Why does the actual source:
https://guccifer2.wordpress.com/2016/08/12/guccifer-2-0-hack...
https://news.ycombinator.com/item?id=12279977
get flag-killed immediately where as this somewhat colored article gets on the frontpage?
https://guccifer2.wordpress.com/2016/08/12/guccifer-2-0-hack...
https://news.ycombinator.com/item?id=12279977
get flag-killed immediately where as this somewhat colored article gets on the frontpage?
Keep in mind that Guccifer2 isn't a lone hacker as initially portrayed. Guccifer2 is a cover for APT-28/APT-29 (GRU). So if anything then this leak has to be considered for what it was: A foreign nation meddling in the elections of another. Current Russian meddling fits seamlessly into Russia's bigger doctrine on Cyber Defense Strategies [0][1][2][3][4]
[0] https://www.crowdstrike.com/blog/bears-midst-intrusion-democ...
[1] https://www.blackhat.com/docs/us-16/materials/us-16-Geers-Cy...
[2] https://blog.valbonne-consulting.com/2016/08/06/smartcitiess...
[3] http://www.naa.mil.lv/~/media/NAA/AZPC/Publikacijas/PP%2002-...
[4] http://www.ifri.org/en/publications/enotes/proliferation-pap...
PS: there is now also guccifer 3.0 :-) and I'm hitting reload like crazy https://guccifer3.wordpress.com/
EDIT: anyone interested in this subject also look for 'Gerasimov Doctrine' for a thrilling read.
Are you referring to Mark Galeotti? I'd like to read an analysis written by a Russian scholar on this, would you have any sources?
The only one that has to gain from this hacks is Hillary : she looks like the poor victim of the evil Russians and their agent Trump.
How do you know? The NYT keeps using the passive voice ("believed to be tied to the Russian intelligence") or saying that some unnamed "American intelligence officials" told them so. Even when they name the officials, they don't say how they determined it.
COZY BEAR (also referred to in some industry reports as CozyDuke or APT 29) is the adversary group that last year successfully infiltrated the unclassified networks of the White House, State Department, and US Joint Chiefs of Staff. In addition to the US government, they have targeted organizations across the Defense, Energy, Extractive, Financial, Insurance, Legal, Manufacturing Media, Think Tanks, Pharmaceutical, Research and Technology industries, along with Universities. Victims have also been observed in Western Europe, Brazil, China, Japan, Mexico, New Zealand, South Korea, Turkey and Central Asian countries. COZY BEAR’s preferred intrusion method is a broadly targeted spearphish campaign that typically includes web links to a malicious dropper. Once executed on the machine, the code will deliver one of a number of sophisticated Remote Access Tools (RATs), including AdobeARM, ATI-Agent, and MiniDionis. On many occasions, both the dropper and the payload will contain a range of techniques to ensure the sample is not being analyzed on a virtual machine, using a debugger, or located within a sandbox. They have extensive checks for the various security software that is installed on the system and their specific configurations. When specific versions are discovered that may cause issues for the RAT, it promptly exits. These actions demonstrate a well-resourced adversary with a thorough implant-testing regime that is highly attuned to slight configuration issues that may result in their detection, and which would cause them to deploy a different tool instead. The implants are highly configurable via encrypted configuration files, which allow the adversary to customize various components, including C2 servers, the list of initial tasks to carry out, persistence mechanisms, encryption keys and others. An HTTP protocol with encrypted payload is used for the Command & Control communication.
FANCY BEAR (also known as Sofacy or APT 28) is a separate Russian-based threat actor, which has been active since mid 2000s, and has been responsible for targeted intrusion campaigns against the Aerospace, Defense, Energy, Government and Media sectors. Their victims have been identified in the United States, Western Europe, Brazil, Canada, China, Georgia, Iran, Japan, Malaysia and South Korea. Extensive targeting of defense ministries and other military victims has been observed, the profile of which closely mirrors the strategic interests of the Russian government, and may indicate affiliation with Главное Разведывательное Управление (Main Intelligence Department) or GRU, Russia’s premier military intelligence service. This adversary has a wide range of implants at their disposal, which have been developed over the course of many years and include Sofacy, X-Agent, X-Tunnel, WinIDS, Foozer and DownRange droppers, and even malware for Linux, OSX, IOS, Android and Windows Phones. This group is known for its technique of registering domains that closely resemble domains of legitimate organizations they plan to target. Afterwards, they establish phishing sites on these domains that spoof the look and feel of the victim’s web-based email services in order to steal their credentials. FANCY BEAR has also been linked publicly to intrusions into the German Bundestag and France’s TV5 Monde TV station in April 2015.
At DNC, COZY BEAR intrusion has been identified going back to summer of 2015, while FANCY BEAR separately breached the network in April 2016. We have identified no collaboration between the two actors, or even an awareness of one by the other. Instead, we observed the two Russian espionage groups compromise the same systems and engage separately in the theft of identical credentials. While you would virtually never see Western intelligence agencies going after the same target without de-confliction for fear of compromising each other’s operations, in Russia this is not an uncommon scenario. “Putin’s Hydra: Inside Russia’s Intelligence Services”, a recent paper from European Council on Foreign Relations, does an excellent job outlining the highly adversarial relationship between Russia’s main intelligence services – Федеральная Служба Безопасности (FSB), the primary domestic intelligence agency but one with also significant external collection and ‘active measures’ remit, Служба Внешней Разведки (SVR), the primary foreign intelligence agency, and the aforementioned GRU. Not only do they have overlapping areas of responsibility, but also rarely share intelligence and even occasionally steal sources from each other and compromise operations. Thus, it is not surprising to see them engage in intrusions against the same victim, even when it may be a waste of resources and lead to the discovery and potential compromise of mutual operations. """"
https://www.crowdstrike.com/blog/bears-midst-intrusion-democ...
* broadly targeted spearphising attack
* both groups were constantly going back into the environment to change out their implants, modify persistent methods, move to new Command & Control channels and perform other tasks to try to stay ahead of being detected.
Let's put that into context tho': it happens all the time and no-one bats an eyelid. When Obama came over and said we should vote Bremain, lots of people were annoyed at his presumption, but no-one considered it that big a deal.
US meddling in foreign politics goes back decades (and the same message enforced using different umbrellas, e.g.: in Latin America it was the War on Drugs. In the Arab world the message is the same only the strategy was slightly redefined to another more plausible (if only perceived) threat (radical Islamism).
I didn't flag it, but my guess is that it was flagged because if you don't look to carefully it seams to be a rehash of the old leaks, or a crackpot site with fake documents. The nytimes.com articles have more credibility and are better written.
In this cases you can vouch for the article to unkill it, and also email the mods hn@ycombinator.com. In some cases they remove the flags and reset the time counter of the article.