12 ms·
An update on the threat landscape
- miohtama 5y agoDoes anyone remember REvil arrest anymore? https://krebsonsecurity.com/2022/01/at-request-of-u-s-russia-rounds-up-14-revil-ransomware-affiliates/ https://krebsonsecurity.com/2022/01/at-request-of-u-s-russia... Those people must be now be back to the business, national heroes and the era of ransomware diplomacy ended as fast as it started.
- jacquesm 5y agoThe Russian version of a recruitment drive?
- CryptoBanker 5y agoThose 14 are just a drop in the bucket. Neither their arrest nor release will make much of a difference
- javajosh 5y agoWhy is Russia so into hacking? Would it help if there was a startup community there to absorb the talent? Or is this the inevitable byproduct of bright people living under a brutally corrupt and dishonest dictator and his cronies for most of their lives?
- uluyol 5y agoWhat makes you think Russia is special in this regard?
- bee_rider 5y agoWell, you hear about Russian hackers on the news a lot, which would seem to indicate that either: 1) they are very good at hacking 2) they are not so good at hacking 3) Russia is a popular place for hackers to set up proxies
- weq 5y agoAll of the above!
- xtian 5y ago4) The news is not geopolitically neutral
- oefrha 5y agoAlternatively, news about hacking that you read, including their primary sources like Google/Microsoft/FireEye/whatever, usually suppress news about hacking by U.S. and allies. IIRC last year Google publicly announced a zero day actively exploited by the U.S. which was considered highly unusual, since apparently they usually just patch it without fuzz. The article was discussed here but I can’t find it now.
- fomine3 5y agoThat's why Kaspersky is important. I wish they survive.
- bee_rider 5y agoThis thread was kicked off by discussion about ransomware hacking, though. I'm sure US intelligence agencies get up to all sorts of no good, and I'm sure our news is less likely to report on it, but there doesn't seem to be an equivalent ransomware industry in the US (and the news has no reason to cover for petty hacking criminals in the US). Actually I don't see a ton of news about national-security related hacking by Russia.
- oefrha 5y agoOh, TFA is about nation states so I was talking about that. Asymmetric commercial hacking is pretty easy to explain: hacking foreign entities is safer than hacking domestic ones in terms of risk exposure, and hacking entities in countries richer than yours is more attractive than the other way round.
- 5y ago
- labster 5y agoWhich would you rather earn, 1000 rubles or 1000 dollars? Corruption is much more profitable than honesty in Russia.
- bregma 5y agoThis sort of thing has always been the domain of organized crime syndicates. Narcotics, prostitution, gambling, smuggling, and computer crime all take organization and capitalization. It's just that in some places such organizations control the reigns of political power brazenly and shamelessly.
- godelski 5y ago> Why is Russia so into hacking? Same reason NK is. Same reason every country is. It is rather cheap in comparison. I mean even the largest super computers only cost a few hundred million. That's rather cheap when you consider other military adventures. One state of the art super computer is roughly the price of one (maybe 2) modern jets. The biggest cost is people. And you can do a ton of damage with hacking. The costs are low, benefits are high. [0] Summit was $350m, and a F22 costs $140m (per jet, not including development costs which is hundreds of billions)
- ethbr0 5y agoWhat do super computers have to do with hacking?
- tspike 5y agoThe most immediate use case that comes to mind is breaking encryption.
- speed_spread 5y agoSuccessfully hacking the Gibson it the ultimate challenge!
- godelski 5y agoNot really much, but it was giving an example of the costs of computing in general. More like an upper bound. That you could buy crazy expensive computers and it would cost nowhere near what actual weapons systems cost. I was just trying to say that the cost for hacking is more in man power rather than machinery. And man power is far cheaper than machinery.
- mrep 5y agoWhere are you getting hundreds of billions? Wikipedia says "As production wound down in 2011, the total program cost is estimated to be about $67.3 billion, with $32.4 billion spent on Research, Development, Test and Evaluation (RDT&E) and $34.9 billion on procurement and military construction (MILCON) in then year dollars."
- jazzyjackson 5y ago1. The Russian gov't looks the other way. Hackers in any other country might fear prosecution & extradition, but Russian hackers are protected as long as they don't attack Russians. There was some malware going around at one point where someone realized the payload didn't run if the user had a Russian keymap installed. 2. Kind of a "worse is better" phenomenon. This is apocryphal but while Americans and Europeans were digging into Apple IIs and Commodores, Russia just had crappy knockoff machines that didn't follow the behavior of the machines they were meant to be clones of, so anyone who stuck with it long enough basically taught themselves reverse engineering and the operation of "weird machines", how to operate in environments of undefined behavior. Thats just how I heard it, I'd like to learn more about their history since their space program was pretty one-to-one with ours, they definitely had computer engineers and programmers just as sophisticated as USA
- javajosh 5y ago>they definitely had computer engineers and programmers just as sophisticated as USA Russians also have a world-class reputation in math and physics. At least they did in the 20th century. Now that experiments are so capital intensive, theoretical physics has become unfalsifiable silliness, I would assume that these people went into software. Although I could be wrong.
- heavyset_go 5y ago> The Russian gov't looks the other way. Hackers in any other country might fear prosecution & extradition, but Russian hackers are protected as long as they don't attack Russians. You can see some of this with Anonymous and the FBI these days, too, and NSO Group and Israel. I wouldn't be surprised if most countries do this, now.
- webmaven 5y ago> Why is Russia so into hacking? Would it help if there was a startup community there to absorb the talent? Or is this the inevitable byproduct of bright people living under a brutally corrupt and dishonest dictator and his cronies for most of their lives? It may be worth taking a look at the conditions that first gave rise to the eastern European malware scene in the late 80's, particularly in the Soviet Union and Bulgaria: https://bontchev.nlcv.bas.bg/papers/factory.html https://bontchev.nlcv.bas.bg/papers/factory.html In particular, the presence of the necessary information and lack of economic opportunity gave rise to the original scene, and today that has transformed into an environment where the economic opportunity is directly tied to various for-profit black-hat activities (ransomware, identity theft and credit card fraud, etc.). It is possible to link the relative lack of other economic opportunities to corruption, and that is a valid observation, but if black hat activities weren't profitable and relatively safe from retaliation (as long as you avoid Russian targets), the scene would still be typified by disaffected individuals rather than organized professional groups. I'm not sure if creating a bunch of startups to soak up the extra talent would work, as the incentives to get a leg up on the competition via the Dark Arts (DDOS your competitor, spear-phishing their sales people, etc.) would still be pretty strong.
- er4hn 5y agoThis is the key comment. Free college education, glut of college trained programmers, lack of a legitimate job market.
- steve76 5y ago
- raverbashing 5y agoOn that subject we might ask if the Eastern recruiters care about things like background searches, "polygraphs" or what recreational substances the subjects use on their free time. But yeah it's all of the factors you mentioned.
- Gravityloss 5y agoLess opportunities for startups for running actual stable business products there isn't helping either. I have heard a first hand story how the government just stopped some cloud access, which caused some company that had built its product on top of it to immediately close down.
- cormacrelf 5y agoSince the war began, a number of supposedly independent ransomware groups have publicly announced their allegiance to the Kremlin and the war effort, and their intention to carry out strikes. So the idea of the January arrests was probably part of a larger pattern of arresting criminals and telling them they get out of jail free if they come work for the state. Whether these particular ones have already been turned into assets useful against Ukraine is not clear. At minimum they’re not working against Putin. The idea of “ransomware diplomacy” was probably just a side benefit.
- obblekk 5y agoInteresting that they're targeting media publications - those users (journalists) are probably less technical / security hardened than operators of critical infrastructure, but have a great deal of influence over the country's wellbeing nonetheless. I wonder what other similar professions are? Doctors and lawyers? This combined with the announcement that software piracy is legal in Russia now perhaps suggests a new front is opening up again in cyber.
- Terry_Roll 5y agoIf the BBC World Service hasnt taught people a thing or two (winning hearts and minds through propaganda), what will? Its interesting that some tech firms are jumping on this, there isnt that much data sharing going on between tech firms, I know of email domains which will not work on some webforms or websites, but I think Europes higher levels of privacy and anti surveillance will be a disadvantage at this time.
- mvc 5y agoYep. Definitely lawyers (specifically those involved in high value transactions) are targeted. All you need to do is convince one of their customers that you are speaking on behalf of the lawyer and get them to send the money to you instead. I know this because I've been a victim of this attack. Not sure how you'd monetize patient/doctor communications in the same way but I'm sure someone could think of something.
- ChuckNorris89 5y ago>All you need to do is convince one of their customers that you are speaking on behalf of the lawyer and get them to send the money to you instead. I know this because I've been a victim of this attack. IIRC, there was a guy who was sending letters to the finance department of big tech companies and was claiming to be the CEO and that they had to make various payments to his accounts, and they were paying him without anyone at the company questioning this. He got away with millions before getting caught and he wasn't part of some crime group but some random guy sending letters from home, lol. Maybe people should be trained in snail mail phishing detection too.
- scoofy 5y agoHN has been awkwardly silent on the ongoing conflict. I'll be curious to see where the discussion leads when the conflict starts escalating in the info/itsec areas. I read the Nicole Perlroth's book this year, and I'm not excited about this at all.
- chockchocschoir 5y agoIt has already escalated a lot in terms of "cyberwar" or whatever people call it nowadays. Ukrainian infrastructure is under heavy attack from Russia and Russia is under heavy attack from volunteers from literally ever single country in the world, so heavy that Russia is now cutting off the rest of the internet because they can't handle the attacks.
- trhway 5y agoAccording to Ukrainian TV US cybercommand in Europe is actively engaged in fighting Russian cyberattacks on Ukraine.
- astrange 5y agoThat sounds a bit fanciful because how do you "actively fight cyberattacks"? It's all attack and no defense - even the passive defense is attack (via red teaming).
- madrox 5y agoI don't think it's awkward silence...there's just very little so far that meets HN's guidelines for on-topic: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html It was on the frontpage the other day when Elon Musk gave UKR access to Starlink.
- albybisy 5y agoso for HN users is more important Elon Mask than ....
- 5y ago
- cheeze 5y agoMaybe it's just me but these seem rather... tame? Phishing campaigns? I'd assume those happen year round, war or not. Am I wrong here? Missing something?
- chockchocschoir 5y agoSince Google doesn't really own much infrastructure outside of the US, I don't think Google can do much, and maybe doesn't even have that much insight on what is going through the pipes elsewhere. There is a lot more things happening that just phishing attacks though, from both sides. While Russia is attacking Ukrainian IT-infrastructure, Russian IT-infrastructure is getting hit by every other country at the moment.
- slig 5y ago>and maybe doesn't even have that much insight on what is going through the pipes elsewhere. Chrome and their DNS can be used for that.
- usr1106 5y ago> Since Google doesn't really own much infrastructure outside of the US What is that claim based on? I think they have alot of presence here in Europe. I doubt it would be economically to transfer too much data over the atlantic. Think of every Youtube video that is being watched. However, for services requiring central storage longer like e.g. email, I have no idea. I am not sure whether mailboxes have a home region. Disclaimer: No insider knowledge here. Just what Iremember from tracouting years ago and trying to apply some common sense.
- achernya 5y agohttps://peering.google.com/#/infrastructure https://peering.google.com/#/infrastructure has maps of Google CDN infrastructure. (work at Google, and on the CDN)
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- benatkin 5y agoA few days ago there was another post about Google and Ukraine. I took another look at it and found an update that I hadn't seen until now: https://news.ycombinator.com/item?id=30528022 https://news.ycombinator.com/item?id=30528022 The author of the post, which was about marks on Google Maps, determined that the marks were innocuous.
- twelvechairs 5y agoIs it not worrying that this kind of response is left to Google? They are not a benevolent actor but a business who ultimately only does things to improve their own bottom line and their reach over the internet. [edit: I'd appreciate a response if you are going to downvote as is being done to me]
- deleted 5y ago[deleted]
- vinkelhake 5y agoThe question you ask is valid. If I were to guess (I didn't downvote you), it's because of your second sentence. It hints that you're thinking about it in a zero-sum kind of way. Google benefits from a healthy and secure web. This means they are going to engage in projects that aren't directly tied to what they do, like letsencrypt, Project Zero and TAG.
- rossdavidh 5y agoYou have a point, but I recall that when WW2 started many car companies started making tanks, etc, and mostly for the same reason: a specialized skill set that the government simply didn't have the capacity to meet at that time. The unmet need for IT security related work in government is vast.
- KarlKemp 5y agoThere is absolutely no way that Google will derive direct financial benefits from defending some Ukrainian journalism project from DDOS attacks. So it should be obvious that your assumptions about their motivation is wrong. Yes, maybe their actions will garner some sympathy among the public. But that mechanism is so generic, it just leads to the same conclusion, i. e. that companies are capable, interested, and legally free to act in the public interest.
- dragonwriter 5y ago> Is it not worrying that this kind of response is left to Google? What do you mean “left to” (or “response” for that matter)? Google chooses to do report this information (which is a mix of info gathered from other sources and it's own work to protect it's own critical infrastructure), no one leaves it to them. The government does it's own publication of extensive cybersecurity information of this type, too; see, generally: https://www.cisa.gov/uscert/ncas https://www.cisa.gov/uscert/ncas
- deleted 5y ago[deleted]
- natch 5y agoGoogle flags its own generated emails sent from itself to its gmail users as phishing emails. I am not making this up. Think about that.
- CobrastanJorji 5y agoThe occasional disconnect there isn't surprising at all. Whichever group at Google works on anti-phishing attacks probably has rules like "does it say it's coming from Google, does it look like a Google email, is there a picture of a Google logo, does it talk about your account, did a whole bunch of emails that look just like this one just get sent to a bunch of gmail users," etc. Legitimate emails from Google trip pretty much all of those alarms, and it makes a lot of sense to lean on the side of "phishing warning" if you're not sure. Plus, those teams are probably pretty far from each other on a big corporate organizational tree. Seems like a very reasonable sort of mistake to make.
- natch 5y agoThe teams don’t need to be close. The anti-phishing team is just not doing its job.
- creato 5y agoOr maybe parts of google are sending emails that look too much like phishing. It wouldn’t be the first time my personal phishing meter triggered on some corporate emails.
- natch 5y agoThey have been sending them for around 20 years. It's not like these are new emails. The phishing team has been flagging them for a few years now, not sure how long.
- natch 5y agoWhether it’s reasonable for them to make the mistake or not (see my other replies) the possible detrimental effect of this is summed up by the well-known “boy who cried wolf” story. So it’s a mistake they should fix.
- sydthrowaway 5y agoHow about Google hire these Russian hackers?
- dotancohen 5y agoHow would Google pay them, with the sanctions?
- paganel 5y ago> as well as services like Liveuamap that are designed to help people find information. We expanded eligibility for Project Shield, our free protection against DDoS attacks Really nice that they're doing that. I had noticed Liveuamap giving lots of 5* error codes earlier in the invasion, for obvious reasons, but now it looks like it works pretty well. Again, good job from the people of Google (I usually am very critic about them).
- dayofthedaleks 5y ago'...and that's why we're buying Mandiant.'