Technical report on DNC hack [pdf]
I have looked through the report. The only useful information was brief description of attack methods, everything else looks like a list of general recommendations one can find on the OWASP website.<p>As I understand from report the main methods used were:<p>- sendind emails with executable files that victims for some reason executed<p>- phishing<p>So, they used script kiddie level tools anyone could use (and they are cheap; you don&#x27;t have to buy expensive zero-day exploits on a black market). But of course this could be done intentionally so it looks amateur-ish.<p>This attacks could be easily mitigated. First, OS and applications should not run unknown files from Internet (because some people got used to double click on everything they get in email), second, we should start using physical cryptographic keys instead of passwords. Common people cannot handle passwords, they either make easily guessed passwords or enter them everywhere without thinking. I hate passwords too because they are hard to remember (and please don&#x27;t suggest that I should download some software and upload my passwords to a &quot;cloud&quot; in NSA-controlled country).<p>By the way iOS is the only popular operating system I know that doesn&#x27;t allow to execute files downloaded from web or emails. Apple did it the right way.<p>The report also contains a pretty useless firewall rule named &quot;PAS TOOL PHP WEB KIT FOUND&quot; that can be used to search malware in PHP files. It is interesting that they have replaced digits in &#x27;base64_decode&#x27; function name with regexp as if there were any other similar functions.