Comment by EthanHeilman | Hacker News Reader

Comment by EthanHeilman | Hacker News Reader

Parent Full thread

The report just didn't get into that much detail but they did say:

"the code delivers Remote Access Tools (RATs) and evades detection using a range of techniques."

A "range of techniques" includes things like rootkits.

>No rootkits,

The attackers did use stealthy persistence techniques often called 'rootkits".

"the SeaDaddy implant developed in Python and compiled with py2exe and another Powershell backdoor with persistence accomplished via Windows Management Instrumentation (WMI) system,[..] The Powershell backdoor is ingenious in its simplicity and power" [0]

>no 0 days

The same group used six 0-days in 2015. Either they didn't need to use them in this attack or they used them and deleted the evidence. Senit is APT28 see quote below:

"One of the striking characteristics of the Sednit group is its ability to come up with brand-new 0-day vulnerabilities regularly. In 2015, the group exploited no fewer than six 0-day vulnerabilities" [1]

>yet it was the most routine, simple attack conceivable.

The attack involved multiple pieces of custom written software and carefully researched spearfishing, the attackers spent time and effort to hide their tracks, maintain persistence and exfil data without detection. This level of effort and time does not qualify as routine, some intelligence agencies can't even write their own RATs.

[0]: https://www.crowdstrike.com/blog/bears-midst-intrusion-democ...

[1]: http://www.welivesecurity.com/wp-content/uploads/2016/10/ese...

Can't one just buy a RAT?

Also, the WMI think they describe doesn't look like rootkit, more like cron analogue for Windows. I.e. on Unix it would be like installing a command inside crontab. That's not what is usually called a rootkit - a tool that is designed to conceals its presence (and other tools presence) from regular OS tools.

You can buy RATs. The several RATs used in this campaign were never for sale.

For example the RAT named X-Agent was one of several used in the DNC hack. It has never been put up for sale and it was used in previous Russian intelligence operations (for example tracking Ukraine artillery[0]).

>That's not what is usually called a rootkit

It doesn't appear that anyone has reverse engineered the PC version of X-Agent but the android variant (which may be very different from the one used in the DNC hack) does take some steps to hide itself. Granted nothing suggests anything like kernel syscall hooking but those sorts of rootkit techniques are overrated because they leave obvious and detectable patterns of compromise.

[0]: https://blog.trendmicro.com/trendlabs-security-intelligence/...

So essentially someone hacked the DNC, and it's "advanced" because some custom software was written just for this particular target ?

I've written custom software (which was a lot harder to find than some python WMI hooks) for hacking a lot lower profile organisations. I've consulted for organisations that were hacked by Chinese hackers for bitcoin ransom that had custom software written too. I mean, high profile target, more effort can be expected. It does not mean the government is involved (although a lot of hacking groups seem to have government sidelines in China, though it does not appear to be their primary activity. I mean unless the Chinese government is itself into bitcoin ransoming).

But more seriously, if a component of our government that is this central to our democracy can be hacked by sending emails "open this exe", then ... I mean seriously. Sorry to say, but if that works, you deserve what happens. Is this really the level of competency in the people that are currently organising the government ?

Also the main thing this report does is validate that the information leaked to the press is indeed true (I figured as much, I mean why put so much effort into fighting fake news unless the real target information is not fake ?).

So Hillary and the DNC is in fact in the pocket of wall street. She DID use the DNC organisation to sabotage Bernie Sanders. There are in fact foreign donors to Hillary and the DNC that are illegal under rules that Hillary's government department is supposed to enforce ... this report mostly confirms that this is indeed the view that the top of the DNC has.

> Is this really the level of competency in the people that are currently organizing the government ?

  Garrett Graff 
  ... Hillary seems to actually be a very persnickety technology user. She is 
  not very comfortable with most technology, only liked to use a BlackBerry and,
  more specifically, only liked to use a specific type of increasingly older and
  more out-of-date BlackBerry.

  She doesn't know how to use a desktop computer. She--

  Sean Cole 
  Wait, wait, wait. Back up. Back up. She doesn't know how to use a
  desktop computer.

  Garrett Graff 
  Hillary Clinton, the Democratic presidential nominee in 2016,
  does not know how to use a desktop computer, according to multiple sources
  interviewed by the FBI.

  Sean Cole 
  How is that possible?

  Garrett Graff 
  The short answer is, I don't know...

https://www.thisamericanlife.org/radio-archives/episode/601/...

Let's keep the discussion to the technical aspects of the attack. The democrat vs republican antagonism doesn't belong on hacker news.

Then hacker news doesn't belong in human company.

The sophistication is not evidence of government involvement, the lack of sophistication is not evidence that a government was not involved.

Certainly malware which costs serious resources to develop, like stuxnet, says something about the capabilities of the attacker. Given that at the high end of the resource spectrum it is mostly governments, resources required are suggestive of a government, but resources are not conclusive in and of themselves.

The attribution of the DNC hack to APT28 and APT29 was not based on its sophistication but on the similarity to the methods used, tradecraft fingerprints, and the sharing of C&C servers to past attacks.

Apparently John McAfee disagrees with you:

https://www.youtube.com/watch?v=aDTKKmBjlwE#t=5m40s

Watched, didn't hear anything that contradicts what I wrote. Can you be more specific?

The closest I can find is when McAfee says: "If it looks like the Russians it isn't the Russians." I said "It looks like the Russians." These statements don't contradict each other.

We do disagree on attribution, but I haven't discussed that in this thread. He is radically skeptical about ever attributing any state sponsored hacking, although in the same interview he does attribute Stuxnet to the US/Israel and the OPM hack to China.

Just to add to this, Crowdstrike is on the DNC's payroll. Any conclusions they provide should either be met with skepticism or discredited to a degree.

The Crowdstrike co-founder and CTO is also a Senior Fellow at a think tank that seems particularly giddy about the new Cold War: http://www.atlanticcouncil.org/about/experts/list/dmitri-alp...

Reply on news.ycombinator.com