I fear that you're being downvoted for pointing out the even bigger threat of our national media's exceedingly more dangerous acts of propaganda, presumably because readers either don't recognize it or are wilfully blind to it because it reflects their own biases.

The SolarWinds hack was a devastating attack on our sovereignty.

And so is the other.

The SolarWinds hack in addition to election interference should easily be seen as an attack worthy of taking out Putin IMO.

Yes, let's assassinate a world leader of the country with the most nukes in the world based on unfounded claims of election interference and a hack.

Do you have any idea what America did in Russia in the immediate aftermath of the fall of the Soviet Union? The 1996 election in Russia which was majorly "interfered" with by Clinton: https://archive.is/R7i5u, not to mention the fact that most Russian hacking activities are done using NSA backdoors which were leaked?

I'm surprised and disappointed to see such flagrant ivory tower imperialism on HN.

I agree completely that assasination, beyond moral abhorrence, would work out as well as most U.S. foreign policy - horrifically. The last foreign policy success I'm aware of was the Marshall plan.

I think it's a mistake to minimize Russian influence, when it suffices to compare the unmitigated disaster of U.S. actions - both government and private sector, and at enormous scale - in post-Soviet Russia.

Your cited article is interesting but does not support your assertion of major interference IMO. Policy maneuvers for political purposes are the norm for all countries right or wrong.

Really? A government saying that they would ensure no "negative stories would come out", literally puppetting international institutions to pay out money - billions - for an election campaign, sent US Government agents to be embedded into the Yeltsin campaign right as he was violating every law on the books and calling in favours from the mafia and oligarchs, and very likely also used intelligence agencies to help, all of that isn't major interference?

But targeted ads are?

I have a family member affected by those "targeted ads" and can tell you this is hardly comparable to news agencies writing favorably or not about someone. Some people are seriously fucked up because of this. Just look what happened on January 6th.

For the record, I think that both are elections interference. But there's a far cry behind publishing fake news and advertising it to some demographics and fuelling IMF money into campaigns by the billions and embedding foreign advisors into a criminal election campaign.

Because the Russia link is so strong? Dude, everything you read about Russia in the American press is garbage. From the article:

"They cleaned the crime scene so thoroughly investigators can't prove definitively who was behind it."

That's literally in the article but it doesn't stop them writing the whole thing as if it's utterly proven beyond doubt who was behind it.

I was speaking to some Russians at a party yesterday. They lamented at how Russian and American media were mirrors of each other.

Russia uses America as the core of their propaganda just the same as the DNC has been using Russia as their boogoieman since they needed a narrative to apply to Trump.

As someone who formerly worked for Crowdstrike and has performed the APT-29 demo countless times, I will say attribution is bullshit and people frankly have no real data to point fingers.

There have been deeper dives and better explanations than this NPR article: https://ciexinc.com/blog/solarwinds-articles/zetter.html

Major investigations were completed months ago.

I worked for Crowdstrike. We did this hack as our primary demo. Dmitri is on the Atlantic Council along with the rest of the Obama team.

There is no more evidence to suggest Russia was involved than there was that Dmitri himself was for political reasons. And Shawn Henry will fire you for saying this out loud.

> By design, the hack appeared to work only under very specific circumstances. Its victims had to download the tainted update and then actually deploy it. That was the first condition. The second was that their compromised networks needed to be connected to the Internet, so the hackers could communicate with their servers.

Yea, wow, thanks NPR. Hard hitting stuff right there. Those are “very specific circumstances” that just happen to generally apply to a huge percentage of hacks.

I normally appreciate some stories on NPR, but you’re right. This is a narrative piece.

That's a perfectly valid paragraph. In a decent environment, outbound internet access should be restricted to only the hosts / networks / ports that require it. Especially for server environments. Many servers running the backdoored Orion probably tried to beacon but failed for that reason. (And I'd assume the backdoor would probably first verify outbound internet access so that the failed beacon doesn't generate a firewall/ACL deny event that a security team might detect.)

Plus, the article is written to condense technical information into something that's as layman-friendly as possible. The specific malicious update has to be downloaded, and also installed, and also running on a server which can reach out to anything on the internet. Their point is that there are only going to be so many servers that both use this software and meet those conditions, and that's in part why the backdoor took so long to identify. This is maybe a little obvious to people with infosec knowledge, but definitely not obvious to their target audience.

The article timing is interesting, but I don't think a coincidence is that unlikely. If you read the whole article, it covers enough that I could see it taking months to make.

I don't think coordination with the government is that unlikely, either, or perhaps just a pragmatic editorial decision ("everyone knows sanctions are likely going to be placed sometime in the next few months, and maybe we should wait until then so we can include those details in the story"). Both of those scenarios are more likely than a coincidence, probably - but, either way, I think your post seems overly cynical in general.

I whitelist my networks (by port and host name, At least until TLS 1.3 removes the visible SNI) and my top denies list is very interesting. They have access to bits and pieces of the internet (especially PyPi damn you runtime downloads) and all connections to an allowed port will succeed (they will just be closed after the SNI or IP check fails).

Nonetheless the article was correct the hack did not need bizarre or rare circumstances to take effect.

Wait... What do you mean by PyPi runtime downloads???

Not exactly sure what they meant, but maybe just that it's often hard to install a single Python package if the machine can't reach PyPI. If you download a tarball or wheel of some Python package on a different computer and transfer it to the isolated computer, there's a pretty good chance the package is going to have at least one third-party sub-dependency, in which case trying to install it with pip or setup.py will cause it to try to install more packages from PyPI.

Docker's a decent way to address this, since you install the dependencies when building the image rather than when running the container, so you can build the image elsewhere or through CI and run the container on any server without having to allow access to package management repo servers.

python -m venv temp && temp/scripts/activate && python -m pip install -r requirements.txt && tar -czf temp/Lib/site-packages

You're ready for offline install!