Hacker News Reader

Comment by dominotw | Hacker News Reader

>In spring 2016, APT28 compromised the same political party, again via targeted spearphishing.

I think I might have missed it, but how did they conclude that it was 'APT28' ?

> APT28 is known for leveraging domains that closely mimic those of targeted organizations and tricking potential victims into entering legitimate credentials. APT28 actors relied heavily on shortened URLs in their spearphishing email campaigns.

Aren't these standard phishing 101 techniques. What makes them specific to 'APT28'. This 'report' looks like someone googled 'phishing 101' and 'web security 101' and copy pasted bunch of stuff from wikipedia.

View on HN

An intelligence agency won't declassify how they determined who it was. That would compromise their ability to use the same method (informant, vulnerability, etc) in the future.

They are standard techniques. It doesn't say they are unique. Just that this hacker relies on these specific standard techniques as opposed to other ones.

>An intelligence agency won't declassify how they determined who it was.

Yeah, just like a weapon of mass destruction in Iraq. We can't tell how we got this information, but we know for sure. Then few years later it turns out there is no WMD found. Ooops. Sorry.

Give me a reason to trust them again?

>Give me a reason to trust them again?

you are supposed to elect people who you trust to make these decisions. we don't have direct democracy.

> Give me a reason to trust them again?

There is not a good reason to do so. The trust has been broken and we should consider them corrupt if not overtly adversarial to the democratic process.

No officials took responsibility for the excesses revealed by Snowden, or promised any sort of remediation. Such smugness in the abuse of power is a very scary thing.

You clearly don't understand the intelligence process if this is your critique.

First, the people making the DNC hack report are not the same as the analysts who worked on Iraq. The IC is not a monolith.

Second, the Bush White House saw the intelligence they wanted to see.

Third, burning sources and methods is a very real concern in intelligence gathering. That reality can't be ignored no matter how much you want information to be free and open.

You don't have to trust the IC. In fact you probably shouldn't take what they say at face value. But there are very good reasons for why they operate the way they do.

> But there are very good reasons for why they operate the way they do.

Indeed there are, and no reasonable person would say that having intelligence agencies is a bad thing.

The issue in this case is that the US intelligence agencies have been leveraged politically to help convince the public to support various policies, when in fact there has not been credible evidence.

A lot of people put their lives on the line to end the cold war, and now we have a faction of US politicians who are trying very hard to galvanize the same historic antagonism. We should be judicious and skeptical, and not let them use the common technique of fake urgency to drive a big decision without adequate forethought.

I'm addressing the poor thesis that "the IC has been (deliberately) wrong before, therefore they can't be trusted without an undefined amount of evidence."

The points you raise are good and worth discussing, but unrelated to what I was talking about.

Why trust them in the first place, look at the evidence and if you disagree with a conclusion, be able to say why.

This is the whole problem we're dealing with right now - people just decide they do or do not trust something. Don't agree with a fact check? Just call it bogus and move on, even though it might be a 50 point case they make why bother finding a flaw in their reasoning and using that to refute their conclusion when you can just be a cynic and shrug it off. Don't agree with climate change? Just pick the 1 totally debunked study that supports your case and ignore the 1000 that don't that haven't been debunked.

So I ask, in the analyses that have come out (not just this one), what do you disagree with? As far back as June crowdstrike released a report [1], I assume you went through it in detail and can point to flaws in its reasoning as well?

[1] https://www.crowdstrike.com/blog/bears-midst-intrusion-democ...

The basic flaws I'd mention are:

- Multiple state actors (or well-funded non-state actors) likely compromised the emails.

- A state actor could also have faked the "trail" that points to Russia.

- The rest of the evidence is circumstantial.

Sure, if we pretend we live in a pre-stuxnet, script kiddie sort of world, this was likely a high level state sponsored attack, but it seems preposterous that a state actor would be so sloppy:

If you were Putin wishing to try to use spearfishing to get access to specific accounts, you would not source that work to groups that were known to work with your government. You'd set up a fake Nigerian operation so that if found it would look like the email address had been randomly chosen from a list of many used by some Nigerian person to try to scam a few thousand dollars.

This is not akin to thinking three or four moves ahead, it's simply thinking one move ahead.

This is my issue with it. I know I can pull this off without getting caught, hell half the people here can, why can't a Russian super hacker team?

Exactly, it could just as easily be China making it look like Russia did it...

Yea, This made me think of chinese black pr groups too.

Hillary was not liked in china or korea.

> Why trust them in the first place, look at the evidence and if you disagree with a conclusion, be able to say why.

They never even claim that the evidence they show would lead to the conclusions they assert. What they claim is that there's other information that they can't tell you that would lead to their conclusions, and then they release documents like this so interests who have an interest in supporting their conclusions have something to cite.

They're explicitly asking you to trust them, and offering no evidence.

When climate change scientists who operate within an opaque government agency start telling me that the evidence for climate change is too secret for me to see, I'll become a climate change skeptic, too.

It's certainly possible that intelligence agencies are mistaken or deliberately lying. We can't possibly know if that's the best interpretation of the evidence they may or may not have. They have been correct in the past as well.

The best and only thing the average citizen can really do is try to put people in office who can intelligently parse classified information and evidence from intelligence agencies.

Cheney literally made up an intelligence agency to tell him what he wanted, after the CIA said there was no evidence of WMD. If you blame the CIA for that, you very mistaken.

Do you mean the https://en.wikipedia.org/wiki/Office_of_Special_Plans ?

I'm an ex Army bomb technician, let me help you. You know WMDs were found in Iraq right? ..Unless we're not calling stockpiled chemical weapons WMDs anymore.

http://www.nytimes.com/interactive/2014/10/14/world/middleea...

This does not increase my confidence or trust in abstract assurances from intelligence agencies.

> In five of six incidents in which troops were wounded by chemical agents, the munitions appeared to have been designed in the United States, manufactured in Europe and filled in chemical agent production lines built in Iraq by Western companies.

I understand why that might superficially decrease you trust in the claims, but consider the perspective of the totalitarian trying to spin up a chemical weapons program. Wouldn't leveraging existing expertise and contractors be a good way to get the weapons you wanted? Why wouldn't a dictator hire outsiders to build weapons?

Having his experts check them for traps after the construction sounds much cheaper than building his own design teams.

We knew that Iraq had WMDs because a number of western countries sold them some a few decades ago to drop on Iran on our behalf. That's not a secret, and if I recall correctly they were tightly secured and probably degraded to the point of ineffectiveness by that point. The claim that justified invasion was that they had new chemical weapons programs, and that seems to be categorically untrue and without evidence.

It's not that simple. Saddam was trying to make it look to his neighbors (especially Iran) that he had WMDs. Recall that this is very shortly after the end of the decade-long Iran-Iraq war. He wanted to be very convincing, so as to make his neighbors unwilling to oppose him.

At the same time, he was telling the US, "Who, me? I don't have any WMDs." Which made him look like a two-faced liar. The "evidence" that he wanted his neighbors to see convinced Washington.

I'm thinking at worst our intelligence agencies were intentionally looking the other way during a time period when Saddam was in favor with the US - and at best they missed it and did not stop the weapon assembly at the time...

Except we spy on our allies too.

I do think someone was "looking the other way", but I don't think it was our spy agencies.

Earlier news reports said they came to that conclusion by comparing the RAT artifacts on the compromised machines.

ETA: Also, the bit.ly URLs used in the phishing attacks indicated sharing of resources with other APT28 hacks.

http://motherboard.vice.com/read/how-hackers-broke-into-john...

It's not the bit.ly URLs, but allegedly the domain they pointed to, though they don't show us any other links to it.

For reference, this is the Podesta phishing email: https://wikileaks.org/podesta-emails/emailid/34899

And this is the stats page for the bit.ly link in that email: https://bitly.com/1PibSU0+

That report is due in january.

Reply on news.ycombinator.com