Dear Obama, from Infosec
blog.erratasec.com
blog.erratasec.com
Not really. China's been doing much more overt theft and hacking for years. If you think this is huge issue, you aren't paying attention. Russia got information and then released it to the US public (which nobody wants to authenticate or disavow). I consider this more of a good than a harm.
We (UK+US) have been doing this shit for years and much, much more obviously..
It's clearly an outrage though. Influencing the outcome of another countries election is america's job! How dare those pesky russians have an interest in getting a pro-ru govt installed in the US....
I mean, it's totally different to what we've been doing for decades elsewhere... Right...
I actually felt some anger and disgust into how US has influenced other nations and their own "democratic process" since it's beginning...
I don't want to go down the rabbit hole of arguing which interventions are "more moral"--just pointing out the flaw in your reasoning.
So, let's just concede that you are completely correct. That still doesn't argue for the U.S. doing nothing in response, as some seem to suggest. It's actually mind-blowing that people are offering that as a reason that the U.S. should not protect its democratic process--allowing anyone to engage in an all out assault on it with impunity.
Also, most clients would be more than happy to have someone proclaim that the reason they got owned was because they were the target of spooky foreign state actors and not because they're bad at security. There's no money in downplaying the sophistication of an attack.
Maybe you missed the part where they were hired by the DNC or the part where the ownership is not from the reality-based community: http://www.atlanticcouncil.org/about/experts/list/dmitri-alp...
But the biggest indicator is their attribution based on internally coherent narratives instead of facts - that's not how actual digital forensic experts operate.
Until I see evidence of Russia involvement I don't want to make any judgments. I am just tired of constant narration "you know it was Russia, you don't need proofs". It would be great to see some real proofs this time.
It was attributed to Russians first before the election, and by a private cybersecurity that has never, AFAIK -- even since the attribution -- been accused of Democratic partisanship. So the idea that the Russians are being blamed by the Democrats because the Democrats lost everything in the election, while a convenient political narrative for Republicans, isn't consistent with the facts.
Sure, this can be one side of the coin but attributing something to someone without proofs will not make it a fact, doesn't it? I don't recall seeing any proofs. Maybe it was just convenient to democrats to just flow with that tide, they benefit from that for sure in current situation. But then there is second side of the coin, that Russia indeed was behind that hack and then what you wrote would be true. That's why I am not making any judgments.
If you're looking for firewall logs or hard drives with definitive proof that malware on certain machines was linking back to particular servers then you're out of luck. However Crowdstrike, the firm that the DNC used to investigate the intrusion, published a report that shows some of the code used and other IOCs from the attack [0].
A security firm like Crowdstrike would have lots of familiarity with these APT groups from previous investigations, so when they identify these groups they have evidence (i.e. they found specific malware or tools that are known to have been used in previous attacks, connections to or from known bad domains, IP addresses etc.) that links the attacks to these groups.
This, however, doesn't prove that APT 28 and 29 are Russian, but if you search for information about these groups, their Tools Techniques and Procedures (TTPs), who they have targeted etc. you can draw your own conclusions.
Note, this was long before the election and before there was politics surrounding the attribution. However this data is only about the intrusion into the DNC's network, and not necessarily linked to the release of personal emails of Podesta & co.
[0] https://www.crowdstrike.com/blog/bears-midst-intrusion-democ...
I'm not sure I get your analogy, but no, I wouldn't expel anyone for "radar touching my planes", but in this case that's the equivalent of browsing the DNC website. If someone had broken into my airforce base, stolen security badges to get into other airforce bases, was photographing planes and stealing and leaking blueprints then you better believe I'd take action
I find it very frustrating that intelligent people don't seem to follow through their thought process here.
The intelligence community will never be able to release enough information to satisfy people. The information will either be so non-specific as to be useless ("we had spies who told us" - would anyone here believe that anymore than they do now?), or so specific it will damage ongoing interests ("We have communication intercepts between the hacking groups and the GRU/FSB, and there they are, and here is how we got them" - it's likely there are actual humans involved in that process who will die if they are exposed).
It's fair to argue that this issue is so important that burning some resources is worth it, but no one is taking that angle.
Don't mistake this for defending the US report though. It was terrible and made the situation much more confused. Before the report it was much clearer that Russian groups (either government or non-government) were involved, and now people are (incorrectly) questioning even that because of the pathetic report that was produced.
It's much more interesting to discuss the shared conclusion was formed that "the Russians" were trying to throw the election to Trump (rather than just to sow chaos).
This argument seems plausible. Even so, they are doing a very poor job of convincing knowledgeable folks.
To a large degree, this comes down to an issue of trust.
Do you trust the US intelligence community?
Consider that James Clapper, the current Director of National Intelligence, "wittingly" lied to Congress about spying on US citizens. Also consider that the CIA spied on the Senate Intelligence Committee while the committee was investigating the CIA's torture program, initially lied about it to the Senate, then admitted it but said that it wasn't wrong.
They lie with impunity to Congress, the people who _theoretically_ have power over their budgets.
Do you think they will balk at lying to the press or the American public?
The other major issue was that it was in the context of a political campaign, and one side could claim the other was doing whatever for political reasons.
I think outside of Trump v. Clinton, it might have had more credibility in terms of perception.
Does the intelligence community have reason to believe that lying about Russian attempts to manipulate a US presidential election are justified? For them to believe that, they'd have to believe either that Trump is an existential threat to the US, or that Russia must be countered starting immediately.
A few days back, the same author wrote[0]:
> On the other hand, if they've got web server logs from multiple victims where commands from those IP addresses went to this specific web shell, then the attribution would be strong that all these attacks are by the same actor.
All the FBI/DHS have to do is say: Organizations A, B, and C all have server logs showing this IP address deliver the same malware.
That would be enough information to attribute the hacks to the same actor. If the FBI/DHS were lying about Organization B, then Organization B would speak up about it.
The author of this post is right to point out that the attribution given so far is not only incomplete, but is borderline bizarre.
[0] http://blog.erratasec.com/2016/12/some-notes-on-iocs.html
The attribution issue was whether it was "the Russians".
The focus has been arguments if they were responsible for hacking incidents during election.
I am sure US hacks many other governments, but does not release/leak the data. I am sure Russia, UK, Germany, china, and others do the same.
So more than highly plausible that they did hack DNC etc during election...
Is there any evidence of the data being extracted to Russia/Russia groups specifically..(not just access to the system).
Call me a nut, but its easier for govt (to save face, alterior motives) to claim state actors than the guy living in a bsmt suite down the street.
Also it was clear Podesta/HRC/US had a vendetta against Julian Assange before specific leaks... Which was confirmed with the leaks.
He could have orchestrated it himself or by WikiLeaks (rather than just receiving the info via leak).
Maybe WikiLeaks has Republican data and other data and just didn't release it.
Julian Assanges goal was to disrupt the democratic election and slap back the DNC Podesta and hrc...
This is a fact. And his goal was accomplished.
Then they should say nothing. "It was the Russians, trust us" simply doesn't cut it.
Is wasting your time on trying to refute this intelligent? Intelligent people can spend our time better than trying to refute obvious propaganda. Ie. we're wasting our time.
The reason people are skeptical is because the track records of CIA, NSA, FBI, .. don't add up in history. Yet only in hindsight -in history, when FOIA requests are granted with less and less censorship on the documents- will we get a better picture on who was right and who was wrong. And we may end up never getting the full picture.
This would be better than releasing a report that makes no sense to technical/security people.
Cut to 2016 where none of the intelligence branches claim Russians "hacked the election," they claim they hacked the DNC and other political organizations for political ends. There's no evidence that anyone in the Obama administration pressured the CIA, let alone multiple other intelligence branches to make those claims. There have been concerns that Russians tampered with voting machines themselves but they only things LEOs, intelligence branches, and other representatives of the Executive branch have been saying is when they've looked, they've found no evidence that it happened. So, not like "Saddam has WMDs" 14-15 years ago.
http://fightthefuture.org/videos/does-voting-make-a-differen...
The CIA has admitted before congress that it places adverts in magazines and has refused to answer questions on whether or not they do so on TV as well.
I agree with you entirely. It's exactly like the WMDs. We are in an era where social media networks are talking about filtering out real/fake news. This should worry everyone. "Simply don't use Amazon/Google/Facebook" is less of an option when these industries as so big they control the distribution (and therefore the narrative). Who determines the algorithms on what is real and fake? (I hope it's not the people who created Postini/Google's spam algorithms with its insane false positive rate).
It's not limited to America. We don't live in the Iran/China/Saudi 1984 where governments actively censor content (and consequently, most of the citizens know they are being censored). We live in that other version where lies and facts are mixed into all of our news and content so it's impossible to tell what is real, and what is propaganda.
Just look at Turkey's Erdogan. He's blaming an expat preacher and his followers for the coup in order to tigthen his grip on institutions and the media, arrest HDP (Kurdish moderate left wing party) MPs and leaders, ultimately leading to PKK (Kurdish commie extermists) reemergence. Putin is a role model for him.
Not sure those are mutually exclusive. Tipping the election to Trump seems to be a good way to sow chaos.
And it's why we need proof. Guessing a password or phising it can be a one man operation.
Firstly we know that that Podesta's account was targeted by a phishing email with a bit.ly link [0]. We have proof the bit.ly phishing link in this email was clicked twice in March [1], and his wikileaks dump stops two days after that. The bitly link uses the TTP of base64 encoded strings targeting a google account. We know DNC staffers whose information was leaked by DC Leaks, like Rinehart, were targeted the same way [2] and that the same infrastructure hosted the Rinehart and Podesta phishing pages, along with plenty of other phishing sites [3]. You can verify the bitly links if you like.
We have reports long before Wikleaks released Podesta's information, and before DC leaks had released most of their information, that the same TTP of bitly links with base64 encoded strings that targeted Podesta, Rinehart etc. were targeting other high profile targets in Clinton's campaign [4] as well as Russians, Ukranians etc. [5]. According to security firms these were all using the same two bitly accounts.
Those attacks were attributed to APT 28 by private companies long before Wikileaks released any Podesta information.
We also have proof the same infrastructure that hosted dcleaks [6] hosted domains targeting Syrian human rights groups, Ukranians, Turks, Google accounts, Microsoft accounts etc. or that other IPs used were also used in attacks against the German Parliament, Tv5 etc. That's definitely circumstantial, but a one man job would be terribly unlucky to use a private Romanian server seen used in previous attacks attributed to a state actor.
Sure this could all be circumstantial, it definitely doesn't prove Russia did anything, but the suggestion that this is a one man operation is ludicrous - almost 4,000 people were targeted by the group that targeted the Clinton campaign. In relation to your other comment below, Assange has less credibility than the DHS report unless he comes out with some sort proof.
[0] https://wikileaks.org/podesta-emails/emailid/34899 [1] https://bitly.com/1PibSU0+ [2] http://www.thesmokinggun.com/documents/investigation/trackin... [3] https://www.passivetotal.org/search/80.255.12.237 [4] https://www.secureworks.com/research/threat-group-4127-targe... [5] https://www.secureworks.com/research/threat-group-4127-targe... [6] https://www.threatconnect.com/blog/does-a-bear-leak-in-the-w... and indeed this entire series.
Outside of that, there's tons of data online already regarding Russian government hacking activity: http://researchcenter.paloaltonetworks.com/2016/06/unit42-ne... https://www.fireeye.com/content/dam/fireeye-www/global/en/cu... https://securelist.com/blog/research/72924/sofacy-apt-hits-h... http://researchcenter.paloaltonetworks.com/2016/09/unit42-so...
Do you think understanding the tools, infrastructure, coding styles, activities, targets of these groups allows them to perform attribution?
No. First they ignored all the other intruders on the DNC network because they didn't fit the Russian narrative, then they took a Chinese tool of choice like X-Tunnel and claimed it's some custom Russian tool, then they forgot to tell us that the actual email exfiltration had nothing to do with the internal intruders - it was just phishing, done from the outside.
These private digital forensics companies act more like PR companies, so trusting them with something you can't verify is silly.
And they wouldn't really have to "burn sources" to do it, at least not in the sense that they would put spies in danger. But seriously, if this was such an issue, I would've rather they'd pulled those spies and showed the proof, than just trust them to start WW3 over "secret info that's totally real."
This is as far as my personal intelligence takes me:
* US officials and departments like the NSA have a history of lying to the public
* professional hackers are impossible to track down, therefore any evidence suggesting that they know exactly who it was will be met with great scepticism
* the information they released actually confirms that it could have been any hacker, because they used tools that are easily accessible
* the US seems to have a political agenda here
Knowing these facts I am just unable to believe the narrative. You could argue that they cannot release actual evidence, however that just makes me question the act of the DHS getting into this mess in the first place.
It could be argued that both of those are the same.
I doubt they would be reckless enough to gamble on the former to be honest, when almost everybody thought HRC had it in the bag.
I'm not sure how it would look any different if they did.
>when almost everybody thought HRC had it in the bag.
Wouldn't that be the only reason to try throwing it to him? If he had it in the bag, it would be unneccessary, right?
That, plus, it shouldn't matter who has done it, since (especially if it was Russia) they most likely won't be persecuted for it. What the focus should be put on is making sure this won't happen again - but that the general public isn't very interested in.
Puf - hacked elections, puf - hacked city, puf - hacked country, puf - hacked your iCloud (well, not really, your password was 1234567).
There was no "election hacking", a DNC executive failed for a fishing scam, there is absolutely no proof whatsoever that it was the Russians.
It's interesting how liberals became CIA and FBI shills in less that 2 weeks after the election, while ignoring the wide spread corruption in their party. Now maybe Russia did it, it doesn't make the content of the emails less true. There is also an interesting display of anti Russian xenophobia on liberal media, which proves that the party of "progress" is also capable of the worst when it comes to hate speech and warmongering, now labelling anyone who disagree as "traitor".
Because the crime of breaking in is far more disturbing than what was found, given that even the "victim" brushed it off? If you ask people what the worst part of the emails was, they point to out-of-context blurbs that are either common practices or misleading.
I have legitimate cause for concern when the President to be inaugurated does not believe intelligence about an American adversary.
I dislike Trump for many reasons but, based on the track record of the US intelligence community over the course of the last 10-15 years, if he approaches the intelligence briefings that are fed to him with the same skepticism that he has displayed for climate science, I can only see that as a positive.
A skeptic would at least concede the possibility that there is some truth to climate science, despite the political machinations around it, and actually consider the evidence on its own terms. Trump appears to believe the entire thing is a Chinese conspiracy to harm American business. That's not skepticism, it's just denial.
This is the part I don't get. It is easily discarded because it is attributed to bad guys. Ad hominem / guilt by association.
I think it's worth something to consider the main visible actor opinion.
If Assange received a email dump from a source, how could he possibly know with absolute certainty that the Russian government didn't have any involvement? The only thing I can think of is if he or one of his very trusted associates executed the attacks themselves. Isn't it possible that the Russian government orchestrated the attacks and then handed the data off to a third party? He has the same burden of proof as the CIA. ...and yes I understand that Wikileaks can't reveal its sources but one should not really make such claims if they can't be backed up with evidence.
Not sure if I believe that though, since it seems that Assange would have proved it by now if it were true. Maybe he's withholding the proof as leverage, or maybe he's lying. I do trust Assange much more than the CIA though.
But do you trust Assange more than the 17 US intelligence agencies? And the actual president? And members of congress (including many Republicans who would directly benefit from any intelligence pointing another way)?
At this point it's getting close to Assange vs the world. Even Trump won't directly say the Russians weren't involved anymore, he's just muddying the water with "can you really ever prove anything" talk.
Yes, probably. I find Barack Obama to be a deeply evil person. Assange I'm not sure what to think about. It's plausible to me that the Russian government hacked the DNC and/or Podesta, but it also seems plausible that many state and individual actors may have done the same.
I need to see proof that the Russian government did the hacking, then I need to see proof that the Russian government in particular passed the data along to Wikileaks, and once those two conditions are satisfied, then I will offer my sincere gratitude to the Russian government for exposing illegal behavior on the part of the Clinton campaign and the Clintons themselves :)
Yes. Does that really surprise you?
My money's on Charles Delavan. Nobody's that stupid: https://wikileaks.org/podesta-emails/emailid/34899
The very fact that Assange is has so strenuously denied it was the Russians is itself odd and suspicious. He couldn't possibly know if it is or not and yet he's been adamant since day one. He's either a gov agent, liar, or idiot. And I don't think he's an idiot.
https://sharylattkisson.com/eight-facts-on-the-russian-hacks...
For example, Wikileaks says that they did not get the info from Russia, and this is corroborated by the former British ambassador.
It's so bizarre to me how big this story has become only now when the DNC hacks themselves were done back in June. It's certainly hit a fever pitch since Trump's election, but I can't tell if that's from his tweeting and provocation, or from the Democrats angst at losing the election and trying to save face.
Regardless, compared to China hacking us and stealing our fighter jet plans or the data breach of 18 million personnel records from OPM, compromising the DNC and releasing some authentic but mildly embarrassing emails seems so... minor, I guess. Every time people say "hacking the election" it makes me so frustrated since it minimizes the very real fear of actual election hacking the more we're moving to electronic voting machines, that Bruce Schneier talks about. It's also no surprise that half[0] of Clinton voters believe "hacking the election" means that Russia actually fucking tampered with the vote tallies now.
Surely any impact of the DNC email release months ago was minor compared to say, Comey re-opening the Clinton case right before the election. And I dunno, does an article in the BBC or The Economist count as foreign influence? What about the Snowden leaks to The Guardian?
The evidence that APT28/29 were in the DNC servers is moderately compelling, I think. I can't find the data on the connection between APT28/29 and GRU/FSB, though. In any case, it's clear Russia could have not left a trace if they were so inclined. Maybe they didn't think it was such a big deal so they were a little sloppy? Certainly, a priori, it's hard to imagine the amount of attention releasing DNC and Podesta emails would have gotten.
[0] https://today.yougov.com/news/2016/12/27/belief-conspiracies...
Second, the Russians didn't hack the election. As far as we'll all know, no voting machines were compromised. It may have been some email accounts of campaign officials (about which Wikileaks has already publicly stated the leaks didn't come from Russia). So starting off with the propagandist and frankly bullshit headline "Russia hacked the election" is in and of itself already portraying an extremely false narrative. Dangerous. Very dangerous.
I guess i'm confused as to why we should care if they did. Even if Trump didn't win through fair elections, he was still nominated by us. I think that's damning enough to say we deserve him.
And realistically, the public is not likely to be surprised by it either. It's barely 3 years since we found out the NSA spied on the United Nations, its own allies, and the Pope. And every day the news is full of western governments wanting to legislate back doors into our iPhones so they can read all our emails. Did anyone think notorious bad guy Putin would have his spy agencies twiddling their thumbs thinking "no, we mustn't - it'd be wrong"?
"Foreign government tried to influence our election" has probably lost a lot of its sting too, since Obama weighed in on the Brexit referendum, and every world politician and their dog weighed in on what they thought of Trump.
Honestly, I don't think much of the public cares how Podesta's emails got released, any more than they care how Trump's open-mike tape got released. And embarrassment aside, I doubt the public thinks any of the leaks had much impact on the result. I imagine much of the public muttering "Trump's a letch, the Democrat higher-ups and parts of the media have a love-in, and politicians think of the public as a mixture of easily-led minions and ignoramuses. Yup, we'd pretty much guessed that already..."
I think the "news" in this is why a famously competent, articulate, and measured president (Obama) is being a bit ham-fisted in his response, suddenly upping the reaction quite late in the day.
If I can theorise for a mo -
The Democrats, and parts of the Republican party, are still coming to terms with the surprise that they didn't win, and therefore believe that surely they will be back in power in four years' time. So they want to make it as hard as possible for Trump to deviate from longstanding policy in the meantime.
Moving to taking a hard diplomatic line on China and a soft line on Russia (rather than the other way around) would be a huge strategic shift from past policy, that would be quite hard to unpick. For nearly 40 years, the US strategic position has been to reach out to China, and that the US's chief strategic opponent has been Russia.
I wonder if the Democrats and GOP are starting to come to grips with where Trump's views really are a bit of a departure from the recent past:
- he's decided many of the things the US and Russia compete on these days aren't especially important to the US's interests, so it's not worth considering them the US's biggest opponent
- he's decided that the way to argue/posture with China on points of difference is to use the economy (eg, threat of tariffs) and more belligerent diplomacy (eg, threat of recognising Taiwain), rather than the military (eg, Freedom of navigation operations)
- he's decided the US should stop trying to act as an altruistic international arbiter, and instead attach unswerving value to being the US's friend (eg, moving embassy in Israel to Jerusalem)
And of course, he seems to think the US is in a position where it can be a bit of a dick about things if it wants to. For most of us, we have to be nice people to work with or people won't work with us. But I guess if you're the US it's quite hard for people to say "well I won't work with the world's biggest economy then".