News for hackers. Stuff that matters.

A comment on Technical report on DNC hack [pdf]. Parent comment

Re:Technical report on DNC hack [pdf] by stefantalpalaru on Saturday December 31, 2016 @03:46AM (#13290205)
> X-Tunnel

That one is more likely to be used by the Chinese: https://www.invincea.com/2016/07/tunnel-of-gov-dnc-hack-and-...

[ Parent | on HN ]
Re:Technical report on DNC hack [pdf] by lern_too_spel on Monday January 09, 2017 @11:23AM (#13357457)
That document is yet another example of laughably poor security analysis.

The Chinese implementation of the XTunnel protocol is in Java (the GitHub project is written in Java, and you can see an embedded JRE in your blog post's link to the Chinese tool in the strings here: https://cynomix.invincea.com/sample/e2101519714f8a4056a9de18...). The FancyBear implementation is not (no embedded JRE here: https://cynomix.invincea.com/sample/f09780ba9eb7f7426f93126b...).

If you want to see how professionals do it, take a look at https://www.eset.com/int/about/newsroom/research/dissection-....

[ Parent | on HN ]