News for hackers. Stuff that matters.

A comment on Technical report on DNC hack [pdf]. Parent comment

Re:Technical report on DNC hack [pdf] by ryanlol on Thursday December 29, 2016 @05:14PM (#13280627)
>I have looked through the report. The only useful information was brief description of attack methods, everything else looks like a list of general recommendations one can find on the OWASP website.

https://news.ycombinator.com/item?id=13280068

Look again, they handed you more than enough information.

>The report also contains a pretty useless firewall rule named "PAS TOOL PHP WEB KIT FOUND" that can be used to search malware in PHP files. It is interesting that they have replaced digits in 'base64_decode' function name with regexp as if there were any other similar functions.

  root@:~/super_secret_govt_malware_samples# grep * -e bas|tail -n2
  D285115E97C02063836F1CF8F91669C114052727C39BF4BD3C062AD5B3509E38:<?php $_f___f='base'.(32*2).'_de'.'code';$_f___f=$_f___f(str_replace("\n", '', 'FeBvsTxs6EyYpYb/gJ9ckCbVgYYH9D56SKL+O6KdPjkDV91JgHr1g8WRH7/uYOda3hUgVLO064UXPF5K
  DA9F2804B16B369156E1B629AD3D2AAC79326B94284E43C7B8355F3DB71912B8:<?php $l___l_='base'.(32*2).'_de'.'code';$l___l_=$l___l_(str_replace("\n", '', 'QbO8tTv2NBoj4kUpujJlanEQeWDR+lrAJa6TWEnQEGF/uIiq3/G4ox/YCpaqsd6+QRNaT2pbpyBIDnlo
  root@:~/super_secret_govt_malware_samples#
Why is everyone trying so desperately to attack and discredit this report?
[ Parent | on HN ]
Re:Technical report on DNC hack [pdf] by Qworg on Thursday December 29, 2016 @06:09PM (#13281034)
It is interesting to see the strongly negative positions that some people take on any of these reports. It is almost like folks can have ulterior motives or know very little about how to protect sources and methods.
[ Parent | on HN ]
Re:Technical report on DNC hack [pdf] by heurist on Thursday December 29, 2016 @07:21PM (#13281453)
> Why is everyone trying so desperately to attack and discredit this report?

Because half of the US voting population are heavily invested in it being false.

[ Parent | on HN ]
Re:Technical report on DNC hack [pdf] by codedokode on Thursday December 29, 2016 @05:40PM (#13280825)
Ok, you are right, I didn't notice the multiplication sign. This rule really can detect infected PHP files.
[ Parent | on HN ]