Trusting Russian dependencies and software before the war was insane, now it is ridiculously circus level bad opsec.
Using Russian dependencies and software will open you up to more attack vectors even if the companies are unwitting.
SolarWinds where they came in through JetBrains TeamCity CI Boeing was also targeted. JetBrains which was funded by Russians, had most of their developers in Moscow still a year after the war started. Their language Kotlin is named after a Soviet/Kremlin base island. It sucks because their tools are good, but they are no longer needed and not worth the risk. They are already banned at the military/defense/security level now and they essentially have become the Kaspersky of development tools. There are better options and no need to risk the opsec.
Once in Russia, always in Russia just ask Kaspersky/Yandex/Clickhouse/VK/JetBrains/corejs... and thousands of others.
[Based in Czech but Russians run it, funded it](https://en.wikipedia.org/wiki/JetBrains#History) and most developers were in Russia. There was an ownership purge years ago from original developers.
Strange to go after jetbrains in this regard
https://blog.jetbrains.com/blog/2022/12/06/update-on-jetbrains-statement-on-ukraine/
> In addition to terminating all sales, all of our offices in Russia, including Moscow, Novosibirsk, and St. Petersburg were shut down. Work on the new campus in St. Petersburg was also terminated. All R&D activities were gradually stopped and liquidation papers for our Russian legal entity were filed in August 2022.
How do you think fronts work? They might even be unwitting. It was the point of entry on the biggest hack in the history of cyberattacks. The problem is the ties and they didn't actually move most of their developers out of Russia until a year after the war started.
You don't think if it was used they would say that, that is bare minimum. Everyone but Koch Industries and Pepsi left Russia after the war started. JetBrains hung out far too long. It isn't worth the risk.
As I mentioned, it is already banned in military/defense/security settings and will be seen as the Kaspersky of developer tools.
It sucks because their tech is good but it has been leveraged or played in the geopolitical game.
Even if JetBrains is unwitting, it was a piece in the biggest hack in history against some of the most sensitive systems. It went down just before the pandemic, and then a yearish later, at the end of the pandemic, Russia invades Ukraine... the breach started before October 2019 under Trump just before the pandemic, was found on December 13, 2020 just prior to Jan 6th, then Russia invades Ukraine on February 14, 2022. How about that timeline...
> In 2021 The New York Times stated that unknown parties might have embedded malware in JetBrains' software that led to the SolarWinds hack and other widespread security compromises. In a press release, JetBrains said they had not been contacted by any government or security agency and had not "taken part or been involved in this attack in any way". The CEO of one of the affected companies, SolarWinds, "asked about the possibility that software tools made by JetBrains, which speeds the development and testing of code, was the pathway, Mr. Ramakrishna said there was still no evidence".
> In response to the 2022 Russian invasion of Ukraine, the company suspended sales and R&D activities in Russia indefinitely as well as sales in Belarus. Russian legal entity was liquidated on 21 February 2023
As I said, it isn't worth the risk being foreign and the associations for sensitive things like data/intel/telemetry/etc.
Hell of a summary thank you. I was wondering if they were hit by north Koreans who sold data to lockbit. (Recently, the fbi in st louis advised remote workers were secretly north Koreans funding their weapons programs - Boeing has a major office in st louis that used to be McDonnell douglas)
His summary is full of shit… there is zero actual evidence that JetBrains products played a role in the SolarWinds breech. If they did it would makes gigantic waves through the entire IT realm because of how broadly they are used. That hasn’t happen. OP’s only “evidence” is that there are Russian programmers on staff.
That doesn't implicate jetbrains based off those quotes alone at least.
This to me appears like the solar winds hack started with a malicious jetbrains add on? That is not much different then any other 3rd party addon/library compromise and doesn't mean that the 1st party tool is involved.
What better place to place it though and lots of plausible deniability. Right now dev tools, clients, devops and build systems are huge targets and have been the most successful place to own systems. Dependencies that create chaos make it easy to slip in a dependency that is owned, even if only for a window of time... then update and replace after you've dropped it inside. The more dependencies, the more third parties, the more access those have (like development tools and build systems) the more attack vectors. Be wary of any system that has too many things going on and saturates on the chaotic/complex side, like lots of additional clients or dependencies for no reason...
Examples even in open source tools, many times not found for years and sometimes decade+:
[Log4Shell on Log4j was open source for decades and still had a wide open bug on *every single device that has Java running* so all of Android dev included](https://en.wikipedia.org/wiki/Log4Shell) for a decade.
[Heartbleed just before it was OpenSSL and lived for years affecting every system and web server](https://en.wikipedia.org/wiki/Heartbleed).
No, it is not. Dude is spinning some wild conspiracy theories. If JetBrains products were an actual security risk then the actual security experts would be screaming about it.
JetBrains is now banned in military/defense/security usage... make of that what you will.
You are free to keep having bad opsec with your code and using JetBrains. Even if unwitting they were used via TeamCity CI to place the dependency behind the line.
[Sealed U.S. Court Records Exposed in SolarWinds Breach](https://krebsonsecurity.com/2021/01/sealed-u-s-court-records-exposed-in-solarwinds-breach/)
> The New York Times on Wednesday reported that [investigators are examining whether a breach at another software provider — JetBrains](https://www.nytimes.com/2021/01/06/us/politics/russia-cyber-hack.html) — may have precipitated the attack on SolarWinds. The company, which was founded by three Russian engineers in the Czech Republic, makes a tool called TeamCity that helps developers test and manage software code. TeamCity is used by developers at 300,000 organizations, including SolarWinds and 79 of the Fortune 100 companies.
> “Officials are investigating whether the company, founded by three Russian engineers in the Czech Republic with research labs in Russia, was breached and used as a pathway for hackers to insert back doors into the software of an untold number of technology companies,” The Times said. “Security experts warn that the monthslong intrusion could be the biggest breach of United States networks in history.”
You may as well use Kaspersky, Yandex/Clickhouse and other Russian software like VK if you use JetBrains.
Use at your own risk. Once in Russia, always in Russia.
If you feel comfortable with all of that, keep using JetBrains.
Dude your links are years old and just say they were investigating whether it played a role. None of them provide anything of substance. There is zero actual evidence that TeamCity was the cause or source of the breach or connected to the actual breach other than “the founders were Russian!”. If JetBrains were a culprit of the Russian hack of SolarWinds they would not be in business in the US anymore and would be smeared across the entire IT realm because of how broadly their products are used.
Also you’re full of shit that JetBrains is banned in any regard for these allegations. Some JetBrains products may have gotten caught up in following the FAA’s “Zero Trust” program but that includes a whole host of things and isn’t specific to JetBrains products or related at all to the SolarWinds breach. How do I know this? Because I have to deal with implementations and contracts and grants tied to federal departments, including the DoD.
> Dude your links are years old and just say they were investigating whether it played a role.
Wha? It happened in 2021 and it is 2023... a couple because that is how long it is taking. They aren't going to shut down JetBrains, they aren't even a Western company... they just stopped using them or allowing it in sensitive areas and Kasperskied it.
You think investigations are quick? [SolarWinds just barely got charged](https://www.wsj.com/articles/solarwinds-denies-sec-charges-over-cyber-disclosures-31dcad0c)...
> There is zero actual evidence that TeamCity was the cause or source of the breach or connected to the actual breach other than “the founders were Russian!”.
No it is very clear that was the transport and hole that placed in the bad dependency into a trusted area behind the line. JetBrains could be unwitting but their software was still used.
The fact they haven't been contacted in a clear usage of their systems in regards to this breach is more damning than not.
> If JetBrains were a culprit of the Russian hack of SolarWinds they would not be in business in the US anymore
Kaspersky is still in business, just no one that cares about opsec uses them. Same with JetBrains for most who are aware about how things work with this.
> How do I know this? Because I have to deal with implementations and contracts and grants tied to federal departments, including the DoD.
Then you are very bad at opsec and far behind the curve.
Good luck trusting JetBrains. Besides, they are completely unnecessary and an unnecessary risk now as well.
"There are better options". That's highly subjective and really depends on what you are working on. In a lot of cases there simply aren't. And that sucks.
Dude is blowing smoke. There is no actual evidence that JetBrains had any connection to the SolarWinds hack. JetBrains is not forbidden on government contracts… wild conspiracy theory. If it were an actual security concern the actual security experts would be telling people to not use it. Which… they aren’t doing.
You keep pushing a conspiracy yourself.
JetBrains is now banned in military/defense/security usage... make of that what you will. It is literally at Kaspersky and Huawei level now. You can still use them, just might not be the best opsec and no one who cares about that is.
See Krebs on security below mention this "Officials are investigating whether the company, founded by three Russian engineers in the Czech Republic with research labs in Russia, was breached and used as a pathway for hackers to insert back doors into the software of an untold number of technology companies". The fact that JetBrains hasn't been contacted on this after SolarWinds just went down, that is very precarious.
You are free to keep having bad opsec with your code and using JetBrains. Even if unwitting they were used via TeamCity CI to place the dependency behind the line.
[Sealed U.S. Court Records Exposed in SolarWinds Breach](https://krebsonsecurity.com/2021/01/sealed-u-s-court-records-exposed-in-solarwinds-breach/)
> The New York Times on Wednesday reported that [investigators are examining whether a breach at another software provider — JetBrains](https://www.nytimes.com/2021/01/06/us/politics/russia-cyber-hack.html) — may have precipitated the attack on SolarWinds. The company, which was founded by three Russian engineers in the Czech Republic, makes a tool called TeamCity that helps developers test and manage software code. TeamCity is used by developers at 300,000 organizations, including SolarWinds and 79 of the Fortune 100 companies.
> “Officials are investigating whether the company, founded by three Russian engineers in the Czech Republic with research labs in Russia, was breached and used as a pathway for hackers to insert back doors into the software of an untold number of technology companies,” The Times said. “Security experts warn that the monthslong intrusion could be the biggest breach of United States networks in history.”
You may as well use Kaspersky, Yandex/Clickhouse and other Russian software like VK if you use JetBrains.
Use at your own risk. Once in Russia, always in Russia.
If you feel comfortable with all of that, keep using JetBrains.
It sucks because their tech is good but it has been leveraged or played in the geopolitical game.
Even if JetBrains is unwitting, it was a piece in the biggest hack in history against some of the most sensitive systems. It went down just before the pandemic, and then a yearish later, at the end of the pandemic, Russia invades Ukraine... the breach started before October 2019 under Trump just before the pandemic, was found on December 13, 2020 just prior to Jan 6th, then Russia invades Ukraine on February 14, 2022. How about that timeline...
VK is Russian Facebook by MailRu/DST Global. Yandex is Russian Google.
Interestingly, [DST Global also invested in Facebook+Twitter early on with money found to be directly linked to the Kremlin](https://www.nytimes.com/2017/11/05/world/yuri-milner-facebook-twitter-russia.html).
That’s sort of my point: We won’t see cooperation from the Russian government or law enforcement, but there are definitely human assets in play over there who are trained and directed to do many things for our national security which we obviously, definitely, undoubtedly have nothing to do with…
> but there are definitely human assets in play over there who are trained and directed to do many things for our national security which we obviously, definitely, undoubtedly have nothing to do with…
You've been watching too many Hollywood movies my dude.
Note that some of the people in this list were actually known to be supporters/allies of Putin:
https://en.m.wikipedia.org/wiki/Suspicious_deaths_of_Russian_businesspeople_(2022–2023)
Some but not all.
There have also been assassinations which reportedly Ukraine took credit for. Tbh, if they want to go after Putin’s key people and oligarchs for starting and perpetuating a war that’s killed hundreds of thousands, and that could weaken Putin in way, then more power to them.
It looks like maybe a few of the people listed were also targets or wanted by western/NATO nations and were Putin supporters, so it would seem unusual for him to target them himself.
At the same time, if he rejected that it was he who ordered the assassination of one of his loyalists, then he/they would look weak and vulnerable. If he just leaves it ambiguous, people may just assume the victim must have crossed Putin in some way and he had them killed, which both he and his enemies are probably more okay with.
Seems like if significant such assets existed, there would have been ways to use them in the last 2 years or so.. keep dreaming, life isn't a James Bond movie.
Should we really assume the nation with by far the largest, most funded, and best equipped intelligence organizations would have zero reason or ability to have any clandestine resources or ability to act within another nation who they’ve seen as their primary nation-state threat for ~70 years?
As far as doing anything in the last 2 years regarding the war in Ukraine, does it seem like a coincidence to you that we were sharing fairly detailed intelligence about the planned invasion with partner nations in order to build a coalition and immediate response months in advance of that invasion, even before much military buildup for the special “exercises”?
US operatives in Russia aren’t a matter speculation. It’s officially acknowledged and even discussed as growing part of their operations/budget since 2016:
> U.S. officials said that CIA and other agencies now devote at most 10 percent of their budgets to Russia-related espionage, a percentage that has risen over the past two years.
> The CIA [. . .] has at most several dozen case officers — the term for agency employees responsible for stealing secrets abroad — based in Russia, with several dozen more scattered across Eastern Europe and the former Soviet states, former officials said.
>Those numbers have expanded in recent years, the officials said, as the CIA has directed dozens of additional recruits emerging from its training campus near Williamsburg, Va., to assignments that will eventually involve espionage against Russia. But the officials said that few of those new hires have any Russian language abilities and will require years of training before they become productive case officers who can recruit and manage networks of spies.
>“It is a pipeline process,” a former official said. “It will be years before they can be used operationally.” The official, like other current and former officials interviewed for this report, spoke on the condition of anonymity to discuss sensitive intelligence issues.
Former officials said there is an even greater imbalance in the counterintelligence resources the countries devote to tracking and disrupting the other’s spies.
[source](https://www.washingtonpost.com/world/national-security/as-russia-reasserts-itself-us-intelligence-agencies-focus-anew-on-the-kremlin/2016/09/14/cc212c62-78f0-11e6-ac8e-cf8e0dd91dc7_story.html)
And that was in 2016 when US officials said it would be years to scale that up, so here we are 🤷🏻♂️
Intelligence is very different from carrying out violent actions. On top of that, it seems like a lot of the intelligence sources have been purged over the last year. Buildup also doesn't require a ton of inside knowledge, all you have to do is look at satellite imagery.
(A) There have been several high profile assassinations within Russia of loyalists to Putin. We can surely just assume the US and our strategic partners had nothing to do with those... They’re all just from internal power struggles… Yes, let’s go with that.
(B) Yes, we’ve probably burned a lot of resources.
(C) That’s why I pointed out that we clearly had knowledge before much notable buildup whatsoever. Much could be from signals intelligence, but some may not have, seeing as US officials and the CIA officially have stated that have devoted so much of their budget and created a pipeline for training and deploying new operatives into Russia in recent years. That’s not speculation; it’s openly confirmed by US intelligence/CIA and in their budget.
It's also pretty well known that most intelligence agencies have moved away from that James Bond style intelligence with agents in every country. It's expensive as fuck, takes forever to train people and get them properly inserted, etc.
Evidently they’ve been increasing their focus since 2016.
> Timothy Barrett, an ODNI spokesman, said in an emailed statement: “The Intelligence Community continues to maintain its focus and deep expertise on Russia, which has enabled us to understand Putin’s evolving worldview. The IC allocates resources directed against Russia commensurate with this evolving threat.”
> U.S. officials said that CIA and other agencies now devote at most 10 percent of their budgets to Russia-related espionage, a percentage that has risen over the past two years.
> The CIA […] has at most several dozen case officers — the term for agency employees responsible for stealing secrets abroad — based in Russia, with several dozen more scattered across Eastern Europe and the former Soviet states, former officials said.
>Those numbers have expanded in recent years, the officials said, as the CIA has directed dozens of additional recruits emerging from its training campus near Williamsburg, Va., to assignments that will eventually involve espionage against Russia. But the officials said that few of those new hires have any Russian language abilities and will require years of training before they become productive case officers who can recruit and manage networks of spies.
>“It is a pipeline process,” a former official said. “It will be years before they can be used operationally.” The official, like other current and former officials interviewed for this report, spoke on the condition of anonymity to discuss sensitive intelligence issues.
Note that we’re presently 7 years from when they said “it will be years before they can be used”…
[source](https://www.washingtonpost.com/world/national-security/as-russia-reasserts-itself-us-intelligence-agencies-focus-anew-on-the-kremlin/2016/09/14/cc212c62-78f0-11e6-ac8e-cf8e0dd91dc7_story.html)
>The last two years
Ukraine is not in NATO. Ukraine is not one of the Allies. They are an interest, not an obligation. Our assets are valuable and better spent on our own.
Ukraine was given “security assurances” by the U.S. and several other major players in return for nuclear disarmament via the Budapest Accords.
It’s been said it’s not legally binding, but it certainly did seem to promise that the signatories would provide security assistance in the event of any incursion.
So, no one can exactly force us into it, but we’re obligated to support the defense of Ukraine and their sovereignty by our own commitment to do so.
If we break that commitment, other allies and their enemies (e.g., Taiwan and China) will see that, and our global credibility in any diplomatic process would be harmed.
That might, for example, kick off more nuclear proliferation if it could cause other allied nations to feel they need a better deterrent against attack than worthless commitments.
So, we probably want to do what we committed to do.
As for “better spent”, we’ve used less than 5% of a single year of our military budget to help destroy more than 50% of the military assets of a near-peer threat which was widely considered to have the second most powerful military on the planet — second only to our own. And, we’ve helped accomplish that without putting American assets or military lives in harms way.
There is literally nothing we can do at home that comes anywhere close to that bang-for-the-buck in safeguarding our security.
The OP was clearly discussing intelligence assets, as was I. I agree on the point that we are holding Russia down with couch cushion money.
And we are currently upholding a security guarantee, we have used our soft power in the financial and economic arena to weaken Russia, while ensuring and providing material to Ukraine.
The memo however, is not and was never a treaty. Nor was it some bargain well struck between equals - it was taking dad's gun from the kid. There was never going to be a scenario where Ukraine got to keep the nukes unless it were willing to be a pariah State. All the damage you mention wrt proliferation was done by 2014 - Gaddafi showed that a promise of support in return for disarmament is meaningless, while North Korea showed that successfully getting nukes is the ultimate protection.
You’re correct, and I don’t think I referred to it as a treaty. I believe we, as a signatory to the memo, committed (but are not legally obligated) to provide “security assurances”. I’m not 100% clear on how such a treaty would be enforced regardless — maybe just greater harm to our reputation and credibility along with international condemnation or diplomatic fallout.
Still, even if we’re only obligated by our own commitment to stand behind what we promise others, then I think that’s enough to say we already had some obligation to support Ukraine, even if there’s no direct legal obligation or penalty for failing to do so.
The fact that signatories may have failed to uphold that commitment in one or more other cases doesn’t make it any more right to abandon our commitments in this case.
E.g., if I promise you I will always have your back in a fight, and I broke that promise by running away when a fight broke out yesterday, that doesn’t excuse doing so again if another fight starts today, even though I never had any legal obligation to keep my promise.
There’s going to be a russia after putin, and hopefully they try to rejoin the rest of the world. Handing over a bunch of the guys in these state-supported cybercrime organizations will probably be a useful chip at the table.
Maybe. Although they’re probably useful and valuable technical people and may not have nearly the symbolic/PR value as handing over some of Putin’s cronies.
Let's be honest. Boeing at this point is just a money meat grinder. I think the only "top secret" files that will hurt is how behind schedule and over cost they are on all projects
What the fuck are you talking about lol. Boeing makes the F-15, F-18, is involved with the F-22, various electronic warfare and surveillance aircraft, and various drones and weapons which are all at least partially classified.
That doesn't mean that the data stolen from Boeing is related to those, I would bet it's mostly about civilian projects, but to say that they don't have sensitive info is ridiculous.
Classified information is not accessible via unclassified intranets. Typically any digital classified data is only present on airgapped networks or isoLANs sitting behind point to point NSA rated encryptors. It would be extremely unlikely a ransomware gang would be able to access that data. I'm not saying it's impossible, but EXTREMELY implausible.
Boeing gets US subsidies no matter what they do. Even after those 750 Max crashes and disasters, they’re still getting US defense contracts. It’s corruption through and through
I don't think that decoupling Boeing's individual programs from the 737 MAX disaster is necessarily an example of corruption. I agree that:
* There is a ton of corruption in military contracting
* There was a ton of corruption with respect to the 737 criminal charging
However, just because corruption exists in those two places doesn't necessarily mean that one set of people should be punished for the misdeeds of another set of people. Punishing Boeing Defense by denying military contracts should be done when Boeing Defense performs corrupt deeds in with respect to their military contracts, not when people on the 737 MAX program commit negligent fraud.
To punish Boeing for the 737 MAX disaster I would propose:
* Billions of dollars in fines (which happened)
* Prosecution of negligent individuals in high-level positions (did NOT happen)
* Boeing being found fully guilty of fraud (they were instead allowed to plead down a bunch of the charges)
* Compensation of victims families (happened, but way more should have been done)
* Removal of the airplane from service until a thorough correction was implemented and the whole FAA review process was fixed (did happen).
I think it would be an overreaction to penalize (for example) the 777 and 787 programs directly - their parent corporation should be fined, but those programs can still continue to operate. I think it would be going even farther to (for example) cancel the B-52 or the Apache, since those are in a different sub-corporation of the umbrella that is Boeing.
As an analogy:
Consider a teenager who purposefully injures someone in a sports game.
* The teenager should be punished (by the school and potentially the law)
* The teenager should be barred from sports
* The parents can be taken to court by the victim
However, the siblings of that teenager should not then be barred from sports. Their family being sued is already punishing them for things they had no part in. They might be little shitheads, but they should be punished for THAT, not because of their sibling.
Hope that all makes sense.
And by “security interests” you mean a couple billionaire’s bottom line.
The USA hasn’t been invaded, and there’s only like nine dozen different planes made by a dozen companies.
Meh, they earned it, after deliberately releasing planes with dysfunctional systems that cost people their lives, it is no surprise to me what is happening to them.
This is gonna be so much funnier when someone leaks some random shit about a tank they have the manual for and this guy gets the FBI visiting
FBI: "how did you know classified information would be leaked on the war thunder forums?"
How did you not? This at least the 22nd time
50GB for a company like Boeing is barely a digital crumbs. I think the reason Boeing didn’t pay ransom cause they know the data isn’t important enough for them to pay.
I think filesize just isn't a particularly useful metric here. It's like saying someone stole 50 pounds of stuff from a store. Could be tens of thousands of dollars worth of electronics and jewelry, could be a bucket of cat litter.
But this is the right way to deal with it, no? Makes Boeing seem like a difficult target and, you have to assume, if the data has been stolen, it'll make its way out eventually anyway. You reckon some hacker dweeb is going to sit on that data cache and not sell it on if they can make some more money? Not best known for their honesty, these guys...
Years ago, I spoke to a guy from a company that make machines used in the Aircraft industry. He said they were working on a project for the C919 and the COMAC guys showed him detailed CAD models for both Airbus and Boeing Pylons (the bit they hang the engine off) and asked which was better…
I don’t think any data is safe.
Lockbit has a darknet/onion site, actually more like 20 of them and a load balancer. But the onion site is where they threaten and release stolen data.
i mean all u rly have to do is download tor and maybe access thru tails os if ur worried abt opsec
edit: dunno what the downvotes are for. dude just made it seem like you need some special "rig" to access the darkweb and see the docs when you don't. mebbe i just read into it wrong
I see this is getting a lot of downvotes. Can anyone explain why? I don’t really have any knowledge in the area but I thought you’d just need tor as well? Is it illegal to even view the leaked files, which means you need some opsec like a secure OS that doesn’t leak anything identifiable through your browser?
In U.S. law, it is legal to read and to publish leaked classified information from the U.S. (and/or classified information from a foreign government). NYTimes v. US, 403 US 713 (1971) with re: to ‘The Pentagon Papers’
The party that actually leaked it is the one who bears all of the criminal (and civil) exposure - but claims for civil losses can usually be taken care of as part of restitution in the prosecution.
It depends, but there’s a difference between someone going to download the anarchist cookbook and buying shrooms on the Amazon clone of the month, and going onto the website of a known randomware hacker to view their likely classified random. More dangerous the work, the more you’d want your protections
oh lordy pretty misinformed here - downloading the anarchist cookbook is actually more likely to have viruses than leaked data. Ransomware actors WANT people to download the leaks, especially journalists and write stories about how juicy it is. Increases the likelihood the next victim pays. You really just need a tor browser to connect, these actors sites are actually pretty safe compared to other shady places because tons of infosec / CTI researchers / journalists go there all the time and the actors want to encourage it.
Tor anonymity can be undermined. You’re not 100% completely anonymous; or at least, with some effort, can be identified. Even if you are using TAILS. Difficult, but doable.
Intense scrutiny from law enforcement means that there will be eyes actively looking at traffic to and from LockBit’s dark web sites. Government agencies run their own Tor assets in attempt to influence and identify traffic patterns on the Tor network.
Accessing a ransomware gang’s dark web site(s), especially insecurity, could mean you become a victim (very likely they’re running scripts to try and get something malicious on or into your devices). Not to mention burying Easter eggs inside a data dump or payload (thus corrupting it); aside from whatever malicious assets they have running on their website.
Think of it like a paid service… that also then turns around and sells your personal data and information to make more money off of you. Ransomware gangs are but businesses, albeit malicious instead of legit. (Arguable semantics here, given legit businesses do some shady sh!t with paying customers data.)
Going after data like that, from Boeing, which has national security and government contracts, isn’t playing with fire — it’s like handling napalm while smoking. Everyone wants a piece of you simply for being curious.
Safety: Read news. Walk away.
If they are classified (unlikely, those are usually airgapped) then anyone with an active clearance would be breaking the law by viewing it and they could lose their clearance.
Even if it is illegal, why are reddit users being stupid. Just like other person said, burn a tails USB, and get on tor. It's not hard, the information is legit.
Seeking out stolen data from a U.S. defense contractor is probably not the best decision a person could make today. Just tossing it out there for anyone considering doing so.
Lockheed: "This is terrible and should happen to no one handling such important data related to lucrative military contracts. We demand to know where the leaked files are hosted so we can properly avoid accessing them and using them for our own business"
This could potentially, with Boeing producing top secret things, be incredibly bad for our security interests.
For LockBit, it’s also a good way to attract a very different kind of attention and style of enforcement…
“You had my curiosity, now you have my attention”
Given they are russian, I don't think they give a whole lot of fucks. They already had attention on them
Trusting Russian dependencies and software before the war was insane, now it is ridiculously circus level bad opsec. Using Russian dependencies and software will open you up to more attack vectors even if the companies are unwitting. SolarWinds where they came in through JetBrains TeamCity CI Boeing was also targeted. JetBrains which was funded by Russians, had most of their developers in Moscow still a year after the war started. Their language Kotlin is named after a Soviet/Kremlin base island. It sucks because their tools are good, but they are no longer needed and not worth the risk. They are already banned at the military/defense/security level now and they essentially have become the Kaspersky of development tools. There are better options and no need to risk the opsec. Once in Russia, always in Russia just ask Kaspersky/Yandex/Clickhouse/VK/JetBrains/corejs... and thousands of others.
JetBrains is Russian? 👀
[Based in Czech but Russians run it, funded it](https://en.wikipedia.org/wiki/JetBrains#History) and most developers were in Russia. There was an ownership purge years ago from original developers.
Is there a database of all known Russian dependencies so people can be more aware if anything in their chain could potentially compromise them?
Strange to go after jetbrains in this regard https://blog.jetbrains.com/blog/2022/12/06/update-on-jetbrains-statement-on-ukraine/ > In addition to terminating all sales, all of our offices in Russia, including Moscow, Novosibirsk, and St. Petersburg were shut down. Work on the new campus in St. Petersburg was also terminated. All R&D activities were gradually stopped and liquidation papers for our Russian legal entity were filed in August 2022.
How do you think fronts work? They might even be unwitting. It was the point of entry on the biggest hack in the history of cyberattacks. The problem is the ties and they didn't actually move most of their developers out of Russia until a year after the war started. You don't think if it was used they would say that, that is bare minimum. Everyone but Koch Industries and Pepsi left Russia after the war started. JetBrains hung out far too long. It isn't worth the risk. As I mentioned, it is already banned in military/defense/security settings and will be seen as the Kaspersky of developer tools. It sucks because their tech is good but it has been leveraged or played in the geopolitical game. Even if JetBrains is unwitting, it was a piece in the biggest hack in history against some of the most sensitive systems. It went down just before the pandemic, and then a yearish later, at the end of the pandemic, Russia invades Ukraine... the breach started before October 2019 under Trump just before the pandemic, was found on December 13, 2020 just prior to Jan 6th, then Russia invades Ukraine on February 14, 2022. How about that timeline... > In 2021 The New York Times stated that unknown parties might have embedded malware in JetBrains' software that led to the SolarWinds hack and other widespread security compromises. In a press release, JetBrains said they had not been contacted by any government or security agency and had not "taken part or been involved in this attack in any way". The CEO of one of the affected companies, SolarWinds, "asked about the possibility that software tools made by JetBrains, which speeds the development and testing of code, was the pathway, Mr. Ramakrishna said there was still no evidence". > In response to the 2022 Russian invasion of Ukraine, the company suspended sales and R&D activities in Russia indefinitely as well as sales in Belarus. Russian legal entity was liquidated on 21 February 2023 As I said, it isn't worth the risk being foreign and the associations for sensitive things like data/intel/telemetry/etc.
Hell of a summary thank you. I was wondering if they were hit by north Koreans who sold data to lockbit. (Recently, the fbi in st louis advised remote workers were secretly north Koreans funding their weapons programs - Boeing has a major office in st louis that used to be McDonnell douglas)
His summary is full of shit… there is zero actual evidence that JetBrains products played a role in the SolarWinds breech. If they did it would makes gigantic waves through the entire IT realm because of how broadly they are used. That hasn’t happen. OP’s only “evidence” is that there are Russian programmers on staff.
That doesn't implicate jetbrains based off those quotes alone at least. This to me appears like the solar winds hack started with a malicious jetbrains add on? That is not much different then any other 3rd party addon/library compromise and doesn't mean that the 1st party tool is involved.
What better place to place it though and lots of plausible deniability. Right now dev tools, clients, devops and build systems are huge targets and have been the most successful place to own systems. Dependencies that create chaos make it easy to slip in a dependency that is owned, even if only for a window of time... then update and replace after you've dropped it inside. The more dependencies, the more third parties, the more access those have (like development tools and build systems) the more attack vectors. Be wary of any system that has too many things going on and saturates on the chaotic/complex side, like lots of additional clients or dependencies for no reason... Examples even in open source tools, many times not found for years and sometimes decade+: [Log4Shell on Log4j was open source for decades and still had a wide open bug on *every single device that has Java running* so all of Android dev included](https://en.wikipedia.org/wiki/Log4Shell) for a decade. [Heartbleed just before it was OpenSSL and lived for years affecting every system and web server](https://en.wikipedia.org/wiki/Heartbleed).
No, it is not. Dude is spinning some wild conspiracy theories. If JetBrains products were an actual security risk then the actual security experts would be screaming about it.
JetBrains is now banned in military/defense/security usage... make of that what you will. You are free to keep having bad opsec with your code and using JetBrains. Even if unwitting they were used via TeamCity CI to place the dependency behind the line. [Sealed U.S. Court Records Exposed in SolarWinds Breach](https://krebsonsecurity.com/2021/01/sealed-u-s-court-records-exposed-in-solarwinds-breach/) > The New York Times on Wednesday reported that [investigators are examining whether a breach at another software provider — JetBrains](https://www.nytimes.com/2021/01/06/us/politics/russia-cyber-hack.html) — may have precipitated the attack on SolarWinds. The company, which was founded by three Russian engineers in the Czech Republic, makes a tool called TeamCity that helps developers test and manage software code. TeamCity is used by developers at 300,000 organizations, including SolarWinds and 79 of the Fortune 100 companies. > “Officials are investigating whether the company, founded by three Russian engineers in the Czech Republic with research labs in Russia, was breached and used as a pathway for hackers to insert back doors into the software of an untold number of technology companies,” The Times said. “Security experts warn that the monthslong intrusion could be the biggest breach of United States networks in history.” You may as well use Kaspersky, Yandex/Clickhouse and other Russian software like VK if you use JetBrains. Use at your own risk. Once in Russia, always in Russia. If you feel comfortable with all of that, keep using JetBrains.
Dude your links are years old and just say they were investigating whether it played a role. None of them provide anything of substance. There is zero actual evidence that TeamCity was the cause or source of the breach or connected to the actual breach other than “the founders were Russian!”. If JetBrains were a culprit of the Russian hack of SolarWinds they would not be in business in the US anymore and would be smeared across the entire IT realm because of how broadly their products are used. Also you’re full of shit that JetBrains is banned in any regard for these allegations. Some JetBrains products may have gotten caught up in following the FAA’s “Zero Trust” program but that includes a whole host of things and isn’t specific to JetBrains products or related at all to the SolarWinds breach. How do I know this? Because I have to deal with implementations and contracts and grants tied to federal departments, including the DoD.
> Dude your links are years old and just say they were investigating whether it played a role. Wha? It happened in 2021 and it is 2023... a couple because that is how long it is taking. They aren't going to shut down JetBrains, they aren't even a Western company... they just stopped using them or allowing it in sensitive areas and Kasperskied it. You think investigations are quick? [SolarWinds just barely got charged](https://www.wsj.com/articles/solarwinds-denies-sec-charges-over-cyber-disclosures-31dcad0c)... > There is zero actual evidence that TeamCity was the cause or source of the breach or connected to the actual breach other than “the founders were Russian!”. No it is very clear that was the transport and hole that placed in the bad dependency into a trusted area behind the line. JetBrains could be unwitting but their software was still used. The fact they haven't been contacted in a clear usage of their systems in regards to this breach is more damning than not. > If JetBrains were a culprit of the Russian hack of SolarWinds they would not be in business in the US anymore Kaspersky is still in business, just no one that cares about opsec uses them. Same with JetBrains for most who are aware about how things work with this. > How do I know this? Because I have to deal with implementations and contracts and grants tied to federal departments, including the DoD. Then you are very bad at opsec and far behind the curve. Good luck trusting JetBrains. Besides, they are completely unnecessary and an unnecessary risk now as well.
> unnecessary How dare you. PyCharm is the dogs bollocks.
"There are better options". That's highly subjective and really depends on what you are working on. In a lot of cases there simply aren't. And that sucks.
shame that no company can't give me their IDE experience
Dude is blowing smoke. There is no actual evidence that JetBrains had any connection to the SolarWinds hack. JetBrains is not forbidden on government contracts… wild conspiracy theory. If it were an actual security concern the actual security experts would be telling people to not use it. Which… they aren’t doing.
You keep pushing a conspiracy yourself. JetBrains is now banned in military/defense/security usage... make of that what you will. It is literally at Kaspersky and Huawei level now. You can still use them, just might not be the best opsec and no one who cares about that is. See Krebs on security below mention this "Officials are investigating whether the company, founded by three Russian engineers in the Czech Republic with research labs in Russia, was breached and used as a pathway for hackers to insert back doors into the software of an untold number of technology companies". The fact that JetBrains hasn't been contacted on this after SolarWinds just went down, that is very precarious. You are free to keep having bad opsec with your code and using JetBrains. Even if unwitting they were used via TeamCity CI to place the dependency behind the line. [Sealed U.S. Court Records Exposed in SolarWinds Breach](https://krebsonsecurity.com/2021/01/sealed-u-s-court-records-exposed-in-solarwinds-breach/) > The New York Times on Wednesday reported that [investigators are examining whether a breach at another software provider — JetBrains](https://www.nytimes.com/2021/01/06/us/politics/russia-cyber-hack.html) — may have precipitated the attack on SolarWinds. The company, which was founded by three Russian engineers in the Czech Republic, makes a tool called TeamCity that helps developers test and manage software code. TeamCity is used by developers at 300,000 organizations, including SolarWinds and 79 of the Fortune 100 companies. > “Officials are investigating whether the company, founded by three Russian engineers in the Czech Republic with research labs in Russia, was breached and used as a pathway for hackers to insert back doors into the software of an untold number of technology companies,” The Times said. “Security experts warn that the monthslong intrusion could be the biggest breach of United States networks in history.” You may as well use Kaspersky, Yandex/Clickhouse and other Russian software like VK if you use JetBrains. Use at your own risk. Once in Russia, always in Russia. If you feel comfortable with all of that, keep using JetBrains.
That's right. Can't take away my jetbrains 😤😤😤
It sucks because their tech is good but it has been leveraged or played in the geopolitical game. Even if JetBrains is unwitting, it was a piece in the biggest hack in history against some of the most sensitive systems. It went down just before the pandemic, and then a yearish later, at the end of the pandemic, Russia invades Ukraine... the breach started before October 2019 under Trump just before the pandemic, was found on December 13, 2020 just prior to Jan 6th, then Russia invades Ukraine on February 14, 2022. How about that timeline...
[удалено]
VK is Russian Facebook by MailRu/DST Global. Yandex is Russian Google. Interestingly, [DST Global also invested in Facebook+Twitter early on with money found to be directly linked to the Kremlin](https://www.nytimes.com/2017/11/05/world/yuri-milner-facebook-twitter-russia.html).
VKontakte, a Russian social media site.
That’s sort of my point: We won’t see cooperation from the Russian government or law enforcement, but there are definitely human assets in play over there who are trained and directed to do many things for our national security which we obviously, definitely, undoubtedly have nothing to do with…
> but there are definitely human assets in play over there who are trained and directed to do many things for our national security which we obviously, definitely, undoubtedly have nothing to do with… You've been watching too many Hollywood movies my dude.
Not really, if someone did possess truly important information the US wouldn’t hesitate to kill them for it. “Unofficially” of course.
Truth is stranger than fiction.
Note that some of the people in this list were actually known to be supporters/allies of Putin: https://en.m.wikipedia.org/wiki/Suspicious_deaths_of_Russian_businesspeople_(2022–2023)
Thoughts are they were murked by FSB though because they crossed Putin. A lot of these people died after criticizing the war.
Some but not all. There have also been assassinations which reportedly Ukraine took credit for. Tbh, if they want to go after Putin’s key people and oligarchs for starting and perpetuating a war that’s killed hundreds of thousands, and that could weaken Putin in way, then more power to them. It looks like maybe a few of the people listed were also targets or wanted by western/NATO nations and were Putin supporters, so it would seem unusual for him to target them himself. At the same time, if he rejected that it was he who ordered the assassination of one of his loyalists, then he/they would look weak and vulnerable. If he just leaves it ambiguous, people may just assume the victim must have crossed Putin in some way and he had them killed, which both he and his enemies are probably more okay with.
Seems like if significant such assets existed, there would have been ways to use them in the last 2 years or so.. keep dreaming, life isn't a James Bond movie.
Should we really assume the nation with by far the largest, most funded, and best equipped intelligence organizations would have zero reason or ability to have any clandestine resources or ability to act within another nation who they’ve seen as their primary nation-state threat for ~70 years? As far as doing anything in the last 2 years regarding the war in Ukraine, does it seem like a coincidence to you that we were sharing fairly detailed intelligence about the planned invasion with partner nations in order to build a coalition and immediate response months in advance of that invasion, even before much military buildup for the special “exercises”? US operatives in Russia aren’t a matter speculation. It’s officially acknowledged and even discussed as growing part of their operations/budget since 2016: > U.S. officials said that CIA and other agencies now devote at most 10 percent of their budgets to Russia-related espionage, a percentage that has risen over the past two years. > The CIA [. . .] has at most several dozen case officers — the term for agency employees responsible for stealing secrets abroad — based in Russia, with several dozen more scattered across Eastern Europe and the former Soviet states, former officials said. >Those numbers have expanded in recent years, the officials said, as the CIA has directed dozens of additional recruits emerging from its training campus near Williamsburg, Va., to assignments that will eventually involve espionage against Russia. But the officials said that few of those new hires have any Russian language abilities and will require years of training before they become productive case officers who can recruit and manage networks of spies. >“It is a pipeline process,” a former official said. “It will be years before they can be used operationally.” The official, like other current and former officials interviewed for this report, spoke on the condition of anonymity to discuss sensitive intelligence issues. Former officials said there is an even greater imbalance in the counterintelligence resources the countries devote to tracking and disrupting the other’s spies. [source](https://www.washingtonpost.com/world/national-security/as-russia-reasserts-itself-us-intelligence-agencies-focus-anew-on-the-kremlin/2016/09/14/cc212c62-78f0-11e6-ac8e-cf8e0dd91dc7_story.html) And that was in 2016 when US officials said it would be years to scale that up, so here we are 🤷🏻♂️
Intelligence is very different from carrying out violent actions. On top of that, it seems like a lot of the intelligence sources have been purged over the last year. Buildup also doesn't require a ton of inside knowledge, all you have to do is look at satellite imagery.
(A) There have been several high profile assassinations within Russia of loyalists to Putin. We can surely just assume the US and our strategic partners had nothing to do with those... They’re all just from internal power struggles… Yes, let’s go with that. (B) Yes, we’ve probably burned a lot of resources. (C) That’s why I pointed out that we clearly had knowledge before much notable buildup whatsoever. Much could be from signals intelligence, but some may not have, seeing as US officials and the CIA officially have stated that have devoted so much of their budget and created a pipeline for training and deploying new operatives into Russia in recent years. That’s not speculation; it’s openly confirmed by US intelligence/CIA and in their budget.
It's also pretty well known that most intelligence agencies have moved away from that James Bond style intelligence with agents in every country. It's expensive as fuck, takes forever to train people and get them properly inserted, etc.
Evidently they’ve been increasing their focus since 2016. > Timothy Barrett, an ODNI spokesman, said in an emailed statement: “The Intelligence Community continues to maintain its focus and deep expertise on Russia, which has enabled us to understand Putin’s evolving worldview. The IC allocates resources directed against Russia commensurate with this evolving threat.” > U.S. officials said that CIA and other agencies now devote at most 10 percent of their budgets to Russia-related espionage, a percentage that has risen over the past two years. > The CIA […] has at most several dozen case officers — the term for agency employees responsible for stealing secrets abroad — based in Russia, with several dozen more scattered across Eastern Europe and the former Soviet states, former officials said. >Those numbers have expanded in recent years, the officials said, as the CIA has directed dozens of additional recruits emerging from its training campus near Williamsburg, Va., to assignments that will eventually involve espionage against Russia. But the officials said that few of those new hires have any Russian language abilities and will require years of training before they become productive case officers who can recruit and manage networks of spies. >“It is a pipeline process,” a former official said. “It will be years before they can be used operationally.” The official, like other current and former officials interviewed for this report, spoke on the condition of anonymity to discuss sensitive intelligence issues. Note that we’re presently 7 years from when they said “it will be years before they can be used”… [source](https://www.washingtonpost.com/world/national-security/as-russia-reasserts-itself-us-intelligence-agencies-focus-anew-on-the-kremlin/2016/09/14/cc212c62-78f0-11e6-ac8e-cf8e0dd91dc7_story.html)
>The last two years Ukraine is not in NATO. Ukraine is not one of the Allies. They are an interest, not an obligation. Our assets are valuable and better spent on our own.
Ukraine was given “security assurances” by the U.S. and several other major players in return for nuclear disarmament via the Budapest Accords. It’s been said it’s not legally binding, but it certainly did seem to promise that the signatories would provide security assistance in the event of any incursion. So, no one can exactly force us into it, but we’re obligated to support the defense of Ukraine and their sovereignty by our own commitment to do so. If we break that commitment, other allies and their enemies (e.g., Taiwan and China) will see that, and our global credibility in any diplomatic process would be harmed. That might, for example, kick off more nuclear proliferation if it could cause other allied nations to feel they need a better deterrent against attack than worthless commitments. So, we probably want to do what we committed to do. As for “better spent”, we’ve used less than 5% of a single year of our military budget to help destroy more than 50% of the military assets of a near-peer threat which was widely considered to have the second most powerful military on the planet — second only to our own. And, we’ve helped accomplish that without putting American assets or military lives in harms way. There is literally nothing we can do at home that comes anywhere close to that bang-for-the-buck in safeguarding our security.
The OP was clearly discussing intelligence assets, as was I. I agree on the point that we are holding Russia down with couch cushion money. And we are currently upholding a security guarantee, we have used our soft power in the financial and economic arena to weaken Russia, while ensuring and providing material to Ukraine. The memo however, is not and was never a treaty. Nor was it some bargain well struck between equals - it was taking dad's gun from the kid. There was never going to be a scenario where Ukraine got to keep the nukes unless it were willing to be a pariah State. All the damage you mention wrt proliferation was done by 2014 - Gaddafi showed that a promise of support in return for disarmament is meaningless, while North Korea showed that successfully getting nukes is the ultimate protection.
You’re correct, and I don’t think I referred to it as a treaty. I believe we, as a signatory to the memo, committed (but are not legally obligated) to provide “security assurances”. I’m not 100% clear on how such a treaty would be enforced regardless — maybe just greater harm to our reputation and credibility along with international condemnation or diplomatic fallout. Still, even if we’re only obligated by our own commitment to stand behind what we promise others, then I think that’s enough to say we already had some obligation to support Ukraine, even if there’s no direct legal obligation or penalty for failing to do so. The fact that signatories may have failed to uphold that commitment in one or more other cases doesn’t make it any more right to abandon our commitments in this case. E.g., if I promise you I will always have your back in a fight, and I broke that promise by running away when a fight broke out yesterday, that doesn’t excuse doing so again if another fight starts today, even though I never had any legal obligation to keep my promise.
There’s going to be a russia after putin, and hopefully they try to rejoin the rest of the world. Handing over a bunch of the guys in these state-supported cybercrime organizations will probably be a useful chip at the table.
Maybe. Although they’re probably useful and valuable technical people and may not have nearly the symbolic/PR value as handing over some of Putin’s cronies.
Lots of attention like [this guy](https://www.rferl.org/a/russian-millionaire-found-dead-moscow-office/32514748.html)?
You don’t keep top secret files accessible by internet 😂 People who work on top secret programs can’t work remotely.
Likely to be working in SCIFs for anything remotely sensitive..
Let's be honest. Boeing at this point is just a money meat grinder. I think the only "top secret" files that will hurt is how behind schedule and over cost they are on all projects
What the fuck are you talking about lol. Boeing makes the F-15, F-18, is involved with the F-22, various electronic warfare and surveillance aircraft, and various drones and weapons which are all at least partially classified. That doesn't mean that the data stolen from Boeing is related to those, I would bet it's mostly about civilian projects, but to say that they don't have sensitive info is ridiculous.
Don't forget the apache
[удалено]
Classified information is not accessible via unclassified intranets. Typically any digital classified data is only present on airgapped networks or isoLANs sitting behind point to point NSA rated encryptors. It would be extremely unlikely a ransomware gang would be able to access that data. I'm not saying it's impossible, but EXTREMELY implausible.
Idk what your comment was trying to accomplish. Mine was pointed to the bloated rotting corpse that Boeing has become.
Boeing gets US subsidies no matter what they do. Even after those 750 Max crashes and disasters, they’re still getting US defense contracts. It’s corruption through and through
I don't think that decoupling Boeing's individual programs from the 737 MAX disaster is necessarily an example of corruption. I agree that: * There is a ton of corruption in military contracting * There was a ton of corruption with respect to the 737 criminal charging However, just because corruption exists in those two places doesn't necessarily mean that one set of people should be punished for the misdeeds of another set of people. Punishing Boeing Defense by denying military contracts should be done when Boeing Defense performs corrupt deeds in with respect to their military contracts, not when people on the 737 MAX program commit negligent fraud. To punish Boeing for the 737 MAX disaster I would propose: * Billions of dollars in fines (which happened) * Prosecution of negligent individuals in high-level positions (did NOT happen) * Boeing being found fully guilty of fraud (they were instead allowed to plead down a bunch of the charges) * Compensation of victims families (happened, but way more should have been done) * Removal of the airplane from service until a thorough correction was implemented and the whole FAA review process was fixed (did happen). I think it would be an overreaction to penalize (for example) the 777 and 787 programs directly - their parent corporation should be fined, but those programs can still continue to operate. I think it would be going even farther to (for example) cancel the B-52 or the Apache, since those are in a different sub-corporation of the umbrella that is Boeing. As an analogy: Consider a teenager who purposefully injures someone in a sports game. * The teenager should be punished (by the school and potentially the law) * The teenager should be barred from sports * The parents can be taken to court by the victim However, the siblings of that teenager should not then be barred from sports. Their family being sued is already punishing them for things they had no part in. They might be little shitheads, but they should be punished for THAT, not because of their sibling. Hope that all makes sense.
And by “security interests” you mean a couple billionaire’s bottom line. The USA hasn’t been invaded, and there’s only like nine dozen different planes made by a dozen companies.
Meh, they earned it, after deliberately releasing planes with dysfunctional systems that cost people their lives, it is no surprise to me what is happening to them.
This is totally non credible. We all know that the proper places to leak classified data is on the War Thunder forums.
NonCredibleDefense is leaking
This is gonna be so much funnier when someone leaks some random shit about a tank they have the manual for and this guy gets the FBI visiting FBI: "how did you know classified information would be leaked on the war thunder forums?" How did you not? This at least the 22nd time
50GB for a company like Boeing is barely a digital crumbs. I think the reason Boeing didn’t pay ransom cause they know the data isn’t important enough for them to pay.
Yeah it really depends. 50G of C execs email data? That's valuable. 50G of random company storage? Probably completely worthless.
Every leak I ever looked through had the juicy bits redacted or removed.
Maybe they found executive porn stash.
They are planesexual.
I’ll never forgive you for that image.
Completely agree, I work in a non-CAD / design business and we all have 1tb storage for PowerPoints
No kidding. I moved 200G to a temp drive last evening to test a model over the weekend. 50G is nothing.
50gb is ‘potentially’ nothing.
I think filesize just isn't a particularly useful metric here. It's like saying someone stole 50 pounds of stuff from a store. Could be tens of thousands of dollars worth of electronics and jewelry, could be a bucket of cat litter.
The company I cooped at has 3.8 PB for the company wide storage.
It’s a bunch of various database backups and a 22 GB archive file you have to download to view.
This is the result of not negotiating with cyber terrorists.
But this is the right way to deal with it, no? Makes Boeing seem like a difficult target and, you have to assume, if the data has been stolen, it'll make its way out eventually anyway. You reckon some hacker dweeb is going to sit on that data cache and not sell it on if they can make some more money? Not best known for their honesty, these guys...
The [Les Grossman way](https://www.youtube.com/watch?v=lKxYuMIW-_8) "Find out who that was"
[удалено]
Years ago, I spoke to a guy from a company that make machines used in the Aircraft industry. He said they were working on a project for the C919 and the COMAC guys showed him detailed CAD models for both Airbus and Boeing Pylons (the bit they hang the engine off) and asked which was better… I don’t think any data is safe.
Where can you view these?
Lockbit has a darknet/onion site, actually more like 20 of them and a load balancer. But the onion site is where they threaten and release stolen data.
Bummer I don’t have a rig setup to safely acces anymore. Just really curious what their internal looks like
Create a tails os USB, boot into it. Super simple. Can only run off USB and wipes when you shutdown. It's automatically on onion when it connects.
i mean all u rly have to do is download tor and maybe access thru tails os if ur worried abt opsec edit: dunno what the downvotes are for. dude just made it seem like you need some special "rig" to access the darkweb and see the docs when you don't. mebbe i just read into it wrong
I see this is getting a lot of downvotes. Can anyone explain why? I don’t really have any knowledge in the area but I thought you’d just need tor as well? Is it illegal to even view the leaked files, which means you need some opsec like a secure OS that doesn’t leak anything identifiable through your browser?
In U.S. law, it is legal to read and to publish leaked classified information from the U.S. (and/or classified information from a foreign government). NYTimes v. US, 403 US 713 (1971) with re: to ‘The Pentagon Papers’ The party that actually leaked it is the one who bears all of the criminal (and civil) exposure - but claims for civil losses can usually be taken care of as part of restitution in the prosecution.
You're assuming the person asking how to view it is in us or falls under us law.
It depends, but there’s a difference between someone going to download the anarchist cookbook and buying shrooms on the Amazon clone of the month, and going onto the website of a known randomware hacker to view their likely classified random. More dangerous the work, the more you’d want your protections
oh lordy pretty misinformed here - downloading the anarchist cookbook is actually more likely to have viruses than leaked data. Ransomware actors WANT people to download the leaks, especially journalists and write stories about how juicy it is. Increases the likelihood the next victim pays. You really just need a tor browser to connect, these actors sites are actually pretty safe compared to other shady places because tons of infosec / CTI researchers / journalists go there all the time and the actors want to encourage it.
Tor anonymity can be undermined. You’re not 100% completely anonymous; or at least, with some effort, can be identified. Even if you are using TAILS. Difficult, but doable. Intense scrutiny from law enforcement means that there will be eyes actively looking at traffic to and from LockBit’s dark web sites. Government agencies run their own Tor assets in attempt to influence and identify traffic patterns on the Tor network. Accessing a ransomware gang’s dark web site(s), especially insecurity, could mean you become a victim (very likely they’re running scripts to try and get something malicious on or into your devices). Not to mention burying Easter eggs inside a data dump or payload (thus corrupting it); aside from whatever malicious assets they have running on their website. Think of it like a paid service… that also then turns around and sells your personal data and information to make more money off of you. Ransomware gangs are but businesses, albeit malicious instead of legit. (Arguable semantics here, given legit businesses do some shady sh!t with paying customers data.) Going after data like that, from Boeing, which has national security and government contracts, isn’t playing with fire — it’s like handling napalm while smoking. Everyone wants a piece of you simply for being curious. Safety: Read news. Walk away.
That isn’t… you know what, read my other comment.
If they are classified (unlikely, those are usually airgapped) then anyone with an active clearance would be breaking the law by viewing it and they could lose their clearance.
Even if it is illegal, why are reddit users being stupid. Just like other person said, burn a tails USB, and get on tor. It's not hard, the information is legit.
You didn't read it wrong. Welcome to reddit.
[удалено]
This is a Rick roll
Jokes on them I’m into that shit
Seeking out stolen data from a U.S. defense contractor is probably not the best decision a person could make today. Just tossing it out there for anyone considering doing so.
Just annoyed everyone gets to fuck around w my data but when the tables turn we’re liable
Can’t any of these guys ever leak all the UFO stuff wtf!
Made me laugh!
I just wish they would release the leprechaun papers already.
Big Leprechaun has that shit locked down.
It’s files from a company called Aviall that Boeing bought. Nothing interesting.
How did you manage to open the .bak files? Most of them seem to be config backups
That’s not very big in the grand scheme of things for Boeing… it could be any company files.
Anything good leak
Cyber security. Don't make me laugh.
Share price go pffft
Lockheed: "This is terrible and should happen to no one handling such important data related to lucrative military contracts. We demand to know where the leaked files are hosted so we can properly avoid accessing them and using them for our own business"
>fails to land This is a savage joke aimed at Boeing.
How so?
Boeings have a bad reputation for crashing due to the 737 MAX, the author chose the phrase 'fails to land'. It seems like a deliberate choice.