CBS confirms reporter Sharyl Attkisson’s computer breached

http://www.washingtonpost.com/lifestyle/style/cbs-confirms-reporter-sharyl-attkisons-computer-breached/2013/06/14/321b77f0-d504-11e2-a73e-826d299ff459_print.html

by rpm4321 • 13 years ago

61 69 13 years ago

washingtonpost.com

steven2012• 13 years ago

Is your computer waking up in the middle of the night a sign that it's being accessed? I've seen this with my laptop often, I have Windows 7, and I didn't think twice about it. Now I'm thinking twice...

socillion• 13 years ago

Windows Update is, I believe, scheduled for 3am by default. If connected to AC, it can wake up your computer to install updates. You can look into this more with the powercfg command (from an Admin console).

    powercfg -lastwake

"Computer waking up" is meaningless without controlling for updates and other factors, including dog/cat/mouse bumping into a mouse cable.

epochwolf• 13 years ago

If your desk isn't level or if you have a fan on, the mice could move enough to wake the computer. :)

kunai8• 13 years ago

It depends. Usually, on any Windows box, random sleep wakeups and unverified internet use is usually a sign of malware or a trojan horse. Running AVG twice can be enough to fix it, but sometimes, they've already penetrated the boot process to execute malicious code without you even knowing it. It's hit me 4 times so far, and this is WITHOUT accessing black hat websites, and WITH protection and startup utilities disabled. It could be TDSS.

tptacek19• 13 years ago

The dumbest script-bound teenagers will appear "sophisticated" to the Washington Post. How you know this attacker wasn't sophisticated: the Washington Post "detected" them.

Note: as was pointed out downthread, I'm being sloppy; CBS "detected" them.

mrschwabe3• 13 years ago

"forensic analysis revealed an intruder had executed commands that appeared to involve search and [removal] of data. This party also used sophisticated methods to remove all possible indications of unauthorized activity, and alter system times to cause further confusion."

Doesn't sound so dumb to me. Specifically removing data and then covering up traces of being there - sounds a little more than a 'script-bound teenager'.

And now, in light of NSA/PRISM - we have a good suspect is in a case like this. At the very least, there is grounds here to issue a suponea to the NSA since they should have plenty of data about her internet connection that could help in determining the responsible party.

tptacek19• 13 years ago

You think the forensics capabilities of the Washington Post have a chance of detecting NSA? You think if NSA breaks into a laptop, it would be apparent to a forensics person that they'd "covered up traces of being there"?

Teenagers had rootkits that swapped out system libraries to hide processes and binaries back in 1996. The very, very lame teenagers had utmp and wtmp editors to "cover up their traces".

It's worth taking a moment to examine your thought processes here. "Now, in light of NSA/PRISM, we have a good suspect"? We clearly do not.

pdeuchler• 13 years ago

Who profits from this breach?

I have a hard time believing any sort of script kiddy would risk major jail time and a high profile arrest for hacking into a journalists laptop for no profit.

The NSA/Gubberment however, does have quite a bit to gain from this information/deletion

tptacek19• 13 years ago

I have a hard time believing any sort of script kiddy would risk major jail time and a high profile arrest for hacking into a journalists laptop for no profit.

Then you don't pay attention to script kiddies.

dkokelley• 13 years ago

The thing with script kiddies is that they are not necessarily mature enough to realize and properly weigh the risks associated with their illicit hacking. It's fun and it gets them "cyber cred". Gangsters are often the same way. They risk jail time for flashy stunts that earn them respect from their peers.

kunai8• 13 years ago

Might not be a script kiddie. I know that the Washington Post calling something like this "sophisticated" is kind of ridiculous, and the reporter's reaction is only more absurd, but there could be some real motives here. Business, government, whatever-- I do think that the government wouldn't risk something like this, but there could always be rogues, and you can never distrust government too much as we saw with PRISM.

tptacek19• 13 years ago

This is innuendo, not analysis.

deelowe2• 13 years ago

Sounds about par for the course for a government ran operation.

tptacek19• 13 years ago

Not par for the course for NSA attack/pen.

brown9-2• 13 years ago

How can you detect what commands were run on a laptop by someone months ago?

If you assume the OS is Windows, is it normal to even log those?

kunai8• 13 years ago

Well, if you're on any arbitrary Unix system with bash installed, just open up a terminal emulator and keep hitting the up arrow key. It should give you a full history of all commands entered. Unfortunately, there's no date tagging to my knowledge, so you'll just have to remember when you entered a command and if you see any anomalies.

ben10403• 13 years ago

It should give you a full history of all commands entered.

Commands entered by that user, in a shell, assuming the shell's history file wasn't cleared. So maybe you'd get a history of what someone did if they sat down at your computer and typed things while you were away refilling your coffee.

Your shell history isn't going to show a trace if someone actually remotely roots your computer and starts executing commands.

lawnchair_larry2• 13 years ago

For this to work, your adversary would have to be the worst hacker possible, but maybe.

Other possibilities:

1) A script file containing a list of commands was recovered during forensics, which did something obvious like search for something and delete. This is common for automated attacks, and seems unlikely for a targeted attack.

2) "Commands" is being interpreted too literally. They could have observed that files were deleted, and consider the act of deletion to be a "command". You can't really take technical reporting from mainstream media to be that accurate.

pmorici• 13 years ago

Yes, sometimes. Google, "user assist key"

tumblen• 13 years ago

A couple months ago I turned VNC on quickly, without a password, just to test out an app that turns my iPad into a trackpad for my computer. Of course, forgot to turn off VNC after learning the iPad trackpad wasn't a great solution for me.

A couple days later as I was working, my cursor kept getting pulled away from me and I figured there must be some tracking issue with the mouse, not giving it a second thought.

I started reading something at my desk and looked up - a tab had been opened in Chrome to some .ru domain name and someone was clicking a 'Pay with PayPal' link on the page.

With my PayPal password auto-filled, they would have had easy work of getting into my account to pay a large, arbitrary amount to themselves.

Luckily, I caught it just in time. They were so good at keeping control of the mouse that I had to run to unplug my router.

Point is, VNC is a really easy vector to gain access to a computer and there are apparently people or bot constantly port scanning everything to find what's unsecured.

Was definitely a wake up call for me and I wouldn't be surprised if this is a similar case.

vardyr• 13 years ago

If someone was able to initiate a connection to your desktop behind a router, and you did not manually set up port forwarding, it sounds like you have UPnP enabled. I strongly suggest turning that off.

This would not happen behind any home router I know of with UPnP disabled, unless you have malware on the machine.

cientifico2• 13 years ago

I am curious why this information appears now. Is this in reference to Microsoft given exploits to the government?

If that is the case, could this problem be solve by installing linux? I am not a linux fan, but the point of the source code being open and review by millions of people starts making me feeling more secure.

tptacek19• 13 years ago

Microsoft doesn't give "exploits" to the government. Microsoft doesn't have the in-house expertise to write many of those exploits. It provides information about verified security vulnerabilities (different from exploits) before they're patched, because their patch schedules are elaborate and necessarily create a window of unpatched vulnerability. Microsoft also gives the same information to many commercial vendors, so they can write antivirus and IPS signatures.

NSA does not need Microsoft's help to break into computers.

temp92512• 13 years ago

It seems disingenuous to compare it to the disclosure to commercial vendors when the government is not listed as a MAPP partner. I have no clue what they actually disclose, but I disagree that the issue is so cut and dried.

kunai8• 13 years ago

This is going to sound dickish, but technically it's "the NSA," not just "NSA".

"National Security Administration doesn't need Microsoft to break into computers." vs "The National Security Administration doesn't need Microsoft to break into computers."

Too much of a tangent, perhaps?

lawnchair_larry2• 13 years ago

MAPP customers do get proof-of-concept code to trigger the vulnerability, sometimes months in advance. That is a huge head start towards a functional exploit, and has been converted to a fully functional remote code-exec exploit prior to disclosure in at least one case that was fairly public.

Though I do not think this story has anything to do with MAPP.

cientifico2• 13 years ago

Seems like microsoft have that expertises:

http://www.techdirt.com/articles/20130614/02110223467/micros...

hga7• 13 years ago

Only the official confirmation is new, word that she thought her computer(s) were compromised has been out for a while.

I'm not at all sure Linux is the solution; the only plausible culprit for whom that would be a barrier is a non-state actor doing a modern variety of "Will no one rid me of this turbulent priest" (http://en.wikipedia.org/wiki/Thomas_Becket). But the reported sophistication of the attack makes that less likely that previously speculated, and I assume that "Linux" is not a high enough barrier to a state actor.

kunai8• 13 years ago

Assuming that the NSA doesn't possess quantum computers, perhaps 4096-bit PGP email hosted on a local mail server, along with SELinux, full disk encryption and a strong firewall that blocks all incoming connections, should do the trick. Am I correct?

It's the setup I'm using now.

rubbingalcohol• 13 years ago

This was right around the time when there were numerous other attacks on press and US industry networks by Chinese IP addresses. There's not enough info here to draw any conclusions, but I certainly wouldn't jump on the NSA bandwagon just because they're up in our netz (they probably wouldn't need to compromise her specific computer anyway).

CBS confirms reporter Sharyl Attkisson’s computer breached

Related Stories