoKind of feels like the US should have been focusing more on defensive cybersecurity rather than building cool hacking tools to go on the offensive.
- baxtr 6y agoWell that’s the nature of asymmetric attack vectors I guess. It’s more expensive to protect than to attack.
- indigochill 6y agoAnd from everything I've seen from government policy, they actually don't want to defend because that would mean securing common software that "the enemy" also uses, closing their own avenues of attack. You can't really have an arsenal of exploits at hand without acknowledging that by keeping them secret, you're making your own people less safe.
- JumpCrisscross 6y agoSealed documents for ongoing cases being on a server, fine. But for closed cases? Those should only be in hard copy. Indices, at most, could be digital.
- Nbox9 6y agoReally? It’s so much cheaper to maintain digital documents than paper copies.
- anonisko 6y agoTape reels would probably be best for cold storage, not paper or live, network connected disks.
- Nbox9 6y agoAn air gap would significantly increase security, but it would also significantly increase the cost of reviewing the sealed documents. I’m unsure how frequently those files should be read, but an air gapped disk storage would make sense for highly sensitive or rarely accessed and sensitive documents.
- toomuchtodo 6y agoWould you consider a robotic tape library air gapped if human intervention was required to approve tape loading?
- Nbox9 6y agoI consider an air gap to be a computer that is not connected to the internet, and is not networked with another device that connects to the internet. A robotic tape library might fit that definition, and it might not.
- StillBored 6y agoPretty much none of the library controllers have options to prompt the user before moving a tape. That is after all the advantage of a _robot_ vs just having a human take it off the shelf and stick it in the drive. So, no "air gapping" a tape library is called tape export, where the tapes are ejected into a port for the operator to stick on the shelf, or ship to cold storage.
- mrhyyyyde 6y agoAm I the only one wondering if any cases exposed are just by chance related to certain politicians or their business partners? Just a thought..
- anonymouse008 6y agoI feel like a person with red yarn all over my wall, and I don’t like it.
- techer 6y agoSorry to be slow but can you elaborate on your statement?
- triceratops 6y agoI believe they're referring to a popular image of conspiracy theorists who have corkboards with newspaper clippings, pictures, and maps pinned on it, and red yarn connecting various things.
- mcintyre1994 6y agoIt's probably a reference to this meme: https://knowyourmeme.com/memes/pepe-silvia https://knowyourmeme.com/memes/pepe-silvia
- OpticalWindows 6y agoI can't imagine the amount of political capital they gained from that information. By political capital I mean blackmail.
- briantakita 6y agoA proverbial "seat at the table".
- OpticalWindows 6y agoglobally iran looks like they want one.
- dmix 6y agoIf you read an indictment such as this Indian tech support scam from last month, they nabbed multiple guys in different airports on different flights, presumedly using sealed court orders combined with scanning names of aircraft passenger lists, then having appropriate federal or local police at the airport to handle the arrest upon boarding or deboarding. https://www.justice.gov/usao-ri/pr/five-tied-millions-dollars-telemarketing-fraud-convicted https://www.justice.gov/usao-ri/pr/five-tied-millions-dollar... The Russians or whoever it was could use this to warn individuals (ie state hackers) from flying because of sealed arrest warrants for very serious cases. This is very serious indeed. And that’s only one scenario.
- Scoundreller 6y ago> over a nine-month period beginning in August 2018, he routed nearly 20,000 “Tech Fraud” scheme calls to call centers in India. Many of the callers hung-up shortly after making contact with a call center operator. However, approximately 7,524 callers remained on the line with call center operators for more than 20 minutes. 30% made it to >20 mins? Even on my best day, I can’t keep them on for more than 5 minutes.
- dmix 6y agoI highly recommend watch this if you don’t believe the numbers are real. https://youtu.be/xb_rgQ4IDS8 https://youtu.be/xb_rgQ4IDS8 Jim Browning fully owned the Indian scamming company (including CCTV cameras and live calls with UK people) and should be awarded for his work. Tech support scammers are a massive problem, the US justice dept has only just scratched the surface.
- ricardo81 6y agoIndeed, IIRC some of his work has exposed spreadsheets showing people being scammed out of hundreds of thousands of dollars, and these call centers easily make 5 figures a month just extracting money from the unknowing. "Kitboga" on YT manages to keep scammers on call for hours and hours, quite amusing that in the end he's the one gaining monetarily as his videos sometimes get millions of views.
- laydn 6y agoWhy are we only hearing about these breaches in the US? Whoever exploited this weakness, must have attacked all targets in Europe, Asia, etc. Are they keeping it quiet somehow? Or maybe they aren't as good at identifying the breaches?
- AnHonestComment 6y agoI think we’re hearing about US cases because FireEye, Microsoft, and CISA/NSA have done a good job disclosing information.
- corty 6y agoI guess they are just slower or more incompetent. The German federal government is still counting the number of Solarwinds installations, not all ministries have answered their questions yet...
- marcosdumay 6y agoHow many customers do Solar Winds have outside of the US? I don't think I have ever heard about them before the breach. Of course, they breached Microsoft, and that one is popular all over the world. But at least until now, they are denying any larger problem.
- tdhz77 6y agoI work at the courts and manage our ECF system. Our government was very quick to respond, but not sure it matters considering Russians were in the system for 8 months. On top of that, several vendors were exploited VMware and Microsoft. I’ve fought for the federal government to create instead of buy. I continue to fail. It’s becoming increasing obvious the United States needs a privacy branch for data breaches and also for a whole bunch of engineers building out the next generation of apps for a better/smarter government. This is my life’s work, and I will keep trying.
- lifeisstillgood 6y agoWe hear you. A long time ago I tried to start something similar in UK - http://oss4gov.org/manifesto http://oss4gov.org/manifesto My contacts are in the profile if you want to chat / scheme :-)
- m12k 6y agoCan we just designate Russia as a rogue state and sanction the fuck out of them already? Annexing Crimea, shooting down MH17, Meddling in the '16 US election, meddling in the Brexit vote, poisoning Navalny, meddling in the '20 US election and now this massive hack. A government should not be able to act like that and still get to to interact normally with the rest of international society.
- deleted 6y ago[deleted]
- PopeDotNinja 6y agoOne day the USA is gonna start getting slapped with sanctions for all the stuff it does. I don’t think they’re prepared for that.
- m12k 6y agoAbsolutely, the world should not tolerate aggression or deceitfulness like that from any country. Oh, I nearly forgot about Russia's polonium poisoning in the UK, and the massive state-funded doping program for the 2014 Sochi Winter Olympics where the majority of Russian athletes were doped. It really does feel like the past 7 years, Putin has really been testing the limits of what he can get away with, and sadly the answer so far is "as much backstabbing as he wants". Time for that to change
- briantakita 6y agoSomebody has blackmail material...
- a-dub 6y agois the solarwinds product windows only, or are unix hosts also exposed via mono or the like?
- peter_d_sherman 6y agoThere's a couple of interesting problems in Law that come up, as a result of this. In order to explain them more effectively, let's suppose that for the purposes of discussion that you are Mark Zuckerberg and that you run Facebook... OK, so when you start Facebook, you make a promise to users, and that is, that their data that will be confidential, that is, only shared with parties that they give explicit permission to share that data with, and no one else, never. In other words, that you will respect users' privacy. This becomes part of the agreement you make with all new users, it becomes part of the user agreement -- the CONTRACT you made with them. You engineer the system such that it will respect those rules, and you assume that nothing possible can go wrong. But then later on, you realize that all of this was not as foolproof as you had once thought. That's because Government, via it's Police and Lawyers, and it's NSL's and other legal instruments -- are now requesting information from you about your users, to solve criminal cases, but they're asking you to keep silent about user data you give them, basically because you were coerced by their Lawyers. You begrudgingly turn over the data and keep silent about it, that is, you respect the Law -- but deep in your mind, in your conscience -- you know that something about this whole thing is very, very wrong. You see, the problem that now occurs, legally, lawfully, morally and ethically -- is now that basically YOU'VE VIOLATED THAT CONTRACT YOU MADE WITH YOUR USERS. You broke that CONTRACT. And you also destroyed that trust. You told people that a future set of events was going to happen (that their data would be kept private), that they relied on in making the decision of whether to give you their business or not, to give you their eyeballs or not, and YOU BETRAYED THAT TRUST. YOU BROKE THAT CONTRACT You didn't do it intentionally -- you had no way of knowing what future circumstances would turn out to be, but nonetheless, those circumstances resulted in YOUR BREACH OF CONTRACT. That's because explicity or implicity or in both ways, YOU AGREED TO THAT RESPONSIBILITY. THAT YOU WOULD PROTECT USERS And because of circumstances, YOU DIDN'T But nonetheless, YOU AGREED TO THAT RESPONSIBILITY. Now, if you understand all of that... then here's the next piece of understanding... The sealed court records -- are no different than Facebook user data in the above example. The Court -- had a CONTRACT -- implicit, explicit (heck, I'll let Lawyers figure it out) -- TO KEEP THOSE DOCUMENTS SEALED. Even though it was a third party, a set of circumstances, that caused the breach of that CONTRACT, THERE STILL WAS A BREACH OF CONTRACT. See? Even though the players and the parts and the modes and the mechanisms are different, THERE STILL WAS A BREACH OF CONTRACT. The Court contracted, CONTRACTED that it would keep these records confidential (compare Attorney-Client privilege), and they basically BROKE THAT CONTRACT. What you have here is grounds for a super-big-ass CLASS ACTION LAWSUIT. I'll let all of the Lawyers (aka "Bar Association Members") attend to that. My point is simply this: If you're running an online service in this day and age, if you have users, you cannot, CANNOT make any guarantees of privacy to them. Your best bet is to be honest and tell them that you'll take all the security best practices you can on your end, but at the end of the day, even that is no guarantee against a data breach, wanted or unwanted, done via lawful or unlawful means, executed by the Government or hacker group, or whomever. YOU CANNOT GUARANTEE PRIVACY IN THIS DAY AND AGE. It would be simpler just to be honest and up-front to all of your users and simply tell them that, EVEN IF as a result of this they stopped doing business with you, or using your website, or whatever. You'd get a lot more sleep at night -- if you had a clear conscience... I quote to you the 3rd Delphic Maxim: "Surety brings ruin". https://en.wikipedia.org/wiki/Delphic_maxims https://en.wikipedia.org/wiki/Delphic_maxims If the Court (or any other entity, Government, Corporation, Person) makes promises to anyone else, implicitly or explicity, while those promises might not be written down, those promises constitute a CONTRACT.