You get an email.

It contains a link.

Oh, noes, what to do?

Choice A:
You stupidly click on it.

Bam. You're hacked. That email talking about your boss and how he's makin' bacon with the pet pig you got him for Xmas shows up in your boss's twitter feed as you're asking for a raise later in the day.

Choice B:
You delete the email without clicking on the link. If you're really with it, you route all future mail from the sender to junk or spam for mass deletion.

You're not hacked, and there's no evidence that anybody attempted to hack you.

Monday morning quarterback session:
A was hacked. B wasn't hacked. This shows the clear intent of the hacker to support A, because if the hacker was neutral both sets of email would have been publicized. Since B's email wasn't exposed, the hacker's rooting for him.

That's fine, if the hacking really depended entirely on the hacker. (Some Russians tried to hack my personal account today. It's a routine thing. I don't click on links embedded in email.)

Hugin

(33,137 posts)

24. You and I both know the basics of Internet Security.

Reply to Igel (Reply #10)

Fri Dec 30, 2016, 09:03 AM

Dec 2016

And, have known for some time now.

I've received extensive training on the subject.

Sadly, we are the exception rather than the rule in the modern era. Especially, in the personal and private spheres.

It's always been a concern of mine attempts were discarded and not recorded or monitored. Luckily, even though we've deleted the email there is still a record in the systems it passed through that such an email existed. But, going back and putting the pieces together after is reactive and not proactive.

Also, there are many forms of hacking (aka social engineering) which don't require the cooperation of an inside party or a computer to accomplish. In the case of GRIZZLY STEPPE, I'm of the opinion there was much more message and media manipulation than has been described in the report.

The Kremlin is a big fan of extortion... They even have a word for it.

Ilsa

(61,695 posts)

14. They were probably phishing for opposition research on

Reply to Hugin (Reply #3)

Fri Dec 30, 2016, 12:01 AM

Dec 2016

HRC and other Dems within the RNC's system. They probably found info on R's as well, to hold until Putin needs it for leverage.

uponit7771

(90,335 posts)

20. +1

Reply to Hugin (Reply #3)

Fri Dec 30, 2016, 06:48 AM

Dec 2016

superpatriotman

(6,247 posts)

4. Please simplify it for me Donny!

Reply to Skidmore (Original post)

Thu Dec 29, 2016, 05:39 PM

Dec 2016

Summarize this document in 140 characters or less

Shandris

(3,447 posts)

5. ....ummm...I know this won't help my popularity any, and...

Reply to Skidmore (Original post)

Thu Dec 29, 2016, 05:43 PM

Dec 2016

...I hate to be the bearer of bad news, but this is a long, obfuscated way of saying "They clicked on stuff they shouldn't have." The 9 pages of 'procedures' are...literally the very basic descriptions of what every sysadmin should already be doing. The amount of new (or even 'interesting' from a technical point of view) approaches zero (although seeing it all so neatly packed together is a nice touch, so I can't complain or anything about that part of it).

In short, here's the 'evidence'. "Russian hackers, using tools that every other nation on Earth uses, managed to get some info and leak it. Here's a list of things to do for basic internet security at an organizational level." FFS, the first set talks about BACKUPS.

I'm hoping there's more, because this is kind of sad. OTOH, most people will look at it and think it's scary or something, so there is that.

Rex

(65,616 posts)

6. Looking it over, the perps took the identities and passwords

Reply to Skidmore (Original post)

Thu Dec 29, 2016, 05:51 PM

Dec 2016

of government officials, disrupted point of access nodes, gained remote access to rummage around in anything they had a security clearance (the official).

They sent out mass spoofing emails that would install remote access tools, like key-mapping (so you can see what the person did that day on the PC) etc..

A lot of high level spying going on, with the Russians getting caught.

Igel

(35,300 posts)

11. Except that it's a shotgun approach.

Reply to Rex (Reply #6)

Thu Dec 29, 2016, 10:21 PM

Dec 2016

Spray thousands of people and hundreds of organizations with the spam.

If they click, you got them. If they don't click, there's no evidence they were targeted.

What makes it high-level was the target. I get that kind of spam routinely at all my email accounts. Yeah, that data on my how my kids did on their last chemical nomenclature test is really heady stuff. And my login credentials for that McGraw-Hill chemistry textbook? If the russkies get their hands on that it'll bring their knowledge of chemistry firmly into the 1900s. (Hey, I know they already have IUPAC nomenclatural norms, someplace I have a draft of the proposed Russian system from the late '70s. And for what it's worth, it's as awkward and clumsy in Russian as in English, perhaps more so. No, strike that, it's utterly inhuman(e) in all languages.)