Comment by not_a_spy | Hacker News Reader

Comment by not_a_spy | Hacker News Reader

Parent Full thread

Here's what I can see in the files:

* The first few documents (1.doc through 3.doc) have metadata which says they were written by Warren Flood. However, the "last saved by" claims is was by Феликс Эдмундович. It also claims that it was created earlier today.

* The 4.doc file said the author was "Blake" and the company was "Grizli777" and it was last saved by "user" and created today.

* 5.doc claims to have been written by "jbs836" at the company "University of Texas at Austin". Again, last saved by "Феликс Эдмундович" and again, created earlier today.

* None of the excel files had anything interesting, except that their creation dates also all said today.

Research:

* There is a Warren Flood associated with the DNC (according to LinkedIn: https://www.linkedin.com/in/warrenflood).

* Google translates "Феликс Эдмундович" as "Felix", Bing and Prompt as "Felix Dzerzhinsky". Googleing "Felix Dzerzhinsky" turns up Felix Edmundovich Dzerzhinsky, the former Director of Cheka... an Russian internal security service. He's been dead 90 years, so I doubt it was really him though.

* Googling "Grizli777" seems to suggest that the user's copy was pirated. Nothing really to go on there.

* Googling "jbs836" finds people (talking about this subject) suggesting that it's James B. Steinberg (https://en.wikipedia.org/wiki/James_Steinberg) a Democratic politician who formerly worked for the University of Texas at Austin.

My Take:

* The files are either genuine or someone bothered to find some Democrats names to attach to them. I'm leaning toward genuine since they didn't clean up any other metadata.

* The files have at least passed through the hands of a Russian or someone who likes using former Russian spies as a pseudonym.

* There's no evidence that these files came from a DNC server and not, say, Warren Flood's laptop.

* There's no evidence that the individual who wrote this acted alone or that he is not working for a state.

>* The files have at least passed through the hands of a Russian or someone who likes using former Russian spies as a pseudonym.

Looks to me that someone desperately wants to implicate Russians or to make it seem that the attacker is Russian. Even the original Guccifer used Russian proxies (as per his Wikipedia entry).

I also read on twitter that ")))" is a Russian version of a smiley face... they apparently omit ':' in ':)'. That version of the smiley face was used in his blog post. Again, that's definitely not a subtle clue.

I hope someone runs linguistic forensic analysis on that whole blog post because the 'broken english' nature of it might reveal where the author could be from and what his mother tongue might be. People who are not native speakers of english make different mistakes based on what their mother tongue is so that's something that might be harder to manufacture. Broken english of a chinese speaker will be different from someone who speaks french, for example.

I've also seen malware analysis reports which show that malware authors often change the locale of their computers and often insert variable names in different languages to further obfuscate the origin of malware.

This is a fascinating case and it reads like a spy novel!

I used to play an MMO primarily populated by Russians and Ukrainians - I've also lived in a few other places. The writing on the blog post definitely sounds Russian.

I really doubt it was Russian intelligence services, though, just a hacker having some fun with account names etc.

I assumed these were going to be filled with FUD, and that this was a "false flag" against the Clinton campaign when I read the blog post without looking at the contents of the documents.

But tbh, all the stuff that's "leaked" looks pretty reasonable to me. The Trump stuff is all true, public knowledge --- obviously spun a little bit, but maybe even more fair to Trump than John Oliver. The policy stuff sounds pretty good to me --- national cyber advisor is probably needed, the crisis response stuff sounds like a pretty good idea, a speech to an Islamic forum in the first 100 days sounds good too.

If this were fake, you'd think it would be more damaging. If anything, this probably makes me a little more comfortable with the idea of voting Clinton, since she has (less) incentive to lie in "confidential documents." (Of course, I don't think that she would have the confidential-confidential-plans-to-expand-the-NSA papers in the hands of a campaign staffer.)

So.... solid leak, Guccifer 2.0. You keep doing you.

> all the stuff that's "leaked" looks pretty reasonable to me.

If I understand correctly, the only point of this leak was to demonstrate that the hack actually happened. The damaging stuff has been given to Wikileaks, which knows better how to maximise its impact.

Depending on WL and the leaker's agenda, they'll release it before or after the DNC convention: some people would rather have Sanders as a Dem candidate, some others would rather have an undermined Clinton being trounced by Trump.

France faced a similar situation in 2012: DSK (https://en.wikipedia.org/wiki/Dominique_Strauss-Kahn) was bound to win the presidency, except that he could neither keep his dick in his pants, nor bother to get consent before shoving it down people's throats. His campaign exploded before the left-wing primary, because he allegedly raped a maid in New York's Sofitel; but the right-wing government had an ongoing investigation on pimping charges, linked to Lille's Carlton, which was scheduled to go public after the primary. Had he been bust by the French investigation, rather than prematurely in New York, French then-president Sarkozy would have very likely been re-elected.

The problem with this read is that Sanders will never be the dem candiate (even if Hillary drops dead tomorrow the backup is Uncle Joe and maybe Sen. Warren) and Hillary could emulate the Cheetoh Jesus' claim and shoot someone dead on 5th avenue and she is still going to be the next US president. Releasing to WL is also a good move if the leak were to have come direclty from the Clinton camp, as there are few information sources more biased and discredited among the general public than WL.

I admit I don't know enough about Democratic party rules to guess who would replace a busted Clinton candidacy. Common sense would dictate that a candidate who came close second would be chosen, but common sense doesn't necessarily apply here indeed.

As for Clinton being the next president, I'd be surprised if she were. Based among others on PG's "It's Charisma, stupid" [http://www.paulgraham.com/charisma.html], more recently Scott Adams' perspectives, US history, and the mounting anti-establishment sentiments empowered by Internet bypassing centralised media, I expect Trump to tune his public persona for a target wider than Tea Party voters, then to thoroughly beat her. It sounds very bold, until you remember that this country chose Bush Jr. against Kerry, who was vastly more likeable, competent, and seemingly honest than HRC.

I'm also doubtful about the public at large being influenced by a WL apparent origin: I'm afraid the general public hasn't yet learned to mind and evaluate sources. That's a digital native reflex, we're still a minority, and we're rather sympathetic towards WL.

"Scott Adams' perspectives"? Seriously, what particular insight to you think that particular MRA douche brings to bear here? You just need to look at the polling data to see where things are going to go; there are not enough angry white bros left to make a difference in the election at this point. The only question is the degree of impact on down-ticket races that the upcoming beat-down of Trump will have. The Senate is going to flip control, but at the speed at which Trump is crashing to earth I think the House may be in play.

The prediction markets say something like 75% Clinton to 25% Trump. Either you know something they don't (and are about to make a lot of money) – or you probably shouldn't be making predictions with that degree of confidence. Especially considering how unpredictable the elections have been thus far.

Just looking at the polling data is exactly what did the many pundits who completely failed to predict the GOP primary outcome (as well as Sanders' excellent performance).

By contrast, Adams predicted what would happen, why how and when, with striking accuracy, all of that before it happened, when traditional pundits struggle to even fit the facts in a narrative retrospectively.

Polls are good to predict more of the same, this election is different (and would have been even more so, had the DNC been impartial between candidates). Calling him a "MRA douche" is an ad hominem attack, a sign that you're short in rational arguments. I believe it also happens to be false.

Finally, those who think Trump will be elected don't expect angry white bros to multiply by magic; they expect Trump to appeal to a much wider demographic. Angry white bros are whom you need to seduce to steal the GOP from its elite, and boy has he done it skillfully. Given the limited memory and attention span of many electors, many people believe he has the skill to completely reposition himself.

I would like to stress the difference between acknowledging populist skills and endorsing someone as a great potential president, but such nuances are usually lost to angry people, whether they're white bros or not.

Primaries are notorious for bad polling. What it basically comes down to is that the voting model for a primary is hard to determine since it has such a low turnout. This is not a new phenomenon and pundits have routinely failed to predict primary results. Things get much, much better when you are talking about a general election.

Adams' "prediction" was more a restatement of what he wanted to see happen and once it comes to pass you seem to think it is an indicator of some keen insight rather than blind luck combining with wishful thinking. Most pundits work with anecdotal models about what they think will happen and things which break outside of that model cause problems (c.f. the mea culpa from Nate Silver). No, this election is not "different" other than having one of the worst candidates possible manage to come out on top of the Republican primaries.

As far as Adams himself, I think you are misunderstanding what an ad hominem attack is. I noted that Adams' loathsome misogyny led him to his particular prediction, which is completely accurate. If I had instead stated "Scott Adams is a bad driver because he is an MRA douche" then I would be engaging in ad hominem. I this case his misogyny is what is leading him to think that a mere woman could never convince people to vote for them, because (like children and handicapped people according to Adams) he feels that women are treated differently and no one would ever let a woman do something crazy like lead a superpower. His grotesque personal views colored his prediction to the point where there is no difference between the two.

The thing about Trump is that there is no wider demo he can appeal to. If he was capable of pivoting he would have done so already once the primary was locked up. You are reading in to him a populist touch that he simply lacks; like most "reality" stars what you see is what you get. There is no hidden depth to Donald, or we would have seen it already in his long history in the spotlight. What is most amusing is that even when smarter Republican politicians try to advise and/or course-correct for his bumbling misstatements he ends up attacking them. Trump does not have "populist skills", he just has a Mr. Angry persona and a small rump of the Republican party that think this is just what they were looking for in a candidate. The problem for Trump is that 30% of the smaller party in American politics is not enough to get the job done.

Of course, this is just looking at Trump and not at the map. The map is what matters. Presidential elections are won on a state-by-state basis and here things look even worse for Trump. In these sort of analysis you start with the previous presidential results (the prior for this experiment) and then try to determine what states this new candidate can put into play to change the outcome of the election. Here is where Trump goes from failure to embarrassing punchline.

The short version of electoral analysis is that Trump might be able to put Pennsylvania, Maine, and possibly Ohio into play, but that doesn't get him to the finish line. In contrast, Clinton is polling well enough that Arizona and Georgia are in contention. OTOH, you could also just look at the state of either campaign to see that Trump has no ground game, no organization (seriously, he has less than 100 people working on his campaign), and very little money.

If you want predictions then here is one: Clinton is going to put Texas into play this election cycle. Maybe not win it, but come close enough that the RNC and Trump will have to start running ads.

> and that this was a "false flag" against the Clinton campaign

> If this were fake, you'd think it would be more damaging.

Why would you think it'd be more damaging if it were fake? If you're going to hack yourself to gain pity, you would obviously only release documents that didn't significantly damage your campaign.

I think the OP means fake meaning "fabricated to do damage to the DNC", not fake as in "created by the DNC for publicity". The suggestion is that if the intent was to do damage, the contents would've been made much more inflammatory.

Those automatic translations are wrong. The name you cited means "Felix Edmundovich" (or "Felix, son of Edmund")

I agree. This leads to the question what the heck Bing is translating here.

It's algorithm is probably associating words or ideas with equivalent but not identical best match in English - if you translate First Patronymic of some famous dude (famous enough that the bingbot has a lot of Russian and English text about them to learn from) it'll spit out the English First Last - as the patronymic will rarely be used in English articles about them. In that way First-Patronymic serves as sort of a dual-index on the Russian half of the Russian-English translation. Just a guess

Russian names are generally given name then patronymic (i.e. 'son of' or 'daughter of') then family name. A person is formally addressed by their given and patronymic names.

In this case Felix Edmundovich would refer to Felix Edmundovich Dzerzhinsky.

https://en.wikipedia.org/wiki/Felix_Dzerzhinsky

Actually, I'd say that the "Grizzli777" signature is a hint that it's an individual or a small group. State-level actors wouldn't use pirated software - Microsoft Office is cheap for a government, and running 'warez' is really bad security practice, and a great way to have your own systems compromised.

Many state actors use contractors with lots of leeway; the NSA-GCHQ model of tight control is actually not the norm when it comes to APT. Just look at the Mandiant report on PLA Unit 61398.

If they used MS Office they'd be sure to pirate it. That way if it leaked any information it wouldn't be real.

For state agencies, assume that they are capable of misleading, but not generally capable of completely avoiding slip-ups.

So "state-level actors wouldn't use pirated software" is not good evidence - they might, both because it's easy and to make it look authentic as an independent hacker. Whether independent or not, if you're good enough to gain access where you shouldn't, you probably know where to get safe pirated copies.

But the Russian name in the most recent save is still evidence, because it's a perfectly plausible slip-up.

You can't prove a negative, and you certainly can never prove that something wasn't done by a more capable, more powerful actor pretending to be a less capable and powerful actor. It's the "that's what they WANT you to believe" argument of conspiracy theories.

As I see it, there are two options here. One is that a lone hacker succeeded in making it look like the Russians. The other is that the Russians failed at making it look like a lone hacker. Faking stuff is hard, so I'm betting on the failure.

DNC also said they believe it's a Russian intrusion, but we don't know if they rely on the same evidence for that - they potentially have access to a lot more.

Another thing is that Putin's government doesn't seem to be terribly concerned that you know they did something, as long as they can spread just a little doubt or have a fig leaf of plausible deniability. (Otherwise they'd probably not go around poisoning people with polonium). It makes sense if you view them as a sort of mafia: a mafia boss may not want it to be an official matter that he killed some people who got in his way - but he sure wants similar people to know.

I think a lone hacker managed to look like he's a Russian. The DNC has every motivation to claim that they have been hacked by "the Russians" as it's significantly less embarrassing to be hacked by a state actor than by an individual.

EDIT: Let's assume Russian state level actor, and that the purpose of the hack is to obtain evidence that will lead to an indictment of Hillary, improving Trumps chances at winning the presidency (a Trump presidency would presumably be very susceptible to strong-man optics and influence form the Kremlin). First strike against that, is timing: You want Hillary to formally secure the nomination first. An (imminent) indictment against the presumptive nominee would surely allow some kind of manoeuvring to hand the nomination to Sanders (or even someone else) in a way that can't be done after the convention is wrapped up. Sanders/Trump is probably in Trumps favour, but not as much as indicted-Hillary/Trump is. Second strike is the publicity. Being hacked, especially by a malevolent foreign power, has several positive PR spins, standing up against foreign interference in a democratic election etc. If you just wanted to hit Hillary, make it look like an anonymous whistleblower from inside the DNC leaking documents to an investigative reporter (Russia certainly has the capacity to make such a plant). Best not to have Russian fingerprints at all on this.

> * The files have at least passed through the hands of a Russian or someone who likes using former Russian spies as a pseudonym.

Or intentionally made to look like that. Attribution of hacks is on the spectrum of hard to impossible. Who can prove it wasn't the NSA/CIA?

So much investigation, when this line alone tells he's a russian:

>appreciated my skills so highly))) But in fact

The))) smile.

Or is supposed to tell that he is?

Time to put on my tinfoil hat.

Reply on news.ycombinator.com