Hacker News Reader

Comment by AndrewKemendo | Hacker News Reader

You're ignoring the political context in which it was released.

1. Released the same day as the announcement of formal Russian Sanctions

2. Released the same day US made 35 "diplomats" (aka. known Human Intelligence Officers) Persona Non Grata. Which is a big deal.

This type of document is not intended to "make the case" because we don't do that.

Making a case for something by definition, would reveal sources and methods which we highly guard. It also opens the administration up for scrutiny because there are many pieces which cannot be revealed because of classification - so it's impossibly to fully "make a case."

This type of report does however hint suggestively and point in the direction of support. They just let you put the pieces together.

In fact they don't have to put anything out and most people wouldn't even know to ask (outside of possibly FOIA, which won't go far in these cases).

[1]https://en.wikipedia.org/wiki/Persona_non_grata

View on HN

It appears to confirm what we knew: the DNC's failure to adhere to basic security protocols, which would be enforced in any corporation with more than a couple dozen employees (edit: or not, see eropple's comment below), allowed its systems to be compromised by script kiddies (for political reasons, the USG insists these script kiddies are sponsored by the Russian government, and insists we take them at their word).

This document says the attack would've failed if the DNC had watched out for SQL injection and if DNC staffers had not fallen for a phishing scheme. We're supposed to believe only a nation-state could've conducted these attacks? This is "Baby's First Hack" level stuff.

This only further proves the government's propaganda policy for dealing with prominent cybersecurity breaches: blame it all on a foreign boogieman, as they did in the case of the Sony leak, so that the public doesn't catch on to just how very vulnerable all their electronic data is to practically anyone with the inclination to attempt to steal it.

> which would be enforced in any corporation with more than a couple dozen employees

No they wouldn't, and you are one of the people here who I would say should very well know it. :p

The DNC screwed up, but the overwhelming majority of everybody else screws up to this level or worse on the regular.

Yeah, you are completely right, and I completely agree, as I imply later in the post. Such mistakes are extremely common across the spectrum, at companies large and small alike (remember when American Express accidentally exposed an internal debugging application? [0] :O). Cybersecurity is still very difficult for everyone, and I don't mean to imply any differently.

My quip was meant to emphasize that the security breaches described are basic, and likely could've been blocked if the DNC had, at the time, been following good security practice. Many corporations withstand such attacks routinely (and as you note, many don't).

The penetration of the DNC was not something that required professional-level skill, let alone the resources of a nation-state.

[0] http://www.securityweek.com/amex-developers-leave-debug-tool...

What it really requires is the blind eye (or knowing nod) of a nation state, since with the level of unuttered evidence (and the private orgs named which no one seems to be mentioning here) the idea that "we won't prosecute you if you do this" is the nation-state sophistication here. In the US you'd normally face justice for this, regardless of the locale or the ease of the break-in.

Also the report doesn't say anything about not having your password literally be password!

While the methods used were very simple, I have an opinion why this could be done for some government or political party. The emails and data from a political party are probably very boring stuff, so a typical hacker would not bother to spend a lot of time sending thousands of phishing emails to get access to them. And later he would have to read through them to find some facts the mass media would be interested in. Usually hackers hunt for things like credit card numbers or fame.

Hackers have been targeting boring government docs for as long as there's been hacking, sometimes just for laughs, bragging rights, etc.

If all the docs are boring, isn't that all the more reason to think that a nation state had nothing to do with this?

The NSA would've intercepted your new router in the mail with a backdoor and could've used a TEMPEST van to read your screens from miles away. I have to believe those mighty Russian hackers have figured out comparable tricks by now and aren't reliant on people falling for idiotic phishing scams to get their information.

I mean, they have Snowden, who showed us the NSA's TAO programs... right?

Why bother when it wasn't needed?

They have the motive to do it, as much or more than anyone else and certainly the capacity. They are tied to a disinformation campaigns [1] that seem to have the goal of sowing suspicion between allies who oppose them and have everything to gain by swaying our political process.

That isn't enough evidence of course, but I'm surprised by the suspicion here and I can only chock it up to the increase in cynicism that is partly a result of these very actions. Because the Bush administration managed to finagle the intelligence enough to justify the war in Iraq we can just ignore our intelligence agencies whenever we want, right?

Internal bullshit like what was going on at the DNC is annoying, frustrating and unfortunate but people are falling for the trap hook line and sinker. This happens everywhere, you can damn be sure it was going on at the RNC as well but republicans wouldn't have abandoned their party (at this point its pretty clear nothing can make a fair number of them abandon their party) but independents and some liberals are doing exactly what the hackers want (whoever they turn out to be, likely the Russians): we are getting cynical and despondent. Rather than getting involved and saying we should clean house, its like "well if you didn't suck so much you wouldn't have lost." while doing nothing to make things suck less.

[1] http://www.nytimes.com/2016/08/29/world/europe/russia-sweden...

Because an attack like that gives you short term access which isn't particularly valuable to a nation state. It was quickly found out and stopped.

Exactly this. If it was just a recommendation notice, why release on same day. Plus the thing is titled: "Russian Malicious Cyber Activity"

The Obama administration announced they will release evidence about the hack in "3 weeks". So they will be making the case. It will obviously just be redacted.

Reply on news.ycombinator.com