12 ms·

They keep on saying the Russians did it and that the trail leads to the Russians. What is the actual evidence that it was the Russians that did it? And Bitly

They keep on saying the Russians did it and that the trail leads to the Russians. What is the actual evidence that it was the Russians that did it? And Bitly links ain't it.

rfrank 10y ago
"The intelligence community declined to explain how they reached their conclusion, and it’s fair to assume they have data no one else can see." My personal favorite part of the article, couple paragraphs after that quote: "We are approaching the point in this case where there are only two reasons for why people say there’s no good evidence,” Rid told me. “The first reason is because they don’t understand the evidence—because the don’t have the necessary technical knowledge. The second reason is they don’t want to understand the evidence.”
- deleted 10y ago
  [deleted]
- h4nkoslo 10y ago
  There is no reason for them to not source the evidence they're using to attribute it to the Russians. If it was them, they already know exactly what they left behind. It's actually not that difficult to disguise sources of attacks (assuming for the sake of argument it was the Russians, it could very well have physically occurred from a Manhattan Starbucks), and based on what we know about the server setup it's not like the hack required particular technical sophistication or traceable 0-days. Conversely, there are ample reasons for the intelligence community to pin it on their historic enemy, rather than the more likely Murder on the Orient Express scenario where absolutely everyone paying attention hacked every grotesquely unsecured setup, or the insider-threat scenario. Hey, whatever happened to Seth Rich? And if the "intelligence community" isn't actively targeting insiders at least as a pure pen-testing contingency, why aren't they?
  - jgalt212 10y ago
    > There is no reason for them to not source the evidence they're using to attribute it to the Russians. Well, what if that evidence was gathered via extra-legal means?
  - rfrank 10y ago
    Agreed, I'm uncomfortable with the Russia allegations barring irrefutable evidence, and I haven't seen that yet. Even assuming they did do it, I'm unsure what the correct response would be. And I can definitely see incentives to just say, "Russia did it." I feel like given the amount of info necessary for security clearance & the fact most politicians live and die with their phones means the intelligence agencies have them all pretty much dead to rights.
  - mikeryan 10y ago
    There is no reason for them to not source the evidence they're using to attribute it to the Russians What if the source is an actual human asset within the malicious organization? What if the source is a compromised server of the Russian organization? What if the source is a legal wiretap on a bad actor?
    - h4nkoslo 10y ago
      Assuming it was Russia, and that they did derive it from some secret means, public announcing they discovered it but not giving the source makes that inference more likely. That's why eg in World War II, the allies only acted on Enigma intercepts if there was a plausible alternate source. So my inference is that they're lying about having sufficient evidence to definitively point at the rooskies, or they're being reckless with sourcing.
dahdum 10y ago
At least they mention it: "None of this new data constitutes a smoking gun that can clearly frame Russia as the culprit" The scam was so generic I'm confused why it has to be Russian government vs individuals, but it doesn't matter much IMO.
- rfrank 10y ago
  Given the saber rattling going on between the US and Russia at the moment, it would seem to matter very much. Blaming the Russians gives them more room to deflect without acknowledging content of the leaks.
  - dahdum 10y ago
    You're right, I'm sure they tested the message "but...but...the Russians". I think HRC wins this easily, but these scandals won't just go away. There's enough meat in them to fuel 1-2 years of republican attacks. I fear she'll be the most ineffective President of my time.
    - rfrank 10y ago
      Time will tell I suppose. Here's a fun one from today: https://i.redd.it/dxedkw7jwosx.png https://i.redd.it/dxedkw7jwosx.png
      - misiti3780 10y ago
        is that real ?
        rfrank 10y ago
        yes: https://wikileaks.org/podesta-emails/emailid/23199 https://wikileaks.org/podesta-emails/emailid/23199
        misiti3780 10y ago
bradford 10y ago
Relevent portion from the article: "US government took the rare step of publicly pointing the finger at the Russian government, accusing it of directing the recent string of hacks and data breaches. The intelligence community declined to explain how they reached their conclusion, and it’s fair to assume they have data no one else can see." So, if the evidence exists (and I personally believe it does, though I also understand those who disagree) it hasn't been made public.
- gizmodo59 10y ago
  > I personally believe it does Not to sound arrogant, I really like to know some reasoning behind it. I'm even more curious to understand if you are an American citizen.
  - bradford 10y ago
    Yes, American citizen here. With the lack of any publicly available evidence, I guess the reasoning behind it largely comes down to trust. You either trust the government on this or you don't. On this issue, I do, but again, I wouldn't fault you for disagreeing. If I had to elaborate, I'd say: The cost of being caught in a lie is sufficiently damaging to the organization that makes the claim. What benefit do they gain by making such a claim? does the risk of getting caught in a lie outweigh the benefit? I just don't see the lie as being a risk worth taking. There have been many times in the past where 'blaming it on Russia' could have been politically convenient. If you do it too often, you become the boy-who-cries-wolf. Would the risk of reputation loss outweigh the benefits gained by telling the lie? again, I don't see the lie as being worth the risk.
    - AvenueIngres 10y ago
      >What benefit do they gain by making such a claim? Not losing the most important general election of this first half-century?
      - eridius 10y ago
cypherpunks01 10y ago
I'm coming to understand that the chain of evidence is in the following steps: 0. FireEye identifies a threat group known as APT28 (active since 2007) as having Russian origin, based upon political identities of targets, language markers, timezone data, and compiler settings. This analysis is from 2014. [EDIT: added this step later on to solidify Russian attribution] Sources: - https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html https://www.fireeye.com/blog/threat-research/2014/10/apt28-a... (blog) - https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf https://www.fireeye.com/content/dam/fireeye-www/global/en/cu... (long-form report PDF) 1. CrowdStrike & SecureWorks identifying the DNC breaches originating from the well-known Russian state threat actor APT28. Sources: - https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ https://www.crowdstrike.com/blog/bears-midst-intrusion-democ... - https://www.secureworks.com/research/threat-group-4127-targets-hillary-clinton-presidential-campaign https://www.secureworks.com/research/threat-group-4127-targe... 2. This Motherboard article revealing the custom bitly links used in the Podesta phishing email. Sources: - [OP] http://motherboard.vice.com/read/how-hackers-broke-into-john-podesta-and-colin-powells-gmail-accounts http://motherboard.vice.com/read/how-hackers-broke-into-john... 3. Politico confirming with SecureWorks that the Podesta spoofed phishing domain from step 2 has previously been used by threat actor APT28: "'The Google-spoofing domain in the Motherboard article is one we observed used by Fancy Bear,' SecureWorks researcher Tom Finney told POLITICO in an email." Sources: - http://www.politico.com/story/2016/10/russia-responsible-podesta-wikileaks-hack-230095 http://www.politico.com/story/2016/10/russia-responsible-pod... This Politico article is the better summary. It also links to 2 other quality corroborating stories from ThreatConnect and Esquire. The Motherboard one is key but doesn't tie the whole story together. Sorry to disappoint parent commenter but the evidence does involve bitly custom domains! I'm not 100% clear whether this was simply a decently-executed vanilla phishing attack or if there were some advanced techniques used, but none of the evidence above hinges on that.
- revelation 10y ago
  There is no evidence here. The "Sources" are thinly veiled advertisements for their Security^TM products.
thisisdallas 10y ago
> What is the actual evidence that it was the Russians that did it? If there actually is evidence, it's not public. In my opinion, the "RUSSIANS WILL KILL US ALL AND TRUMP IS BEST FRIENDS WITH PUTIN" meme is nothing but a scare tactic to influence older voters who were around during the cold war. Obviously, I could be completely wrong. That's just my cynical opinion.
- deleted 10y ago
  [deleted]
- jessaustin 10y ago
  Those who aren't cynical, aren't paying attention.
  - 1812calif 10y ago
    This is a meaningless statement. "Those who are not hopeful, who do not believe in a better future, are not paying attention." --me Same amount of authority.
    - jessaustin 10y ago
      I agree with your "quoted" statement. Cynicism is not a flavor of pessimism.
      - 1812calif 10y ago
        Short pithy statements, are worth the electrons written on.
        jessaustin 10y ago
        Most of your HN comments are one or two sentences?
- dimino 10y ago
  Can we not live in a world where the Russians did execute the hack, but the "RUSSIANS WILL KILL US" meme is also nothing but a scare tactic?
alva 10y ago
Last time I will post this as have linked to this all over the shop in the last week. At no point in the official statement [0] is Russia EVER blamed for the DNC hack and subsequent leaks. This statement has given the media carte blanche to make the accusation themselves. When previously posted, numerous people have said it does accuse the Russians of this. I would urge you to read the statement extremely carefully. The amount of intelligence and man-hours that go into crafting something like this is huge. There is a reason why at no point, is any current official coming out and explicitly accusing Russia of the DNC hack. Note that at no point has POTUS, Earnest during press briefings of Clinton ever accused the Russians of the DNC hack. Every time they refer to the matter they take great time and care to get their wording right. [0] https://www.dhs.gov/node/23199 https://www.dhs.gov/node/23199 edit: What I am saying is not far-fetched or crazy. For those down-voting I hope you get a lawyer before signing any important legal document. Do not forgot Bill Clinton during his trial at the Grand Jury :"It depends upon what your definition of is is."
- ones_and_zeros 10y ago
  I have my doubts as well, but this seems pretty direct: > The U.S. Intelligence Community (USIC) is confident that the Russian Government directed the recent compromises of e-mails from US persons and institutions, including from US political organizations.
  - alva 10y ago
    "the recent compromises of e-mails from US persons and institutions, including from US political organizations" which recent compromises are they referring to?
    - cypherpunks01 10y ago
      They're referring to all recent compromises leaked "on sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona".
      - 10y ago
Kalium 10y ago
What are you looking for in terms of evidence? Please bear in mind that we're very unlikely to find something signed "PUTIN WUZ HERE" anywhere.
whybroke 10y ago
>And Bitly links ain't it. And why aren't they? Too damning I presume.
nikcub 10y ago
This blog post is part of a longer trail of breadcrumbs that is spread out across multiple sources and over a long period of time. It started with the WashPo story[0] on the DNC hack and the CrowdStrike attribution (there were some good rebuttal stories at that time, I think they have changed their minds) and now you have 10-15 different sources kicking this story further down the road each day. That's how journalism is changing - rather than having 2-3 investigative reporters at one newspaper do a one year investigation then publish their in-depth series (pass go, collect pulitzer etc.) the large stories are now often broken down piecemeal and worked on in public over time. It means many more experts can work on it and the stories are better for it - but the downside is that they're very difficult to keep track of (the only way is Twitter or reddit, IMO - and the netsec reddit is horrible with approving stories). If you come into it part way you can feel lost because the writers assume you've been following along (which is a mistake) I've honestly probably read 100+ stories on this thread, likely more. At this stage you need to bring the thread back together yourself with Google or starting with the Wikipedia pages[2][3] [0] https://www.washingtonpost.com/world/national-security/russian-government-hackers-penetrated-dnc-stole-opposition-research-on-trump/2016/06/14/cf006cb4-316e-11e6-8ff7-7b6c1998b7a0_story.html https://www.washingtonpost.com/world/national-security/russi... [1] https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ https://www.crowdstrike.com/blog/bears-midst-intrusion-democ... [2] https://en.wikipedia.org/wiki/Democratic_National_Committee_cyber_attacks https://en.wikipedia.org/wiki/Democratic_National_Committee_... [3] https://en.wikipedia.org/wiki/2016_Democratic_National_Committee_email_leak https://en.wikipedia.org/wiki/2016_Democratic_National_Commi...
- sourcex 10y ago
  You say you read 100+ stories. How do you keep track of all of them? It is easy to forget when you read so much and more difficult to exactly pinpoint where you read it?
razster 10y ago
Vice has been a government mouth piece for a while now, so of course they're going to say Russia.
- danyim 10y ago
  What makes you say that about Vice?

They keep on saying the Russians did it and that the trail leads to the Russians. What is the actual evidence that it was the Russians that did it? And Bitly links ain't it.

rfrank 10y ago

"The intelligence community declined to explain how they reached their conclusion, and it’s fair to assume they have data no one else can see." My personal favorite part of the article, couple paragraphs after that quote: "We are approaching the point in this case where there are only two reasons for why people say there’s no good evidence,” Rid told me. “The first reason is because they don’t understand the evidence—because the don’t have the necessary technical knowledge. The second reason is they don’t want to understand the evidence.”

deleted 10y ago
[deleted]
h4nkoslo 10y ago
There is no reason for them to not source the evidence they're using to attribute it to the Russians. If it was them, they already know exactly what they left behind. It's actually not that difficult to disguise sources of attacks (assuming for the sake of argument it was the Russians, it could very well have physically occurred from a Manhattan Starbucks), and based on what we know about the server setup it's not like the hack required particular technical sophistication or traceable 0-days. Conversely, there are ample reasons for the intelligence community to pin it on their historic enemy, rather than the more likely Murder on the Orient Express scenario where absolutely everyone paying attention hacked every grotesquely unsecured setup, or the insider-threat scenario. Hey, whatever happened to Seth Rich? And if the "intelligence community" isn't actively targeting insiders at least as a pure pen-testing contingency, why aren't they?
- jgalt212 10y ago
  > There is no reason for them to not source the evidence they're using to attribute it to the Russians. Well, what if that evidence was gathered via extra-legal means?
- rfrank 10y ago
  Agreed, I'm uncomfortable with the Russia allegations barring irrefutable evidence, and I haven't seen that yet. Even assuming they did do it, I'm unsure what the correct response would be. And I can definitely see incentives to just say, "Russia did it." I feel like given the amount of info necessary for security clearance & the fact most politicians live and die with their phones means the intelligence agencies have them all pretty much dead to rights.
- mikeryan 10y ago
  There is no reason for them to not source the evidence they're using to attribute it to the Russians What if the source is an actual human asset within the malicious organization? What if the source is a compromised server of the Russian organization? What if the source is a legal wiretap on a bad actor?
  - h4nkoslo 10y ago
    Assuming it was Russia, and that they did derive it from some secret means, public announcing they discovered it but not giving the source makes that inference more likely. That's why eg in World War II, the allies only acted on Enigma intercepts if there was a plausible alternate source. So my inference is that they're lying about having sufficient evidence to definitively point at the rooskies, or they're being reckless with sourcing.

dahdum 10y ago

At least they mention it: "None of this new data constitutes a smoking gun that can clearly frame Russia as the culprit" The scam was so generic I'm confused why it has to be Russian government vs individuals, but it doesn't matter much IMO.

rfrank 10y ago
Given the saber rattling going on between the US and Russia at the moment, it would seem to matter very much. Blaming the Russians gives them more room to deflect without acknowledging content of the leaks.
- dahdum 10y ago
  You're right, I'm sure they tested the message "but...but...the Russians". I think HRC wins this easily, but these scandals won't just go away. There's enough meat in them to fuel 1-2 years of republican attacks. I fear she'll be the most ineffective President of my time.
  - rfrank 10y ago
    Time will tell I suppose. Here's a fun one from today: https://i.redd.it/dxedkw7jwosx.png https://i.redd.it/dxedkw7jwosx.png
    - misiti3780 10y ago
      is that real ?
      - rfrank 10y ago
        yes: https://wikileaks.org/podesta-emails/emailid/23199 https://wikileaks.org/podesta-emails/emailid/23199
        misiti3780 10y ago

bradford 10y ago

Relevent portion from the article: "US government took the rare step of publicly pointing the finger at the Russian government, accusing it of directing the recent string of hacks and data breaches. The intelligence community declined to explain how they reached their conclusion, and it’s fair to assume they have data no one else can see." So, if the evidence exists (and I personally believe it does, though I also understand those who disagree) it hasn't been made public.

gizmodo59 10y ago
> I personally believe it does Not to sound arrogant, I really like to know some reasoning behind it. I'm even more curious to understand if you are an American citizen.
- bradford 10y ago
  Yes, American citizen here. With the lack of any publicly available evidence, I guess the reasoning behind it largely comes down to trust. You either trust the government on this or you don't. On this issue, I do, but again, I wouldn't fault you for disagreeing. If I had to elaborate, I'd say: The cost of being caught in a lie is sufficiently damaging to the organization that makes the claim. What benefit do they gain by making such a claim? does the risk of getting caught in a lie outweigh the benefit? I just don't see the lie as being a risk worth taking. There have been many times in the past where 'blaming it on Russia' could have been politically convenient. If you do it too often, you become the boy-who-cries-wolf. Would the risk of reputation loss outweigh the benefits gained by telling the lie? again, I don't see the lie as being worth the risk.
  - AvenueIngres 10y ago
    >What benefit do they gain by making such a claim? Not losing the most important general election of this first half-century?
    - eridius 10y ago

cypherpunks01 10y ago

I'm coming to understand that the chain of evidence is in the following steps: 0. FireEye identifies a threat group known as APT28 (active since 2007) as having Russian origin, based upon political identities of targets, language markers, timezone data, and compiler settings. This analysis is from 2014. [EDIT: added this step later on to solidify Russian attribution] Sources: - https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html https://www.fireeye.com/blog/threat-research/2014/10/apt28-a... (blog) - https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf https://www.fireeye.com/content/dam/fireeye-www/global/en/cu... (long-form report PDF) 1. CrowdStrike & SecureWorks identifying the DNC breaches originating from the well-known Russian state threat actor APT28. Sources: - https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ https://www.crowdstrike.com/blog/bears-midst-intrusion-democ... - https://www.secureworks.com/research/threat-group-4127-targets-hillary-clinton-presidential-campaign https://www.secureworks.com/research/threat-group-4127-targe... 2. This Motherboard article revealing the custom bitly links used in the Podesta phishing email. Sources: - [OP] http://motherboard.vice.com/read/how-hackers-broke-into-john-podesta-and-colin-powells-gmail-accounts http://motherboard.vice.com/read/how-hackers-broke-into-john... 3. Politico confirming with SecureWorks that the Podesta spoofed phishing domain from step 2 has previously been used by threat actor APT28: "'The Google-spoofing domain in the Motherboard article is one we observed used by Fancy Bear,' SecureWorks researcher Tom Finney told POLITICO in an email." Sources: - http://www.politico.com/story/2016/10/russia-responsible-podesta-wikileaks-hack-230095 http://www.politico.com/story/2016/10/russia-responsible-pod... This Politico article is the better summary. It also links to 2 other quality corroborating stories from ThreatConnect and Esquire. The Motherboard one is key but doesn't tie the whole story together. Sorry to disappoint parent commenter but the evidence does involve bitly custom domains! I'm not 100% clear whether this was simply a decently-executed vanilla phishing attack or if there were some advanced techniques used, but none of the evidence above hinges on that.

revelation 10y ago
There is no evidence here. The "Sources" are thinly veiled advertisements for their Security^TM products.

thisisdallas 10y ago

> What is the actual evidence that it was the Russians that did it? If there actually is evidence, it's not public. In my opinion, the "RUSSIANS WILL KILL US ALL AND TRUMP IS BEST FRIENDS WITH PUTIN" meme is nothing but a scare tactic to influence older voters who were around during the cold war. Obviously, I could be completely wrong. That's just my cynical opinion.

deleted 10y ago
[deleted]
jessaustin 10y ago
Those who aren't cynical, aren't paying attention.
- 1812calif 10y ago
  This is a meaningless statement. "Those who are not hopeful, who do not believe in a better future, are not paying attention." --me Same amount of authority.
  - jessaustin 10y ago
    I agree with your "quoted" statement. Cynicism is not a flavor of pessimism.
    - 1812calif 10y ago
      Short pithy statements, are worth the electrons written on.
      - jessaustin 10y ago
        Most of your HN comments are one or two sentences?
dimino 10y ago
Can we not live in a world where the Russians did execute the hack, but the "RUSSIANS WILL KILL US" meme is also nothing but a scare tactic?

alva 10y ago

Last time I will post this as have linked to this all over the shop in the last week. At no point in the official statement [0] is Russia EVER blamed for the DNC hack and subsequent leaks. This statement has given the media carte blanche to make the accusation themselves. When previously posted, numerous people have said it does accuse the Russians of this. I would urge you to read the statement extremely carefully. The amount of intelligence and man-hours that go into crafting something like this is huge. There is a reason why at no point, is any current official coming out and explicitly accusing Russia of the DNC hack. Note that at no point has POTUS, Earnest during press briefings of Clinton ever accused the Russians of the DNC hack. Every time they refer to the matter they take great time and care to get their wording right. [0] https://www.dhs.gov/node/23199 https://www.dhs.gov/node/23199 edit: What I am saying is not far-fetched or crazy. For those down-voting I hope you get a lawyer before signing any important legal document. Do not forgot Bill Clinton during his trial at the Grand Jury :"It depends upon what your definition of is is."

ones_and_zeros 10y ago
I have my doubts as well, but this seems pretty direct: > The U.S. Intelligence Community (USIC) is confident that the Russian Government directed the recent compromises of e-mails from US persons and institutions, including from US political organizations.
- alva 10y ago
  "the recent compromises of e-mails from US persons and institutions, including from US political organizations" which recent compromises are they referring to?
  - cypherpunks01 10y ago
    They're referring to all recent compromises leaked "on sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona".
    - 10y ago

Kalium 10y ago

What are you looking for in terms of evidence? Please bear in mind that we're very unlikely to find something signed "PUTIN WUZ HERE" anywhere.

whybroke 10y ago

>And Bitly links ain't it. And why aren't they? Too damning I presume.

nikcub 10y ago

This blog post is part of a longer trail of breadcrumbs that is spread out across multiple sources and over a long period of time. It started with the WashPo story[0] on the DNC hack and the CrowdStrike attribution (there were some good rebuttal stories at that time, I think they have changed their minds) and now you have 10-15 different sources kicking this story further down the road each day. That's how journalism is changing - rather than having 2-3 investigative reporters at one newspaper do a one year investigation then publish their in-depth series (pass go, collect pulitzer etc.) the large stories are now often broken down piecemeal and worked on in public over time. It means many more experts can work on it and the stories are better for it - but the downside is that they're very difficult to keep track of (the only way is Twitter or reddit, IMO - and the netsec reddit is horrible with approving stories). If you come into it part way you can feel lost because the writers assume you've been following along (which is a mistake) I've honestly probably read 100+ stories on this thread, likely more. At this stage you need to bring the thread back together yourself with Google or starting with the Wikipedia pages[2][3] [0] https://www.washingtonpost.com/world/national-security/russian-government-hackers-penetrated-dnc-stole-opposition-research-on-trump/2016/06/14/cf006cb4-316e-11e6-8ff7-7b6c1998b7a0_story.html https://www.washingtonpost.com/world/national-security/russi... [1] https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ https://www.crowdstrike.com/blog/bears-midst-intrusion-democ... [2] https://en.wikipedia.org/wiki/Democratic_National_Committee_cyber_attacks https://en.wikipedia.org/wiki/Democratic_National_Committee_... [3] https://en.wikipedia.org/wiki/2016_Democratic_National_Committee_email_leak https://en.wikipedia.org/wiki/2016_Democratic_National_Commi...

sourcex 10y ago
You say you read 100+ stories. How do you keep track of all of them? It is easy to forget when you read so much and more difficult to exactly pinpoint where you read it?

razster 10y ago

Vice has been a government mouth piece for a while now, so of course they're going to say Russia.

danyim 10y ago
What makes you say that about Vice?