Hacker News Reader

Comment by justinv | Hacker News Reader

"by what it believed was a "state-sponsored actor.""

The de facto excuse to use when you get hacked these days. Who could possibly defend against an entire nation? And it's incredibly easy to "prove" that some Russian IP accessed your system at some point, therefore Putin is directly involved and no amount of security would've prevented him from getting in.

Would a hacker who claims unemployment benefits be considered state sponsored?

Truly food for thought...

Sidetracked: Can someone explain to me why there seem to be a culture of blackhat hacking from Russia? Do their CS degrees have mandatory advanced courses on how to exploit vulnerabilities for lulz?

Not really even saying this in a mean way. Almost all top CS programs in the US have assignments on writing buffer overflow attacks and reverse engineering in their mandatory intro to systems course. But I don't seem to see them going off on their own to learn more sophisticated attacks and acutally using it in the real world.

Why does russia seem to foster so many blackhats? Or is it just the proxies that are hosted there?

Maybe it's just that the avails of theft and fraud are not limited by prevailing wages in your area, so are relatively a better deal?

I don't understand what difference it makes if it's state-sponsored or not.

It seems like Yahoo's PR wants to switch focus to state-sponsored hacking and form a narrative around what's been in the news lately as opposed to Yahoo's incompetence.

Also it's less embarrassing to get hacked by a whole nation than a few nerds in their basement.

If you're a human rights activist with a Yahoo account and Russia or China stole these passwords, then your communications have a much higher chances to have been breached and spied upon than if say, a Russian gang got their hands on this and used accounts to spread more ransomware around.

IMO:

State attack = a state steals the access and keep the breach secret for as long as they can [or until they get hacked themselves]. They use it for espionage and similar purposes

Evil bad guy = all accounts and passwords are already available on blackmarket.com since Day+1 after the breach. They'll probably end up in a torrent within the next month.

Evil bad guy sponsored by a state = Well, somewhere between the two. Hopefully the state ensures they get exclusive access and non disclosure.

Once the accounts are for sale on the black market (they are), then the distinction between state and non-state is moot.

Do you have a source? Has it been mentioned that these accounts are afor sale?

> I don't understand what difference it makes if it's state-sponsored or not.

> Also it's less embarrassing to get hacked by a whole nation than a few nerds in their basement.

Seems like you understand just fine.

A state sponsored attacker has some (easy) possibilities that are normally out of the league of a normal attacker.

Like showing up on the doorstep of a CA and asking them to issue forged SSL certificates.

This was relevant for the pinning bug that was just fixed in Firefox 49: normal users shouldn't care about it, but it's very dangerous for Tor users.

Reply on news.ycombinator.com