State-Sponsored Russian Hackers Actively Seeking To Hijack Essential Internet Hardware, US and UK Intelligence Agencies Say (bbc.com) 170
State-sponsored Russian hackers are actively seeking to hijack essential internet hardware, US and UK intelligence agencies say. BBC reports: The UK's National Cyber Security Centre (NCSC), the FBI and the US Department of Homeland Security issued a joint alert warning of a global campaign. The alert details methods used to take over essential network hardware. The attacks could be an attempt by Russia to gain a foothold for use in a future offensive, it said. "Russia is our most capable hostile adversary in cyber-space, so dealing with their attacks is a major priority for the National Cyber Security Centre and our US allies," said Ciaran Martin, head of the NCSC in a statement. The alert said attacks were aimed at routers and switches that directed traffic around the net. Compromised devices were used to look at data passing through them, so Russia could scoop up valuable intellectual property, business information and other intelligence.
Boris and Natasha (Score:2, Funny)
And they're pissed (Score:4, Funny)
I mean, who enjoys competition in their core business?
Re: (Score:2)
Yeah, don't you hate it when you root a box and it is already infested with a bunch of rootkits?
Re: (Score:2)
That one's easy, you just kick out the other rootkits and install your own.
But what really makes me angry is when someone else is doing that with boxes I have already "set up".
Re: (Score:2)
We should side with competition. Capitalism preaches that competition in the market is good, monopolies are bad. Why should it be different for spying?
What I say is... (Score:5, Insightful)
...every country's spy agencies are trying to suborn every other country's switching gear.
Are we back to the "exceptionalism" or "world police" nobnsense whereby it's ok ok if we do it to them, but not vice-versa, because we're the good guys? Every country's spy agencies think they're the good guys.
Dictionary: (Score:4, Funny)
'nobnsense" is rubbish stated by one of the elite :)
Re: (Score:2, Interesting)
It's been going on since the days of the telegraph. It's only news right now because the media is trying to create some Trump - Russia connection.
Re:What I say is... (Score:4, Informative)
Re: (Score:2)
Re: (Score:1)
The illegal act is already proved.
Re: (Score:2)
Trump owns a multinational commercial property development company, of course they took money from foreign citizens, what the fuck are you going on about. It even looks like the company he controls definitely did break laws, in Russia, by allowing Russians to launder money through Trumps developments to cheat on taxes from often illegal income. So how many Americans take money from foreigners, they should all be prosecuted, lined up against the wall and shot, every single airline, every single hotel (ohh ah
Re: (Score:1)
Re: (Score:3)
Even worse is that someone is *actually surprised* by this information.
Re: (Score:2)
Yes, and if we only stopped talking about it they'd stop doing it.
Re: (Score:2)
I think the point here is that there is a recent surge. I know here we've seen a big uptick in Russia-sourced phishing attempts. Kinda weird actually. They'll phish a user's account then try to use it to phish more accounts (in a very clumsy manner that alerts everyone to the problem and helps us find out who else was phished) in what seems to be a self-perpetuating activity with no apparent end-goal. Not an efficient way to run things. I suspect performance metrics at work.
Re: (Score:2)
Re: (Score:2)
This 'I'm a bad guy, but that's necessary to stop even worse people over there' is much the same rhetoric used by every side to justify behaviour that is otherwise unjustifiable.
'Their' behaviour is never an excuse for one's own poor behaviour. There is no justification for being a 'bad guy'. The threat of something 'worse' is the excuse that tyrants use to oppress their people; that 'secret police' use to justify their excesses; for torturers to justify their barbarism.
And yes, I realise that it makes thin
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
Re: (Score:3)
At least they don't go around bullying other countries like we do.
They most certainly do. I don't know if you've been living under a rock or something, but Russia annexed part of the Ukraine not too long ago and that conflict is still ongoing. Also, this very story is about "State-Sponsored Russian Hackers Actively Seeking To Hijack Essential Internet Hardware."
I will grant your point that neither they nor we are "the good guys," but that seems like something of a non-sequitur. It isn't necessary for us to be good for their attack on us to be bad.
Re: (Score:1)
Complicated issue.
Crimea was part of Ukraine, technically. Sure it was also part of Russia at some point, before that it belonged to the Tartars, which Stalin strategically displaced and replaced them with Russian citizens ensuring a majority there.
Yup, Ukraine's government was illegitimately overthrown.
But the things on Crimea also only happened after a massive fear mongering campaign by Russian media that told everyone there that the evil fascists will be coming for them. And of course if they become par
Re: (Score:1)
Re:What I say is... (Score:4, Insightful)
Re: (Score:2)
Re: (Score:2)
No, we just ban them from entering the country.
Holy shit! 'Murricans are obviously the worst!
Re: (Score:2)
Re: (Score:1)
Every country reserves the right to ban people (foreigners) from entering. Even the Schengen countries can refuse visas to citizens of non-Schengen countries.
Unless you're a citizen, or you have some valid travel document issued by Country A, that explicitly says you personally are allowed to enter Country A (and may, optionally, also specify a particular time and place at which this may happen), you should have no expectation of being allowed entry.
What the Russian government does is different in several w
Re: (Score:2)
No, we just charge them under the espionage act.
I'm not so sure Micheal Hasting's death was just an accident, either.
Re: What I say is... (Score:1)
The list of Russian journalists killed is much longer than the US one.
https://en.m.wikipedia.org/wiki/List_of_journalists_killed_in_Russia
Did a search for Russian journalists killed and there's a fresh corpse. Russia really is up there with the worst gangster states.
"A Russian reporter known for his investigations into Russian mercenaries in Syria died after a fall from his apartment in the city of Yekaterinburg, raising fresh concern about threats to independent journalists.
https://edition-m.cnn.com/2018/
Re: What I say is... (Score:2)
Re: What I say is... (Score:2)
No but we should stop acting surprised and also stop pretending that we are not doing the same thing.
Re: (Score:2)
"Back To"? It had never stopped. The Russian Spy system may had slowed down after the fall of Communism, but that was mostly because everything else in Russia was failing.
It isn't because we are the good guys, it is because we are the toughest guys. The actions of a nation are the equivalent of 8 year old in a school yard. All the kids wants to play a different game, however the biggest kid makes the final choice what to play. Many will join the game. Some will go with the next biggest kid and play thei
Re: (Score:1)
"Back To"? It had never stopped. The Russian Spy system may had slowed down after the fall of Communism, but that was mostly because everything else in Russia was failing.
It isn't because we are the good guys, it is because we are the toughest guys. The actions of a nation are the equivalent of 8 year old in a school yard. All the kids wants to play a different game, however the biggest kid makes the final choice what to play. Many will join the game. Some will go with the next biggest kid and play their game. Then you get few kids on the swing set pretending not to feel lonely. Now the two big kids, if they disagree or want to use their stuff, will find ways to get it. Be sneaky pretending to play the other game, then run off with the ball to play their game, then they would have a counter measure, or they will just outwardly fight each other.
It isn't about right or wrong, it is just about asserting power over the others. And being part of the more powerful group.
AKA "might is right". The opposing viewpoint is that it doesn't have to be. Humans have become more civilized over the millennia, and we could and probably will progress further. Some monkeys have done away with murder, it's not impossible. The key seems to be the entire group has to attack the aggressor.
Re: (Score:2)
Bullying only works when you can prevent the victim from leaving. Like the schoolyard. It also tends to fall apart quickly once someone breaks away and/or demonstrates that the bully isn't as unbeatable as people think.
Syria might show that the US is no longer the superpower it once was, and with China starting to look like an alternative as a trading partner to the US, I expect that the ability for the US to compel countries to do as it bids is rapidly drawing to a close.
It might be time for the US to star
Re: (Score:2)
nobnsense
There's a Karl Pilkington joke in there somewhere.
Re: (Score:1)
I'm not sure about that. The general Russian narrative is that everyone else is a lot worse than them. Which of course makes them better in comparison and also means that others should better shut up and not dare criticizing anything they do.
Of course I don't know what actual Russians think about this, but that's the outward impression all these trolls and useful idiots give off.
It also appears to be a tactic their government employs to silence critics among their own. If they don't die sudden deaths like f
They do (Score:3)
Re: (Score:2)
That's mentioned in TFA. What isn't... is an actual link to the technical warning. Go figure.
Re: (Score:2)
The Ars article [arstechnica.com] actually bothered to link the report.
Funny all the "lock down this or that" advice didn't include the obvious "Don't let packets spoofed with your own source addresses come in you Internet pipe." Not that that's a watertight seal, given internal footholds, but... a glaring omission.
Comment removed (Score:5, Funny)
Re: (Score:2, Funny)
# iptables -I FORWARD -i nsatap001 -s ! fiveEyes -j alertMedia
# iptables -I alertMedia -j LOG --log-prefix 'Evilhackers: '
# iptables -I alertMedia -j DROP
Re: (Score:3)
Sure (Score:1)
Ok.
Comment removed (Score:5, Insightful)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
If Putin had to hand to pick anyone to do a counterintelligence investigation on him (and I do mean anyone at all), he would pick someone whose last name is Mueller (and, no, I don't mean this Mueller... any Mueller). Putin built his entire political career on having an alter ego of a Russian spy embedded in Germany in 1945 [wikipedia.org]. The spy's arch-nemesis is an SS counter-intelligence general by the name of Heinrich Müller. No matter what Mueller's findings are in the end, the fact that he was the one handl
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
Fact: The Russians *are* out to get us.
Maybe. I am not sure why, but there could be some historical gripes. But another fact is that every time a Democrat mentions it, they are talking out of their ass and it's very, very transparent
Re: (Score:2)
When his portrayer Vyacheslav Tikhonov died in December 2009, the Foreign Intelligence Service—one of the successor organisations of the former Soviet KGB—sent its condolences to his family. Ivan Zassoursky notes that Russian Prime Minister (and former and current President) Vladimir Putin, a former KGB agent, has been portrayed as "embod[ying] the image—very important for the Russian television audience—of Standartenführer von Stierlitz... If anyone missed the connection between Putin, who served in Germany, and von Stierlitz, articles in the press reminded them of the resemblance and helped create the association."[3] The connection went both ways; Putin was strongly influenced by the novels, commenting: "What amazed me most of all was how one man's effort could achieve what whole armies could not."
Re: (Score:2)
Comey seemed keen to let the world know that Trump is concerned about the 'pee tape'. It could be that Trump is acting like Putin's his friend because he's being blackmailed. Putin certainly has the means, motive and form - likewise Trump. I expect if that is the case, then once it's been milked for all it's worth, it will be revealed, just for the chaos that will ensue.
Strange times
Re: (Score:1)
We really missed an opportunity (Score:4, Interesting)
Amid all the snarky comments about how Russia's encroaching on the U.S. and U.K.'s state cyber hacking business, Russia does seem more dark and foreboding than anytime post Cold War- and Perestroika/Glasnost.
It always seemed to me the U.S. and its NATO allies lost an enormous opportunity to reach out to Russia after the dissolution of the Soviet Union to help them economically and socially embrace the West's principals. It would have been to our mutual advantage. Instead, it felt like we wasted that opportunity gloating over the USSR's demise, and secretly cheering on the corruption that took hold.
With Putin cemented in power, it feels like we've been transported back 30 years.
Re: (Score:3)
What do you mean, they embraced oligarchy like we did...
Re: (Score:1)
Re: (Score:2)
With Putin cemented in power, it feels like we've been transported back 30 years.
I wonder how much of this is just Putin compensating for his own insecurities about being a little guy (seriously, what is he - like 5'2"?). I mean, they publicize photos of him riding horses without wearing a shirt; they like to talk about him shooting bears and whatnot, and now this overly aggressive state-sponsored hacking - it all seems like macho posturing.
Shoot, dude, just buy some lifts and get over it!
Re: (Score:2)
Re: (Score:3)
It always seemed to me the U.S. and its NATO allies lost an enormous opportunity to reach out to Russia after the dissolution of the Soviet Union ...
Unfortunately we expanded NATO (military alliance formed against USSR) all the way up to Russian borders. It is one thing to have former Warsaw Pact nations join the EU but NATO? This is how Putin stirred up nationalism and popularity by using examples of what happened to Russia/USSR when external forces expanded to their borders in 19th and 20th century. He continues this theme to keep himself in power (and also swallow up billions for his own personal gain). Lots of luck with current administration easing
Re: (Score:1)
But Russia is now more dark and foreboding than during the cold war. They think we're reckless warmongers and if there's war they'd better be prepared.So I wouldn't be surprised they're very active in cyberspace.
The problem I have is that our secret services appear to be totally unconcerned about our interests and they'll deceive us all the time if it suits them.They're not working for us.
Re: (Score:2, Interesting)
The Russians are psychotically paranoid with good reason. Everything they try fails and costs them plenty as they grow increasingly desperate for any sort of validation. Hopefully they will implode before they resort to first use of nuclear weapons, but it anyone goes there, you can bet it will be them. And for some grandiosely stupid reason.
Re: (Score:3)
Well, the original oligarchs got their starting capital through the inevitable corruption of the communist state... it's really a multi-factor disease. The only feet at which the blame can be firmly placed is the oligarchs themselves, and they don't care about blame one bit.
Re: (Score:2)
Well, the original oligarchs got their starting capital through the inevitable corruption of the communist state
No, that's not true. Vast fortunes were made after the collapse of the USSR because there was a market for everything. This was post-USSR. The wealth became concentrated in a few hands because the rule of law didn't exist. Russia was a failed state. So both the "well-wishing" from Russia is retarded (because US has retained its rule of law despite Obama) and your libtard world view won't effect anything, either. The disease that is the modern Democratic Party will be healed.
Re: (Score:2)
Vast fortunes were made after the collapse of the USSR because there was a market for everything.
...and the people in position to be the sellers of that everything were the corrupt and connected people from before the fall.
Re: (Score:2)
...and the people in position to be the sellers of that everything were the corrupt and connected people from before the fall.
No, anyone who could scrape enough money to go abroad for a week would see a return of a few multiples just by selling junk they brought back.
What? I am surprise (Score:1)
You mean only Russia does that? US is not, China is not? Iran is not? Those morons in EU are not?
Re: (Score:2)
Most everyone so disadvantaged (Score:1)
Between them, the Americans and Chinese design and manufacture pretty much most the world's digital network.
Russians and all their hacking can't replace glaring disadvantage that they are, as a nation, basically a pilotfish getting dragged around by a shark they can only peripherally try to influence. Given such a disadvantage, their own IT security must be compromised eleventy billion interesting and critical ways I suspect.
Simple Solution (Score:5, Insightful)
Write laws that prevent hardware manufacturers from putting security patches behind paid fees. In the enterprise space, this is far too common, under the guise of "service contracts" and is fucking ridiculous. Its just a way for large companies to milk more money from other large companies, and those smaller companies that cannot always afford to pay continual service contracts are the ones getting fucked over and exploited because of things like this. Seriously, it is sad that there is an actual community dedicated to pirating and distributing security patches from major enterprise hardware manufacturers.
Re: (Score:2)
Re: (Score:1)
And how long would these companies legally be required to issue software patches for free?
It's possible you just don't understand the argument. Nobody is suggesting in the comment above that they be forced to issue software patches for free any longer than they normally would offer security patches. The argument is that they shouldn't be able to deny them just because someone isn't paying a service contract. These are security updates, their issuance is important to all of us. They need to roll the cost of the maintenance into the product, or they need to let someone more responsible have their
Re: (Score:2)
It's possible you just don't understand the argument.
No, I think I understand the argument, and I tend to agree with it. I'm just of the mind that this isn't something that should be solved legislatively.
The argument is that they shouldn't be able to deny them just because someone isn't paying a service contract...They need to roll the cost of the maintenance into the product.
So you and I are both understanding that there is a real cost associated with supporting security patches for these types of things. You think the government mandate it should be paid up front, I think it should be between the consumer and and company to decide.
Re: (Score:2)
The other commenter is right. So long as a company is providing security patches, they should be free. Otherwise, this is no different than mafia practices, where people must pay in order to be protected. Instead of being physically threatened by a mafia, now it is handled legally by companies in order to ensure protection in the digital space. If a company produces a security related software patch for their product, ALL of their customers should be eligible for that patch regardless of service contract st
Re: (Score:2)
they should be free
You keep using that word, I do not think it means what you think it means. No company is going to sign on to do X years of free development.
So you have one of 3 options:
1) Nobody pays for it, companies stop patching their gear. (Not likely to happen)
2) The consumers pay for the support, either up front (built in to the cost of the device) or as part of a service agreement. or
3) The government (all of us) pay for it.
The gov't can legislate all it wants to, but it boils down to the end question. Who
Re: (Score:1)
and whats to stop the companies offering security patches for a shorter amount of time and just forcing you to buy the new product?
The bad name they'll quickly get for rapidly obsoleting products, which raises IT spend.
Re: (Score:2)
Write laws that prevent hardware manufacturers from putting security patches behind paid fees. In the enterprise space, this is far too common, under the guise of "service contracts" and is fucking ridiculous. Its just a way for large companies to milk more money from other large companies, and those smaller companies that cannot always afford to pay continual service contracts are the ones getting fucked over and exploited because of things like this.
So, legislate that you get security updates forever, for free?
If Only . . . (Score:2)
If only security had gotten more that a passing nod from the manufacturers of that equipment, we would not be having this problem.
Nearsighted (Score:3, Interesting)
"Russia is our most capable hostile adversary in cyber-space, so dealing with their attacks is a major priority for the National Cyber Security Centre and our US allies," said Ciaran Martin, head of the NCSC
Ciaran seems to have forgotten the tens of thousands of US trained crackers in the PRC
Ever notice... (Score:2)
... that CERT never sends out TA's about United States state sponsored cyber actors?
Hmmm...
Seeking? (Score:2)
Governments have the skills to ensure they can get in, stay in and escape without detection.
With the mission done.
Some random code litter left for security researchers to ponder.
US and UK lead the field (Score:2)
Re: (Score:2)
As part of my work I write various network standards, having anything but basic security requirements inserted into any network standard is fought tooth and nail by CISCO certification team. They oppose anything that would result in additional development time and try to insert poison pills through public review to undercut competition. They are largely successful, as such we have hard-to-secure infrastructure with insecure-by-design protocols and standard implementations.
As well, the US intelligence community wants the lack of good security so that they can exploit them to obtain intelligence. We pay an escalating cost for their ease of access.
Re:Blah Russia blah blah blah RUSSIA! Blah! (Score:5, Insightful)
We already had a WWIII. It was called the Cold War.
Boy, do you have a nasty surprise coming!
The Cold War was worrying.
WWIII will *melt* you and set you on fire.
Re: (Score:3)
We already had a WWIII. It was called the Cold War.
Boy, do you have a nasty surprise coming!
The Cold War was worrying.
WWIII will *melt* you and set you on fire.
I always figured that the cold war was just a continuation of WW2.
Re: (Score:2)
Which itself was just a continuation of WWI.
Almost as though when you win a war and carve up the spoils, the losers feel like they've been unjustly robbed and seek restitution by the only avenue open to them.
Don't really see a whole lot of alternatives though, aside from avoiding warfare or not pillaging the loser while they're down. Not sure which is more unlikely...
Re: (Score:2)
Which itself was just a continuation of WWI.
Almost as though when you win a war and carve up the spoils, the losers feel like they've been unjustly robbed and seek restitution by the only avenue open to them.
Don't really see a whole lot of alternatives though, aside from avoiding warfare or not pillaging the loser while they're down. Not sure which is more unlikely...
A bit of both. Certainly after WW1, the Germans got a bit of nasty punishment. But when you are in a war and lose, you take what you get. So yes, the WW1 ending had a good bit to go with giving rise to the conditions that were a part of starting WW2.
Given the natural abilities that the Germans had - awesome engineering, industriousness, and some latent racism tendencies, coupled with the punishment, it was not terribly surprising that old Adolph found a receptive audience, and had early success.
But it
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Is it possible -- just hear me out -- that time flows linearly, that phenomena change through the time flow, and that Russia in 2012 might not have been an enemy but Russia in 2016 might have been? I know, it's crazy, I just want to play devil's advocate through my crazy theory that things change.
Re: (Score:2)
You're spinning late-night freshman dorm philosophy here.
Re: (Score:2)
Re: (Score:1)