Here's what Russia's SVR spy agency does when it breaks into your network, says US CISA infosec agency Following attribution of the SolarWinds supply chain attack to Russia's APT29, the US CISA infosec agency has published a list of the spies' known tactics – including a penchant for using a naughtily named email provider. APT29* is the Western infosec world's codename for what we now know is the Russian Foreign Intelligence …
The relentlessly efficient* Austrian scientists have managed to reduce this to a lonely -l, often while lopping off great chunks of the original word. Along with -i, and coming from a High German background, this often feels like one is talking with a child, eg."Wir gehen Berg aufi mit dem Säckl" would roughly translate as "We go uppy the mountain with the sacky".
Fabulous beer, mind.
*compulsory phrase when talking about any Germanic countries.
I believe it was Jo Brand who told the joke years ago about Watson walking into 221b Baker St, to find Holmes on his hands and knees attempting to push a small yellow citrus fruit up his posterior.
"My God, Holmes! What are you doing?"
"Lemon entry, my dear Watson."
Joseph Goebbels:
"Eine Lüge muss nur oft genug wiederholt werden. Dann wird sie geglaubt."
/
"A lie only has to be repeated often enough. Then it will be believed."
Being watching those repetitions for ages now. Our weekly/daily turd drop us now, dear intelligence services (=mobsters).
Normally our mail server only gets a login attempt every couple of minutes but occasionally I see more than 40,000 attempts in a day. The majority appear to be coming from Russia but we're far more concerned about just blocking them than tracking them.
Botnets are still ubiquitous if my web logs are anything to go by. You know they are part of the same botnet because even though one failure is from Brasil and another from France and yet another from Ukraine etc, they all cause the exact same number of failed logins in a 24h period.
Hint to SVR: try to introduce some randomisation with your low and slow.
a few years ago I was immediately (within around 3-hours of registering) telephoned by a rather angry spook from #### who asked WTF I was up-to?
And they didn't ask me in Russian
I hope I didn't give anyone any ideas, my Lichtenstein based site (down at present for hosting change) http://###.li/ is Russian for "bowling ball"/"skittles", and isn't "hyi" in any way shape or form
weird stuff on the interwebs nowadays
I registered a .li domain exactly because of the diminutive effect "li" has in Swiss German, I was at the time in Switzerland.
The result is that I have a very short email address, but it sometimes takes a while to spell it to end users who are still as yet unaware of country suffixes like .ch, .de and - as discussed - .li. Yes, we've only been using this Internet thingy for a couple of decades. Ooh look: paper and ballpoints, yes, you can put away that quill now! Sorry, digressing slightly.
It also has the fun property of two characters next to each other which could be an L, an I or a one (1), which allows for some entertainment while using a sans serif font. Sometimes I like to set up dormant abilities to confuse things, just in case :).
We're not Russian media but this right here is perhaps what it may look like -- coverage of 5EYES piling into Russia.
And here. And pretty much everything written about Edward Snowden and the CIA Wikileaks materials.
C.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
