Hacker News Reader

Comment by CryptoBanker | Hacker News Reader

Those 14 are just a drop in the bucket. Neither their arrest nor release will make much of a difference

Why is Russia so into hacking? Would it help if there was a startup community there to absorb the talent? Or is this the inevitable byproduct of bright people living under a brutally corrupt and dishonest dictator and his cronies for most of their lives?

What makes you think Russia is special in this regard?

Well, you hear about Russian hackers on the news a lot, which would seem to indicate that either:

1) they are very good at hacking

2) they are not so good at hacking

3) Russia is a popular place for hackers to set up proxies

All of the above!

4) The news is not geopolitically neutral

Alternatively, news about hacking that you read, including their primary sources like Google/Microsoft/FireEye/whatever, usually suppress news about hacking by U.S. and allies. IIRC last year Google publicly announced a zero day actively exploited by the U.S. which was considered highly unusual, since apparently they usually just patch it without fuzz. The article was discussed here but I can’t find it now.

That's why Kaspersky is important. I wish they survive.

This thread was kicked off by discussion about ransomware hacking, though. I'm sure US intelligence agencies get up to all sorts of no good, and I'm sure our news is less likely to report on it, but there doesn't seem to be an equivalent ransomware industry in the US (and the news has no reason to cover for petty hacking criminals in the US).

Actually I don't see a ton of news about national-security related hacking by Russia.

Oh, TFA is about nation states so I was talking about that.

Asymmetric commercial hacking is pretty easy to explain: hacking foreign entities is safer than hacking domestic ones in terms of risk exposure, and hacking entities in countries richer than yours is more attractive than the other way round.

How about non-nation states, such as the US?

Pedantry is seldom useful or interesting.

4) You're only looking at American propaganda.

Nah, most of the stories are about ransomware type schemes from Russian criminal gangs. I'm sure both of our intelligence agencies get up to no good, and US news sources are less likely to cover US intelligence agencies, but they have no real reason to cover for petty hacking criminals.

> most of the stories are about ransomware type schemes

And where are these news stories coming from?

are you living under a rock? Do you remember the recent oil pipeline and meat packing facilities that got ransomwared? Ton's of government sites and corporations get hacked. It's way more than what's publicly available too. Most of the time entities just pay up and keep it secret. Lots of the attacks come from russia. They pump out a shit load of malware.

There are obvious incentives to present Russia as a lawless criminal wasteland and the US as a good global citizen.

I don't think they're obvious, and this comment strikes me as baseless innuendo.

What precisely are the incentives for multinational corporations to censor news about American cyber malfeasance, especially given how acute and prolonged a regulatory headache unchecked American surveillance created for them in Europe?

Which would you rather earn, 1000 rubles or 1000 dollars? Corruption is much more profitable than honesty in Russia.

This sort of thing has always been the domain of organized crime syndicates.

Narcotics, prostitution, gambling, smuggling, and computer crime all take organization and capitalization. It's just that in some places such organizations control the reigns of political power brazenly and shamelessly.

1. The Russian gov't looks the other way. Hackers in any other country might fear prosecution & extradition, but Russian hackers are protected as long as they don't attack Russians. There was some malware going around at one point where someone realized the payload didn't run if the user had a Russian keymap installed.

2. Kind of a "worse is better" phenomenon. This is apocryphal but while Americans and Europeans were digging into Apple IIs and Commodores, Russia just had crappy knockoff machines that didn't follow the behavior of the machines they were meant to be clones of, so anyone who stuck with it long enough basically taught themselves reverse engineering and the operation of "weird machines", how to operate in environments of undefined behavior. Thats just how I heard it, I'd like to learn more about their history since their space program was pretty one-to-one with ours, they definitely had computer engineers and programmers just as sophisticated as USA

>they definitely had computer engineers and programmers just as sophisticated as USA

Russians also have a world-class reputation in math and physics. At least they did in the 20th century. Now that experiments are so capital intensive, theoretical physics has become unfalsifiable silliness, I would assume that these people went into software. Although I could be wrong.

> The Russian gov't looks the other way. Hackers in any other country might fear prosecution & extradition, but Russian hackers are protected as long as they don't attack Russians.

You can see some of this with Anonymous and the FBI these days, too, and NSO Group and Israel. I wouldn't be surprised if most countries do this, now.

How does that even work? Does the NSA post on 4chan asking for l33t hax0rs to do a job?

They run operations like Cicda3301 to recruit to ones that make it to the end.

https://www.cicada3301.org/

Ok but seriously they fund things like USAMTS which I assume gives them access to a list of promising young Americans.

That's boring maths though. Great, they found some people that can do hard maths. Cicada3301 winners prove they have a wide range of abilities. You're "tests" would be fine for the NSA types that just sit in a gov't cubicle going blind on cyphers. CIA wants people that can figure things out without getting caught.

The parent comment asked about the NSA, and, well, they happen to do a lot of math.

I'd imagine direct and indirect infiltration. Hackers charged with crimes, who are part of a larger group, sometimes get plea deals. As part of their deals, they might give up accounts, keys, data, or evidence from the group, and/or work as confidential informants for the government.

I found Lex Friedman's interview with Nicole Perlroth discussion of hacker culture and the mechanics of creating and selling 0-days to nation-state actors interesting.

https://youtu.be/hy2G3PhGm-g

You really think there aren't computer security experts from government organisations on 4chan? I thought half of its schtick was it was a wide range of humans from all walks of life, pretending to be (or actually being) whatever-it-is that humans become without any form of supervision.

Aren't they famous for going to hacker conventions and looking like another fellow hacker instead of a suit? the NSA even has given talks at DEFCON.

> Why is Russia so into hacking?

Same reason NK is. Same reason every country is. It is rather cheap in comparison. I mean even the largest super computers only cost a few hundred million. That's rather cheap when you consider other military adventures. One state of the art super computer is roughly the price of one (maybe 2) modern jets. The biggest cost is people. And you can do a ton of damage with hacking.

The costs are low, benefits are high.

[0] Summit was $350m, and a F22 costs $140m (per jet, not including development costs which is hundreds of billions)

What do super computers have to do with hacking?

The most immediate use case that comes to mind is breaking encryption.

Successfully hacking the Gibson it the ultimate challenge!

Not really much, but it was giving an example of the costs of computing in general. More like an upper bound. That you could buy crazy expensive computers and it would cost nowhere near what actual weapons systems cost. I was just trying to say that the cost for hacking is more in man power rather than machinery. And man power is far cheaper than machinery.

Where are you getting hundreds of billions? Wikipedia says "As production wound down in 2011, the total program cost is estimated to be about $67.3 billion, with $32.4 billion spent on Research, Development, Test and Evaluation (RDT&E) and $34.9 billion on procurement and military construction (MILCON) in then year dollars."

Although not the F-22, modern fighters such as the F-35 can cost 100's of billions of dollars in R&D[0] (~150 billion iirc, with ~1.3 trillion total program cost).

[0] https://en.wikipedia.org/wiki/Lockheed_Martin_F-35_Lightning...

> Why is Russia so into hacking? Would it help if there was a startup community there to absorb the talent? Or is this the inevitable byproduct of bright people living under a brutally corrupt and dishonest dictator and his cronies for most of their lives?

It may be worth taking a look at the conditions that first gave rise to the eastern European malware scene in the late 80's, particularly in the Soviet Union and Bulgaria:

https://bontchev.nlcv.bas.bg/papers/factory.html

In particular, the presence of the necessary information and lack of economic opportunity gave rise to the original scene, and today that has transformed into an environment where the economic opportunity is directly tied to various for-profit black-hat activities (ransomware, identity theft and credit card fraud, etc.).

It is possible to link the relative lack of other economic opportunities to corruption, and that is a valid observation, but if black hat activities weren't profitable and relatively safe from retaliation (as long as you avoid Russian targets), the scene would still be typified by disaffected individuals rather than organized professional groups.

I'm not sure if creating a bunch of startups to soak up the extra talent would work, as the incentives to get a leg up on the competition via the Dark Arts (DDOS your competitor, spear-phishing their sales people, etc.) would still be pretty strong.

This is the key comment. Free college education, glut of college trained programmers, lack of a legitimate job market.

France and Germany have free college education.

And an economy. Russian has the economy of Spain, with three times the population. And that economy is 50 percent oil and gas.

Spain itself has extremely high unemployment, but I don't hear about software from there often. (There's one app I use developed there.)

This kind of stat boggles the mind. How are they one of the top ~3 formidable military powers in the world while being no richer than Spain?

They inherited the military of the Soviet Union, which was overhyped but large and not obsolete. They have invested money into keeping up with tech in principle, i.e. a few demo units, but they don't have money to actually equip their military with the new tech or to train correctly. So the Russian military has Soviet nukes and otherwise it's a Potemkin village. It may be that the nukes are also a Potemkin village, but it's dangerous to check.

Russia has been doing asymmetric operations, e.g. buying the US republican party was a lot cheaper than winning a war against the US but effectively was almost as good. Helping far-right, anti-democracy, anti-EU, anti-NATO politicians worldwide has been destabilizing. Organizing both the racist and the anti-racist demonstration at the same place and time has kept people and governments distracted. They do a lot of mafia style things to bribe, intimidate and kill people into doing what they want. Turns out going after politicians is more effective than going after military officers because counter-intelligence is more hesitant to act when they suspect a politician of working with/for Russia.

Is the appearance of a deep state the main reason why counterintelligence is reluctant to act when it's politicans being bribed instead of military officers?

Right. Without really solid evidence, it might look like a military junta asserting control over the people's elected representatives. Someone who's not an elected politician would have just lost their security clearance and been let go, if the authorities decided to not pursue espionage charges.

Another thing is that the US military has been trained to be deathly afraid of appearing to have an opinion on politics, and this is both good and bad.

Their buying power within Russia is probably 3x that or more, plus because they have an extractive economy a disproportionately high proportion of GDP goes directly to the state, and because they are an oppressive state a disproportionate amount of that goes to the military.

Russian defence spending is about 1/12 that of the US, but between having lower grade equipment, conscription and cheaper domestic prices they probably get 2x to 3x bang for their buck, at least on paper. As we can see in Ukraine, in practice much of the bang is over hyped, but it still gives them the brute muscle to do a lot of regional bullying.

They dont? Everyone assumed they did but given their performance in the last 2 weeks I'd say it was overblown.

The reason everyone thought they were a great military power is because the Soviets were presumably a great military power with a large army and a lot of hardware. Tanks, aircraft, artillery etc etc. And when it all fell apart the Russians inherited the lion's share.

Russia has lower costs in terms of personnel, lower wages and the like will somewhat lower the overhead of their military. But I think everyone overestimated how much that would help. See, raw materials costs the same around the world more or less. Titanium costs the same in Russia as it does in the US. Same for steel or any other resource that is on the global market. So Russia can only build a tank so much cheaper than Europe or the US can, but there is a floor to that price. On top of that they have been under sanctions for years for a lot of important things they can't make domestically like advanced semiconductors.

Then there is the fact Russia is a well known kleptocracy. They may very well have nominally lower personnel costs but that's likely balanced by much higher corruption.

And when you think of the sheer size of their military, all of those nuclear subs. All of those ICBMs, there are a lot of expensive things there that will easily take up large chunks of their budget.

I think much of the conventional side of the Russian military was left to rot and much of what we were shown pre-invasion was just that, a show. T14 functionally does not exist. Same with Su-57. They are cool show pieces but the real military are using 30+ year old hardware that has been piecemeal upgraded and not well maintained.

Someone here recently said:

Russia has a big and advanced army. But the advanced army is not big. And the big army is not advanced.

and the gas is actually just fart

On that subject we might ask if the Eastern recruiters care about things like background searches, "polygraphs" or what recreational substances the subjects use on their free time.

But yeah it's all of the factors you mentioned.

Less opportunities for startups for running actual stable business products there isn't helping either. I have heard a first hand story how the government just stopped some cloud access, which caused some company that had built its product on top of it to immediately close down.

Reply on news.ycombinator.com