How Hackers Broke into John Podesta and Colin Powell’s Gmail Accounts

Re:How Hackers Broke into John Podesta and Colin Powell’s Gm... by cypherpunks01 on Thursday October 20, 2016 @06:25PM (#12756712)

So if I hear you correctly, you are essentially claiming that the 4 security companies CrowdStrike, SecureWorks, Fidelis and ThreatConnect all conspired together to manufacture evidence in order to mislead the DNC & USGOVT in this investigation because it would be good advertising for their industry?

Personally, I would consider that a somewhat extraordinary claim. Is there anyone familiar with this sector who can comment on this?

[ Parent | on HN ]

Re:How Hackers Broke into John Podesta and Colin Powell’s Gm... by tptacek on Thursday October 20, 2016 @06:31PM (#12756741)

It is very unlikely that Crowdstrike is making things up.

I think very few people on HN understand how Crowdstrike works. Know how every Fortune-1000 company in the world has McAfee or Norton Antivirus installed (or at least used to)? Crowdstrike is like that, except they hoover up all the malware detection stuff they do on endpoints to a central data center and correlate it across customers.

[ Parent | on HN ]

Re:How Hackers Broke into John Podesta and Colin Powell’s Gm... by hueving on Friday October 21, 2016 @01:29AM (#12758342)

Hats off to a company that can convince companies to become a member of its botnet and charge for the privilege!

[ Parent | on HN ]

Re:How Hackers Broke into John Podesta and Colin Powell’s Gm... by tptacek on Friday October 21, 2016 @12:40PM (#12761913)

What widely-deployed desktop software can you not say this about?

[ Parent | on HN ]

Re:How Hackers Broke into John Podesta and Colin Powell’s Gm... by hueving on Friday October 21, 2016 @09:09PM (#12766365)

grep

More seriously, anything not phoning home with traffic patterns for things that 'might be attacks'.

[ Parent | on HN ]

Re:How Hackers Broke into John Podesta and Colin Powell’s Gm... by revelation on Thursday October 20, 2016 @06:35PM (#12756771)

I don't get it. How do you go from "there is no evidence here" to "conspiracy"?

It's fine to explain how malware works and turn it into a PR piece with fancy pictures of minified JavaScript, but none of that is proof of some Russian connection. Neither are professional sounding statements like "we have medium confidence the attackers are Russian actors" or similar baloney.

All there is is Stratfor style analysis along the lines of "we think NATO countries X, Y, Z got exploited so it must be Russia" when in reality that's probably just because all their customers are NATO countries X, Y, Z.

[ Parent | on HN ]

Re:How Hackers Broke into John Podesta and Colin Powell’s Gm... by cypherpunks01 on Thursday October 20, 2016 @06:42PM (#12756819)

I see what you are saying. Your initial response was dismissive and unclear as to what you were attempting to communicate. Something along the lines of "I disagree with your claim that this threat actor has been identified as Russian" would have been more helpful.

I believe that the industry's identification of APT28 (active since 2007) as a Russian group is based on both the political identities of their targets, and language and timezone indicators leaked in their work. Here is one such analysis from 2014 from a different security company:

https://www.fireeye.com/blog/threat-research/2014/10/apt28-a...

[ Parent | on HN ]