Hacker News Reader

Comment by walrus01 | Hacker News Reader

Considering the amount of money that large political parties pay for high-six-figure salary media consultants, stylists, image consultants and PR fluffers....

You would think they would want to hire a few professional, highly qualified NetSec sysadmins and give them authority to enforce network, server and endpoint security policies over an organization as a whole. But nope.

DNC is a fine example of failing to prioritize network security.

edit: I mean it's not exactly rocket science in terms of recruiting. Find a person who would be qualified by their years of experience and proven track record to be the chief security officer at an organization the size of cloudflare, limelight or netflix (or similar) and offer them a job at an equally high salary. Pay relocation and COLA expenses.

View on HN

Get real.

Political campaigns, outside of the States, are very much bootstrapped. And IT folks very much not minded to volunteer their time.

Citation: I'm a member of a European Parliament on his third term in politics. Of my 200+ volunteers, not one is in infosec. Within my party, maybe 60 staff total are paid for a campaign.

I am really skeptical that considering the ongoing total operational budget on a yearly basis for all of the facilities and support structure in Strasbourg there are no infosec/netsec professionals. If that's really true, then to put it crudely, you're utterly fucked. Because Russia certainly does have money for blackhat infosec/netsec types.

> considering the ongoing total operational budget on a yearly basis for all of the facilities and support structure in Strasbourg

You're conflating parliamentary budget and staff with a campaign budget and staff. These documents came from his campaign, not a parliamentary office (be it EU or French). For obvious reasons the two don't mix. Campaigns generally operate on extremely restricted budgets, and are naturally transient in nature.

okay, true, even so. In a nation the size of France I find it really doubtful that major political parties would go begging for the budget to hire infosec/netsec professionals, considering the amount of money spent on all the other expenses of a major campaign.

Note that En Marche is a party that was specifically set up for Macron's presidential campaign in April last year - it's not one of France's established parties.

FN is financed by Russia, since other banks wouldn't give them a loan. And Le Pen is a contender in the second round so presumably it is exactly the case that major parties can have budget issues.

> I am really skeptical that considering the ongoing total operational budget on a yearly basis for all of the facilities and support structure in Strasbourg there are no infosec/netsec professionals.

I think you just confused "a European Parliament" (that is, a national parliament in Europe) with "the European Parliament", which is a different thing altogether.

And then also confused an MP (or, in your interpretation, MEP) not having any infosec staff with the whole government (or EU) not having infosec staff.

But then, even with all that, your conclusion isn't all that wrong for the topic at hand; if a major power like Russia targets a particular politician in the West (perhaps aside from the official, rather than campaign, personality of the sitting head of state), there is likely to be a substantial resource asymmetry that favors the attacker.

I think OP works for a member of parliament, if I understand them correctly. Their offices are actually not that sensitive. All the secrets are held by the executive, and the EU doesn't even have the sort of military and intelligence institutions that are usually most secretive.

> I think OP works for a member of parliament, if I understand them correctly.

No, he is saying that he is a member of a parliament. The lower house of the Irish parliament to be exact [0].

[0] https://en.wikipedia.org/wiki/Noel_Rock

>EU doesn't even have the sort of military and intelligence institutions that are usually most secretive.

Might just be because the EU is a trade block, it doesn't have secretive military and intelligence institutions because it doesn't have any military and intelligence institutions at all.

> it doesn't have any military and intelligence institutions at all.

Better let INTCEN, SIAC, SitCen, EUFOR and EUNAVFOR know that.

The EU is absolutely far, far more than a trade block.

and ISAF (now RS/Resolute Support)

ISAF and RS are functions of NATO, not the EU.

Well shit, I better let the people in the DGSE and BND know that they shouldn't have access to their data sharing partnership with the NSA. Some guy on the Internet says that the EU doesn't have any IMINT, HUMINT or SIGINT, it must be true.

France or Germany having their own intelligence services is entirely compatible with what I said though. Their allegiance is to their own country first, and data sharing partnerships change little.

I'll just add as a reference that for the french presidential election most campaigns are costing around 5 millions euros ( it's a side effect of a system which fixes this as a max limit for campaign costs refunds, but I guess they can't spend way more)

And in France (as in many other countries), most high ranking politicians do not have any kind of technical background. They typically studied political science or other soft disciplines. And are also often of a generation that barely uses computers but do not understand them.

In fact in France there is a general contempt from the political class and the medias for any candidate who is not a literary person.

I'd be interested in volunteering some time or access to data sets to help protect these sorts of things. Feel free to DM me.

Then political parties need to get real or resign themselves to being hacked.

At the level of Hillary and Macron, the money is there. If infosec people don't volunteer, they will need to be paid for, even if it means running less television ads or what not. Even in Europe campaigns have paid staff. It might mean cuts to something else, but is it worth skimping on security?

As an aside, I'm from the US and have never heard of a campaign looking for infosec volunteers. Are we sure no one would volunteer?

Shoot me an email (in profile) if you'd like some domain expertise :)

Wow you are a TD? On hacker news?

Wonders never cease.

> Political campaigns, outside of the States, are very much bootstrapped

Get real.

edit: Considering the response perhaps I should qualify. The major parties in most developed countries have permanent election teams with multi-million pound budgets. I cannot see why my response is in any way controversial.

The US is mostly unique in having 18-24 months to fundraise, A/B test, staff up, etc.

edit: Regarding this...

> The major parties in all developed countries have permanent election teams with many multi-million pound budgets.

That's very likely. However, the bursty nature of elections means they're probably also onboarding thousands of volunteers and temporary staff in a very short period of time.

a Canadian political campaign (Federal) lasts at most 45 days, with probably an estimated 45-60 days of additional lead up time to prepare for it when it's obvious a vote is going to be called... The parties still seem to find plenty of money to spend on 4/5-star hotels, chartered airplanes, staff, etc.

> And IT folks very much not minded to volunteer their time.

This is an ignorant statement. The many millions of hours of work freely given to producing, maintaining and supporting users of software licensed under Free Software [1] licenses shows it's not true.

I suspect it's just that ‘IT folks’ tend to be cynical about most political parties. So they would want to be paid for any work done for such outfits rather than doing it pro bono.

I'd suggest that politicians who expect they can get such work done for free are the ones who need to “get real”.

[1] https://en.wikipedia.org/wiki/Free_software

Free Software doesn't mean unpaid volunteer any more, given the number of projects that have developers working for large companies...

Obviously some developers get paid. But there is still a huge amount of unpaid volunteer work given to these projects.

He meant they do not volunteer their time to political campaigns.

You would think they would ...

Um, yeah, they've thought of that (and have been told that 10,000 times) already.

Just that it turns out these organizations -- and the threat models they face -- are a bit more complicated than you would seem to think. And the task of finding qualified and, crucially, trustworthy people who can also interface with the sprawling, chaotic, and (inherently) politicized juggernauts that underlie these campaigns, even more so.

Some ex-cloudflare/limelight/netflix chef security officers certainly won't be able to do anything against state actors.

You can name-drop all you want. These people have heard it all. But the short answer is, if they can't interface with the rough-and-tumble reality (and day-to-day insanity) of a scrappy political campaign... then no, their technical chops (by themselves) just won't do all that much.

won't be able to do anything

That's some pretty crude hyperbole (as I'm sure you're already aware).

I don't think there is a great deal of venn diagram overlap between political apparatchik/ass-kisser and the sort of person who you want to hire as CSO of netflix or a similarly sized organization. Hiring a competent CSO who could deal with the politics and actually has the technical skills to deal with nationstate sponsored zero days... that's a hard problem.

En Marche! was only founded within the last year. Although they attracted a considerable amount of donations, not sure we're talking about the same scale of money.

Also, accounting in French political campaigns are very restricted to ensure fairness between candidates (no more than EUR 4'600 per candidate per physical person, no business donations; the total expenses are capped to ~22m€).

Accounts are checked after each elections by the National Commission on Campaign Accounts and Political Financing; it is an active check, as some of the previous campaigns refunds were blocked because of some wrong doing.

More details available on Wikipedia (translated from FR): https://translate.google.fr/translate?sl=fr&tl=en&js=y&prev=...

Shouldn't this be a government expense, and not a campaign expense? Do candidates pay for their own physical security?

Actually, ANSSI (French government agency for the security of IT) gave some workshops to campaign teams.

Source (in French): http://www.zdnet.fr/actualites/lection-presidentielle-l-anss...

Wow, so this really was a catastrophic failure on multiple levels. Lotta of self-reflection for some in Paris this weekend!

I think the biggest issue is the short campaign time. You have to pay a pretty big premium to get someone to quit a job with good stock bonuses for 45 days of work. It’s also very challenging to implement a full security Implementation solo in one week (or whatever aggressive timeline is needed to prevent hacks from day one). Hiring a team is cost prohibitive in most countries.

That is absolutely true. Not going to recruit a person like that for just 45 days. Organizations like the DNC need to have such a person on staff full time, 365 days a year, whether an election campaign is active or not.

I wish. We're still trying to get tech companies to prioritize security.

I wish I could upvote this to the top of every thread regarding security.

Imagine the competence of government employees but without the financing.

I find the competence of government employees quite acceptable and even at times commendable given my quality of life. But then I also understand how the rest of the world has to get by which makes me appreciate what I'm fortunate enough to have.

The weird thing I've noticed is that some people in my country will express your sentiment, but then turn around and tell you they live in the best country in the world and would be offended were anyone to say otherwise.

I guess they don't see the connection between the government workers and that quality of life.

You think quality of life is synonymous with quality and competence of government. This is the problem.

Where in the. modern world is this untrue?

As someone who has worked in government I take offence to this. There are plenty of very qualified people in government who do want to help make the country a better place.

They are often just dealing with out of date processes that are mandated by law and which limit their ability to be innovative.

Yeah. I take issue with those people that have given up demanding that their government do better. They are defeatists.

Both DNC and also the Clinton Campaign (Campaign Chairman Podesta). Podesta was hacked by pfishing which most users < 30 knows to avoid. Tells me Podesta had no geek friends.

worse, podesta actually asked their sysadmin "is this legit" and was told, paraphased "yup, click on it and enter your credentials".

https://www.vox.com/policy-and-politics/2016/10/28/13456368/...

"Seemingly skeptical (and rightfully so), Podesta forwarded the email to his chief of staff, who then passed along the email to the campaign’s IT team. This is where things go so painfully wrong: The campaign’s IT team incorrectly identified the email phishing for Podesta’s password as legitimate, instructing him to change his password."

Amazing; I hadn't seen that story. Vox doesn't prove that this particular phishing attack was the way the attackers got access to Podesta's email, but what an unbelievable failure by their IT team. Who would fall for this?

The phishing email claims to be from from Google support, and tells the user:

> CHANGE PASSWORD: <https://bit.ly/[deleted]>

That should be enough red flags. Also, the bitly address expands to one in the domain, myaccount.google.com-securitysettingpage.tk

> Vox doesn't prove that this particular phishing attack was the way the attackers got access to Podesta's email

If you visit the stats page for that bitly link by adding a + to the end, you'll find that it was visited exactly twice, both visits at the right time for the hack, and you'll find that the Wikileaks data cuts off soon after the hack, probably when they set up 2FA as suggested. While that doesn't technically prove that they're related, it's better evidence than we have for any other theories.

Sources:

Bitly stats page: https://bitly.com/1PibSU0+

Phishing email: https://wikileaks.org/podesta-emails/emailid/34899

That's very helpful information and not something reported in the NYT, WaPo, or other MSM.

This is my source: https://motherboard.vice.com/en_us/article/how-hackers-broke...

Also, I learned recently that Clinton didn't know how to use a personal computer. Nobody on her staff could take the time to teach her the basics.

Gonna need to science to show me that most users under 30 know how to avoid phishing (particularly spearphishing). This goes against all available evidence that I have seen in the industry.

In my experience a huge number of users under age 30 can't even distinguish the difference between a binary that is natively running on their windows10 or osx workstation OS, and something that is presented inside of a web browser window. Thus you get people paying for windows bluescreen ransom javascript webpages (or "FBI has locked your computer") that are presented with scary graphics as fullscreen inside chrome on OSX.

People basically treat their laptops as glorified thin clients nowadays.

Considering that many day to day apps (slack, spotify, vscode) are web views, is that really surprising?

They do.

Obama campaign had a contract firm that implemented and enforced infosec. They even tossed USB keys in the parking lot to catch campaign workers that we're dumb enough to try them.

The problem is beyond rote security at this point. We're in the realm of talented, well financed threat actors with databases of 0days.

> The problem is beyond rote security at this point. We're in the realm of talented, well financed threat actors with databases of 0days.

State actors

I think that is likely the case, but I don't know if that is an exclusive thing anymore. A lot of what I read about reminds me of 1970s sponsorship of various terror entities and revolutionaries.

From a nation state actor standpoint it is probably a lot cheaper to pay gobs of money to a half-dozen antisocial young black hat types (that have been messing around with linux since age 12 in their bedroom in belarus), than to fund the PLO.

Yep, and if you look at the carders in Russia, they have some very close ties with government. Perfect infrastructure for this shit.

Politicians are still campaigning with outdated mindsets, so securing their computing environment is not a priority.

But looking good on camera, oh yeah.

Reply on news.ycombinator.com