6 ms·

Microsoft confirms Russian spies stole source code, accessed internal systems

62 points by jycr753 3y ago

willcipriano 3y ago
Remember when we all learned from the vault 7 leaks that the US government has the ability to create cyberattacks that appear to investigators to have come from another nation? We were doing that prior to 2017. Thank God someone like China can't ever do that, even nearly a decade after we did and we can trust these sort of accusations at face value and not at all think critically about them.
- wenebego 3y ago
  So is there any evidence for it being done by China beside that its been done by the US before?
  - willcipriano 3y ago
    No that's why we all can naively say it isn't happening even though many of us here could do it ourselves as a fun side project.
    - wenebego 3y ago
      Nobody in this thread is saying that but you, atm. I was just wondering if you were speculating or had any evidence. Id even be interested to hear more about your logic because "its possible and has been done before by other actors" isnt enough to convince me
      - washadjeffmad 3y ago
        Are you implying that people are not, in fact, IPs?
    - Larrikin 3y ago
      So you just are wildly speculating and assume this one technique you know about completely defeats teams of specialists with the budget of the richest country in the world It's one thing to point out issues with attribution. It's another to just say since we can't say with 100% certainty let's just make up attributions. Especially with no knowledge of the attributions certainty, they could be 99.9% sure
      - consumer451 3y ago
        What OP is doing also happens to look like a disinformation technique.
      - willcipriano 3y ago
        > we can't say with 100% certainty This admission is unknown to the general public, they "trust the experts" that it is 100 proven. > let's just make up attributions. If you aren't 100% it is Russia and scream Russia, that's what you are doing
        Larrikin 3y ago
        >If you aren't 100% it is Russia and scream Russia, that's what you are doing So anything attributing attacks to Russia is made up? I think you've lost the benefit of the doubt I was giving you. The other reply to my post is probably right, you seem to be purposefully spreading disinformation.
- ipython 3y ago
  Attributions are about more than the code flow. You also need infrastructure to funnel exfiltrated data back to yourself. As you can imagine, it’s harder to reuse someone else’s infrastructure. Easy to copy code patterns but you can’t exactly reuse domains, listening posts etc.
  - rightbyte 3y ago
    > Attributions are about more than the code flow. You also need infrastructure to funnel exfiltrated data back to yourself. How is that even possible and how does it help? A computer is like a state machine where a minuscule amount of states are logged. When the state is gone the trace is gone. And you don't control the other involved computers anyway. And what good does accessing "exfiltrated data" do?
    - ipython 3y ago
      Take this wildly simplified example. You are the attacker. You already have access to internal systems at Microsoft. Now you need to send the large amounts of data back to yourself, preferably without giving away your own location in the process. That’s the exfiltration phase of the cyber kill chain. In order to do that, you’ve already established a set of listening posts and command/control sites across the internet. That’s your infrastructure. Setting that up in a pseudo anonymous way is hard, so you don’t do it often and may need to reuse it for multiple targets. It’s that infrastructure that is hard to replicate if you’re trying to “look like” another threat actor on the Internet.
      - rightbyte 3y ago
        What happens after the first node is hit? You more or less need to control the network stack around it to know were it in turn sends data. If the NSA or whatever do control virtually every network stack they can access politically, every lead will end in countries which does not comply, right? If there is any world-wide N-to-N statistical analysis of eavesdropped nodes for reentry of the data, it should trivially be able to be defeated by buffering in the nodes. I don't get how these things can be tracked at all, unless the hackers are quite incompetent.
- Starman_Jones 3y ago
  The cyberattacks which used the Marble framework were limited to those where a payload was delivered. Marble is comparable to mailing a bomb and putting a fake return address on the package. For data exfiltration, which is like robbing a bank vault, you'll need more than a fake address. It's orders of magnitude more difficult to cover your tracks, and you only need to leave one clue behind to undo all that work.
  - willcipriano 3y ago
    You don't think you can smuggle a few terabytes of traffic over the internet undetected? For the US to have the capability to be aware of that they would have to be engaged in unconstitutional spying on US citizens. A thing they have claimed to have stopped doing. "Trust us, we are lying" P.S. this also means the feds have the ability to stop child sexual exploitation that takes place over the internet in its tracks but decided not to.
    - Starman_Jones 3y ago
      I think we're discussing different topics. The article headline says, "Microsoft confirms Russian spies stole source code, accessed internal systems." I interpreted your comment about vault 7 to imply that investigators (ie, MS & anyone that they asked to be involved) couldn't be certain this was Russia. I disagree with that; snuggling data leaves too many breadcrumbs. Your reply seems more focused on other parts of vault 7, and although I don't necessarily disagree with it, I'm not sure what you're trying to say here. However, it's important to remember that FBI!=CIA!=NSA
      - willcipriano 3y ago
        > snuggling data leaves too many breadcrumbs I can understand these breadcrumbs in detail. From easy stuff like TCP and DNS to the design patterns of the radiation hardened firmware running on the communication satellites. I propose a blinded trial, give me a API with a few terabytes of data I'll have it accessed and the data moved to a third party. Then Microsoft can tell me who that person is right?
lionkor 3y ago
This may be a silly question, but how do they know who did it?
- adriancr 3y ago
  They investigate, but seriously, forensics, monitor active intrusions, honey traps, etc
- hulitu 3y ago
  > This may be a silly question, but how do they know who did it? They don't know. But it is fashionable to blame the Russians. /s
  - darthrupert 3y ago
    And being against nazis is 1940s was just another fashion statement. "/s"
zrn900 3y ago
"Blame it on the X" X: Russians Chinese Iran (current US enemy)
ChrisArchitect 3y ago
[dupe] Some more discussion on official post: https://news.ycombinator.com/item?id=39641953 https://news.ycombinator.com/item?id=39641953 And here: https://news.ycombinator.com/item?id=39648170 https://news.ycombinator.com/item?id=39648170
DuskHorizon 3y ago
Bad ruskies again… Maybe it’s time to find another enemy of the state? How about reptilians from outer space?
mistrial9 3y ago
when caught being completely run over, change the subject to the awfulness of some enemy.. do not relent! every ounce of effort on media spin! oh wait
wstrange 3y ago
This is a big story, and it seems curious why it isn't on the front page of HN. Also weird are the comments alleging this is really some US spy op, and not the Russian state. Russia has the motive and means and unless other evidence comes to light, it seems likely that they are behind it.
- decremental 3y ago
  [dead]
- probably_satan 3y ago
  Because Microsoft sold out the US to China, and is now trying to play victim it seems.

62 points by jycr753 3y ago

Remember when we all learned from the vault 7 leaks that the US government has the ability to create cyberattacks that appear to investigators to have come from another nation? We were doing that prior to 2017. Thank God someone like China can't ever do that, even nearly a decade after we did and we can trust these sort of accusations at face value and not at all think critically about them.

wenebego 3y ago
So is there any evidence for it being done by China beside that its been done by the US before?
- willcipriano 3y ago
  No that's why we all can naively say it isn't happening even though many of us here could do it ourselves as a fun side project.
  - wenebego 3y ago
    Nobody in this thread is saying that but you, atm. I was just wondering if you were speculating or had any evidence. Id even be interested to hear more about your logic because "its possible and has been done before by other actors" isnt enough to convince me
    - washadjeffmad 3y ago
      Are you implying that people are not, in fact, IPs?
  - Larrikin 3y ago
    So you just are wildly speculating and assume this one technique you know about completely defeats teams of specialists with the budget of the richest country in the world It's one thing to point out issues with attribution. It's another to just say since we can't say with 100% certainty let's just make up attributions. Especially with no knowledge of the attributions certainty, they could be 99.9% sure
    - consumer451 3y ago
      What OP is doing also happens to look like a disinformation technique.
    - willcipriano 3y ago
      > we can't say with 100% certainty This admission is unknown to the general public, they "trust the experts" that it is 100 proven. > let's just make up attributions. If you aren't 100% it is Russia and scream Russia, that's what you are doing
      - Larrikin 3y ago
        >If you aren't 100% it is Russia and scream Russia, that's what you are doing So anything attributing attacks to Russia is made up? I think you've lost the benefit of the doubt I was giving you. The other reply to my post is probably right, you seem to be purposefully spreading disinformation.
ipython 3y ago
Attributions are about more than the code flow. You also need infrastructure to funnel exfiltrated data back to yourself. As you can imagine, it’s harder to reuse someone else’s infrastructure. Easy to copy code patterns but you can’t exactly reuse domains, listening posts etc.
- rightbyte 3y ago
  > Attributions are about more than the code flow. You also need infrastructure to funnel exfiltrated data back to yourself. How is that even possible and how does it help? A computer is like a state machine where a minuscule amount of states are logged. When the state is gone the trace is gone. And you don't control the other involved computers anyway. And what good does accessing "exfiltrated data" do?
  - ipython 3y ago
    Take this wildly simplified example. You are the attacker. You already have access to internal systems at Microsoft. Now you need to send the large amounts of data back to yourself, preferably without giving away your own location in the process. That’s the exfiltration phase of the cyber kill chain. In order to do that, you’ve already established a set of listening posts and command/control sites across the internet. That’s your infrastructure. Setting that up in a pseudo anonymous way is hard, so you don’t do it often and may need to reuse it for multiple targets. It’s that infrastructure that is hard to replicate if you’re trying to “look like” another threat actor on the Internet.
    - rightbyte 3y ago
      What happens after the first node is hit? You more or less need to control the network stack around it to know were it in turn sends data. If the NSA or whatever do control virtually every network stack they can access politically, every lead will end in countries which does not comply, right? If there is any world-wide N-to-N statistical analysis of eavesdropped nodes for reentry of the data, it should trivially be able to be defeated by buffering in the nodes. I don't get how these things can be tracked at all, unless the hackers are quite incompetent.
Starman_Jones 3y ago
The cyberattacks which used the Marble framework were limited to those where a payload was delivered. Marble is comparable to mailing a bomb and putting a fake return address on the package. For data exfiltration, which is like robbing a bank vault, you'll need more than a fake address. It's orders of magnitude more difficult to cover your tracks, and you only need to leave one clue behind to undo all that work.
- willcipriano 3y ago
  You don't think you can smuggle a few terabytes of traffic over the internet undetected? For the US to have the capability to be aware of that they would have to be engaged in unconstitutional spying on US citizens. A thing they have claimed to have stopped doing. "Trust us, we are lying" P.S. this also means the feds have the ability to stop child sexual exploitation that takes place over the internet in its tracks but decided not to.
  - Starman_Jones 3y ago
    I think we're discussing different topics. The article headline says, "Microsoft confirms Russian spies stole source code, accessed internal systems." I interpreted your comment about vault 7 to imply that investigators (ie, MS & anyone that they asked to be involved) couldn't be certain this was Russia. I disagree with that; snuggling data leaves too many breadcrumbs. Your reply seems more focused on other parts of vault 7, and although I don't necessarily disagree with it, I'm not sure what you're trying to say here. However, it's important to remember that FBI!=CIA!=NSA
    - willcipriano 3y ago
      > snuggling data leaves too many breadcrumbs I can understand these breadcrumbs in detail. From easy stuff like TCP and DNS to the design patterns of the radiation hardened firmware running on the communication satellites. I propose a blinded trial, give me a API with a few terabytes of data I'll have it accessed and the data moved to a third party. Then Microsoft can tell me who that person is right?

lionkor 3y ago

This may be a silly question, but how do they know who did it?

adriancr 3y ago
They investigate, but seriously, forensics, monitor active intrusions, honey traps, etc
hulitu 3y ago
> This may be a silly question, but how do they know who did it? They don't know. But it is fashionable to blame the Russians. /s
- darthrupert 3y ago
  And being against nazis is 1940s was just another fashion statement. "/s"

zrn900 3y ago

"Blame it on the X" X: Russians Chinese Iran (current US enemy)

ChrisArchitect 3y ago

[dupe] Some more discussion on official post: https://news.ycombinator.com/item?id=39641953 https://news.ycombinator.com/item?id=39641953 And here: https://news.ycombinator.com/item?id=39648170 https://news.ycombinator.com/item?id=39648170

DuskHorizon 3y ago

Bad ruskies again… Maybe it’s time to find another enemy of the state? How about reptilians from outer space?

mistrial9 3y ago

when caught being completely run over, change the subject to the awfulness of some enemy.. do not relent! every ounce of effort on media spin! oh wait

wstrange 3y ago

This is a big story, and it seems curious why it isn't on the front page of HN. Also weird are the comments alleging this is really some US spy op, and not the Russian state. Russia has the motive and means and unless other evidence comes to light, it seems likely that they are behind it.

decremental 3y ago
[dead]
probably_satan 3y ago
Because Microsoft sold out the US to China, and is now trying to play victim it seems.