Hacker News Reader

Comment by thephyber | Hacker News Reader

As someone who works in cybersecurity, it's always hard for me to interpret PR language like "orchestrated through a sophisticated attack". This could be aimed towards non-savvy readers meaning basically anything or it could be accurate and describe a nation-state (although I don't get the feeling of a sophisticated nation-state actor here).

The DoJ used similar wording when prosecuting Aaron Schwartz for using Python scripts to glue together "curl" calls.

View on HN

As someone who works in cybersecurity, it is perfectly clear to me that victims of attacks don't want to sound inept in their announcements so they ALWAYS say attacks are "sophisticated," "orchestrated," or "advanced." Nobody is going to say "we were hacked because we lack even basic security precautions." Instead, everything is an "APT."

Point of order: the victims of the attack are the million or so people reading about it in the news.

The targets of the attack are doing their level best to control the narrative by spinning their attackers as extremely sophisticated so they don’t end up with a million or so people holding torches and pitchforks outside their offices.

Well, targets are also victims to some degree, but I get your gist. I would take it a step further: for identity theft the company that fails to verify your identity before reporting false info to a credit agency is at fault - for libel with damages. My SSN is not a form of authentication and using it as such should be a crime.

Speaking of misleading cybersecurity language, note how you used the term "nation-state", which is a word that indicates a specific subset of countries and is not just a fancy synonym for "country".

That's an existing problem that hasn't been solved in geopolitical meatspace. I don't expect it to be solved in cybersecurity first.

That said, for my understanding: which political bodies are countries but not nation-states? Is this a reference to places like Singapore and the Vatican, which are probably more accurately labeled city-states?

https://en.wikipedia.org/wiki/Multinational_state

> Present-day examples of multinational states are Afghanistan, Belgium, Bolivia, Bosnia and Herzegovina, Brazil, Canada, China, France, Ethiopia, India, Indonesia, Iraq, Madagascar, Malaysia, Mauritius, Montenegro, Nigeria, Pakistan, Philippines, Russia, Serbia, Singapore, South Africa, Spain, Sri Lanka, Suriname, Switzerland, United Kingdom and United States.

I think you interpreted this dishonest PR spin just fine.

Unless they come out with details of a convoluted deeper infiltration, escalation of privilege, and careful exfiltration of data over a period of time to escape detection I wouldn't buy the PR bs.

I think the metaphor of "orchestration" refers to, as an analogy to actually composing/arranging music for an orchestra, getting lots of other entities to do what one entity specifies that they do. Amplification of control. Not "basically anything."

"Sophisticated" I suppose means above-average in complexity, which indeed could be "basically anything."

Just wait until Krebs on Security talks about it.

Krebs on Doxxing

Often, security bulletins will use the word sophisticated when describing multi-step attacks.

Step 1: Type in stolen username

Step 2: Type in stolen password

Step 3: Click log in button

Step 4: ( •_• ) ( •_• )>⌐■-■ ( ⌐■_■)

Step 5: I'm in

One example of a "sophisticated" attack

Now you're making me wonder how many places the sunglasses meme in unicode could be used as a valid password.

By the way, it's Swartz

On the subject of nation-states, they want the data to help out spies

To be fair, curl is a nightmare of pedantry without something like postman to deal with it all for you. BTW, when did postman come out anyway?

If by which you mean it adheres to the specs and does what you tell it to, then sure?

Postman is nice and ergonomic!

curl is great if you already have the command crafted. My suspicion is that the Python script scraping a web page for URLs/IDs which then ran a curl shell command which saved the resulting document to the file system.

Reply on news.ycombinator.com