6 ms·

CBS confirms reporter Sharyl Attkisson’s computer breached

61 points by rpm4321 13y ago

steven2012 13y ago
Is your computer waking up in the middle of the night a sign that it's being accessed? I've seen this with my laptop often, I have Windows 7, and I didn't think twice about it. Now I'm thinking twice...
- socillion 13y ago
  Windows Update is, I believe, scheduled for 3am by default. If connected to AC, it can wake up your computer to install updates. You can look into this more with the powercfg command (from an Admin console). powercfg -lastwake "Computer waking up" is meaningless without controlling for updates and other factors, including dog/cat/mouse bumping into a mouse cable.
  - epochwolf 13y ago
    If your desk isn't level or if you have a fan on, the mice could move enough to wake the computer. :)
- kunai 13y ago
  It depends. Usually, on any Windows box, random sleep wakeups and unverified internet use is usually a sign of malware or a trojan horse. Running AVG twice can be enough to fix it, but sometimes, they've already penetrated the boot process to execute malicious code without you even knowing it. It's hit me 4 times so far, and this is WITHOUT accessing black hat websites, and WITH protection and startup utilities disabled. It could be TDSS.
tptacek 13y ago
The dumbest script-bound teenagers will appear "sophisticated" to the Washington Post. How you know this attacker wasn't sophisticated: the Washington Post "detected" them. Note: as was pointed out downthread, I'm being sloppy; CBS "detected" them.
- mrschwabe 13y ago
  "forensic analysis revealed an intruder had executed commands that appeared to involve search and [removal] of data. This party also used sophisticated methods to remove all possible indications of unauthorized activity, and alter system times to cause further confusion." Doesn't sound so dumb to me. Specifically removing data and then covering up traces of being there - sounds a little more than a 'script-bound teenager'. And now, in light of NSA/PRISM - we have a good suspect is in a case like this. At the very least, there is grounds here to issue a suponea to the NSA since they should have plenty of data about her internet connection that could help in determining the responsible party.
  - tptacek 13y ago
    You think the forensics capabilities of the Washington Post have a chance of detecting NSA? You think if NSA breaks into a laptop, it would be apparent to a forensics person that they'd "covered up traces of being there"? Teenagers had rootkits that swapped out system libraries to hide processes and binaries back in 1996. The very, very lame teenagers had utmp and wtmp editors to "cover up their traces". It's worth taking a moment to examine your thought processes here. "Now, in light of NSA/PRISM, we have a good suspect"? We clearly do not.
    - hga 13y ago
      Ummm, this is as reported by CBS as reported by whomever they hired to do the forensic analysis. And yes, if "the NSA" were to break in it's possible they might not be able to do it tracelessly. E.g. no one as of yet is suspecting a black bag job.
      - tptacek 13y ago
        We are thus far discussing technical details of an attack that would be easy for a teenager to have carried out in 1999, let alone 2013, and are attributing them to the world's most experienced computer security organization. I think that's happening because it's much more fun to think about NSA breaking into media laptops than it is to think about random Eastern European hackers doing the same, and HN has a profound bias towards whichever narrative is more fun to talk about.
brown9-2 13y ago
How can you detect what commands were run on a laptop by someone months ago? If you assume the OS is Windows, is it normal to even log those?
- kunai 13y ago
  Well, if you're on any arbitrary Unix system with bash installed, just open up a terminal emulator and keep hitting the up arrow key. It should give you a full history of all commands entered. Unfortunately, there's no date tagging to my knowledge, so you'll just have to remember when you entered a command and if you see any anomalies.
  - ben1040 13y ago
    >It should give you a full history of all commands entered. Commands entered by that user, in a shell, assuming the shell's history file wasn't cleared. So maybe you'd get a history of what someone did if they sat down at your computer and typed things while you were away refilling your coffee. Your shell history isn't going to show a trace if someone actually remotely roots your computer and starts executing commands.
    - kunai 13y ago
      If it was done through a root account, then sudo su and accessing a shell history should do the trick, right? Please correct me if I'm wrong.
      - ben1040 13y ago
        It would IF they obtained a root shell and started typing commands into it like they were at the console, and that they didn't just go ahead and delete the history file right afterwards. But if someone's used a privilege escalation method on some vulnerable software and injects code that makes system() calls as the root user, that's not going to show up in root's shell history. Shell history is just a convenience for the user typing things in the shell; it doesn't log everything that goes on in the box as that given user, and isn't an audit trail.
tumblen 13y ago
A couple months ago I turned VNC on quickly, without a password, just to test out an app that turns my iPad into a trackpad for my computer. Of course, forgot to turn off VNC after learning the iPad trackpad wasn't a great solution for me. A couple days later as I was working, my cursor kept getting pulled away from me and I figured there must be some tracking issue with the mouse, not giving it a second thought. I started reading something at my desk and looked up - a tab had been opened in Chrome to some .ru domain name and someone was clicking a 'Pay with PayPal' link on the page. With my PayPal password auto-filled, they would have had easy work of getting into my account to pay a large, arbitrary amount to themselves. Luckily, I caught it just in time. They were so good at keeping control of the mouse that I had to run to unplug my router. Point is, VNC is a really easy vector to gain access to a computer and there are apparently people or bot constantly port scanning everything to find what's unsecured. Was definitely a wake up call for me and I wouldn't be surprised if this is a similar case.
- vardyr 13y ago
  If someone was able to initiate a connection to your desktop behind a router, and you did not manually set up port forwarding, it sounds like you have UPnP enabled. I strongly suggest turning that off. This would not happen behind any home router I know of with UPnP disabled, unless you have malware on the machine.
cientifico 13y ago
I am curious why this information appears now. Is this in reference to Microsoft given exploits to the government? If that is the case, could this problem be solve by installing linux? I am not a linux fan, but the point of the source code being open and review by millions of people starts making me feeling more secure.
- tptacek 13y ago
  Microsoft doesn't give "exploits" to the government. Microsoft doesn't have the in-house expertise to write many of those exploits. It provides information about verified security vulnerabilities (different from exploits) before they're patched, because their patch schedules are elaborate and necessarily create a window of unpatched vulnerability. Microsoft also gives the same information to many commercial vendors, so they can write antivirus and IPS signatures. NSA does not need Microsoft's help to break into computers.
  - temp9251 13y ago
    It seems disingenuous to compare it to the disclosure to commercial vendors when the government is not listed as a MAPP partner. I have no clue what they actually disclose, but I disagree that the issue is so cut and dried.
    - tptacek 13y ago
      Which specific statement did I make that you disagree with? I'm happy to go into more depth.
      - temp9251 13y ago
        Do you know more than I do about Microsoft's disclosures to the US Government (effectively nothing) or is it an educated guess that what they receive is comparable with MAPP?
        tptacek 13y ago
rubbingalcohol 13y ago
This was right around the time when there were numerous other attacks on press and US industry networks by Chinese IP addresses. There's not enough info here to draw any conclusions, but I certainly wouldn't jump on the NSA bandwagon just because they're up in our netz (they probably wouldn't need to compromise her specific computer anyway).

61 points by rpm4321 13y ago

steven2012 13y ago

Is your computer waking up in the middle of the night a sign that it's being accessed? I've seen this with my laptop often, I have Windows 7, and I didn't think twice about it. Now I'm thinking twice...

socillion 13y ago
Windows Update is, I believe, scheduled for 3am by default. If connected to AC, it can wake up your computer to install updates. You can look into this more with the powercfg command (from an Admin console). powercfg -lastwake "Computer waking up" is meaningless without controlling for updates and other factors, including dog/cat/mouse bumping into a mouse cable.
- epochwolf 13y ago
  If your desk isn't level or if you have a fan on, the mice could move enough to wake the computer. :)
kunai 13y ago
It depends. Usually, on any Windows box, random sleep wakeups and unverified internet use is usually a sign of malware or a trojan horse. Running AVG twice can be enough to fix it, but sometimes, they've already penetrated the boot process to execute malicious code without you even knowing it. It's hit me 4 times so far, and this is WITHOUT accessing black hat websites, and WITH protection and startup utilities disabled. It could be TDSS.

tptacek 13y ago

The dumbest script-bound teenagers will appear "sophisticated" to the Washington Post. How you know this attacker wasn't sophisticated: the Washington Post "detected" them. Note: as was pointed out downthread, I'm being sloppy; CBS "detected" them.

mrschwabe 13y ago
"forensic analysis revealed an intruder had executed commands that appeared to involve search and [removal] of data. This party also used sophisticated methods to remove all possible indications of unauthorized activity, and alter system times to cause further confusion." Doesn't sound so dumb to me. Specifically removing data and then covering up traces of being there - sounds a little more than a 'script-bound teenager'. And now, in light of NSA/PRISM - we have a good suspect is in a case like this. At the very least, there is grounds here to issue a suponea to the NSA since they should have plenty of data about her internet connection that could help in determining the responsible party.
- tptacek 13y ago
  You think the forensics capabilities of the Washington Post have a chance of detecting NSA? You think if NSA breaks into a laptop, it would be apparent to a forensics person that they'd "covered up traces of being there"? Teenagers had rootkits that swapped out system libraries to hide processes and binaries back in 1996. The very, very lame teenagers had utmp and wtmp editors to "cover up their traces". It's worth taking a moment to examine your thought processes here. "Now, in light of NSA/PRISM, we have a good suspect"? We clearly do not.
  - hga 13y ago
    Ummm, this is as reported by CBS as reported by whomever they hired to do the forensic analysis. And yes, if "the NSA" were to break in it's possible they might not be able to do it tracelessly. E.g. no one as of yet is suspecting a black bag job.
    - tptacek 13y ago
      We are thus far discussing technical details of an attack that would be easy for a teenager to have carried out in 1999, let alone 2013, and are attributing them to the world's most experienced computer security organization. I think that's happening because it's much more fun to think about NSA breaking into media laptops than it is to think about random Eastern European hackers doing the same, and HN has a profound bias towards whichever narrative is more fun to talk about.

brown9-2 13y ago

How can you detect what commands were run on a laptop by someone months ago? If you assume the OS is Windows, is it normal to even log those?

kunai 13y ago
Well, if you're on any arbitrary Unix system with bash installed, just open up a terminal emulator and keep hitting the up arrow key. It should give you a full history of all commands entered. Unfortunately, there's no date tagging to my knowledge, so you'll just have to remember when you entered a command and if you see any anomalies.
- ben1040 13y ago
  >It should give you a full history of all commands entered. Commands entered by that user, in a shell, assuming the shell's history file wasn't cleared. So maybe you'd get a history of what someone did if they sat down at your computer and typed things while you were away refilling your coffee. Your shell history isn't going to show a trace if someone actually remotely roots your computer and starts executing commands.
  - kunai 13y ago
    If it was done through a root account, then sudo su and accessing a shell history should do the trick, right? Please correct me if I'm wrong.
    - ben1040 13y ago
      It would IF they obtained a root shell and started typing commands into it like they were at the console, and that they didn't just go ahead and delete the history file right afterwards. But if someone's used a privilege escalation method on some vulnerable software and injects code that makes system() calls as the root user, that's not going to show up in root's shell history. Shell history is just a convenience for the user typing things in the shell; it doesn't log everything that goes on in the box as that given user, and isn't an audit trail.

tumblen 13y ago

A couple months ago I turned VNC on quickly, without a password, just to test out an app that turns my iPad into a trackpad for my computer. Of course, forgot to turn off VNC after learning the iPad trackpad wasn't a great solution for me. A couple days later as I was working, my cursor kept getting pulled away from me and I figured there must be some tracking issue with the mouse, not giving it a second thought. I started reading something at my desk and looked up - a tab had been opened in Chrome to some .ru domain name and someone was clicking a 'Pay with PayPal' link on the page. With my PayPal password auto-filled, they would have had easy work of getting into my account to pay a large, arbitrary amount to themselves. Luckily, I caught it just in time. They were so good at keeping control of the mouse that I had to run to unplug my router. Point is, VNC is a really easy vector to gain access to a computer and there are apparently people or bot constantly port scanning everything to find what's unsecured. Was definitely a wake up call for me and I wouldn't be surprised if this is a similar case.

vardyr 13y ago
If someone was able to initiate a connection to your desktop behind a router, and you did not manually set up port forwarding, it sounds like you have UPnP enabled. I strongly suggest turning that off. This would not happen behind any home router I know of with UPnP disabled, unless you have malware on the machine.

cientifico 13y ago

I am curious why this information appears now. Is this in reference to Microsoft given exploits to the government? If that is the case, could this problem be solve by installing linux? I am not a linux fan, but the point of the source code being open and review by millions of people starts making me feeling more secure.

tptacek 13y ago
Microsoft doesn't give "exploits" to the government. Microsoft doesn't have the in-house expertise to write many of those exploits. It provides information about verified security vulnerabilities (different from exploits) before they're patched, because their patch schedules are elaborate and necessarily create a window of unpatched vulnerability. Microsoft also gives the same information to many commercial vendors, so they can write antivirus and IPS signatures. NSA does not need Microsoft's help to break into computers.
- temp9251 13y ago
  It seems disingenuous to compare it to the disclosure to commercial vendors when the government is not listed as a MAPP partner. I have no clue what they actually disclose, but I disagree that the issue is so cut and dried.
  - tptacek 13y ago
    Which specific statement did I make that you disagree with? I'm happy to go into more depth.
    - temp9251 13y ago
      Do you know more than I do about Microsoft's disclosures to the US Government (effectively nothing) or is it an educated guess that what they receive is comparable with MAPP?
      - tptacek 13y ago

rubbingalcohol 13y ago

This was right around the time when there were numerous other attacks on press and US industry networks by Chinese IP addresses. There's not enough info here to draw any conclusions, but I certainly wouldn't jump on the NSA bandwagon just because they're up in our netz (they probably wouldn't need to compromise her specific computer anyway).