<div dir="ltr"><div>As a follow-up, here is a link to Bruce Schneier's more authoritative assessment of the issue.</div><div>He concurs with my friends' conclusion that rebuilding from scratch,</div><div>aka "burning the network to the ground" is the most appropriate response.</div><div><br></div><div><a href="https://www.theguardian.com/commentisfree/2020/dec/23/cyber-attack-us-security-protocols">https://www.theguardian.com/commentisfree/2020/dec/23/cyber-attack-us-security-protocols</a></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Dec 21, 2020 at 3:07 PM Alan Frank <<a href="mailto:alan@8wheels.org">alan@8wheels.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">I was listening to the radio yesterday and some prominent former member <br>
of the DT administration was saying that the affected organizations <br>
"would have to build new networks from the ground up." So it is not <br>
just the engineers who will be pushing for that.<br>
<br>
<br>
-------- Original Message --------<br>
Subject: Re: [Hidden-tech] Maybe some one can help - at least locally<br>
Date: 20.12.2020 15:39<br>
From: Daniel Nachbar via Hidden-discuss <br>
<<a href="mailto:hidden-discuss@lists.hidden-tech.net" target="_blank">hidden-discuss@lists.hidden-tech.net</a>><br>
To: HT-discuss <<a href="mailto:hidden-discuss@lists.hidden-tech.net" target="_blank">hidden-discuss@lists.hidden-tech.net</a>><br>
<br>
I'm not a network security expert but I have discussed this topic with<br>
some.<br>
<br>
Their consensus view is that there is essentially no way to<br>
effectively scrub the compromised networks/machines. These are very<br>
sophisticated attackers who had far too much access for far too long.<br>
Rebuilding from scratch is likely the only effective response.<br>
<br>
However such drastic remediation is almost impossible to sell to upper<br>
management when there is no immediate evidence of compromise. Worse<br>
yet, making the pitch to rebuild requires one to explain to upper<br>
management how one totally screwed up in the first place.<br>
<br>
So most victims will likely instead do some half-measure "security<br>
scans", which will of course find nothing (because these are extremely<br>
sophisticated attackers), and then just move on. Months or years from<br>
now previously unidentified dormant worms will activate and the whole<br>
compromise cycle will begin anew.<br>
<br>
There is going to be a very, very long tail on this thing.<br>
<br>
On Sun, Dec 20, 2020 at 12:39 PM Rich@tnr via Hidden-discuss<br>
<<a href="mailto:hidden-discuss@lists.hidden-tech.net" target="_blank">hidden-discuss@lists.hidden-tech.net</a>> wrote:<br>
<br>
> Should like a job for a super-techie -- any takers ??<br>
> <br>
> It’s going to take months to kick elite hackers widely believed to<br>
> be Russian out of the U.S. government networks they have been<br>
> quietly rifling through since as far back as March in Washington’s<br>
> worst cyberespionage failure on record.<br>
> <br>
> ... “We have a serious problem. We don’t know what networks they<br>
> are in, how deep they are, what access they have, what tools they<br>
> left,” said Bruce Schneier, a prominent security expert and<br>
> Harvard fellow. ...<br>
> <br>
> <br>
<a href="https://apnews.com/article/hacking-russia-bafff5557a8941aa1a5ef239d36c4e28?fbclid=IwAR1MvOIpHUL8GrS2IE-g_hd6BY336St-00rQ-C4FRsngagVEDg9zmh6trhM" rel="noreferrer" target="_blank">https://apnews.com/article/hacking-russia-bafff5557a8941aa1a5ef239d36c4e28?fbclid=IwAR1MvOIpHUL8GrS2IE-g_hd6BY336St-00rQ-C4FRsngagVEDg9zmh6trhM</a><br>
> <br>
> --<br>
> Rich Roth<br>
> CEO TnR Global<br>
> <br>
> Bio and personal blog: <a href="http://rizbang.com" rel="noreferrer" target="_blank">http://rizbang.com</a><br>
> Building the really big sites: <a href="http://www.tnrglobal.com" rel="noreferrer" target="_blank">http://www.tnrglobal.com</a><br>
> Small/Soho business in the PV: <a href="http://www.hidden-tech.net" rel="noreferrer" target="_blank">http://www.hidden-tech.net</a><br>
> Places to meet for business: <a href="http://www.meetmewhere.com" rel="noreferrer" target="_blank">http://www.meetmewhere.com</a><br>
> And for Arts and relaxation:<br>
> <a href="http://TarotMuertos.com" rel="noreferrer" target="_blank">http://TarotMuertos.com</a> - Artistic Tarot Deck<br>
> <a href="http://www.welovemuseums.com" rel="noreferrer" target="_blank">http://www.welovemuseums.com</a><br>
> <a href="http://www.artonmytv.com/" rel="noreferrer" target="_blank">http://www.artonmytv.com/</a><br>
> Helping move the world: <a href="http://www.earththrives.com" rel="noreferrer" target="_blank">http://www.earththrives.com</a><br>
> _______________________________________________<br>
> Hidden-discuss mailing list - home page: <a href="http://www.hidden-tech.net" rel="noreferrer" target="_blank">http://www.hidden-tech.net</a><br>
> <a href="mailto:Hidden-discuss@lists.hidden-tech.net" target="_blank">Hidden-discuss@lists.hidden-tech.net</a><br>
> <br>
> You are receiving this because you are on the Hidden-Tech Discussion<br>
> list.<br>
> If you would like to change your list preferences, Go to the Members<br>
> page on the Hidden Tech Web site.<br>
> <a href="http://www.hidden-tech.net/members" rel="noreferrer" target="_blank">http://www.hidden-tech.net/members</a><br>
_______________________________________________<br>
Hidden-discuss mailing list - home page: <a href="http://www.hidden-tech.net" rel="noreferrer" target="_blank">http://www.hidden-tech.net</a><br>
<a href="mailto:Hidden-discuss@lists.hidden-tech.net" target="_blank">Hidden-discuss@lists.hidden-tech.net</a><br>
<br>
You are receiving this because you are on the Hidden-Tech Discussion <br>
list.<br>
If you would like to change your list preferences, Go to the Members<br>
page on the Hidden Tech Web site.<br>
<a href="http://www.hidden-tech.net/members" rel="noreferrer" target="_blank">http://www.hidden-tech.net/members</a><br>
</blockquote></div>