Russia Hysteria Infects WashPost: False Story About Hacking U.S. Electric Grid

We didn't look at the hashes or using hashing to identify anything. It's quite a story actually:

The report provided a Yara sig for PHP malware. We used that to search our own attack data that we log and we found the full malware sample that matched the sig.

But it was encrypted. It's a small piece of PHP that gets a key from a POST param or COOKIE and decrypts the executable code and runs it. Quite smart actually if you want to obfuscate code. So we needed the key.

We looked at our attack data and thankfully we logged one of the attempts by an attacker to access the malware including their key. It was just 4 lowercase chars so we could have bruteforced it.

We decrypted the malware. That gave us the name and version. We googled that and found the distro site. Claim they're a Ukrainian group and the version DHS has a Yara sig for is several versions behind.

We downloaded it. It's a standard PHP 'shell' malware which means it's just a utility to manage a compromised site. File management, upload, OS info, OS command running etc. Nothing super scary and the most common malware we see. Nothing that would infect a workstation in a watering-hole attack.

Regarding the IPs: No we just did a PTR lookup and assumed they're Tor exit nodes as they say they are.

Mark.

Anyone can download it and check.

There is also a forum thread at https://rdot.org/forum/showthread.php?t=1567 started by this software developer in 2011. He answers the questions from the users of his software and asks them to donate to continue development.

So it is a publicly available software, not a private tool made by some hacker group for themselves. That is why other people could find it in their systems.

We want into Iraq. How do we justify it? We want to keep Trump away from Putin, how do we justify it?

"The Department of Homeland Security and the Federal Bureau of Investigation are releasing declassified technical information on Russian civilian and military intelligence service cyber activity, to help network defenders in the United States and abroad identify, detect, and disrupt Russia’s global campaign of malicious cyber activities."

This suggests it is evidence of Russian activity.

"These actions are not the sum total of our response to Russia’s aggressive activities. We will continue to take a variety of actions at a time and place of our choosing, some of which will not be publicized."

This suggests we're going to be engaging in a classified cyber war with Russia.

Source: https://www.whitehouse.gov/the-press-office/2016/12/29/state...

In the United States the only organization that can legally 'hack back' is the US military, according to the CFAA. So any cyber operation will be a military operation.

I imagine someone was assigned a task to produce some document about how Russians hacked us to justify all the propaganda narrative so far. That person handed it to their subordinate, who handed to their and someone came up with that paper.

It looks technical enough with jargon that someone from the street will see it as proof.

Now an interesting thing to think about is if someone who wrote this understands that this is bullshit and wrote it as such. Those who know what's what will see it too and this was a wink to them. Their superiors though will think this is some solid proof.

Stuxnet happened in a very similar way

The United States went to war in Iraq in 2003 under false pretenses. The cost of that mistake was gigantic, and continues to pile up.

This saber-rattling against Russia could have serious consequences, and seems to be inspired mainly by a need to find some kind of scapegoat on which to blame the DNC's absurd loss against Trump.

I'm glad they're doing this.

I mean if the intelligence community is going to drum up shoddy evidence that could potentially lead to war, I'd sure hope the media would spend an inordinate amount of time trying to combat it.

Too late. I already saw a news segment about Russia hacking US power plants on mainstream Italian TV. There will be no retraction here and the disinformation is already in the public consciousness.

I don't know where people get the idea that it is some unbelievable stretch of the imagination that Russia would hack the DNC. The only surprising thing to me is that the frickin' DNC was not ready and expecting them to.

Thissss. I'm so sick and tired of the hypocrisy. If there was a "Chinese snowden" who leaked that China was doing the same stuff we where it would start a war. If Russia or China started building military bases through out the world for "democracy" we would loose our shit.

Why are we surprised when other world powers follow our example and try to hack the shit out anything they can get their hands on. Can't we be grown ups about this? It's a total double stAndard. We mess with so many elections around the world, and cry foul when someone does it to us.

Don't get me wrong, I understand why we do it, and sometimes agree with it. I feel like it stems from almost a prehistoric primitive tribal instinct - I live if my tribe lives, and to do that we have to control the other tribes.

By all means continue to dominate other countries, but PLEASE STOP USING THE MORAL SUPERIORITY CARD.

I don't think that is a very good argument. If you were to look through the email of most middle-sized organisations you would be able to find embarrassing things.

[0] To within experimental error.

It's much more likely that they know they can publish something fake, get the desired public impact, and then retract it and retain credibility.

The Washington Post is not a "higher quality publication".

The agents and officers they actually care about, they (and we) rarely touch. It's better if they think their cover is intact.

Yes Mr inspector the poor lads though they where being burglarised and as "drink had been taken" they got a bit boisterous

Their opinion pieces can have a bit more "free thinking", definitely, but they are always marked as opinion.

1. Select an arbitrary NFL game being played in the first week of season.

2. Email a sufficiently large ( > 131,072) group of people, telling half of them that Team A will win. Tell the other half people that team B will win.

3. The game will necessarily yield a loser. (To account for ties, tell your audience team N will not lose, instead of will win)

4. The emailed people who received the correct prediction become the remaining pool, and those that received the incorrect prediction are no longer involved in this exercise.

5. Repeat steps 1-4 for the first 16 of the 17 weeks of the NFL season, always retaining the half of the pool who received the correct prediction.

6. After the 16th game, since you started with a sufficiently large pool, you will have sent the correct predictions for all 16 games to a nonzero number of people.

7. This nonzero number of people, if they have paid attention, will be forced to believe that you can predict the winner of the 17th game, and will be willing to give you ridiculous amounts of money to obtain that 17th prediction.

In their eyes, you can predict the future, but all you did was apply successive approximation, which is how many analog to digital converters work.

The same tactic works in reverse, you simply need to keep the people paying attention to the incorrect predictions long enough. I'll leave the most recent example of this phenomenon as an exercise to the reader.

[1] http://www.mediaite.com/online/new-poll-shows-that-41-of-rep...

I would hardly call this a fix. The MSM is certainly unreliable, but "twitter and various blogs" are even less so.

And at the same time some of them are saying crap like "Who cares about Russia, their only contribution to the world was the gulag". I'm paraphrasing here, but this is what I was referring to in my post above. In their zeal to denounce a man they see as a racist bigot, they turn to bigotry themselves. Shameful is the word for it. I mean, look at this: https://twitter.com/timjacobwise/status/809188697002409988

All in all it's just a startling 180- 4 years ago, Democrats were (correctly) lambasting Romney for BS tough-talk about Russia.

If I had to argue a point in a university essay, and argued in the fashion the media has for the last year, any of my profs would have failed me.

You'd think educated professionals, in a supposedly intellectual, free society would do better. But nope, just "Putin is a dictator", or "Trump is a racist". It's these journalists' fault no one listens any more.

People are just tired of democrats calling anything who doesn't agree with them a racist/sexist/islamophobe when the VAST majority of conservatives are none of the above.

you seem intent on forcing your particular world view on hn than providing moderation of explosive or unpleasant reading.

i find reading all the posts you like to detach often more interesting reading than any of the hn comments that get left over.

Also, him saying "false story" is, itself false, because the the facts are objectively true. Officials did say what they were quoted as saying, and the NYT changed the headline shortly after publishing the story, which is (like it or not) common practice in the industry. Glenn was party to it himself while at The Guardian.

It's just "weird" to me that there's a faction of people out there who don't believe that Russia infiltrated the DNC, and I think it's because they're politically motivated to not believe this to be the case.

There's never been such an ignorance driving security news before. It's alarming and completely out of left field.

I'm sorry, but what? There is a preponderance of evidence, way more than is usually available for such things.

What piece of evidence is missing? What would convince you?