8 ms·

The media (and CrowdStrike) blame Russians for it [0]. Heh... yet this blog and the hacker himself, says he did it alone. I guess it's easier to forgive incompe

by Jerry2 10y ago

The media (and CrowdStrike) blame Russians for it [0]. Heh... yet this blog and the hacker himself, says he did it alone. I guess it's easier to forgive incompetence if you blame the attack on some huge, powerful, resourceful, state-funded opponent. That's why every hacking report of some big organization or company today lays the blame on APTs, China, Russia, NORKs and so on. Management is off the hook since they don't have to admit that they were hacked by some kid and the security company gets the prestige of 'fighting and outsmarting a state actor'. And everyone's job is more or less safe. Other companies and CIO/CSOs now know that 'Sec Company X' will cover their ass by shifting the blame on some huge entity. Company lawyers are also happy because the liability of such attacks will be less. And the cycle continues. Guccifer, for example, didn't even know how to program and he used his phone to hack [1]. Yes, APTs definitely do happen but I'd bet they happen a lot less frequently than the media and security companies would want us to believe. [0] https://www.washingtonpost.com/world/national-security/russian-government-hackers-penetrated-dnc-stole-opposition-research-on-trump/2016/06/14/cf006cb4-316e-11e6-8ff7-7b6c1998b7a0_story.html https://www.washingtonpost.com/world/national-security/russi... [1] https://en.wikipedia.org/wiki/Guccifer#Computer_hacking_activities https://en.wikipedia.org/wiki/Guccifer#Computer_hacking_acti...

slg 10y ago
If it was China or Russia and they planned to release the information, they wouldn't want anyone to acknowledge their connection to the hacker. Not saying it was them behind this, just that the hacker could have just as much motive to lie about it.
- r721 10y ago
  There were also talks recently that "NATO may counter cyber attacks with conventional weapons" [1], so hypothetical nation-state attackers would want to downplay their involvement. [1] http://www.reuters.com/article/us-cyber-nato-idUSKCN0Z12NE http://www.reuters.com/article/us-cyber-nato-idUSKCN0Z12NE
  - nraynaud 10y ago
    I am sensing bullshit, I'm pretty sure a lot of countries in NATO wouldn't want to do that, and if a NATO country attacks first (or a country doesn't interprets a cyber attack as an actual attack), the alliance doesn't hold.
maxerickson 10y ago
Simple possible explanation: lots of people hacked the DNC servers.
- fab13n 10y ago
  Indeed, filthy metaphors about doing semen forensics analysis in a whorehouse come to mind :-)
akhilcacharya 10y ago
I don't see why a state actor (one that ostensibly wants him to become president) would reveal that it was responsible.
sverige 10y ago
After the email fkup, it's not hard at all to believe that the DNC's servers are still insecure. I mean, the people that HRC hired to set up her server were introduced via the party machine.
theoh 10y ago
Is it not the case that when APTs "happen", they stay happening whether you detect them or not. That's the persistent threat part. The advanced part means you can't realistically do anything about it. The notion of unscrupulous or frivolous APTs (not just routine espionage) is quite frightening for that reason.
peterwwillis 10y ago
Ask any grey hat or black hat hacker if they've ever stepped on another hacker's toes. Sometimes it gets comical. Sometimes they actually leave big new holes by mistake and you get in and then claim you owned it first. If a big juicy target can be owned once, chances are it'll be owned again.
not_a_spy 10y ago
Here's what I can see in the files: * The first few documents (1.doc through 3.doc) have metadata which says they were written by Warren Flood. However, the "last saved by" claims is was by Феликс Эдмундович. It also claims that it was created earlier today. * The 4.doc file said the author was "Blake" and the company was "Grizli777" and it was last saved by "user" and created today. * 5.doc claims to have been written by "jbs836" at the company "University of Texas at Austin". Again, last saved by "Феликс Эдмундович" and again, created earlier today. * None of the excel files had anything interesting, except that their creation dates also all said today. Research: * There is a Warren Flood associated with the DNC (according to LinkedIn: https://www.linkedin.com/in/warrenflood https://www.linkedin.com/in/warrenflood). * Google translates "Феликс Эдмундович" as "Felix", Bing and Prompt as "Felix Dzerzhinsky". Googleing "Felix Dzerzhinsky" turns up Felix Edmundovich Dzerzhinsky, the former Director of Cheka... an Russian internal security service. He's been dead 90 years, so I doubt it was really him though. * Googling "Grizli777" seems to suggest that the user's copy was pirated. Nothing really to go on there. * Googling "jbs836" finds people (talking about this subject) suggesting that it's James B. Steinberg (https://en.wikipedia.org/wiki/James_Steinberg https://en.wikipedia.org/wiki/James_Steinberg) a Democratic politician who formerly worked for the University of Texas at Austin. My Take: * The files are either genuine or someone bothered to find some Democrats names to attach to them. I'm leaning toward genuine since they didn't clean up any other metadata. * The files have at least passed through the hands of a Russian or someone who likes using former Russian spies as a pseudonym. * There's no evidence that these files came from a DNC server and not, say, Warren Flood's laptop. * There's no evidence that the individual who wrote this acted alone or that he is not working for a state.
- capitalsigma 10y ago
  I assumed these were going to be filled with FUD, and that this was a "false flag" against the Clinton campaign when I read the blog post without looking at the contents of the documents. But tbh, all the stuff that's "leaked" looks pretty reasonable to me. The Trump stuff is all true, public knowledge --- obviously spun a little bit, but maybe even more fair to Trump than John Oliver. The policy stuff sounds pretty good to me --- national cyber advisor is probably needed, the crisis response stuff sounds like a pretty good idea, a speech to an Islamic forum in the first 100 days sounds good too. If this were fake, you'd think it would be more damaging. If anything, this probably makes me a little more comfortable with the idea of voting Clinton, since she has (less) incentive to lie in "confidential documents." (Of course, I don't think that she would have the confidential-confidential-plans-to-expand-the-NSA papers in the hands of a campaign staffer.) So.... solid leak, Guccifer 2.0. You keep doing you.
meowface 10y ago
This leads me to suspect multiple different groups may have independently gained access to their servers. Definitely this guy, but possibly also Russians.
goombastic 10y ago
Definitely russian. His/her smileys don't have eyes. :) vs )
- x0 10y ago
  According to my Russian friend, that evolved because the colon is Shift-6, so it's a bit annoying to type.
linkregister 10y ago
It's pretty naive to think that APT wouldn't consider this a target as well. More than one person can hack the same box :) I agree this hack in particular is probably not APT. If you think APT wouldn't be interested in a political campaign, just look back to the 2013 leak about the US's espionage of the Brazilian presidential candidate Dilma Rousseff's campaign. (Now it seems pretty prescient given her impeachment for corruption). > That's why every hacking report of some big organization or company today lays the blame on APTs, China, Russia, NORKs and so on. What? We must have very different sources of reports. The big hacks I read about in the NYT or LA times are almost always some poorly-secured retail company or social media company has a credit card or password dump. Brian Krebs has earned his living for years based off of this reporting. > media and security companies would want us to believe. Security companies? Maybe. Media? Where's the motive? This is the top comment? Come on.

by Jerry2 10y ago

slg 10y ago

If it was China or Russia and they planned to release the information, they wouldn't want anyone to acknowledge their connection to the hacker. Not saying it was them behind this, just that the hacker could have just as much motive to lie about it.

r721 10y ago
There were also talks recently that "NATO may counter cyber attacks with conventional weapons" [1], so hypothetical nation-state attackers would want to downplay their involvement. [1] http://www.reuters.com/article/us-cyber-nato-idUSKCN0Z12NE http://www.reuters.com/article/us-cyber-nato-idUSKCN0Z12NE
- nraynaud 10y ago
  I am sensing bullshit, I'm pretty sure a lot of countries in NATO wouldn't want to do that, and if a NATO country attacks first (or a country doesn't interprets a cyber attack as an actual attack), the alliance doesn't hold.

maxerickson 10y ago

Simple possible explanation: lots of people hacked the DNC servers.

fab13n 10y ago
Indeed, filthy metaphors about doing semen forensics analysis in a whorehouse come to mind :-)

akhilcacharya 10y ago

I don't see why a state actor (one that ostensibly wants him to become president) would reveal that it was responsible.

sverige 10y ago

After the email fkup, it's not hard at all to believe that the DNC's servers are still insecure. I mean, the people that HRC hired to set up her server were introduced via the party machine.

theoh 10y ago

Is it not the case that when APTs "happen", they stay happening whether you detect them or not. That's the persistent threat part. The advanced part means you can't realistically do anything about it. The notion of unscrupulous or frivolous APTs (not just routine espionage) is quite frightening for that reason.

peterwwillis 10y ago

Ask any grey hat or black hat hacker if they've ever stepped on another hacker's toes. Sometimes it gets comical. Sometimes they actually leave big new holes by mistake and you get in and then claim you owned it first. If a big juicy target can be owned once, chances are it'll be owned again.

not_a_spy 10y ago

Here's what I can see in the files: * The first few documents (1.doc through 3.doc) have metadata which says they were written by Warren Flood. However, the "last saved by" claims is was by Феликс Эдмундович. It also claims that it was created earlier today. * The 4.doc file said the author was "Blake" and the company was "Grizli777" and it was last saved by "user" and created today. * 5.doc claims to have been written by "jbs836" at the company "University of Texas at Austin". Again, last saved by "Феликс Эдмундович" and again, created earlier today. * None of the excel files had anything interesting, except that their creation dates also all said today. Research: * There is a Warren Flood associated with the DNC (according to LinkedIn: https://www.linkedin.com/in/warrenflood https://www.linkedin.com/in/warrenflood). * Google translates "Феликс Эдмундович" as "Felix", Bing and Prompt as "Felix Dzerzhinsky". Googleing "Felix Dzerzhinsky" turns up Felix Edmundovich Dzerzhinsky, the former Director of Cheka... an Russian internal security service. He's been dead 90 years, so I doubt it was really him though. * Googling "Grizli777" seems to suggest that the user's copy was pirated. Nothing really to go on there. * Googling "jbs836" finds people (talking about this subject) suggesting that it's James B. Steinberg (https://en.wikipedia.org/wiki/James_Steinberg https://en.wikipedia.org/wiki/James_Steinberg) a Democratic politician who formerly worked for the University of Texas at Austin. My Take: * The files are either genuine or someone bothered to find some Democrats names to attach to them. I'm leaning toward genuine since they didn't clean up any other metadata. * The files have at least passed through the hands of a Russian or someone who likes using former Russian spies as a pseudonym. * There's no evidence that these files came from a DNC server and not, say, Warren Flood's laptop. * There's no evidence that the individual who wrote this acted alone or that he is not working for a state.

capitalsigma 10y ago
I assumed these were going to be filled with FUD, and that this was a "false flag" against the Clinton campaign when I read the blog post without looking at the contents of the documents. But tbh, all the stuff that's "leaked" looks pretty reasonable to me. The Trump stuff is all true, public knowledge --- obviously spun a little bit, but maybe even more fair to Trump than John Oliver. The policy stuff sounds pretty good to me --- national cyber advisor is probably needed, the crisis response stuff sounds like a pretty good idea, a speech to an Islamic forum in the first 100 days sounds good too. If this were fake, you'd think it would be more damaging. If anything, this probably makes me a little more comfortable with the idea of voting Clinton, since she has (less) incentive to lie in "confidential documents." (Of course, I don't think that she would have the confidential-confidential-plans-to-expand-the-NSA papers in the hands of a campaign staffer.) So.... solid leak, Guccifer 2.0. You keep doing you.

meowface 10y ago

This leads me to suspect multiple different groups may have independently gained access to their servers. Definitely this guy, but possibly also Russians.

goombastic 10y ago

Definitely russian. His/her smileys don't have eyes. :) vs )

x0 10y ago
According to my Russian friend, that evolved because the colon is Shift-6, so it's a bit annoying to type.

linkregister 10y ago

It's pretty naive to think that APT wouldn't consider this a target as well. More than one person can hack the same box :) I agree this hack in particular is probably not APT. If you think APT wouldn't be interested in a political campaign, just look back to the 2013 leak about the US's espionage of the Brazilian presidential candidate Dilma Rousseff's campaign. (Now it seems pretty prescient given her impeachment for corruption). > That's why every hacking report of some big organization or company today lays the blame on APTs, China, Russia, NORKs and so on. What? We must have very different sources of reports. The big hacks I read about in the NYT or LA times are almost always some poorly-secured retail company or social media company has a credit card or password dump. Brian Krebs has earned his living for years based off of this reporting. > media and security companies would want us to believe. Security companies? Maybe. Media? Where's the motive? This is the top comment? Come on.