Russian hackers penetrated U.S. electricity utility, officials say | Hacker News Reader

Russian hackers penetrated U.S. electricity utility, officials say

washingtonpost.com

117 pointsbrentm117 comments

Last year it was China. This year it is Russia. If hacking were a reason to escalate with a country, then everyone would already be at war with the US, as we have hacked everyone, almost completely and entirely, from before they even boot their NIB routers.

The report is interesting only in that it exposes operational and software weaknesses that should be hardened.

The rest of it, I roll my eyes at the side show and am ever hopeful the US will saber rattle less, and get on with the business of helping Americans prosper.

I hope by that you mean secure our infrastructure from future intrusion.

> I hope by that you mean secure our infrastructure from future intrusion.

Pretty sure, that's what they meant when they said:

> The report is interesting only in that it exposes operational and software weaknesses that should be hardened.

Not sure how else you could read the above paragraph and NOT get "secure our infrastructure from future intrusion."

> saber rattle

Trolls and their bots have turned this phrase into a dog-whistle. Talking about how Putin is a dangerous autocrat? That's sabre rattling. Breaking with long-standing policy vis-à-vis Taiwan to China's chagrin? A bold move.

> everyone would already be at war with the US

The post-Cold War balance of power contradicts this. Provoking a great power makes little sense for obvious reasons.

But Russia and China don't go around enforcing human rights and their morality on other countries. So it's not just superpowers playing their advantage. It's become a recent American diplomatic tradition to push hard on this stuff (externally) where it's convenient.

Not just the state department but Human Rights Watch and similar orgs often push an American agenda, where it often seems to be in coordination with the CIA.

Human rights include electoral freedom yes - but also freedom from unjustified violations of privacy by the state, free media, freedom of speech (silent all-seeing eyes chills people's speech via self-censorship).

That's why there is more of an irony or hypocrisy when America calls out a country like Russia which doesn't do this type of preaching. While simultaneously operating the largest and most effective sigint and hacking operation in the world, along with the rest of the five eyes. Their access goes far beyond what Russia or China could ever do thanks to all of the Internet backbone, mobile companies, and tech companies within their (and UK, Australia, etc) geographic range. Along with the five eyes having wayyy more money to spend on defence. While Russia's economy is the size of Spain.

So let be honest the only reason this charade works is because most people are oblivious to how this all works. It's just complicated "computer stuff". And those that do often rationalize it away as "everyone does it", regardless of unbridled scale - uncomparable in access to anything during the cold war - or the moral agenda being pushed by their countries.

Also the US seems much better at not getting caught (publically). When they do it's 3yr+ old malware, that their adversary was able to play catch up enough to catch, or no longer needed to hide the fact they had it. Old hacks are far less newsworthy and people move on.

The question is how long this one way street will be viable without blowback.

> Not just the state department but Human Rights Watch and s similar orgs often push an American agenda where it often seems in coordination with the CIA.

I would have disagreed with you until I watched the horror of Aleppo unfold quietly on the back pages for months, and then suddenly become breaking news the moment the 'wrong' side started winning.

This seems like a stretch as HRW has been one of the main organizations casting a light on CIA torture: https://www.hrw.org/news/2016/10/03/us-ex-detainees-describe...

Red Cross exposed that not HRW. There was no way they could ignore that after it became public, everyone jumped on that. But without cherry picking the few times they did something, there are far far more times they didn't.

Their politicized role in Syria is a great example. But there are plenty of other times they don't call out the CIA. One example:

> HRW’s accommodation to U.S. policy has also extended to renditions—the illegal practice of kidnapping and transporting suspects around the planet to be interrogated and often tortured in allied countries. In early 2009, when it was reported that the newly elected Obama administration was leaving this program intact, HRW’s then Washington advocacy director Tom Malinowski argued that “under limited circumstances, there is a legitimate place” for renditions, and encouraged patience: “they want to design a system that doesn’t result in people being sent to foreign dungeons to be tortured,” he said, “but designing that system is going to take some time.”

And their connections run deep:

> The advisory committee for HRW’s Americas Division has even boasted the presence of a former Central Intelligence Agency official, Miguel Díaz. According to his State Department biography, Díaz served as a CIA analyst and also provided “oversight of U.S. intelligence activities in Latin America” for the House Permanent Select Committee on Intelligence.9 As of 2012, Díaz focused, as he once did for the CIA, on Central America for the State Department’s DRL—the same bureau now to be supervised by Malinowski.

> One underlying factor for HRW’s general conformity with U.S. policy was clarified on July 8, 2013, when Roth took to Twitter to congratulate his colleague Malinowski on his nomination to be Assistant Secretary of State for Democracy, Human Rights and Labor (DRL). Malinowski was poised to further human rights as a senior-level foreign-policy official for an administration that convenes weekly “Terror Tuesday” meetings. In these meetings, Obama and his staffers deliberate the meting out of extrajudicial drone assassinations around the planet, reportedly working from a secret “kill list” that has included several U.S. citizens and a 17-year-old girl.

> Her HRW biography, the vice chair of HRW’s board of directors, Susan Manilow, describes herself as “a longtime friend to Bill Clinton,” and helped manage his campaign finances. (HRW once signed a letter to Clinton advocating the prosecution of Yugoslav President Slobodan Milosevic for war crimes; HRW made no case for holding Clinton accountable for NATO’s civilian-killing bombings despite concluding that they constituted “violations of international humanitarian law.”).

Etc, etc.

http://nacla.org/news/2014/2/4/hypocrisy-human-rights-watch

Diplomacy is full of compromise and backroom dealing. I'm not naive about that. But it's hard to have an organization this big and influential without being itself compromised by agencies and agendas, without some real outward effort, transparency, and clear separation from the state - which I don't see here at all. Not to mention it having a natural slant from the various board members and financers who are all powerful Americans.

But regardless you can't deny HRW is very slanted to US policy. It's impossible to follow geopolitics in the media without seeing their name constantly pop up in support of attacking Americas current adversaries of the day, in a very narrow way.

And NACLA is soft on the Venezuelan and Bolivian regimes despite all the abuses there.

No organization, institution, or living person meets the internet's standard for consistency. My providing an example is your "cherry-picking." Have a nice evening.

NACLA just conveniently collected examples that I've repeatedly noticed in the media and in books over the years. They're tiny and unknown, so it's not the same. HRW is far bigger and has some real power. They have their hands in everything.

Which conviently backs US policy as if they were some independent 3rd party non profit. It's much more influential that way. Plus they don't have the baggage of acting consistent like the state department usually has to do while NSA/CIA/DoD run wild.

So they are a useful example of being an extension of US policy of exporting morality and human rights - selectively.

Which is my whole original point.

Just because China and Russia do not go around talking about human rights doesn't mean that they are not forcing other views on other countries. Russia is quite busy in eastern europe.

I think that the reason they aren't seen enforcing views on human rights is many of their views aren't compatible with most American/European definitions of human rights.

I am amazed how Europe and US refuse to engage with Saudi Arabia because of Gender apartheid. /s

Not giving aid to Juntas that overthrow democratically elected governments like in Egypt. /s

We engage plenty, we sell them lots of guns, to the tune of $115B under Obama (http://www.reuters.com/article/us-usa-saudi-security-idUSKCN...).

Russia wants a friendly buffer state. They couldn't care less the exact form of government in the Ukraine, as long as it's pro-Russia.

Why? https://en.wikipedia.org/wiki/Enlargement_of_NATO#/media/Fil...

> But Russia and China don't go around enforcing human rights and their morality on other countries.

Russia literally invaded a neighbor two years ago...

This might sound like sophistry, but invading a country is not the same thing as trying to export and enforce a country's own political ideals.

If you just look at a map, NATO has been steadily pushing towards Russia ever since the USSR fell. They have legitimate security concerns and want to have a friendly government on their border, for the simple reason that Russia doesn't trust us.

What they're not doing is dismantling the country and trying to rebuild it from scratch, like the US has been trying in Iraq.

> This might sound like sophistry, but invading a country is not the same thing as trying to export and enforce a country's own political ideals.

It's literally sophistry. Russia's "own political ideals" weren't merely exported to or enforced on Crimea. The region was annexed. It's now has precisely identical "political ideals", being, y'know, part of Russia.

And the whole argument is sort of crazy-specific anyway, given the history of this region[1] has been one of a huge, Russian-led attempt to enforce a single political system on a giant collection of border states.

[1] That, y'know, kind of led to that NATO expansion you're mentioning. Eastern Europe doesn't want to be dominated by the Russians again. Go figure.

Crimea really isn't a great example to hang your hat on, given that the population is majority Russian, was historically part of Russia before the creation of the Soviet Union (1783-1954), and by all accounts, the population wants to be part of Russia.

Like, I'm all for the principle of no border changes through warfare, and we should object to the invasion on those grounds, but this is literally not an example of nation building, more like Putin wanting to take back historically Russian territory.

This is getting Orwellian. America's nation building is unique and special becuase Russia never does that and invading a neighbor is totally a different kind of thing. And Russia is justified in this behavior because it's neighbors don't trust it and are aligning against it because they don't trust Russia due to literally decades of the kind of aggressive Russian nation building that Russia never does.

Your whole thesis only makes sense if you look at the last 9-10 years and ignore the rest of history.

I mean, I seriously doubt the FSB cares about HN or even knows what it is, but if they were to put a plant here to spread propaganda...

You're putting words in my mouth. Of course Russia did 'nation building' post-WW2, and it did it beforehand too. It was called the Russian Empire for a reason. But none of that has anything to do with the present day, for the same reason it's not useful to talk about German nation-building or Japanese nation-building -- like Russia, those regimes were defeated, their ideologies discredited, and their leaders and institutions replaced.

America is unique in how it actively funds and promotes Western political institutions throughout the entire world. There's also no other modern-day parallel to Iraq or Afghanistan, where sovereign nations halfway around the world are invaded, their leadership decapitated wholesale, and Western democratic institutions are built from the ground up -- institutions that have zero cultural history in those places.

I'm not saying what the US is doing good or bad, but facts are facts. Only the US does this because only the US has the power and money to. Russia can barely project power past its own borders; China as well. Even if they wanted to, they couldn't pull off an Iraq.

Also, the US policy establishment has a history of being fooled by its own propaganda and projecting pure ideological motives on its opponents, often to the detriment of its own strategic goals.

For example, Truman and MacArthur's outright dismissal of China's warning to not approach the Yalu river, which brought China into the Korean war -- the US completely misread China's strategic motives, which were to prevent an American troops literally right next to its industrial heartland, and instead thought that China was completely under the USSR's thumb and that the USSR didn't want a war. US bought into its own rhetoric and thought Communist ideology trumped nationalism, a mistake that cost ~20-30k American lives.

Anyway, no matter if you really think the US is right and Russia is the bad guy, the first step is to actually understand your opponent's motives.

But I guess you prefer calling everyone who disagrees with you an FSB plant.

> What they're not doing is dismantling the country and trying to rebuild it from scratch, like the US has been trying in Iraq.

That's true. Other those two wars, they have taken the tack of funding and supporting pro-Putin political parties instead. You can see that throughout Europe. Rather than rebuilding countries with weak institutions, Putin attacks those with decent ones from within.

> NATO has been steadily pushing towards Russia ever since the USSR fell

Yes, as Putin's Russia has become more and more beligerent. It's not as though the Baltics joined just for the sake of more meetings.

> But Russia and China don't go around enforcing human rights and their morality on other countries

Do you have more details on this? Georgia, Ukraine and Syria would be very interested in learning about Russian passivity as far as enforcement of their world views.

So a portion of Ukraine and Syria? What inconsistent values are they forcing on other countries? Which they attack other countries for not doing, but actively fail to follow themselves? I've given examples, I'd like to hear yours...

US actively pushes human rights agendas across China, all of South East asia, Balkans, Latin America, etc, every time they do trade or diplomatic deal. Russia doesn't do this stuff at all AFAIK. They just occasionally demand unquestionable political support in exchange for support or outright annexation. They don't package in morality and human rights like the state department and executive branch of the US does.

Russia and China seem pretty consistent with their immorality. But diseases are just as dangerous when they lurk silently and when the host is in denial they exist internally. And you can't go around playing doctor when you don't follow you're own medical advice. It totally weakens the message. It's easy to dismiss, even if the message is good and moral, it's ineffective.

How is it going to stop Russia from playing dirty in the dark while pretending they are upstanding citizens in light? You don't hire junkies to get junkies to quit drugs.

> What inconsistent values are they forcing on other countries, which they attack other countries for not doing, but actively fail to follow themselves?

The question is kinda convoluted and involves a triple negative, but I'll try - aren't things such as "peace", "protecting human rights", "independent judicial system" and "equality of all people before law and court" some of the values declared by Russia?

> Russia doesn't do this stuff at all AFAIK.

Well, invasion of Crimea was later re-justified as an attempt to protect the rights of the Russian-speaking population (which quickly erased and replaced the previous message of "there were no Russian troops in Crimea"). Any conversations with Baltic countries involve protection of rights of Russian-speaking population within Estonia, Latvia and Lithuania. Russian military bases in Moldova exist to protect the rights of the Russian-speaking population, and 2008 Georgia invasion was justified by human rights agenda as well. Military operation in eastern Ukraine was just a friendly and helpful gesture to help the [perceived] victims whose basic human rights were allegedly violated.

And there's this http://www.rferl.org/a/russia-ethnic-russification-baltics-k...

I don't know, is Russia exporting peace and judicial equality in Crimea, Donetsk, or Syria? Was that a core requirement of their agenda when they intervened? I've never seen it being exported by them but I could be wrong. They seemed to be entirely motivated by preventing western power plays in their regions. I doubt they'd put serious pressure on the new Ukraine republics or Assad if they were acting authoritarian, suppressed political dissent, controlled the media, etc. Last time I checked that was happening in all of those places. Just as it is in Russia.

But if they are doing that earnestly that would be similarily ineffective and damage their credibility. Worst of all you hand then excuse to ignore it, they can point out the hypocrisy and maintain their internal/external polticial support.

That's the main point really. Consistency for consistencies sake it not the goal.

>Provoking a great power makes little sense for obvious reasons.

It makes great sense for an autocratic-esque states. See Iraq (Sadam era), Iran, Russia, ISIS, DPRNK, Lybia, Grenada, Philippines, Al Qaida, Somalia. Instead of looking at your cruel leadership, you can blame all your problems and rally all your citizens against the US.

Even then, it tends to be non-state or revolutionary actors -- or those backed by another (would-be) great power in the case of DPRK.

    > Talking about how Putin is a dangerous autocrat?
    > That's sabre rattling.

Yes, that is indeed sabre rattling.

You should also be unhappy with Obama putting sanctions on Russia because he is unhappy that some dirty laundry on Hillary was released to the voters, even after Assange and many others have assured us that this was an inside leak, not Russia related.

You should be unhappy that Obama has been sabre rattling against Russia for years. There are many who believe that his motivations to topple Assad are to deny Russia it's only warm water port in Tartus, Syria. This would explain why he keeps sending weapons to extremist groups that tell us they're not ISIS affiliated but still end up burning and decapitating people. Obama is already engaged in a proxy war with Russia, which is pretty much the ultimate form of sabre-rattling.

    > he is unhappy that some dirty laundry
    > on Hillary was released to the voters

Even the Ecuadorians were pretty pissed off about it[0], and they seem to have no problem giving the US the finger

    > even after Assange ... have assured us

It's funny, I find Snowden very very credible, but Assange I find not-in-the-least credible. Also I can't find a source for this, just "an associate of" Assange -- this[1] is the best source I could find, and it's ... weird.

    > You should be unhappy that Obama has
    > been sabre rattling against Russia
    > for years

Hrm[2].

[0] http://bigstory.ap.org/article/6f997f97c5f140a29f385ea05f1b6...

[1] http://www.dailymail.co.uk/news/article-4034038/Ex-British-a...

[2] http://www.politifact.com/truth-o-meter/statements/2012/oct/...

    > It's funny, I find Snowden very very credible, but 
    > Assange I find not-in-the-least credible.

That's a shame. Assange has earned your trust by never, once, being shown to have provided incorrect information. If you can cite a single instance where his information was not correct, I am very interested. Until then, he's gone through more hell even then Snowden with nobody able to dispute his releases. What more could he possibly do to earn your trust?

    > Assange has earned your trust
    > by never, once, being shown to
    > have provided incorrect
    > information

I suspect what you mean is "Wikileaks has apparently never released forged documents", which is very very different from "Assange has never provided incorrect information".

Has Putin not invaded Georgia and Ukraine, ordered the killing of journalists, jailed and assassinated political opponents, and deployed his military in support of Assad's genocidal regime? How do you "sabre rattle" against someone who's already charged into battle and killed?

> Has Putin not invaded Georgia

Georgia started that conflict for the record. I don't know the details but Russia retiliated pretty aggressive but they responded.

> and Ukraine,

Annexion of Crima (important seaport, russian majority) and supporting the seperatists in a region that was pro russia even before the the conflict to have a frozen conflict to avoid Ukraine joining NATO... is a bit more complicated than "invading".

> ordered the killing of journalists,

There is no proof (afaik) that Putin did that. There other poeple in Russia with connections to Putin that likely did that through e.g. the ruler of chechnya. There are internal battles in Russian politics (invisible outside of the kremlin)

> jailed and assassinated political opponents,

You mean the other oligarchs? That's not as black and white as western media likes to explain it. I'm not sure if any assassination attempts that can be traced to Putin are reliable documented.

> and deployed his military in support of Assad's genocidal regime?

Quite a simplification of the Syrian conflict, also Russia has it's only warm seaport in Syria. Russias involvement was widely seen as a reaction.

> How do you "sabre rattle" against someone who's already charged into battle and killed?

It's actually complicated and the west, especially the US is not really the good guy in a lot of stories. Putin is also not good. It's strategic game playing while ignoring deaths. On both sides. There is no simple black/white good and bad logic here. It's ugly from all sides.

I wish more people could see this reality. We are willfully blinded by our exceptionalism long before 'an eye for an eye.'

If we replace Mutually Assured Destruction based on nuclear bombs with MAD based on the fact that we can all shut down each other's electrical grids at will, I think the world will be made a lot safer.

That is, as long as the nukes can't be hacked...

In 2006, a paper was widely distributed among policy makers that advocated the idea that the United States could establish "Nuclear Primacy" and could win a nuclear war with Russia if we struck first.

There is an interesting article about this dangerous idea that is permeating Washington here. http://www.zerohedge.com/news/2016-12-30/eric-zuesse-america...

Much like other applications of software it's just a cheaper replacement or at least supplement to what people were doing manually for years or centuries. Katrina Leung prised more secrets out of the FBI using her wiles than China does with hacking.

Everyone is hacking everyone these days and it doesn't seem like things are going to change. I'm not sure why it's become such a big deal in the media these days, governments have been hacking each other's network equipment since the dawn of the internet

Any other reference? The only thing i know is Stuxnet.

The flame malware stuxnet is based on has turned up in several places and is a good place to start. So is the equation group leaks. Those are the two major sources known for info on US/Isreal/five eyes countries. Another interesting thing to look up is the "black rooms" in global datacentres. China and Russia have their own "state" malware as well that goes by various names. Not to leave off North Korea, they do a lot of cyber warfare themselves and have a university apparently dedicated to it.

Basically every major world power has their own secretive hacking groups, malware, and pool of zero day exploits. Hilariously, the best way to find out what your country has got is to look it up from an anti-virus vendor based in another country.

Kaspersky Labs in particular (might be connected to Russian govt but interesting anyways) is a great source to learn about state sanctioned malware besides Russian/Chinese stuff.

The difference is the magnitude. In world war II, people would work months to decode single paragraph messages. Now people work weeks to take over their adversaries entire communication and control systems.

I think we are coming into a very difficult time, where human nature and habit are coming head-to-head with ubiquitous, all-knowing clandestine surveillance. It has patently been too much to ask a 69 year old secretary of state and her aging staff to comprehend the complexity and non-negotiable nature of information security.

>It has patently been too much to ask a 69 year old secretary of state and her aging staff to comprehend the complexity and non-negotiable nature of information security.

You're being ageist.

I didn't intend to come across that way, and I was just editing a last line about how this is a problem of mindset: pride and willful ignorance.

You specifically called out her age and referred to her staff as aged. How is that not explicitly ageist? And what exactly are you referring to?

Her generation of leaders and executives, and the lessons that have served them well throughout their careers, so far, that obviously aren't helping them deal with information security topics.

This seems largely speculative and unsupported. I think a lot of this comes down to "we declassified something where we did X in 1965 and Y in 1972, therefor it's likely we are presently doing A,B,C,D ..."

I think it's fair to accept that we might be capable of A,B,C,D, but unfair to assume it's already happening unless there's actual evidence.

As for "saber rattling," is this where we think this is going? This strikes me as the kind of minor skirmish between the superpowers we've seen for decades, generally intended to shame one another and court global support.

Finally, I would say that critical security issues and intrusions in utilities could become a big impediment to the prosperity of Americans.

How about these cases?

https://en.wikipedia.org/wiki/Cyberwarfare_in_the_United_Sta...

And this list doesn't even include us tapping the German prime minister's phone line. Imagine our reaction if another nation tapped our president's phone line... Absolute double-standard.

I think both sides agree that security is tantamount. However, the disagreement is on whether the solution to cyberwarfare is being more offensive capability or more defensive capability.

I'm sorry if you read that as though we do not engage in hacking at all. That's not what I was saying.

It's "saber rattling" until the foreign power actually causes severe disruption in the systems they hack into (either accidentally or on purpose).

I think that's the point a lot of people don't get. Obama, despite having hacked the world is scared of the same shit happening to the US. He actually feels vulnerable and scared. So he's giving Russians shit for it.

> boot their NIB routers.

This was a new one for me. What is a "NIB router"?

New In Box :-)

hacking is the new terrorism... just another excuse for doing whatever you want... (proof of wrong-doing not required)

Mods, can the title be changed to reflect clarification? It was a laptop owned by the utility - not the actual power grid http://www.burlingtonfreepress.com/story/news/local/vermont/...

Not just that, the title is completely inaccurate. The most relevant part of the articles title, "OFFICIALS SAY" is absent.

Its the difference between:

WMD found in Iraq.

and

WMD found in Iraq, officials say.

Not to nitpick but do you have a source for officials saying that WMD's were found in Iraq? Obviously US officials said that intelligence pointed towards Iraq having them, but I'm not aware of any statements like "we found chemical weapons in _____."

Edit: Based on the downvotes I guess this appeared to be nitpicking, but if we're going to use Iraqi WMD's as the canonical example of why we can't rely on statements from the government, seems like we should make sure we don't change the facts to fit a narrative either.

You are being downvoted because you missed the point. He's not claiming that anyone ever said anything about WMDs. He's just using that as an example.

It's the equivalent of:

UFO seen over AREA 51

and

UFO seen over AREA 51, officials say

It is rabbit hole speak; not you, per se--the downvotes. #vote.

> Not just that, the title is completely inaccurate. The most relevant part of the articles title, "OFFICIALS SAY" is absent.

For what it's worth I copy & pasted the title from Wash Po at time of submission. I had to drop "officials say" because of the space restrictions on the HN submission form.

Ok, we took a shot at it. If anyone suggests a more accurate and neutral title, we can change it again.

The NY grid operator and ConEdison (NYC electric utility) unknowingly had a former KGB spy who had been living under an assumed identity for 40 years on the payroll in CIO/Chief Software Architect roles for many years.

I'm sure there's plenty of similar stories, both human and technological.

https://www.rtoinsider.com/soviet-spy-jack-barsky-nyiso-1505...

Do you have another source for this claim?

Try Google. It was in all of the regional papers. The guy was also interviewed on 60 Minutes. That interview prompted the system operator to issue their "he was in charge of software systems, but had no access to important things like the electric market" statement.

The weird thing was the FBI knew about him and there was a strange quote that he would be more useful being interviewed by them while "living in freedom".

Piles of them just googling his name.

Jack Barsky was profiled on 60 minutes. They interviewed the FBI agents who turned him (or captured or whatever it was exactly that happened).

That seems entirely accidental, though. He was a mostly failed spy, a compromised one to boot, who just got on with his life and happened to work at ConEd. It's not like the KGB planted a spy at the heart of power grid operations just waiting to flip a switch and plunge the Eastern seaboard into darkness.

Grid operators take security pretty seriously. Lots of background checks, etc.

If some dude with established ties to the KGB, living illegally in the country under the identity of a dead infant was able to make it past that, whatever controls are in place have some serious defects.

This guy might have been perfectly fine, but his background should have precluded being in that gig.

Oh no doubt. I just mean the case is an interesting but accidental curiosity rather some intricate John le Carré-style gambit to compromise the US power grid.

I think we violently agree. :)

I did not mean to imply anything other than its very possible for someone with ill intent to get into a role like that.

Yeah and that could have even been him, but it's unlikely the Russians trusted him with anything after he refused to be recalled. Nonetheless, years later, the FBI found catching an actual Soviet 'nelegal' valuable enough to not expose let alone prosecute him. It's an absolutely crazy story.

from the quick read, it looks like a spear phishing attack at the root of it. --- According to the report by the FBI and DHS, the hackers involved in the Russian operation used fraudulent emails that tricked their recipients into revealing passwords. --- This incident should be investigated thoroughly and serious defenses should be put in place. Destabilizing the electric grid like the Kiev incident shouldn't be allowed.

Yeah I'm surprised 2FA isn't the norm with organizations that work with the government or control infrastructure. The idea of just using a password is fairly idiotic. They're too easy speared and cracked.

What's preventing the bad guys from phishing a 2FA token on their fake login page too?

It should make it harder because you have to run the attack based on the user interaction timing, you can't just capture and hold credentials for later.

No doubt, but that's hardly an obstacle for an even moderately sophisticated attacker. I don't know what the magic bullet answer to phishing is, but this ain't it.

Usually 2FA is only at the perimeter where you have legacy or embedded systems.

There's always a way in.

> A code associated with the Russian hacking operation dubbed Grizzly Steppe by the Obama administration has been detected within the system of a Vermont utility, according to U.S. officials.

First question: what is "Grizzly Steppe"? I thought it was the name given to the actions by both APT28 and APT29. Is this article claiming that somehow this campaign is related to the DNC / Podesta campaign? Or just that the malware involved was the same one used there and therefore probably something done by one or the other. And by "a code associated with", I wonder what that means? The Grizzly Steppe document released yesterday included things like "Powershell backdoor" as associations with APT28/29, but that can't be what they mean here, right?

> This week, officials from the Department of Homeland Security, FBI and the Office of the Director of National Intelligence shared the Grizzly Steppe malware code with executives from 16 sectors nationwide, including the financial, utility and transportation industries, a senior administration official said. Vermont utility officials identified the code within their operations and reported it to federal officials Friday, the official said.

So was this the PAS_TOOL_PHP_WEB_KIT Yara signature in the document released yesterday then? Or is there more unreleased info that the FBI and DNI released to those executives?

Of course, going into no detail regarding how difficult it is to reliably attribute attacks based on the form of software.

Also, more statements "anonymous officials" being published through WP. Literally no way to tell if they're just making this up. They could have said "Software attributed by Obama administration to Russian hacking group found on a laptop at a Vermont electrical utility company". But instead, they choose to venture down the most uncharitable and specific line of reasoning.

Only the naive think Russia hasn't owned up many of the largest utilities in the US, and/or that they couldn't significantly disrupt power distribution with the access they've acquired. The US doubtless has the same access to Russia's infrastructure. No matter what message board people think should be the case here, the fact is that this infrastructure is in fact exposed to attackers in a variety of ways.

Hacking attempts are, and will be forever, part of reality. Just as are prostitution or drug abuse. Therefore, they should not be seen as something special, something newsworthy, or even something illegal. (It is the lack of security that results in break-ins, that should.)

>or even something illegal. (It is the lack of security that results in break-ins, that should.)

Wat

Does this mean stealing from people's houses is not only legal if they don't have "proper security", but that the victim should be punished instead?

I think he implies that once you get into the area of international law, what's "illegal" for one party is merely "protecting and advancing national interests" for another.

Moreover, there's no universally accepted third-party authority in charge of decision-making (i.e. your local courts) and enforcement (i.e. your local cops) that any country can appeal to in order to rule something "illegal". And even if there was, it's all based on a system of international agreements, so what's to prevent the aggressor from exiting the treaty anyways?

> according to U.S. officials.

"officials" said iraq has wmd. "officials" have an ambassador's daughter crying in front if congress, telling lies about babies being killed. "officials say" all kinds of shit. "officials" have lost all credibility. and still, "officials" have their "say" in some stupid paper.

edit:

https://en.m.wikipedia.org/wiki/Nayirah_(testimony)

https://youtu.be/LmfVs3WaE9Y

"officials" aren't a single person either.

So name them. No US official will tell classified info on some agency phone, so it is always the opinion of the administration that is being repeated. But papers like WP and NYT allow "officials speaking on the condition of anonymity" to claim any number of things and slander whoever without even the remote possibility of supporting documentation.

It's not even about access, there is no access to be had, just more PR that didn't hit the wire. The only journalist who got classified info from a gov official in the last years was the mistress of Petraeus writing his biography, and even he realized that mere words are useless so helpfully supplied his notebook and docs.

Why? You already know everything about who gets what classified info and what journalist's internal processes look like. Surely you have access to the names of officials who hold public office in the relevant departments and agencies.

you're right. it's a bunch of folks without a spine to stand up straight and oppose lies and question "facts" thereby supporting and carrying forth the myths.

some may fail simply because of bureaucracy but still all of this happens because the majority are desperate sheep.

Are you saying you have reason to believe that Grizzly Steppe code was not used to penetrate the Vermont utility? Or are you just being cynical?

I don't necessarily agree with what GP is saying, but I don't see why we should be trusting people so much so as to require evidence of absence from people who simply doubt what's being said.

GP provides some examples of cases in which trust was mis-placed, which is fine enough for me to have a second-think about this rather than assume it to be true.

I think he's saying that government officials should have absolutely no credibility given their long and nearly perfect track-record of always being wrong. The real tragedy isn't that government officials have no credibility, its that so many Americans fail to grasp this indisputable truth.

Bush misused and misled the public on the little WMD evidence that was had:

"It has become clear that official intelligence was not relied on in making even the most significant national security decisions, that intelligence was misused publicly to justify decisions already made, that damaging ill will developed between [Bush] policymakers and intelligence officers, and that the intelligence community's own work was politicized," Pillar wrote.

http://www.washingtonpost.com/wp-dyn/content/article/2006/02...

Also, Powell: "I'm Not Reading This. This is Bullshit."

http://www.truth-out.org/archive/item/44516:powell-im-not-re...

On top of that, your little talking point, which is endlessly repeated on the internet, makes no sense. So Iraq was sold to the public dishonestly, thus all claims from the government are dishonest, but for some bizarre reason the Russian government is unusually honest and truthful? Come on.

Reasonable minds can agree both governments have proven to be dishonest, although Russia is almost certainly worse.

I think he's just saying he has some skepticism, which is perfectly reasonable.

But he/she is not making a reasonable argument though, they are making a cynical one that doesn't even remotely make room for a rational discussion. This seems to be a scary new norm where people are so frustrated they cannot see the complexity and nuance of the world, its just all crap and crap crap crap. The only think these people seem to trust is everyone lies and you can't trust anything, and when you can convince enough people of this (who will in turn stay home on election day and leave control up to the extremists who will not be) and you can take control, thereby creating a self-fulfilling prophecy.

The thing that scares me about this the most is the attitudes of people I ran into face-to-face registering voters this year. I ran into quite a few people to would make similar statements and the interesting thing was that after a while I could actually predict pretty well how people would respond to being asked if they were registered to vote from a distance. The people who had very cynical responses looked miserable (from a distance, before I talked to them) and likely were miserable (thinking the world is crap and everyone is lying and we're all being spied on and no-one can stop it, etc) and it leads me to believe many of the people who comment on these stories in similar ways are similarly miserable.

The bad-news flood from our overly connected lives I think is starting to have a serious effect on peoples psychology and it is making it harder and harder to have reasonable discourse. In the end at this rate its going to be a small number of news-junkies and academics and a bunch of extremists and the rest of the population will be tuned out as long as there is enough food and distractions available.

He's complaining about the dishonesty and obfuscation of information from a democratically elected government. How can a democracy survive when they don't even know what's really going on?

It's a legitimate gripe, but delivered poorly.

Well, while I don't necessarily agree with the articulation of the top level post, but I agree with the sentiment. And I agree with your remark that the capability of appreciating nuance is fundamental.

What I'd ask for is this: I'd like a standard by which the government claiming "Evidence of X" from some special committee is no longer treated as carte-blanche.

I see no problem with asking for evidence from every such major government claim, and it seems it could have saved us 1.7 trillion dollars and the last two wars if we [as a public, as a country] had practiced this mentality sooner.

1. https://www.google.com/webhp?sourceid=chrome-instant&ion=1&e...

The environment you describe is also how a third party can get traction. It just needs a few charismatic leaders and good marketing to gain traction and a bot army to flood all social networks. :)

Iraq had WMD and used it frequently, like other countries in the region.

well, we never found them.

I think what may be confusing the issue is at what time we're talking about. Given the broad strokes being argued in this thread, it makes it difficult to have a constructive discussion.

There are documented cases of Iraq using chemical weapons while under Saddam's rule. For example:

https://en.wikipedia.org/wiki/Halabja_chemical_attack

For more:

https://en.wikipedia.org/wiki/Iraqi_chemical_weapons_program

Following the 1990 Gulf War, there was a concerted international effort to eliminate Iraq's WMD capabilities.

https://en.wikipedia.org/wiki/Iraq_disarmament_crisis

By 2003, when the coalition invaded Iraq, for all intents and purposes Iraq no longer had WMDs, as reported by the Iraq Survey Group.

concerning halabja let me quote my fellow countryman:

Dieter Backfisch, managing director of West German company Karl Kolb GmbH, was quoted by saying in 1989 that "for people in Germany poison gas is something quite terrible, but this does not worry customers abroad."

i hate all this being discussed and referenced in a one-sided way. as if saddam or putin or others are the only evil.

background on how the west delivers all the groundwork which they then condemn: https://fas.org/nuke/guide/iraq/cw/az120103.html

I agree that it can be difficult to figure out where to limit the scope. On the other hand, figuring out a place to start where you can agree is important, otherwise people are left talking past each other. Trying to clarify a few points being discussed does not mean everything else not mentioned is being ignored or assumed to be justified.

USA and Germany are different countries, not a single "West" country. They were at war not a far time ago.

Germany delivered equipment to produce WMD, USA tried to stop that.

None were found, and the OP's reference to a diplomat's daughter faking testimony is, in fact, real and it did help precipitate a war.

All that said, it has no bearing on the Russian hacking case, which should be viewed in the context of a certainty about Russian hacking capabilities, and of a long history of Putin undermining transatlantic and european unity with all the tools of asymmetric conflict.

it has much bearing because it demonstrates historical precedent. show us _real_ evidence. what specific code was planted by whom exactly and when and how? can you _be sure_ it was person 1? are you sure person 2 didn't impersonate person 1?

Your parent is very likely referring to the US and UK assertions of Iraqi WMDs to justify the 2003 coalition invasion of Iraq.

https://en.wikipedia.org/wiki/Rationale_for_the_Iraq_War#Wea...

Granted, your parent doesn't explicitly state this, but this is generally what's meant when this theme is referred to.

Are you referring to the same time or prior to Iraq WMD disarmament?

https://en.wikipedia.org/wiki/Iraq_disarmament_crisis

I'm referring to same time. There is multiple evidences that Iraq had WMD in 2002, and that they are moved to Syria.

http://www.foxnews.com/story/2006/01/26/exclusive-former-top...

Thanks for clarifying.

Glenn Greenwald eviscerates this WaPo article https://theintercept.com/2016/12/31/russia-hysteria-infects-...

Laptop gets malware - could have come from anywhere Government links malware to russia - no proof ?? War!

(and more then likely turned off voting machines in Clinton's disctricts)

Reply on news.ycombinator.com