Hacker News Reader

Comment by tptacek | Hacker News Reader

It is not the argument that the DNC was so secure that only Russia could have owned it up. Literally nobody thinks that. Everyone agrees the DNC's security was comical.

The problem for Russia skeptics is that as easy as it was to own up the DNC, it is in fact very difficult to own it up in a way that points a finger back to Russia, because the "finger" in this case is a collection of IOCs forensically taken from previous attacks that are in most cases known only to law enforcement and to a few very reputable attribution firms.

View on HN

Sabu disagrees, claims the methods and tools are widely shared on the same criminal forums http://searchsecurity.techtarget.com/news/450298715/DNC-hack...

Well if SABU disagrees with Mandiant and CrowdStrike...

Hmm, their claims don't actually necessarily disagree that I can see. One says this RAT is used by Russians, the other says it's available to more than just the government.

If anyone truly wants to refute it, they just have to visit the forums SABU found and figure out if it's the right tool or not.

The RAT(s) used aren't the only IOC here!

True. But if they missed finding one thing that's publicly available, how can we say they missed nothing else? It's a big internet out there. I don't think anyone can say that things are unavailable, only that they haven't seen them.

> are in most cases known only to law enforcement and to a few very reputable attribution firms.

No one in eastern europe knows how to run a honeypot? Or the article is wrong that Russia attacked them? If they are attacking non government computers that doesn't include every candidate's website?

I have no question that Russia has infiltrated these machines and is as interested in manipulating elections as the US is capable, but manipulation through public disclosure of data is not a precedent Russia should want. I think the treatment of Russia is clearly a boogey man response and everyone would know that and know they needed such a deflection, if they were going to mount such a rough shod attack.

Forensics could only deal with a serial killer who collected used condoms to confuse them since he used too many. I have to wonder how many were cleverer and didnt make it into tales of the forensic experts.. Digital forensics can only recognize patterns and know what the chosen style was, which can at most eliminate amatuers that are too low value to attract attacks.

This is an interesting twist on the ninja defense ("I am a ninja, ninjas are undetectable, therefore I could not have done it") where Russia is simultaneously capable of hacking both US political parties without leaving a trace, but so stupid that they fell into some rando's honeypot --- and then the randos subsequently framed them.

We're getting into Calvinball territory here.

? You have strange beliefs about what is easy and what is hard on machines that are setup properly in advance and ones that are not. I could believe that the DoD can occasionally do attributions on attacks into its network. That poorly administered machines attacked over years contain sufficient data to identify that only one perpetrator took data and then which attack they were needs a lead actor like travolta.

(Nowhere did I say Russia attacks without traces, script kiddies just watch ninja films. They are among the tens of thousands of attackers that leave traces of attempts every few minutes. The only inherent advantage state attackers have is that they don't need to monitize so 90% of the ways they should get noticed are gone, leaving them to get noticed more by honeypots than people running machines on the open Internet with no specific plan to detect intrusions.)

I think this is a (rare) case where my beliefs are pretty much entirely within the mainstream of the broader infosec community.

Well it is a shame to see the industry converging on believing the seemingly impossible based on secret evidence when presented by people who have every reason to lie (or build their own overconfidence) about their capabilities. When I worked in infosec the dominant opinion was that anyone with extrodinary claims should be ignored until they presented means of community verification, not just more salesmen who said they can do it too.

Reply on news.ycombinator.com