Pwn All The Things
If you're interested in the technical aspects of #DNCHack, implant and attribution, here's @Crowdstrike's analysis: https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ …
-
Fixed IV/key in COSYBEAR means can traffic-decrypt from pcap. Clearly not written by folks who know crypto
#DNCHackpic.twitter.com/BrPLBNjli9
-
-
lolwtf? COSYBEAR operators apparently are lame script kiddies. Clearing event logs is like the worst opsec
#DncHackpic.twitter.com/KW2AA1iW7a
-
Serious Q: What AV does DNC run? How did it possibly miss an implant clearing win-event logs w/ WMI persistance?pic.twitter.com/bls5QPOn8R
-
For some reason
@CrowdStrike listing IOCs as SHA256, when industry standard is SHA1. Makes it harder to search for.pic.twitter.com/p2BQY92hXz
-
.
@CrowdStrike Also for some reason clearly have, but aren't sharing the binaries. Seems optimized to stop people checking their results. -
Btw, if you want to piggyback onto COSYBEAR, its startup module downloaded w/ fixed AES/IV dl-ed over HTTP (port80)pic.twitter.com/HejStU8MWi
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.