You Have Around 20 Minutes To Contain a Russian APT Attack (zdnet.com)

When a Russian nation-state actor attacks a government or a private organization, they have about 20 minutes to detect and contain the attack. From a report: New statistics published today by US cyber-security firm Crowdstrike ranked threat groups based on their "breakout time." "Breakout time" refers to the time a hacker group takes from gaining initial access to a victim's computer to moving laterally through its network. This includes the time the attacker spends scanning the local network and deploying exploits in order to escalate his access to other nearby computers.

[...] According to data gathered from 2018 hack investigations, CrowdStrike says Russian hackers (which the company calls internally "Bears") have been the most prolific and efficient hacker groups last year, with an average breakout time of 18 minutes and 49 seconds.

Comments

20 minutes?

[110010001000]

With enough vodka I do it in 10.

Re:20 minutes?

[Anonymous Coward]

With enough vodka I do it in 10.

That's what she said.

Re:20 minutes?

[Red_Forman]

I can do it in two. /Scrapper-142

Re:20 minutes?

[Anonymous Coward]

It's how msmash "edits" these stories, too. Idiot scarewords and clickbait, idiot summary full of repetition, leaving the reader disappointed and annoyed, wondering who's the bigger idiot: The reader or the "editor". Yeah, truly a work of the current "editors".

Re:20 minutes?

[Anonymous Coward]

So you admit you are a russian spy?

The same dudes that "investigated" the DNC server?

[Anonymous Coward]

Russia Russia Russia Russia Russia Russia

russia Russia Russia Russia

It was her turn! Waaah wah wahhhh

'APT' attack?

[Necron69]

I admit I had to Google that one. Stupid article doesn't explain the name at all, and here I was thinking we had some big new Debian/Ubuntu vulnerability.

- Necron69

Re:'APT' attack?

[aaarrrgggh]

While it didn’t register, I was able to come up with Advanced Persistant Threat on my own given the summary.

Re:'APT' attack?

[Anonymous Coward]

Advanced persistent threats have been using the APT acronym for at least a decade now. If you're going to read about computer security, don't blame the article just because you don't know a common term.

Re:'APT' attack?

[retchdog]

well, shit! look at the brain on aaarrrgggh. you are one smart motherfucker, aaarrrgggh!

Re:'APT' attack?

[Anonymous Coward]

Thats because the article is hand waving pseudo-technical sounding clickbait horse shit to keep this Russia nonsense alive.

Or it could be you're just that ignorant.

APT is a term that has been around for fucking years now, and is well-known within the security community. Calling that "pseudo-technical" clickbait horse shit does nothing but showcase your stupidity. Be thankful they didn't use really advanced terms like "DNS" and "AD" to further confuse you.

Re:'APT' attack?

[Anonymous Coward]

Thats because the article is hand waving pseudo-technical sounding clickbait horse shit to keep this Russia nonsense alive.

Your grammar is pretty good for someone who lives off the crumbs that fall of the oligarchs table.

Re:'APT' attack?

[tomhath]

Which doesn't change the fact that the article really *is* clickbait horse shit to keep this Russia nonsense alive.

Re:'APT' attack?

[Anonymous Coward]

Oh, shut the f*** up. APT has been around for two decades now. What's next? Are you gonna complain about not explaining spelling out TCP or XML? Get over yourself.

Re:'APT' attack?

[Anonymous Coward]

It's not nonsense when tens of cyber-security firms say the same thing.

Re: 'APT' attack?

[Anonymous Coward]

https://en.m.wikipedia.org/wiki/TCP

Re:'APT' attack?

[Anonymous Coward]

So you are implying that Russia does not have any hackers capable of this?

Re: 'APT' attack?

[Anonymous Coward]

Lots of people say their religion is the right one, too.

Re:'APT' attack?

[Anonymous Coward]

The main takeaway is non-trivial info. On average it takes 20 minutes between when a foothold is established to lateral movement inside the target net. This is part of the kind of info needed for effective Incident Response, defense strategies, etc. Not claiming its deep. but its not pure "horse shit" either.

Re:'APT' attack?

[Anonymous Coward]

No. Read it again.

Addendum:

"An advanced persistent threat (APT) is a prolonged, aimed attack on a specific target with the intention to compromise their system and gain information from or about that target."

Re:'APT' attack?

[Anonymous Coward]

The only thing that's nonsense is that it's all about Trump and Russia.

The non-nonsense is that Russia is seeking to divide and conquer in every single western democracy by trying to pit us against each other. It's all part of the grand plan for revolution.

Editing ...

[Anonymous Coward]

What is an APT? Is it APK's Bolshevik cousin?

And how long do I have if it is a simulated

[Anonymous Coward]

"Russian" attack by NSA? 20 minutes, or less?

Re:And how long do I have if it is a simulated

[gweihir]

The NSA is probably outsourcing these attacks not to make them cheaper...

Re:And how long do I have if it is a simulated

[Anonymous Coward]

20 minutes? nukes only gave us 4 minutes, how is this progress?

Re: DRUMPF

[Anonymous Coward]

Orange man bad!
Orange man bad!
Orange man bad!

Honeypots

[goombah99]

I've wondered for some time why Honeypots are not a near-universal solution to this. That is, each router can host a bunch of fake servers with real IP addresses on the network then watch for intrusion attempted or real on these fake nodes. You don' t need a lot of horsepower backing the fake nodes since they are not doing anything except mimicking a normal level of net traffic to other computers so it's not a burden on the system or the routers. And if one was worried the hackers could eventually learn to spot these virtual nodes in the routers (perhapsvia hacking the router itself), then one could also sprinkle in a few real computers on the network acting as honey pots.

In any event, any attempt to break in or a successful one on a honey pot, is 100% evidence the network is experiencing lateral intrusions and you just shut it down immediately.

What's the catch?

Re:Honeypots

[fustakrakich]

What's the catch?

Headlines, drama, intrigue, excitement! We need these stories to keep our eyes on the prize.

Re:Honeypots

[Shaitan]

"What's the catch?"

Time, effort, resources. This is all very very expensive in all three areas since devs are being used as part-time admins it only gets worse.

Re:Honeypots

[N1AK]

I can't help but think there will be some obvious answer, but for once this is a suggestion on Slashdot that does seem to make quite a lot of sense. You can put a lot of security in place, but a lot of the escalated response steps are often manual. If my firewall IPS detects something it can stop that traffic, but a larger response would need to be triggered by an employee and we don't have a24/7 IT Ops desk so it could be 10+ hours between the first IPS and someone acting. If you're typical attack happens over a day this isn't a big issue, but less than a couple of hours...
I can see some headaches about making sure your honeypots don't trigger lockdowns on unintended safe activity, and you'd have to ensure the honeypots were obvious enough they didn't get missed while also not being obviously honeypots which may be a hard thing to balance.

Re:Honeypots

[jbmartin6]

It's not quite so simple. From what I've seen in pen tests and attacks, fake network nodes are not effective. Attackers aren't blindly flailing around breaking into whatever host they find. They are following various bits of information which they find on each link in the chain. Either by examining domain structures, local documents on a workstations, and the like. At least you would have to add your honeypots to AD or other information sources so attackers would find them, then tune out all the noise from legitimate tools and processes which try to access your honeypots for network inventory, vulnerability scans, host management, etc. Deception as a defense strategy is not a bad idea, it just takes some thought to put it where attackers are likely to find it but legitimate process or curious users don't stumble across it. Meanwhile, AD and system admins are cautious about injecting anomalous data into their babies.

Some folks are using virtual infrastructure to place fake workstations around, so that attackers in the early 'get any Windows credential hash and see where it leads' can trip across them and set off alarms. This is aimed at tools like Responder and the like which try to get other nodes to send them an authentication exchange. One thing that should exist, and AFAIK does not, is a way to add well disguised fake credentials to the local Windows system, since that is usually the first place an attacker will look once they gain their foothold. Their are commercial tools which will do this, for a price, but no reliable way to make a convincing decoy on the cheap.

Re:Honeypots

[Anonymous Coward]

Give this a watch. Great presentation talking about exactly this and how to do it super cheap. Some really neat ideas.

https://www.youtube.com/watch?v=aeBMbedxgO4

Re:Honeypots

[ctilsie242]

The catch is that you need manpower to actually have someone look at the honeypots, declare there is an attack in progress, and start disconnecting stuff. However, in most IT environments, not many employees will actually do so unless they have 100% evidence to do so, for fear they will be fired for crying wolf. In fact, IT people may get fired regardless of catching the attack in progress because "it happened on their watch."

For a small startup with C-level people, this would work and even provide some entertainment. However, for a lot of companies where the C-levels actually will make a tidy profit by shorting their stock before they announce to the public they were compromised, it likely would not work.

Re:Honeypots

[Anonymous Coward]

Your honeypot has to have aspects that make it look real, such as outgoing connections to real-world, identified as valid IP addresses with a data amount that is appropriate, at any given time of day, with a certain amount of unique but not garbage data, generated responses expected when something blatant happens (say, a very loud and clumsy exploit attempt in the honeynet), etc.

I'd wager that many people who put out the honeypot have in filled with spoiled honey (or no honey)

Re:Honeypots

[Anonymous Coward]

"devs are being used as part-time admins"

But you get a snazzy dev-ops title to go with it!

Re:Honeypots

[Anonymous Coward]

The catch is that it takes effort to set up honey-pots. Just blatantly lying your eyes out on national TV and media about supposed evil Russians and Iranians to keep the narrative going costs basically nothing.

Re:Honeypots

[Anonymous Coward]

The catch is that you need manpower to actually have someone look at the honeypots, declare there is an attack in progress, and start disconnecting stuff.

No. That's the HIPS's job. It finds a session or traffic which should not be there, instant firewall rule applied to the edge appliance. A few minutes to set up. A few miliseconds to stop external originating incidents. EzPz.

So, so many people on slashdot don't know a damn thing about security. 90%+ of posters here easily.

Re:Honeypots

[Anonymous Coward]

Wow cynical! Much brave.

Re:Honeypots

[Anonymous Coward]

Wow democrat bot! Much surprise!

Re:Honeypots

[Anonymous Coward]

Assuming, smartypants that your wonderful HIPS list of signatures has a signature for the attack. It's only barely above script kiddie levels of skill to be able to write non-detectable implants. Even scans can be hidden. "Living off the land" is a thing.

Re:Honeypots

[Anonymous Coward]

the catch is that the red teamers are smarter than the blue teamers.

Re:Honeypots

[Anonymous Coward]

Well, Roger Grimes agrees with you. He's been promoting honeypots as a security solution for years now.

Example:
https://www.csoonline.com/article/3128818/data-protection/10-decisions-youll-face-when-deploying-a-honeypot.html

IIRC he has always lamented that honeypots aren't a near-universal solution.

Re:DRUMPF

[Anonymous Coward]

Nobody "stole" any elections. Hillary (It's Her Turn) Clinton lost in the same way as she lost to Obama, by being Hillary. If she's the best the Democrat party can deliver, the Democrat party will be out of office even if Drumpf resigns and is imprisoned.

Of course, this time the Democrat party can try with Pocahontas...

Arrogant President Trump

[Anonymous Coward]

Will mock handicapped reporters and tweet insults that make you feel sick

Re:Arrogant President Trump

[Anonymous Coward]

He did not insult a handicapped reporter. He was mocking someone in his speech and, to convey their level of intelligence, made a face and a spastic hand motion. The target of his insult was not handicapped. He's done the same thing many times, at non-handicapped people. There just happened to be a random handicapped reporter attending, and the misconstrueing bagan...

As for insults, he gets as good as he given (except that he's a bit better at making it funny).

Re:Arrogant President Trump

[tehcyder]

He did not insult a handicapped reporter. He was mocking someone in his speech and, to convey their level of intelligence, made a face and a spastic hand motion. The target of his insult was not handicapped. He's done the same thing many times, at non-handicapped people. There just happened to be a random handicapped reporter attending, and the misconstrueing bagan...

As for insults, he gets as good as he given (except that he's a bit better at making it funny).

At the risk of stating the obvious, making "a face and a spastic hand motion" that equates physical disability with low intelligence is offensive in itself, regardless of who you're talking to.

Re:Arrogant President Trump

[wildfish]

whoooshh .. "and, to convey their level of intelligence, made a face and a spastic hand motion" The insult in your statement here does not require the presence of any particular type of person. The insult is the conflation of certain physical traits with intelligence.

Re:Arrogant President Trump

[Anonymous Coward]

President Obama mocked the Special Olympics on the Tonight Show.

Where were you then?

Probably in Russia hacking computers

Re: Arrogant President Trump

[Anonymous Coward]

I mean that handicapped person was a reporter that said some really mean things about Trump. If you can pick a fight then don't complain about your handicap. Everyone has some sort of handicap. Its not a free ticket to act like an ass and get away with it.

Re:Arrogant President Trump

[Anonymous Coward]

making "a face and a spastic hand motion" that equates physical disability with low intelligence is offensive in itself

So Nancy Pelosi offends you.

Re:Arrogant President Trump

[Anonymous Coward]

Very much so.

Re:Arrogant President Trump

[Anonymous Coward]

President Obama mocked the Special Olympics on the Tonight Show.

First, he claimed his bowling was like the Special Olympics, which is not mocking them, but not nice either. He apologized before the clip even aired! Trump doesn't apologize for anything offensive he does. Making fun of the way Puerto Rico is properly pronounced was especially low.

Re:Arrogant President Trump

[Anonymous Coward]

a blatant lie to cover up The Dotard in Chief's bigotry. Donald Trump's bigotry is well documented. In this case https://www.politifact.com/truth-o-meter/statements/2016/oct/20/donald-trump/donald-trump-says-hillary-clinton-wrong-say-he-moc/
https://www.politifact.com/colorado/statements/2016/jun/13/priorities-usa-action/pro-clinton-super-pac-ad-trump-mocked-disabled-r/

Re:Arrogant President Trump

[Anonymous Coward]

At the risk of stating the obvious: only if your audience doesn't understand that relying on visual metaphor doesn't require it to be true. There is vast difference between being offensive, and someone having cause to take offence - in particular if they're doing it on someone else's behalf.

But if you are going to complain about the gesture. I hope you also complain about anyone who says 'doh when quoting an opponent - as if they're mentally handicapped.

Re:Arrogant President Trump

[Solandri]

At the risk of stating the obvious, making "a face and a spastic hand motion" that equates physical disability with low intelligence is offensive in itself, regardless of who you're talking to.

So is calling Bush a chimp. I'd have a lot more respect for the left's criticism of Trump's offensive remarks, if they would at least criticize their own for making equally offensive remarks.

It is wrong to make fun of a person for things they have no control over (their appearance, disabilities, race, gender, etc), no matter who is doing it and who the target is. "My guy" doesn't automatically get a free pass, "your guy" doesn't automatically become a valid target. It is always wrong.

Re:Arrogant President Trump

[Anonymous Coward]

They tried to say he was making fun of a specific reporter in a wheelchair, that he probably didn't even know was in the audience. It was all a very big stretch. Was it the best thing he could have done at the time? No. Has everyone in the world made a similar remark or action that could have been construed (albeit very loosely) as offending someone? Yes. In the grand scheme of things, that was extremely benign but they chose to make it such a big issue that they've drawn attention away from legitimate issues.

Re:Arrogant President Trump

[Anonymous Coward]

Revisionist history has come a long way...

Re:Arrogant President Trump

[Anonymous Coward]

"Trump may deny that he intentionally mocked Kovaleski for his disability, but many Americans believe his remarks amounted to mocking, and we concur that that’s a reasonable -- indeed, perhaps the only -- interpretation of his actions."

That is not documenting facts, that's weighing in with an opinion.

Just because you agree with politifact's conclusions doesn't mean what they say is a fact.

Re:Arrogant President Trump

[Anonymous Coward]

At the risk of stating more of the obvious... I feel like the standards we apply to how the POTUS should be conducting himself are just a wee bit different than the standards we expect of random twitter pundits or even media personalities. Which side of the isle you lean towards has nothing to do with that.

Re:Arrogant President Trump

[Anonymous Coward]

fuck off you god damn russian troll

Bullshit

[gweihir]

They have a few years actually building secure infrastructure instead of the insecure crap most have in place. If you are not prepared, even advanced script-kiddies can get in.

Re:Bullshit

[Anonymous Coward]

Yeah. The majority of "hackers" are in fact advanced script kiddies. Reason is this: the scripts are way more advanced than what most lone wolf working in the basement writing code from scratch dudes could come up with.
e.g. metasploit, powershell empire and the like.

You don't have 20m

[guruevi]

Once you've been breached you're at least 2-3 years too late to contain the issue. These "nation states" hackers typically aren't the best in the field. They get in through inept security IT people above all else.

These companies have something to sell you - containment is a poor security strategy but sadly most companies won't invest until something happens so containment is their only strategy.

Re:You don't have 20m

[Freischutz]

Once you've been breached you're at least 2-3 years too late to contain the issue. These "nation states" hackers typically aren't the best in the field. They get in through inept security IT people above all else.

Seems to me then that they are exploiting the biggest un-patched vulnerability in the system. That is not a sign of lacking skill, it is a sign of intelligence. You don't launch a frontal assault on the city walls thorough a hailstorm of arrows and cannon balls when you can sneak in through the sewers and surprise the defenders. What the Russians have done is send their intelligence services after best criminal hackers and confront them with a choice, either they drop everything and go to work for the intelligence services whenever they are needed while the security services make sure they suffer no unwanted attention over their side-business or ... well let's just say that American shit-hole prisons are a luxury spa compared to Russian ones.

Re:You don't have 20m

[Anonymous Coward]

Yes, there should be only minor lateral movement within a service or excepted risk boundaries; if the infrastructure is architected and implemented properly.

Perhaps they shouldn't run there web server and database on the same physical box, for example.

Re:You don't have 20m

[mlyle]

Oh, come on. The personnel may be uneven, but nation states both have very, very nasty toolkits to assist spread, concealment, and information extraction... and they buy zero-days.

An initial foothold on the network can only be prevented by A) inability to be exploited by undisclosed exploits and B) perfect end-user practices to not inadvertently cooperate with attackers. Otherwise, we're in the scenario described above.

Duh!

[Anonymous Coward]

Once they are in your system, they run a script. It should not take even 20 minutes.

Re:DRUMPF

[liquid_schwartz]

Nobody "stole" any elections. Hillary (It's Her Turn) Clinton lost in the same way as she lost to Obama, by being Hillary. If she's the best the Democrat party can deliver, the Democrat party will be out of office even if Drumpf resigns and is imprisoned.

Of course, this time the Democrat party can try with Pocahontas...

They know this, thus the push for importing millions of people illegally then making them voters. If you can drown out the actual citizens with a loyal constituency then you win. It will destroy the country and wreck standards of living but hey, you can't make an omelette without breaking a few eggs.

Eagles are missing from the list!

[Anonymous Coward]

I want to know where USA falls on their list.

Re:Eagles are missing from the list!

[gmuslera]

It would be Elephant instead, even if you don't see it in the room.

Re:Eagles are missing from the list!

[Archtech]

I want to know where USA falls on their list.

It isn't on their list - of course. Americans would never do anything bad or harmful.

Re:The same dudes that "investigated" the DNC serv

[Anonymous Coward]

Crowdstrike story

They have a history of blaming Russia for every hack even if Russia was not involved. They have 2 big cases where they falsely blamed Russia, one a hack in the Ukraine, the second the DNC email server. That's right, the DNC server that the FBI never examined, we were told was hacked by Russia by Comey. Well the people who told him admitted they lied, before Comey came out and told Congress under oath.

So Crowdstrike yelling "RUSSIA!!!" isn't new. Them providing proof would be.

Re:The same dudes that "investigated" the DNC serv

[Anonymous Coward]

Back to your handlers Ivan.

Stop using Microsoft products

[Anonymous Coward]

Stop using Microsoft products, you fucking imbeciles.

Re:Stop using Microsoft products

[tepples]

It's pretty hard to avoid Azure or GitHub if you work in computer software.

Re:Stop using Microsoft products

[Anonymous Coward]

Dirty cow much?

Poppycock

[jbmartin6]

Well, Crowdstrike sells endpoint detection and response software, so the claim has to be taken with a grain of salt. But the real problem lies here:

"Breakout time" refers to the time a hacker group takes from gaining initial access to a victim's computer to moving laterally through its network...The "breakout" metric is crucial for organizations, as this is the time they have to detect infections and isolate hacked computers before a simple intrusion turns into a compromise of its entire network.

Getting lateral movement is just one of the early steps in the chain, not the game over moment. Nor does it mean 'the entire network' is compromised. Attacker still has to locate what they need on the network and then get access to it, and then exfiltrate it (for stealing data) or break it. In other words, you still have a lot more than 20 minutes to detect and respond effectively.

So why not...

[Anonymous Coward]

1. - Compartmentalize your network

Separate user-space from server-space from dev-space. Use hardened firewalls within the organisation and within the server-space to slow the spread of any attack.

2. - Educate the salesmen and senior management

The people most likely to have weak passwords are senior managers and salesmen, either because they're too busy worrying about the money, or because they've got their heads up so far up their ***** that they can't see the real world. Be sure to have the CIO on board before you stop them using their wives and children's names for passwords.

3. - Install honeytraps with a canary

Deliberately leave some VMs on the network with suitably encouraging names (Fin_Dev_01, Fin_DB01, etc) which have a canary. When the canary expires the CIO decides whether to press the big red button and shut down the internal firewalls.

4. - There's no substitute for a cold backup when one of your key servers is trashed during an attack.

Re:DRUMPF

[Anonymous Coward]

They're already setting that up. Bankfraud Bernie just announced his policy of NO REFUNDS in 2020, so when he bitches out of the primaries of a party he doesn't even belong to, the less intelligent of his supporters will surely be on the warpath for Warren.

Block the source of the attacks easily... apk

[Anonymous Coward]

Via APK Hosts File Engine 2.0++ 64-bit for Linux/BSD h t t p : / / a p k . i t - m a t e . c o . u k / A P K H o s t s F i l e E n g i n e F o r L i n u x . z i p

Yields more security/speed/reliability/anonymity vs. any 1 solution (99% of threats use hostnames vs. IP address most firewalls use) more efficiently/FASTER + NATIVELY 4 less!

Vs. "Bolt on 'MoAr' illogic-logic" slowing u hosts speed u up 2 ways: Adblocks + Hardcode fav. sites u spend most time @ vs. competition w/ security bugs (DNS/AntiVir) + overheads slowing u (messagepass 'souled-out' to advertisers easily detected & blocked addons + firewall filtering drivers) & their complexity leads to exploit!

* ONLY 1 of its kind in GUI 4 Linux (soon 4 MacOS)!

99++% of ATTACKS USE HOSTNAMES vs. IP Address!

APK

P.S.=> Protects vs. scripts/trackers (kernelmode faster vs. usermode slower NoScript vs. 3rd party script)/ads/DNS request tracking + redirect poisoned or downed DNS/botnets/malware download/malcript/email malpayload

Hosts efficacy recently vs. threats

[Anonymous Coward]

See subject & results in https://tech.slashdot.org/comm... https://yro.slashdot.org/comme... https://it.slashdot.org/commen... https://linux.slashdot.org/com... https://news.slashdot.org/comm... https://apple.slashdot.org/com... https://it.slashdot.org/commen... https://it.slashdot.org/commen... https://it.slashdot.org/commen... https://it.slashdot.org/commen... https://it.slashdot.org/commen... https://it.slashdot.org/commen... https://search.slashdot.org/co... https://it.slashdot.org/commen... https://it.slashdot.org/commen... https://tech.slashdot.org/comm... https://tech.slashdot.org/comm... https://apple.slashdot.org/com... https://tech.slashdot.org/comm... https://it.slashdot.org/commen... https://tech.slashdot.org/comm... https://tech.slashdot.org/comm... https://science.slashdot.org/c...

* That's only recently while I've been on Linux (July 2018) & 100's of times vs. MANY other botnets/malwares etc. in the past circa 2006-early 2018 while I was on Windows: CONCRETE VERIFIABLE UNDENIABLE REALITY (see those links as proof)! ... & that's ONLY what /. reported on (there were FAR more)

APK

P.S.=> "It's working: Neville... it's working!" - "I AM LEGEND" + HOSTNAME USE IS DOWN IN MALWARE https://unit42.paloaltonetwork... (my ACT OF FAITH is JUSTIFIED by fact)... apk

Security pros etc. QUOTED on hosts

[Anonymous Coward]

"classic Windows hosts trick to block the Coinhive or Crypto-Loot domains" - https://www.bleepingcomputer.com/news/security/a-new-player-joins-coinhive-on-the-browser-cryptojacking-scene/ - BLEEPING COMPUTER

ZD NET http://www.zdnet.com/article/how-to-use-a-hosts-file-to-improve-your-internet-experience/ "Hosts files really shine by letting you block ads, spyware sites, malware sites, & tracking sites"

SANS ("A related approach to the DNS issue is to create a hosts file on each system that sends requests for spyware to some place else" hosts by myself & RAMU right @ START of "malware explosion" mid 2005 on) https://isc.sans.edu/forums/di...

Aryeh Goretsky/ESET/NOD32: hosts = good security https://it.slashdot.org/comments.pl?sid=7442373&amp.cid=49747129/

Oliver Day (SYMANTEC/SECURITYFOCUS) http://www.securityfocus.com/columnists/491/

Spybot S&D uses hosts.

APK

P.S.=> Malwarebytes' hpHosts hosts & RECOMMENDS my program forum.hosts-file.net/viewtopic.php?f=5&t=4290

Even CHINA copied me (vs. DNS down/redirected)

[Anonymous Coward]

Who did it 1st: China or me? I did - dates are my proof https://theregister.co.uk/2017... w/ the FACT China rampantly STEALS U.S. Intellectual properties & military secrets!

* IMITATION truly IS the SINCEREST FORM of FLATTERY!

(... & proves hosts work vs. DNS faults in tracking you via dns request logs (since you avoid it & resolve FASTER locally using hosts) + DNS being downed OR Kaminsky REDIRECT security flaw misdirected poisoned (or vs. DNSChanger))

US DHS issues DNS redirect is HUGE danger (not w/ hosts vs.) https://threatpost.com/gov-war...

APK

P.S.=> Folks, It's NOT EASY being "World-Class" like me (lol - 100,000++ users prove it for me) - enjoy the fruits of my labors for FREE + going FASTER/SAFER/MORE RELIABLY online (w/ a bit more anonymity too via my program)... apk

Registered /.ers reviews #1/5

[Anonymous Coward]

Your software is just fine - well written, functional... I'm going to continue using the Host File Engine by mmell February 17, 2017

Your premise that hostfiles are a good way to deal with advertising and malvertising is quite valid - by JazzLad April 20, 2016

his hosts program is actually pretty good by xenotransplant August 10 2015

his hosts tool is actually useful for those cases in which one does indeed want to locally block stuff outright while consuming minimum system resources by alexgieg September 25 2015

I like your host file system by Karmashock September 09 2015

that APK guy, I use his host file by rogoshen1 Tuesday March 03, 2015

I personally use a HOSTS file blocker produced from a genius called APK by 110010001000 October 27 2017

* For the Win32/64 model!

APK

P.S.=> Linux model's faster/more efficient/better MERGE feature too - More coming... apk

Registered /.ers reviews #2/5

[Anonymous Coward]

Apk has the answer for that - really... kill automatic updates by adding a hosts file entry setting updates.steam.com or whatever to 127.0.0.1. You have to find the right hostname for each software you want to block updates on by raymorris (2726007) on Friday July 06, 2018

APK your posts on this and the hosts file posts, and more, have never been in error and/or bad advice by BlueStrat (756137) on Wednesday June 21, 2017

I support APK's stand on the hosts file and can't see why it's not used more than it is. My hosts file is 144247 lines long (4,332 Kb) it & a firewall serves me very well - by Trax3001BBS (2368736)

ABP is insufficient as a solid hosts file does everything APK reminds us about fast turtle September 17 2013

You need APK's hosts file - by Teun (17872) on Wednesday August 06, 2014

* For the Win32/64 model!

APK

P.S.=> Linux model's faster/more efficient + BETTER merge feature - More coming... apk

Registered /.ers reviews #3/5

[Anonymous Coward]

APK is totally right on this count. Adblock Plus on Firefox mobile is a dog on older, or lower end, phones. A hostfile based adblocker makes for a much better experience in this context. Of course, your phone has to be rooted, which isn't the case with Firefox + adblock." - by chihowa on Saturday May 16, 2015

APK solution STILL relevant Thud457 June 11 2015

In a footnote, I would like to note that I find your hosts file admirable - by vel-ex-tech (4337079) on Tuesday November 24, 2015

APK's monolithic hosts file is looking pretty good at the moment - by Culture20 on Thursday November 17

you're right about hosts files - by drinkypoo (153816) on Thursday May 26

APK, I know people give you a lot of shit regarding hosts, but please don't ever stop - by nasredin (958927) on Friday June 12, 2015 @03:34PM

* For the Win32/64 model!

APK

P.S.=> Linux model's faster/more efficient + BETTER merge feature - More coming... apk

Re:The same dudes that "investigated" the DNC serv

[Anonymous Coward]

Why Crowdstrike, or FireEye are treated as authoritative experts by the media when it comes to analyzing network attacks by "nation-state actors" is beyond me. AFAIK, they're rarely right about anything.

Registered /.ers reviews #4/5

[Anonymous Coward]

APK is kinda right... I've given up on JS based adblocking and gone to blackholing in /etc/hosts, just like it was back in the 90s. The computational load has gotten intolerable for any ad-blocking using JS. I've tried his hosts file generating software. It works. - by bmo (77928) on Thursday October 15, 2015

get around to 'installing' a hosts file list, not sure which one, likely the one from someonewhocares.org. If it works as well as what I used for a while about ten years ago, I'll be happy. And grateful to APK for the lesson and the reminder. - by kermidge (2221646) on Wednesday March 27

I actually went and downloaded a 16k line hosts file and started using that after seeing that post, you know just for trying it out. some sites load up faster. - by gl4ss (559668) on Thursday November 17

dammit MS, you proved APK right about something by lgw

* For the Win32/64 model!

APK

P.S.=> Linux model's faster/more efficient + BETTER merge feature - More coming... apk

Registered /.ers reviews #5/5

[Anonymous Coward]

(APK) is still right a hosts file really does work. It even blocked a some of the video ads that were inserted into a stream OrangeTide February 10 2016

the Host File Engine performs exactly as promised - by mmell (832646) on Thursday February 16, 2017

I do use APK's host file on all my systems at home by OrangeTide December 01 2017

I've never tried to belittle (APK's work), I've flat out said it's good - by BronsCon (927697) on Thursday February 11, 2016 @06:48PM (#51491263)

(Toss on 100,000++ users worldwide too!)

* For the Win32/64 model!

APK

P.S.=> Linux model's faster/more efficient + BETTER merge feature... apk

Re: DRUMPF

[Anonymous Coward]

*cheers in NPC*

Let's make this about me, OK?

[CaptainDork]

Mobil Oil, ca. 1986. We had a fractional T1 connecting Beaumont, Dallas and Reston, Va.

I was senior network engineer in Beaumont. Got a call from Dallas that a hacker* was crawling all over the place.

I pulled the Ethernet cable on my Cisco router while I was on the phone.

Reston started calling, freaking out. It never occurred to the other blokes that bad guys ride wires.

*The hacker was actually a Joe Cool Kollidge Kid working for us who hooked Mobil to Lamar University in Beaumont to his home computer.

Ah, the learning days. I miss those.

Nice graphics

[CustomSolvers2]

The linked article is a masterpiece! So cool names and animals for the state actors! And look at the Mummy Spider below! What a tremendous job! 20 minutes, 3 hours or 5 years, it doesn't matter! Simple values which anyone could easily input into that well-crafted graphical heaven! I don't know what you are selling, but I want 10 of each! Please, take my money!! LOL.

Re:Nice graphics

[Archtech]

As Caitlin Johnstone lucidly explains, when it comes to propaganda facts count for nothing - what you need is a good hot exciting story.

https://caitlinjohnstone.com/2...

Re:Nice graphics

[CustomSolvers2]

As a terrible salesman, my opinion about what should (not) be done is worth nothing. As a random viewer and potential client, I can say that a so marketing-intensive setup is very unappealing to me. Much more when dealing with a theoretically "cold" reality, where accurate and properly-justified numbers seem the only important thing. If you are selling cakes, slightly increasing the amount of sugar might be a good idea; but certainly not if you are selling steaks.

Impeach Pelosi!

[Anonymous Coward]

Nah, orange man good! Sign the petition to impeach Nancy Pelosi! She's a traitor to our great nation. Protect our border! Build the Wall!

Re:Impeach Pelosi!

[CAOgdin]

I can understand why you're an Anonymous Coward! Your politics are upside-down!

Re:The same dudes that "investigated" the DNC serv

[Archtech]

Nowhere in the article does it say anything about how Crowdstrike are supposed to have identified the attackers. But we do know that the CIA and NSA (to say nothing of other parts of the alphabet soup) have means of disguising their malicious handiwork as that of anyone else they please.

Would anyone like to suggest practical ways in which Crowdstrike could be certain about who is responsible for a given attack?

Re:The same dudes that "investigated" the DNC serv

[Archtech]

"WHY THE DNC WAS NOT HACKED BY THE RUSSIANS"

William Binney, former Technical Director NSA
Larry Johnson, former State CT and CIA

https://turcopolier.typepad.co...

apt-get 1998; threat 2006

[tepples]

APT has referred to Debian's package manager since 1998 or thereabouts. The earliest public citation for "advanced persistent threat" I can find in a cursory search is from US Air Force Colonel Greg Rattray in 2006.

ORLY 2

[jf_moreira]

Assuming you know **it about it.

Re:The same dudes that "investigated" the DNC serv

[Anonymous Coward]

Specific cases of identified attackers and the methods used to do so tend to be something you have to purchase the support contract to find out.

Pushing the whole Evil Axis too hard

[Anonymous Coward]

What is it, like 5 articles in the last 24 hours, pushing the whole evil Russia, evil China, and evil Iran attacking the poor, peaceful and friendly America narrative?

It's tiresome, and it's not working. You have several war criminals among your past presidents. Your intelligence agencies are basically state-sanctioned terrorist organizations, and you have no credibility left.

When Russia, China, and Iran are definitely proven of having hacked you, and your cyber sabotage organization NSA has stopped their activities, then you can complain, and we will listen.

US, China Internet attack legitimize Russian APT.

[dweller_below]

The US has been attacking multiple countries via the Internet for years. We did it first. We did it best. Yay US. Years ago, our doctrine was that Internet attack was a favorable option, because it had less unfortunate consequences than physical attack. But now, Internet can be much more devastating that physical attack. And the US has the most to lose in Internet attack.

The US economy is totally dependent on the Internet. Internet attack can cripple or destroy us. We can no longer afford to legitimize Internet attack. The past aggressive internet attacks by the US, China and Russia have legitimized Internet attack for all the remaining governments. EVERYBODY who has anything valuable, now gets a chance to receive targetted, remote attack by several governments, PLUS targetted attack by the many organized crime groups.

The US must formally cease undeclared war via the Internet. We must work with all other governments to ensure that we ALL stop waging undeclared war via the Internet.

Re:The same dudes that "investigated" the DNC serv

[Anonymous Coward]

Since when did having an authentic and reputable source matter to the corporate media?

Re:The same dudes that "investigated" the DNC serv

[Anonymous Coward]

What's up with slashdot lately? Russia, Huawei, China, Russia, Huawei, China, Russi, Huawei, China.

U.S. missing - article is BS

[Anonymous Coward]

China and North Korea accounted for almost half of all the nation-state attacks in 2018.

U.S.A. is missing from this list. The statistics are obviously B.S.

Re:DRUMPF

[CAOgdin]

Um...er....She Actually WON the voters' preference in the Election. It was the Electoral College that reversed that outcome! It's an anachronistic outrage that smaller-population states refuse to challenge, even in light of the Internet...which wasn't even a dream when the E.C. originally rode horseback to their Washington, D.C. meetings.

It needs to be abolished as archaic and unfair to voters. It's one of the reasons some adults refuse to vote...because their vote can be overridden by selected politicians!

Re:The same dudes that "investigated" the DNC serv

[Anonymous Coward]

You either trust people, or you don't. Having been ON the front-lines, I was gathering information with unique methods, which would've been revealed if the underlying facts we gleaned had been publicized. That what being a "spook" is all about: Finding out what they (e.g., Russians) are doing to harm (or try to harm) us, and working with professionals with other skills to create ways to put a stop to it...but never revealing HOW we found out!

Unless you are in (or have served in) one or more of the security agencies, you are unqualified to claim "fake news" because you're not on the "inside," where you'd have a completely different set of facts at your disposal. Yes, I had a price on my head in Russia (over 40 years ago!), and my colleagues from collaborating branches celebrated us for doing what we did, even though we became "no longer useful" because of that exposure. So, I was moved to public role in the Armed Forces Radio Service (American ratio for soldiers overseas) after I was no longer able to "hide in plain sight" while I found sources and milked them for information others in the agency needed to be able to do THEIR jobs protecting our nation and our citizens.

Re:Honeypots:

[Anonymous Coward]

How do you know they're NOT???

Re: DRUMPF

[Anonymous Coward]

Dey toooook our jobs!!!!!

Re:The same dudes that "investigated" the DNC serv

[Anonymous Coward]

What is it with this website and old tinfoil hat nutbags?

Shove off, grandpa. Just because you're no longer relevant doesn't mean we want to listen to your trite facebook shit.

Wow. Crowstrike is Genius!

[Anonymous Coward]

I bet they even used a clock to measure time.

*Start timer* Scan, run exploit framework, install software, clean up. Rinse and repeat. *Stop timer*

IT Sec has gotten so hyped everyone with an IQ over 90 that has seen the first Matrix movie has become an "Ethical hacker." or "Pen tester." and yet somehow real talent is harder to find than ever.

Re:DRUMPF

[sarren1901]

The whole idea behind the E.C. was to ensure a few big cities didn't decide who the President would be every four years.

If we really want to talk about how unfair the E.C. is, we can talk about how most states are winner take all. So you get 51% of the vote in a given state and you get EVERYTHING. It's one of numerous reasons why people would like to break up California and Texas as well.

The popular vote would change that but then the politicians would change how they run for office. If they knew it was popular vote they would just blow sunshine at the huge cities and ignore half the country due simply to numbers.

Which brings us right back to the founding fathers didn't want a handful of cities deciding the election every four years.

Re: The same dudes that "investigated" the DNC ser

[Anonymous Coward]

It's like economists. Politicians come up with policy first, then find an "expert" who will justify it to the public for them.

Re:US, China Internet attack legitimize Russian AP

[_merlin]

Nice sentiment, but the cat's out of the bag and you can't put the genie back in the bottle. Welcome to the brave new world where you have to assume anything connected to the Internet will be attacked, whether it's by your own government, another government, a competing business, a black hat, or kids doing it for the lulz. Yeah, I miss the old, friendly Internet as much as anyone, where we could run recursing DNS servers, open mail relays, TCP small services, and unencrypted web servers. But it hasn't existed for more than a decade now.

Re:DRUMPF

[Anonymous Coward]

What you said makes sense to me. It also is why if we're already on the subject of improving the electoral system I'd go for a parliamentary system with proportional representation. That leads to more parties in congress. In particular, (unlike winner takes all) its still rational to have parties focused primarily on the interests of the rural population & on smaller states. It also leads to coalition politics which in turn is more inclusive and more consensus oriented. Yet at the same time each vote has equal weight (unlike with the EC).

More lies from retarded bitch APK

[Anonymous Coward]

I see the retarded bitch Alexander Peter Kowalski is spreading more of his lies. His work does nothing against threats like this but that won't stop him from believing and saying it does. Hell it barely does anything against threats created by script kiddies with one week of experience and advertisers who hold a MBA. At 20 minutes his program is still churning through a bunch of out dated host files it downloaded from elsewhere. There are 2 kinds of security, there is the kind that protects your stuff from your kid sister and there is the kind that protects your stuff from state actors. All of APK's work falls in the kid sister category and he refuses to accept practices that actually do stop state level actors. Because of this no one should take his security advise.

Re: DRUMPF

[Anonymous Coward]

She won by 2.8 million votes national wide. She won California by 4.3 million votes. Without the electoral college, California would've reversed the other 49 state's choice.

And you want to abolish it. Because Orange Man Bad.

Re:The same dudes that "investigated" the DNC serv

[Anonymous Coward]

What's with your juvenile deflection.

"CrowdStrike says Russian hackers (which the company calls internally "Bears") have been the most prolific and efficient hacker groups last year, with an average breakout time of 18 minutes and 49 seconds."

Obviously the US has much better resources than some russian group.

Re:DRUMPF

[Anonymous Coward]

Nope, that's the excuse pseudo-historians try every time. The reality was physical logistics. Those have changed. The EC is obsolete.

Re: DRUMPF

[Anonymous Coward]

Fuck. Off. You. God. Damn. Russian. Paid. Agitator!