Hacker News Reader

Comment by adrr | Hacker News Reader

Russia allows their FSB operatives to moonlight on the side. Darkside hackers could be government operatives and an attack on critical infrastructure is an act of war. It is the same as bombing the pipeline if infrastructure is disabled. I am sure the cyber insurance provider won’t pay and say it was an act of war by a foreign government. It always a grey area.

View on HN

Do you have any extraordinary evidence for these extraordinary claims?

Very few doubt that FSB and Russian mafia are one.

Even if it's true that very few doubt it, that doesn't mean it's true that they are.

https://bpr.berkeley.edu/2019/12/16/gangs-and-gulags-how-vla...

those few are all here downvoting you?

It's not possible to bring "extraordinary" evidence of a 3 letter agency doing this kind of shit the way some HN user would want without ending up as a political prisoner somewhere learning all about the meaning of the word "pain". Never-the-less, I have no doubt that FSB operatives are allowed to moonlight.

The United States Department of Justice has not exactly been shy about charging operatives of foreign governments for their illegal activities online (e.g. OlympicDestroyer, Solarigate). As far as I've been able to determine, neither their prosecutors nor the FBI agents doing the investigating have had the problems you so colorfully describe. If it were the case that this type of moonlighting was happening, I think the FBI would have been bringing cases to court. That would constitute evidence.

They have. Here is a well known example from 2017 [1]:

During the conspiracy, the FSB officers facilitated Belan’s other criminal activities, by providing him with sensitive FSB law enforcement and intelligence information that would have helped him avoid detection by U.S. and other law enforcement agencies outside Russia, including information regarding FSB investigations of computer hacking and FSB techniques for identifying criminal hackers. Additionally, while working with his FSB conspirators to compromise Yahoo’s network and its users, Belan used his access to steal financial information such as gift card and credit card numbers from webmail accounts; to gain access to more than 30 million accounts whose contacts were then stolen to facilitate a spam campaign; and to earn commissions from fraudulently redirecting a subset of Yahoo’s search engine traffic.

Here's what the Treasury had to say about it in April [2]:

To bolster its malicious cyber operations, the FSB cultivates and co-opts criminal hackers, including the previously designated Evil Corp, enabling them to engage in disruptive ransomware attacks and phishing campaigns.

More about Evil Corp etc in [3].

[1] https://www.justice.gov/opa/pr/us-charges-russian-fsb-office...

[2] https://home.treasury.gov/news/press-releases/jy0127

[3] https://apnews.com/article/business-technology-general-news-...

The entirety of the Cold War between the USA and USSR?

There's plenty of evidence that the USSR engaged in espionage activities. There's plenty of evidence that the Russian Federation has engaged in the same thing. Neither of those is what is being alleged here.

It's pretty clear that the Russian Gov is not actively prosecuting cyber criminals, provided they attack foreign competition. On top of that, there is a fair amount of forensic data indicating shared resources between hacker groups and GRU operatives.

> On top of that, there is a fair amount of forensic data indicating shared resources between hacker groups and GRU operatives.

Go on

You could start to look at the spread of Diskcoder.C across several attacks and the shared code with ExPetr and NotPetya... This forms the basis for the DOJ indictment against 6 officers of GRU Unit 74455.

There is much more if you care to go down that rabbit hole.

Oh nonsense, that was well established to be an edit of the binary. It’s obvious the GRU didn’t have the source code. The idea that this was an example of the GRU working with criminal hackers is plainly ridiculous.

https://blog.malwarebytes.com/threat-analysis/2017/06/eterna...

Why call it diskcoder.c anyway? It’s Petya

Why have them moonlight as hackers when you can get third parties to do what you want? I don't believe for a second that it's an elaborate conspiratorial scheme directed from the top.

It's the same as domestic operations here in the USA: GRU comes up with ways to run loosely controlled groups that are accomplishing roughly the same ends. It's about making the battle space more confusing and unpredictable, and it's been going on for quite some time, very successfully. The soldiers don't report back to central control: they're NOT controlled, they're just loosely directed.

This would be the same. The hackers doing this don't have to be direct agents here, they're sheltered by the Russian state and only need to have some indication of where and what to strike. It's one-way communication, and it's possible to get the desired feedback through things like Facebook and Google Analytics (by paying for it like any ordinary customer).

Remember when Emotet was believed to be connected to Russia? Until January of this year, when it turned out it was actually Ukrainian.

Reply on news.ycombinator.com