7 ms·

Here's what I can see in the files: * The first few documents (1.doc through 3.doc) have metadata which says they were written by Warren Flood. However, the "l

Here's what I can see in the files: * The first few documents (1.doc through 3.doc) have metadata which says they were written by Warren Flood. However, the "last saved by" claims is was by Феликс Эдмундович. It also claims that it was created earlier today. * The 4.doc file said the author was "Blake" and the company was "Grizli777" and it was last saved by "user" and created today. * 5.doc claims to have been written by "jbs836" at the company "University of Texas at Austin". Again, last saved by "Феликс Эдмундович" and again, created earlier today. * None of the excel files had anything interesting, except that their creation dates also all said today. Research: * There is a Warren Flood associated with the DNC (according to LinkedIn: https://www.linkedin.com/in/warrenflood https://www.linkedin.com/in/warrenflood). * Google translates "Феликс Эдмундович" as "Felix", Bing and Prompt as "Felix Dzerzhinsky". Googleing "Felix Dzerzhinsky" turns up Felix Edmundovich Dzerzhinsky, the former Director of Cheka... an Russian internal security service. He's been dead 90 years, so I doubt it was really him though. * Googling "Grizli777" seems to suggest that the user's copy was pirated. Nothing really to go on there. * Googling "jbs836" finds people (talking about this subject) suggesting that it's James B. Steinberg (https://en.wikipedia.org/wiki/James_Steinberg https://en.wikipedia.org/wiki/James_Steinberg) a Democratic politician who formerly worked for the University of Texas at Austin. My Take: * The files are either genuine or someone bothered to find some Democrats names to attach to them. I'm leaning toward genuine since they didn't clean up any other metadata. * The files have at least passed through the hands of a Russian or someone who likes using former Russian spies as a pseudonym. * There's no evidence that these files came from a DNC server and not, say, Warren Flood's laptop. * There's no evidence that the individual who wrote this acted alone or that he is not working for a state.

capitalsigma 10y ago
I assumed these were going to be filled with FUD, and that this was a "false flag" against the Clinton campaign when I read the blog post without looking at the contents of the documents. But tbh, all the stuff that's "leaked" looks pretty reasonable to me. The Trump stuff is all true, public knowledge --- obviously spun a little bit, but maybe even more fair to Trump than John Oliver. The policy stuff sounds pretty good to me --- national cyber advisor is probably needed, the crisis response stuff sounds like a pretty good idea, a speech to an Islamic forum in the first 100 days sounds good too. If this were fake, you'd think it would be more damaging. If anything, this probably makes me a little more comfortable with the idea of voting Clinton, since she has (less) incentive to lie in "confidential documents." (Of course, I don't think that she would have the confidential-confidential-plans-to-expand-the-NSA papers in the hands of a campaign staffer.) So.... solid leak, Guccifer 2.0. You keep doing you.
- fab13n 10y ago
  > all the stuff that's "leaked" looks pretty reasonable to me. If I understand correctly, the only point of this leak was to demonstrate that the hack actually happened. The damaging stuff has been given to Wikileaks, which knows better how to maximise its impact. Depending on WL and the leaker's agenda, they'll release it before or after the DNC convention: some people would rather have Sanders as a Dem candidate, some others would rather have an undermined Clinton being trounced by Trump. France faced a similar situation in 2012: DSK (https://en.wikipedia.org/wiki/Dominique_Strauss-Kahn https://en.wikipedia.org/wiki/Dominique_Strauss-Kahn) was bound to win the presidency, except that he could neither keep his dick in his pants, nor bother to get consent before shoving it down people's throats. His campaign exploded before the left-wing primary, because he allegedly raped a maid in New York's Sofitel; but the right-wing government had an ongoing investigation on pimping charges, linked to Lille's Carlton, which was scheduled to go public after the primary. Had he been bust by the French investigation, rather than prematurely in New York, French then-president Sarkozy would have very likely been re-elected.
  - evgen 10y ago
    The problem with this read is that Sanders will never be the dem candiate (even if Hillary drops dead tomorrow the backup is Uncle Joe and maybe Sen. Warren) and Hillary could emulate the Cheetoh Jesus' claim and shoot someone dead on 5th avenue and she is still going to be the next US president. Releasing to WL is also a good move if the leak were to have come direclty from the Clinton camp, as there are few information sources more biased and discredited among the general public than WL.
    - fab13n 10y ago
      I admit I don't know enough about Democratic party rules to guess who would replace a busted Clinton candidacy. Common sense would dictate that a candidate who came close second would be chosen, but common sense doesn't necessarily apply here indeed. As for Clinton being the next president, I'd be surprised if she were. Based among others on PG's "It's Charisma, stupid" [http://www.paulgraham.com/charisma.html http://www.paulgraham.com/charisma.html], more recently Scott Adams' perspectives, US history, and the mounting anti-establishment sentiments empowered by Internet bypassing centralised media, I expect Trump to tune his public persona for a target wider than Tea Party voters, then to thoroughly beat her. It sounds very bold, until you remember that this country chose Bush Jr. against Kerry, who was vastly more likeable, competent, and seemingly honest than HRC. I'm also doubtful about the public at large being influenced by a WL apparent origin: I'm afraid the general public hasn't yet learned to mind and evaluate sources. That's a digital native reflex, we're still a minority, and we're rather sympathetic towards WL.
Jerry2 10y ago
>* The files have at least passed through the hands of a Russian or someone who likes using former Russian spies as a pseudonym. Looks to me that someone desperately wants to implicate Russians or to make it seem that the attacker is Russian. Even the original Guccifer used Russian proxies (as per his Wikipedia entry). I also read on twitter that ")))" is a Russian version of a smiley face... they apparently omit ':' in ':)'. That version of the smiley face was used in his blog post. Again, that's definitely not a subtle clue. I hope someone runs linguistic forensic analysis on that whole blog post because the 'broken english' nature of it might reveal where the author could be from and what his mother tongue might be. People who are not native speakers of english make different mistakes based on what their mother tongue is so that's something that might be harder to manufacture. Broken english of a chinese speaker will be different from someone who speaks french, for example. I've also seen malware analysis reports which show that malware authors often change the locale of their computers and often insert variable names in different languages to further obfuscate the origin of malware. This is a fascinating case and it reads like a spy novel!
- vertex-four 10y ago
  I used to play an MMO primarily populated by Russians and Ukrainians - I've also lived in a few other places. The writing on the blog post definitely sounds Russian. I really doubt it was Russian intelligence services, though, just a hacker having some fun with account names etc.
cleeus 10y ago
> * The files have at least passed through the hands of a Russian or someone who likes using former Russian spies as a pseudonym. Or intentionally made to look like that. Attribution of hacks is on the spectrum of hard to impossible. Who can prove it wasn't the NSA/CIA?
umanwizard 10y ago
Those automatic translations are wrong. The name you cited means "Felix Edmundovich" (or "Felix, son of Edmund")
- derFunk 10y ago
  I agree. This leads to the question what the heck Bing is translating here.
  - loblollyboy 10y ago
    It's algorithm is probably associating words or ideas with equivalent but not identical best match in English - if you translate First Patronymic of some famous dude (famous enough that the bingbot has a lot of Russian and English text about them to learn from) it'll spit out the English First Last - as the patronymic will rarely be used in English articles about them. In that way First-Patronymic serves as sort of a dual-index on the Russian half of the Russian-English translation. Just a guess
- extortionist 10y ago
  Russian names are generally given name then patronymic (i.e. 'son of' or 'daughter of') then family name. A person is formally addressed by their given and patronymic names. In this case Felix Edmundovich would refer to Felix Edmundovich Dzerzhinsky. https://en.wikipedia.org/wiki/Felix_Dzerzhinsky https://en.wikipedia.org/wiki/Felix_Dzerzhinsky
tychuz 10y ago
So much investigation, when this line alone tells he's a russian: >appreciated my skills so highly))) But in fact The))) smile.
- mrkgnao 10y ago
  Or is supposed to tell that he is?
  - tychuz 10y ago
    Time to put on my tinfoil hat.
mseebach 10y ago
Actually, I'd say that the "Grizzli777" signature is a hint that it's an individual or a small group. State-level actors wouldn't use pirated software - Microsoft Office is cheap for a government, and running 'warez' is really bad security practice, and a great way to have your own systems compromised.
- linkregister 10y ago
  Many state actors use contractors with lots of leeway; the NSA-GCHQ model of tight control is actually not the norm when it comes to APT. Just look at the Mandiant report on PLA Unit 61398.
- EdHominem 10y ago
  If they used MS Office they'd be sure to pirate it. That way if it leaked any information it wouldn't be real.
- vintermann 10y ago
  For state agencies, assume that they are capable of misleading, but not generally capable of completely avoiding slip-ups. So "state-level actors wouldn't use pirated software" is not good evidence - they might, both because it's easy and to make it look authentic as an independent hacker. Whether independent or not, if you're good enough to gain access where you shouldn't, you probably know where to get safe pirated copies. But the Russian name in the most recent save is still evidence, because it's a perfectly plausible slip-up.
  - mseebach 10y ago
    You can't prove a negative, and you certainly can never prove that something wasn't done by a more capable, more powerful actor pretending to be a less capable and powerful actor. It's the "that's what they WANT you to believe" argument of conspiracy theories.
    - vintermann 10y ago
      As I see it, there are two options here. One is that a lone hacker succeeded in making it look like the Russians. The other is that the Russians failed at making it look like a lone hacker. Faking stuff is hard, so I'm betting on the failure. DNC also said they believe it's a Russian intrusion, but we don't know if they rely on the same evidence for that - they potentially have access to a lot more. Another thing is that Putin's government doesn't seem to be terribly concerned that you know they did something, as long as they can spread just a little doubt or have a fig leaf of plausible deniability. (Otherwise they'd probably not go around poisoning people with polonium). It makes sense if you view them as a sort of mafia: a mafia boss may not want it to be an official matter that he killed some people who got in his way - but he sure wants similar people to know.

capitalsigma 10y ago

I assumed these were going to be filled with FUD, and that this was a "false flag" against the Clinton campaign when I read the blog post without looking at the contents of the documents. But tbh, all the stuff that's "leaked" looks pretty reasonable to me. The Trump stuff is all true, public knowledge --- obviously spun a little bit, but maybe even more fair to Trump than John Oliver. The policy stuff sounds pretty good to me --- national cyber advisor is probably needed, the crisis response stuff sounds like a pretty good idea, a speech to an Islamic forum in the first 100 days sounds good too. If this were fake, you'd think it would be more damaging. If anything, this probably makes me a little more comfortable with the idea of voting Clinton, since she has (less) incentive to lie in "confidential documents." (Of course, I don't think that she would have the confidential-confidential-plans-to-expand-the-NSA papers in the hands of a campaign staffer.) So.... solid leak, Guccifer 2.0. You keep doing you.

fab13n 10y ago
> all the stuff that's "leaked" looks pretty reasonable to me. If I understand correctly, the only point of this leak was to demonstrate that the hack actually happened. The damaging stuff has been given to Wikileaks, which knows better how to maximise its impact. Depending on WL and the leaker's agenda, they'll release it before or after the DNC convention: some people would rather have Sanders as a Dem candidate, some others would rather have an undermined Clinton being trounced by Trump. France faced a similar situation in 2012: DSK (https://en.wikipedia.org/wiki/Dominique_Strauss-Kahn https://en.wikipedia.org/wiki/Dominique_Strauss-Kahn) was bound to win the presidency, except that he could neither keep his dick in his pants, nor bother to get consent before shoving it down people's throats. His campaign exploded before the left-wing primary, because he allegedly raped a maid in New York's Sofitel; but the right-wing government had an ongoing investigation on pimping charges, linked to Lille's Carlton, which was scheduled to go public after the primary. Had he been bust by the French investigation, rather than prematurely in New York, French then-president Sarkozy would have very likely been re-elected.
- evgen 10y ago
  The problem with this read is that Sanders will never be the dem candiate (even if Hillary drops dead tomorrow the backup is Uncle Joe and maybe Sen. Warren) and Hillary could emulate the Cheetoh Jesus' claim and shoot someone dead on 5th avenue and she is still going to be the next US president. Releasing to WL is also a good move if the leak were to have come direclty from the Clinton camp, as there are few information sources more biased and discredited among the general public than WL.
  - fab13n 10y ago
    I admit I don't know enough about Democratic party rules to guess who would replace a busted Clinton candidacy. Common sense would dictate that a candidate who came close second would be chosen, but common sense doesn't necessarily apply here indeed. As for Clinton being the next president, I'd be surprised if she were. Based among others on PG's "It's Charisma, stupid" [http://www.paulgraham.com/charisma.html http://www.paulgraham.com/charisma.html], more recently Scott Adams' perspectives, US history, and the mounting anti-establishment sentiments empowered by Internet bypassing centralised media, I expect Trump to tune his public persona for a target wider than Tea Party voters, then to thoroughly beat her. It sounds very bold, until you remember that this country chose Bush Jr. against Kerry, who was vastly more likeable, competent, and seemingly honest than HRC. I'm also doubtful about the public at large being influenced by a WL apparent origin: I'm afraid the general public hasn't yet learned to mind and evaluate sources. That's a digital native reflex, we're still a minority, and we're rather sympathetic towards WL.

Jerry2 10y ago

>* The files have at least passed through the hands of a Russian or someone who likes using former Russian spies as a pseudonym. Looks to me that someone desperately wants to implicate Russians or to make it seem that the attacker is Russian. Even the original Guccifer used Russian proxies (as per his Wikipedia entry). I also read on twitter that ")))" is a Russian version of a smiley face... they apparently omit ':' in ':)'. That version of the smiley face was used in his blog post. Again, that's definitely not a subtle clue. I hope someone runs linguistic forensic analysis on that whole blog post because the 'broken english' nature of it might reveal where the author could be from and what his mother tongue might be. People who are not native speakers of english make different mistakes based on what their mother tongue is so that's something that might be harder to manufacture. Broken english of a chinese speaker will be different from someone who speaks french, for example. I've also seen malware analysis reports which show that malware authors often change the locale of their computers and often insert variable names in different languages to further obfuscate the origin of malware. This is a fascinating case and it reads like a spy novel!

vertex-four 10y ago
I used to play an MMO primarily populated by Russians and Ukrainians - I've also lived in a few other places. The writing on the blog post definitely sounds Russian. I really doubt it was Russian intelligence services, though, just a hacker having some fun with account names etc.

cleeus 10y ago

> * The files have at least passed through the hands of a Russian or someone who likes using former Russian spies as a pseudonym. Or intentionally made to look like that. Attribution of hacks is on the spectrum of hard to impossible. Who can prove it wasn't the NSA/CIA?

umanwizard 10y ago

Those automatic translations are wrong. The name you cited means "Felix Edmundovich" (or "Felix, son of Edmund")

derFunk 10y ago
I agree. This leads to the question what the heck Bing is translating here.
- loblollyboy 10y ago
  It's algorithm is probably associating words or ideas with equivalent but not identical best match in English - if you translate First Patronymic of some famous dude (famous enough that the bingbot has a lot of Russian and English text about them to learn from) it'll spit out the English First Last - as the patronymic will rarely be used in English articles about them. In that way First-Patronymic serves as sort of a dual-index on the Russian half of the Russian-English translation. Just a guess
extortionist 10y ago
Russian names are generally given name then patronymic (i.e. 'son of' or 'daughter of') then family name. A person is formally addressed by their given and patronymic names. In this case Felix Edmundovich would refer to Felix Edmundovich Dzerzhinsky. https://en.wikipedia.org/wiki/Felix_Dzerzhinsky https://en.wikipedia.org/wiki/Felix_Dzerzhinsky

tychuz 10y ago

So much investigation, when this line alone tells he's a russian: >appreciated my skills so highly))) But in fact The))) smile.

mrkgnao 10y ago
Or is supposed to tell that he is?
- tychuz 10y ago
  Time to put on my tinfoil hat.

mseebach 10y ago

Actually, I'd say that the "Grizzli777" signature is a hint that it's an individual or a small group. State-level actors wouldn't use pirated software - Microsoft Office is cheap for a government, and running 'warez' is really bad security practice, and a great way to have your own systems compromised.

linkregister 10y ago
Many state actors use contractors with lots of leeway; the NSA-GCHQ model of tight control is actually not the norm when it comes to APT. Just look at the Mandiant report on PLA Unit 61398.
EdHominem 10y ago
If they used MS Office they'd be sure to pirate it. That way if it leaked any information it wouldn't be real.
vintermann 10y ago
For state agencies, assume that they are capable of misleading, but not generally capable of completely avoiding slip-ups. So "state-level actors wouldn't use pirated software" is not good evidence - they might, both because it's easy and to make it look authentic as an independent hacker. Whether independent or not, if you're good enough to gain access where you shouldn't, you probably know where to get safe pirated copies. But the Russian name in the most recent save is still evidence, because it's a perfectly plausible slip-up.
- mseebach 10y ago
  You can't prove a negative, and you certainly can never prove that something wasn't done by a more capable, more powerful actor pretending to be a less capable and powerful actor. It's the "that's what they WANT you to believe" argument of conspiracy theories.
  - vintermann 10y ago
    As I see it, there are two options here. One is that a lone hacker succeeded in making it look like the Russians. The other is that the Russians failed at making it look like a lone hacker. Faking stuff is hard, so I'm betting on the failure. DNC also said they believe it's a Russian intrusion, but we don't know if they rely on the same evidence for that - they potentially have access to a lot more. Another thing is that Putin's government doesn't seem to be terribly concerned that you know they did something, as long as they can spread just a little doubt or have a fig leaf of plausible deniability. (Otherwise they'd probably not go around poisoning people with polonium). It makes sense if you view them as a sort of mafia: a mafia boss may not want it to be an official matter that he killed some people who got in his way - but he sure wants similar people to know.