Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
DNC Leak: US Intel Chief Says It's Too Soon To Attribute Blame
Newest First  |  Oldest First  |  Threaded View
GonzSTL
50%
50%
GonzSTL,
User Rank: Ninja
8/1/2016 | 8:43:24 AM
Re: Coincides with my previous statement
We all know how expensive political campaigns can be. Campaign staff are usually comprised of political folks close to the candidate, and not necessarily looking all all aspects of the campaign, notably their information infrastructure. As with industry, infosec likely takes a back seat in the budgeting process. It is almost laughable to think that the DNC would provide this protection, given their candidate's recent debacle with email confidentiality. One would think that the other party however, would likely offer a bit more protection with their candidate more knowledgeable in business matters where all aspects of infrastructure are considered, and hopefully surrounding himself with not just political staff, but also business folks. I guess time will tell, because as you pointed out, most don't act until they themselves get burned. That is an axiom that makes infosec folks uncomfortable.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
7/31/2016 | 9:29:58 PM
Re: Coincides with my previous statement
Very good point. I would hope the RNC would learn from the event at the DNC less it happen to them in the future. But then again, I've seen first hand that most don't act until they themselves get burnt.
GonzSTL
50%
50%
GonzSTL,
User Rank: Ninja
7/29/2016 | 2:42:37 PM
Re: Coincides with my previous statement
There are really two issues at hand. First, the method and motive - although at some point in time it will be possible to attribute the breach/leak actors and their methods, it will be difficult to pin a motive short of a confession. At best, an educated guess will result. Second, the exposure resulting from the leak. Although it is difficult to have an end justify the means, the more important message gleaned is that a major political party disenfranchised 13 million or so voters. That, coming from the party that claims the other political party disenfranchises voters is certainly disingenuous. It does not end there. Now, there appears to be collusion between a political party and news media. People get their news from the media, but how genuine or trustworthy is that news if it is seriously influenced or even shaped by a political party? Although this is not Nazi Germany with Goebbels at the helm of their propaganda machine ... it does resemble it, just with different actors. Here is a more important question - was it a good or bad thing that the leak occurred, when it sheds light on an organization's activities? If so, how is that different from officials "hacking" into data sources to reveal their contents, in the interest of national security, knowing that the leak was a result of a hack (case in point, FBI and terrorist iPhones)? In these cases, there are blurred lines when attempting to define good and bad.

One thing is certain - the DNC is now a richer target environment because there is now a known trove of "juicy information", so they had better be on their toes. Additionally, the RNC should be increasingly alert because their opponents will be searching for their "juicy information" to counterbalance that which was exposed about the DNC. A digital information war by proxy, as it were.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
7/29/2016 | 1:58:57 PM
Re: Coincides with my previous statement
I agree that another dump of emails will most likely occur soon. As for there not being a motive I would find that difficult to believe in this case. For a cause such as a cyber threat or hack there is normally an effect that the hacker is trying to achieve.
theb0x
100%
0%
theb0x,
User Rank: Ninja
7/29/2016 | 1:43:26 PM
Re: Coincides with my previous statement
There doesn't necessarily have to be a motive. We all know the level of corruption there is within these organizations based on what has been exposed. I am predicting another dump of emails soon. This is just the surface...
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
7/29/2016 | 1:06:17 PM
Coincides with my previous statement
This coincides with a previous statement I made for the quick hit "Russia Likely behind DNC Breach says FBI." (I tried linking the article but the post window would not accept it.)


There haven't been enough parameters defined to assess motive.


News
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
Slideshows
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
Commentary
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Take me to your BISO 
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-20538
PUBLISHED: 2021-05-10
IBM Cloud Pak for Security (CP4S) 1.5.0.0 and 1.5.0.1 could allow a user to obtain sensitive information or perform actions they should not have access to due to incorrect authorization mechanisms. IBM X-Force ID: 198919.
CVE-2021-20559
PUBLISHED: 2021-05-10
IBM Control Desk 7.6.1.2 and 7.6.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199228.
CVE-2021-20577
PUBLISHED: 2021-05-10
IBM Cloud Pak for Security (CP4S) 1.5.0.0 and 1.5.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force I...
CVE-2021-29501
PUBLISHED: 2021-05-10
Ticketer is a command based ticket system cog (plugin) for the red discord bot. A vulnerability allowing discord users to expose sensitive information has been found in the Ticketer cog. Please upgrade to version 1.0.1 as soon as possible. As a workaround users may unload the ticketer cog to disable...
CVE-2020-13529
PUBLISHED: 2021-05-10
An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.