8 ms·

Department of Justice Statement on SolarWinds Update

101 points by afrcnc 5y ago

4t3gar 5y ago
Son, you need some covid in this discussion - hacker news rules. COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID
venzlombardo 5y ago
covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid
infogulch 5y ago
> The Department is responding to this incident as if the Advanced Persistent Threat (APT) group responsible for the SolarWinds breach had access to all email communications and attachments found within the compromised O365 accounts. The APT is believed to have access to compromised accounts from approximately May 7 to December 27, 2020. The compromised data included all sent, received, and stored emails and attachments found within those accounts during that time.
- legrande 5y ago
  > The Advanced Persistent Threat (APT) group Never liked the term APT. It just makes the 'blame game' easier to commit, instead of focusing on the more important task of securing your country's infra. Now the US just screams: 'China up to no good again'. 'Oh those damn Russians and their cyber-attacks'. No. Fix. Your. Infra.
  - dillondoyle 5y ago
    I don't think anyone thinks we shouldn't be doing (a lot) more to fix our infra. But if we do, is it even possible to fix enough to stop dedicate states as big as CCP or Russia? I think we need more consequences to deter this type of behavior, it's a new type of attack. And yes I'm sure the US is guilty too but we don't have the same type of state owned/sponsored corporations that we hand over hacked materials to copy nor do we support crypto-hacking and hostage taking.
    - tialaramex 5y ago
      > is it even possible to fix enough to stop dedicate states as big as CCP or Russia? In effect yes, because this is an arbitrarily asymmetric environment. You can make them spend say $1Bn for every $1 you spend, if you actually put the work in. And they can't afford that. The US President is just a man, the Russians could, in principle, shoot him in the head. But the US spends a lot of money to make that really hard, and so it isn't worth it and only random American nutjobs try. Most countries don't do that, it's certainly interesting how relatively few of their political leaders get shot in the head... But that's the wrong mindset to have in this space, and it's how you get this outcome. The US focuses resources on protecting a few high value assets and so your opponent just seizes whatever low value assets they want and leverages those to achieve their goals. The right strategy is to jack up the baseline. That is, rather than spend more money protecting those you perceive as biggest targets, spend that money protecting everybody, including ordinary folks so that these broad attacks are too expensive to pursue. Suppose you're an adversary today, somebody in your team figures out a way to target maybe 80% of California Department of Food & Agriculture employees for $1 each. You won't get the most senior people, or those most on the ball about security, but hey, 80% of all employees for $1 each is a bargain so of course you take that. Now suppose the price goes up steeply due to a better approach to this problem from the US government, and they cost $1000 each. That sucks. Instead of just saying "Do it" on your own authority you need to go talk to management about budget. Nobody wants to authorise $2M for this speculative work that might not go anywhere. They authorise you to spend $100 000 identifying the best targets and attacking those instead. A month later you've identified twenty good targets at the CDFA and successfully breached twelve accounts instead of hundreds. This sucks. Imagine if instead of $1000 it was $1M. Or $1Bn. At some point it gets escalated so that an aide is explaining to Putin that it's a choice whether to spend money on fixing the Kuznetsov or breaking into the accounts of some more US civil servants moaning about the coffee machine in their office on the hope that it helps somehow down the line. This is not a hard choice. > I'm sure the US is guilty too but we don't have the same type of state owned/sponsored corporations that we hand over hacked materials to copy This is startlingly naive. Of course the NSA can and goes obtain commercially sensitive information for US corporations like Boeing. Maybe the US counts as stupider for not insisting on a cut of the proceeds, who can say.
davisr 5y ago
How many infinite free passes are tech companies going to get? Either stop using them altogether, or start passing some legislation mandating safety standards. Anyone who purveys these faulty products has no conscience or shame.
- rantwasp 5y ago
  it’s not about conscience or shame. it’s about cost reduction and lack of incentives. If I do this crappy thing and there is no punishment associated with it AND I save 10% I am going to do it. It’s my obligation to the shareholders. If I do this crappy thing and if I get caught it’s a business ending event it’s my obligation to the shareholders not to do it.
TedDoesntTalk 5y ago
There is not much substance to this statement except a lost of affected branches. What’s the point?
- throwawayboise 5y ago
  It was on a checklist. Statement issued, check marked, day's work done.
  - mingus88 5y ago
    What are you guys expecting? A complete dissection of the government’s network topology, and detailed inventory of past and future mitigations? These are classified gov systems. We are lucky to get an acknowledgment that something even happened.
    - TedDoesntTalk 5y ago
      Good points. Maybe I expected to learn more details but given your comments, that doesn’t make sense.
- Spooky23 5y ago
  > While other districts were impacted to a lesser degree, the APT group gained access to the O365 email accounts of at least 80 percent of employees working in the U.S. Attorneys’ offices located in the Eastern, Northern, Southern, and Western Districts of New York. Think about what is unique about these districts. What was going on between May and December that an “actor” or a downstream information consumer might want to know about?
  - spfzero 5y ago
    It still works as a random fishing expedition as well though. There were certainly lots of legal strategy messages that would be very valuable to the subjects of investigations or ongoing cases. Some of those subjects may be initially ignorant they were even on the radar yet. Some of those would be very wealthy and willing to pay for the information.
Trias11 5y ago
Stop hiring offshore middlemen to develop crappy code.
- Andrex 5y ago
  Private equity firms are a developing scourge.

101 points by afrcnc 5y ago

Son, you need some covid in this discussion - hacker news rules. COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID COVID

venzlombardo 5y ago

covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid covid

infogulch 5y ago

> The Department is responding to this incident as if the Advanced Persistent Threat (APT) group responsible for the SolarWinds breach had access to all email communications and attachments found within the compromised O365 accounts. The APT is believed to have access to compromised accounts from approximately May 7 to December 27, 2020. The compromised data included all sent, received, and stored emails and attachments found within those accounts during that time.

legrande 5y ago
> The Advanced Persistent Threat (APT) group Never liked the term APT. It just makes the 'blame game' easier to commit, instead of focusing on the more important task of securing your country's infra. Now the US just screams: 'China up to no good again'. 'Oh those damn Russians and their cyber-attacks'. No. Fix. Your. Infra.
- dillondoyle 5y ago
  I don't think anyone thinks we shouldn't be doing (a lot) more to fix our infra. But if we do, is it even possible to fix enough to stop dedicate states as big as CCP or Russia? I think we need more consequences to deter this type of behavior, it's a new type of attack. And yes I'm sure the US is guilty too but we don't have the same type of state owned/sponsored corporations that we hand over hacked materials to copy nor do we support crypto-hacking and hostage taking.
  - tialaramex 5y ago
    > is it even possible to fix enough to stop dedicate states as big as CCP or Russia? In effect yes, because this is an arbitrarily asymmetric environment. You can make them spend say $1Bn for every $1 you spend, if you actually put the work in. And they can't afford that. The US President is just a man, the Russians could, in principle, shoot him in the head. But the US spends a lot of money to make that really hard, and so it isn't worth it and only random American nutjobs try. Most countries don't do that, it's certainly interesting how relatively few of their political leaders get shot in the head... But that's the wrong mindset to have in this space, and it's how you get this outcome. The US focuses resources on protecting a few high value assets and so your opponent just seizes whatever low value assets they want and leverages those to achieve their goals. The right strategy is to jack up the baseline. That is, rather than spend more money protecting those you perceive as biggest targets, spend that money protecting everybody, including ordinary folks so that these broad attacks are too expensive to pursue. Suppose you're an adversary today, somebody in your team figures out a way to target maybe 80% of California Department of Food & Agriculture employees for $1 each. You won't get the most senior people, or those most on the ball about security, but hey, 80% of all employees for $1 each is a bargain so of course you take that. Now suppose the price goes up steeply due to a better approach to this problem from the US government, and they cost $1000 each. That sucks. Instead of just saying "Do it" on your own authority you need to go talk to management about budget. Nobody wants to authorise $2M for this speculative work that might not go anywhere. They authorise you to spend $100 000 identifying the best targets and attacking those instead. A month later you've identified twenty good targets at the CDFA and successfully breached twelve accounts instead of hundreds. This sucks. Imagine if instead of $1000 it was $1M. Or $1Bn. At some point it gets escalated so that an aide is explaining to Putin that it's a choice whether to spend money on fixing the Kuznetsov or breaking into the accounts of some more US civil servants moaning about the coffee machine in their office on the hope that it helps somehow down the line. This is not a hard choice. > I'm sure the US is guilty too but we don't have the same type of state owned/sponsored corporations that we hand over hacked materials to copy This is startlingly naive. Of course the NSA can and goes obtain commercially sensitive information for US corporations like Boeing. Maybe the US counts as stupider for not insisting on a cut of the proceeds, who can say.

davisr 5y ago

How many infinite free passes are tech companies going to get? Either stop using them altogether, or start passing some legislation mandating safety standards. Anyone who purveys these faulty products has no conscience or shame.

rantwasp 5y ago
it’s not about conscience or shame. it’s about cost reduction and lack of incentives. If I do this crappy thing and there is no punishment associated with it AND I save 10% I am going to do it. It’s my obligation to the shareholders. If I do this crappy thing and if I get caught it’s a business ending event it’s my obligation to the shareholders not to do it.

TedDoesntTalk 5y ago

There is not much substance to this statement except a lost of affected branches. What’s the point?

throwawayboise 5y ago
It was on a checklist. Statement issued, check marked, day's work done.
- mingus88 5y ago
  What are you guys expecting? A complete dissection of the government’s network topology, and detailed inventory of past and future mitigations? These are classified gov systems. We are lucky to get an acknowledgment that something even happened.
  - TedDoesntTalk 5y ago
    Good points. Maybe I expected to learn more details but given your comments, that doesn’t make sense.
Spooky23 5y ago
> While other districts were impacted to a lesser degree, the APT group gained access to the O365 email accounts of at least 80 percent of employees working in the U.S. Attorneys’ offices located in the Eastern, Northern, Southern, and Western Districts of New York. Think about what is unique about these districts. What was going on between May and December that an “actor” or a downstream information consumer might want to know about?
- spfzero 5y ago
  It still works as a random fishing expedition as well though. There were certainly lots of legal strategy messages that would be very valuable to the subjects of investigations or ongoing cases. Some of those subjects may be initially ignorant they were even on the radar yet. Some of those would be very wealthy and willing to pay for the information.

Trias11 5y ago

Stop hiring offshore middlemen to develop crappy code.

Andrex 5y ago
Private equity firms are a developing scourge.