Russian Code Found In US Utility Computer

[nsaspook]

https://www.washingtonpost.com/worl...d5_story.html?utm_term=.af96f8f5c03a#comments

 

[zoobyshoe]

https://www.washingtonpost.com/worl...d5_story.html?utm_term=.af96f8f5c03a#comments

Thanks for posting this.

Do you know anything about "Neutrino?"

 

[nsaspook]

Thanks for posting this.

Do you know anything about "Neutrino?"

Really old school delivery system Java code for other malware systems.

Neutrino - связка эксплоитов
Друзья, предлагаем Вашему вниманию наш новый продукт, связка эксплоитов Neutrino.
Хотел бы перейти сразу к описанию и остановиться более детально на некоторых особенностях.

Translated by google as :
******************************************

Neutrino - a bunch of exploits
Friends, we offer you our new product, a bunch of exploits Neutrino.
I would like to go directly to the description and to stay in more detail some of the features.
...
Contacts
Jabber: xxxxxxxx_@_dont_click_xxxxxx.cz
ICQ: xxxxxxxxxx

 

[anorlunda]

When I worked in the power industry, I was considered as a radical reactionary. That was because I considered government (at all levels) as a singularly bad partner in IT and security issues. Today's story linked by @nsaspook seems to confirm my bias.

1. Information that government shares with industry is low quality. The Grizzly Bear signature sent out by DHS was insufficiently selective to prevent a false positive (neutrino identified as grizzly)
2. Information that industry shares with government will be mishandled and leaked. In this case it resulted in the Washpost "fake news" that scared the public and reinforces the anxiety that the grid is highly vulnerable. I expect that many fewer people will read and be influenced by the retraction, so the damage can never be entirely undone.

But even more basic, there is an unresolvable conflict inherent in any entity with both offensive (i.e. US Cybercommand) and defensive roles. USA critical infrastructure uses the same basic components as everyone else in the world. Unix variants, routers, hard disk drivers, PLCs, and so on. It is Cybercommand's duty to have the ability to penetrate and bring down the computers of any/all bad guys in the world. In practice, they can only achieve that if they have the capability to bring down anything anywhere, owned by bad guys or good guys. Therefore, I am forced to assume that any standards, software, or other information received from government has been mandated by Cybercommand to be compromised. Government can not tolerate secure computing because bad guys will get their hands on it. I see no possible way to resolve that conflict.