5 ms·

Any guesses for best possible interpretion? The Russians have infiltrated their PCs with keyloggers and DOGE are working from insecure open networks. The worst

Any guesses for best possible interpretion? The Russians have infiltrated their PCs with keyloggers and DOGE are working from insecure open networks. The worst possible interpretation is straightforward - they are working for the Russians as agents and let the Russians in or installed the keyloggers for Russia.

0cf8612b2e1e 2y ago
I would have thought that a Russian state sponsored attack would trivially mask the IP to originate from within the USA. This is just brazen.
- avs733 2y ago
  Sometimes getting caught isn’t a bad thing. If you are trying to seed division between to groups, acting in a way that divides them - e.g., getting caught helping one side - is more effective than what you gain by not getting caught. I struggle to see what Russia would gain with nlrb data, but getting caught “helping doge” furthers distrust between the two sides of our country - which is something they gain from
  - Braxton1980 2y ago
    Why would the Russians do this when Trump won the election. Isn't that the best outcome for them related to Ukraine? >furthers distrust between the two sides of our country - which is something they gain from How?
    - avs733 2y ago
      The best outcome for them and other potential powerful forces is an America so roiled by internal conflict that it can’t now or ever do anything. Yeah Trump winning seems to help them in Ukraine but their need is disruption as much as different policy in the longer term.
      - Braxton1980 2y ago
        While I'm just guessing I'd think it would be better to wait until Ukraine is done and trump is out of office. Creating mistrust in Doge only helps Democrats
        deleted 2y ago
        [deleted]
        avs733 2y ago
        No, the two sides live in different information spheres. This story will percolate up to many democrats who will be furious that Russia is “helping” “doge”. Separately, it won’t (or will be dismissed as “overreacting” or “lying”) by republicans. They will see the democrats as overreacting and having trump derangement syndrome. Meanwhile, the next doge encounter with an agency now brings greater fear of illicit acts for internal IT people and more controls for doge to demand are turned off creating more conflict within government function. The sides believe in the evil and stupidity of the other will be further ossified. Meanwhile, Russia is effectively able to do espionage in a way where getting caught doesn’t diminish the value of the espionage work they are engaged in.
        lobsterthief 2y ago
        This is a great take but please don’t even dignify “trump derangement syndrome” by using it in conversation like this. That’s exactly what the people who created the term wanted it to be used for, ironically sowing further division.
  - JumpCrisscross 2y ago
    > struggle to see what Russia would gain with nlrb data A list of whistleblowers at American companies who presumably don't want said companies to know the details of their work.
    - avs733 2y ago
      That is a good observation
- kenjackson 2y ago
  May not be state sponsored. Could just be a Russian hacking group associated with the DOGE person. Or it could be state sponsored and they didn’t think they needed to be covert as they could walk through the front door on invitation of the executive branch.
  - delusional 2y ago
    There's also a chance Musk just hired a Russian citizen to work for him.
barbazoo 2y ago
Best case scenario those kids were duped into giving out credentials to the wrong (Russian) people.
tenpies 2y ago
Don't forget the third option: false flag. The objective may not have been to obtain access or any useful data. The objective may have been to get the scary headlines about Russians and use the existing media and political agitprop to further destabilize the government you seek to color revolution away.
- lukev 2y ago
  I don't follow. Are you saying the DOGE boys are trying to give Trump bad press?
  - 9283409232 2y ago
    The theory I'm seeing is that they are creating an excuse to try to drum up public support for expanding use of AI in government under the guise of security. You already have people in this very thread and every DOGE thread playing Elon's advocate. Give them a vague reason like security and I'm sure they'll be onboard with no questions asked.
    - Braxton1980 2y ago
      Has anyone suggested AI as a replacement? Why does it increase support for AI in government?
    - santoshalper 2y ago
      That is a really dumb theory, and I'm pretty sure you just made it up.
- DrillShopper 2y ago
  It doesn't make sense to me that an administration that by and large has been throating Putin would do that to throw more shade on Russia. I'm not saying they didn't do that, just that it's not in line with their support for Putin and Russia. Maybe as a false flag it give Putin the cover to crack down on hacking groups that don't throat him.
CSMastermind 2y ago
Spearfishing then some kind of spyware on the system would be my guess. Though with nation state actors you can't rule out Pegasus like zero-click infiltrations.
pontus 2y ago
Isn't it just that the IP router happens to use IPs in Russia as part of the rotation? If they're trying to exfiltrate data, they might want to rotate through IP addresses in order to obfuscate what's going on or otherwise circumvent restrictions. Using a simple ip rotator like the post talks about would maybe be an approach they'd use. If they're not careful with the IP addresses, once in a while one might get caught due to some restriction like being outside the US. It'd maybe appear as though you're getting these weird requests from Russia, but that's just because you're not logging the requests that are not being flagged from the US. Maybe I'm reading the post incorrectly though (if so, please correct me!)
- cthalupa 2y ago
  It uses AWS API Gateway. There is not a Russian AWS region.
breadwinner 2y ago
Related: https://infosec.exchange/@briankrebs/114083485241630234 https://infosec.exchange/@briankrebs/114083485241630234 Excerpt: "How much more proof do we need that this administration is completely compromised? There is zero reason for the US to relax any offensive digital actions against Russia. If anything, we should be applying more."
cryptoegorophy 2y ago
How dumb would Russian hackers be to not use some kind of vpn? My friend who lives in Russia says that without vpn he can not access majority of USA sites so he has it always on be default. Something to is not right or these people are very very dumb.
- op00to 2y ago
  They want to be seen. What are you gonna do about it? What jurisdiction do you have over Russian nationals?
JumpCrisscross 2y ago
> guesses for best possible interpretion? The Russians have infiltrated their PCs with keyloggers and DOGE are working from insecure open networks They were accessing Github over the internet from superuser accounts they were presumably also using as their user account. Given the code quality, I doubt their opsec is put together, either.
lucasRW 2y ago
Yeah, like the APT that compromised O365 accounts from US gov entities a year or so ago, using residential proxies to go around Conditional Access Policies..., is now logging in straight from the Kremlin. :D
- op00to 2y ago
  Is there a difference between a year ago and today? Is someone else sitting behind the resolute desk?
  - lucasRW 2y ago
    You didn't get the point. The alleged "Russian login attempts" were blocked by CAPs. Russian state-sponsored actors have showned in the past that they use residential relay boxes to get around that. If you read between the lines of the whistleblower claims, a lot of stuff doesn't add up. I especially like the conclusion that a deathnote was left on his door BEFORE he blew the whistle, and that a drone was hovering over his house.
    - lobsterthief 2y ago
      This adds up perfectly to me. * He could’ve gotten a death note because they suspected he might become a whistleblower, or simply because of what he knew. * This death note could have been the final straw. * Drones fly over my house all the time. If I witnessed what he did and received a death note, I may assign additional significance to it. None of this is implausible at all.
Ukv 2y ago
> Any guesses for best possible interpretion? The Russians have infiltrated their PCs with keyloggers [...] Best possible case I see would be that the whistleblower has made some mistake (or is being intentionally dishonest). Seems plausible for instance that "it appeared they had the correct username and password" based on "our no-out-of-country logins policy activating" could just be a misunderstanding of how/when the policy triggers. Not to say it's the most likely explanation, just the least concerning one. I think less concerning than keyloggers, while still assuming the whistleblower is correct, would be that a DOGE employee was using a VPN/proxy/Tor. Probably not a great idea to have traffic going through a hostile nation state even with encryption, but less bad than keyloggers on their machines stealing and trying credentials within minutes. Definitely concerning though, to be clear - just steelmanning/answering the question of best possible interpretation.

0cf8612b2e1e 2y ago

I would have thought that a Russian state sponsored attack would trivially mask the IP to originate from within the USA. This is just brazen.

avs733 2y ago
Sometimes getting caught isn’t a bad thing. If you are trying to seed division between to groups, acting in a way that divides them - e.g., getting caught helping one side - is more effective than what you gain by not getting caught. I struggle to see what Russia would gain with nlrb data, but getting caught “helping doge” furthers distrust between the two sides of our country - which is something they gain from
- Braxton1980 2y ago
  Why would the Russians do this when Trump won the election. Isn't that the best outcome for them related to Ukraine? >furthers distrust between the two sides of our country - which is something they gain from How?
  - avs733 2y ago
    The best outcome for them and other potential powerful forces is an America so roiled by internal conflict that it can’t now or ever do anything. Yeah Trump winning seems to help them in Ukraine but their need is disruption as much as different policy in the longer term.
    - Braxton1980 2y ago
      While I'm just guessing I'd think it would be better to wait until Ukraine is done and trump is out of office. Creating mistrust in Doge only helps Democrats
      - deleted 2y ago
        [deleted]
      - avs733 2y ago
        No, the two sides live in different information spheres. This story will percolate up to many democrats who will be furious that Russia is “helping” “doge”. Separately, it won’t (or will be dismissed as “overreacting” or “lying”) by republicans. They will see the democrats as overreacting and having trump derangement syndrome. Meanwhile, the next doge encounter with an agency now brings greater fear of illicit acts for internal IT people and more controls for doge to demand are turned off creating more conflict within government function. The sides believe in the evil and stupidity of the other will be further ossified. Meanwhile, Russia is effectively able to do espionage in a way where getting caught doesn’t diminish the value of the espionage work they are engaged in.
        lobsterthief 2y ago
        This is a great take but please don’t even dignify “trump derangement syndrome” by using it in conversation like this. That’s exactly what the people who created the term wanted it to be used for, ironically sowing further division.
- JumpCrisscross 2y ago
  > struggle to see what Russia would gain with nlrb data A list of whistleblowers at American companies who presumably don't want said companies to know the details of their work.
  - avs733 2y ago
    That is a good observation
kenjackson 2y ago
May not be state sponsored. Could just be a Russian hacking group associated with the DOGE person. Or it could be state sponsored and they didn’t think they needed to be covert as they could walk through the front door on invitation of the executive branch.
- delusional 2y ago
  There's also a chance Musk just hired a Russian citizen to work for him.

barbazoo 2y ago

Best case scenario those kids were duped into giving out credentials to the wrong (Russian) people.

tenpies 2y ago

Don't forget the third option: false flag. The objective may not have been to obtain access or any useful data. The objective may have been to get the scary headlines about Russians and use the existing media and political agitprop to further destabilize the government you seek to color revolution away.

lukev 2y ago
I don't follow. Are you saying the DOGE boys are trying to give Trump bad press?
- 9283409232 2y ago
  The theory I'm seeing is that they are creating an excuse to try to drum up public support for expanding use of AI in government under the guise of security. You already have people in this very thread and every DOGE thread playing Elon's advocate. Give them a vague reason like security and I'm sure they'll be onboard with no questions asked.
  - Braxton1980 2y ago
    Has anyone suggested AI as a replacement? Why does it increase support for AI in government?
  - santoshalper 2y ago
    That is a really dumb theory, and I'm pretty sure you just made it up.
DrillShopper 2y ago
It doesn't make sense to me that an administration that by and large has been throating Putin would do that to throw more shade on Russia. I'm not saying they didn't do that, just that it's not in line with their support for Putin and Russia. Maybe as a false flag it give Putin the cover to crack down on hacking groups that don't throat him.

CSMastermind 2y ago

Spearfishing then some kind of spyware on the system would be my guess. Though with nation state actors you can't rule out Pegasus like zero-click infiltrations.

pontus 2y ago

Isn't it just that the IP router happens to use IPs in Russia as part of the rotation? If they're trying to exfiltrate data, they might want to rotate through IP addresses in order to obfuscate what's going on or otherwise circumvent restrictions. Using a simple ip rotator like the post talks about would maybe be an approach they'd use. If they're not careful with the IP addresses, once in a while one might get caught due to some restriction like being outside the US. It'd maybe appear as though you're getting these weird requests from Russia, but that's just because you're not logging the requests that are not being flagged from the US. Maybe I'm reading the post incorrectly though (if so, please correct me!)

cthalupa 2y ago
It uses AWS API Gateway. There is not a Russian AWS region.

breadwinner 2y ago

Related: https://infosec.exchange/@briankrebs/114083485241630234 https://infosec.exchange/@briankrebs/114083485241630234 Excerpt: "How much more proof do we need that this administration is completely compromised? There is zero reason for the US to relax any offensive digital actions against Russia. If anything, we should be applying more."

cryptoegorophy 2y ago

How dumb would Russian hackers be to not use some kind of vpn? My friend who lives in Russia says that without vpn he can not access majority of USA sites so he has it always on be default. Something to is not right or these people are very very dumb.

op00to 2y ago
They want to be seen. What are you gonna do about it? What jurisdiction do you have over Russian nationals?

JumpCrisscross 2y ago

> guesses for best possible interpretion? The Russians have infiltrated their PCs with keyloggers and DOGE are working from insecure open networks They were accessing Github over the internet from superuser accounts they were presumably also using as their user account. Given the code quality, I doubt their opsec is put together, either.

lucasRW 2y ago

Yeah, like the APT that compromised O365 accounts from US gov entities a year or so ago, using residential proxies to go around Conditional Access Policies..., is now logging in straight from the Kremlin. :D

op00to 2y ago
Is there a difference between a year ago and today? Is someone else sitting behind the resolute desk?
- lucasRW 2y ago
  You didn't get the point. The alleged "Russian login attempts" were blocked by CAPs. Russian state-sponsored actors have showned in the past that they use residential relay boxes to get around that. If you read between the lines of the whistleblower claims, a lot of stuff doesn't add up. I especially like the conclusion that a deathnote was left on his door BEFORE he blew the whistle, and that a drone was hovering over his house.
  - lobsterthief 2y ago
    This adds up perfectly to me. * He could’ve gotten a death note because they suspected he might become a whistleblower, or simply because of what he knew. * This death note could have been the final straw. * Drones fly over my house all the time. If I witnessed what he did and received a death note, I may assign additional significance to it. None of this is implausible at all.

Ukv 2y ago

> Any guesses for best possible interpretion? The Russians have infiltrated their PCs with keyloggers [...] Best possible case I see would be that the whistleblower has made some mistake (or is being intentionally dishonest). Seems plausible for instance that "it appeared they had the correct username and password" based on "our no-out-of-country logins policy activating" could just be a misunderstanding of how/when the policy triggers. Not to say it's the most likely explanation, just the least concerning one. I think less concerning than keyloggers, while still assuming the whistleblower is correct, would be that a DOGE employee was using a VPN/proxy/Tor. Probably not a great idea to have traffic going through a hostile nation state even with encryption, but less bad than keyloggers on their machines stealing and trying credentials within minutes. Definitely concerning though, to be clear - just steelmanning/answering the question of best possible interpretation.