4 ms·

I'm coming to understand that the chain of evidence is in the following steps: 0. FireEye identifies a threat group known as APT28 (active since 2007) as havin

I'm coming to understand that the chain of evidence is in the following steps: 0. FireEye identifies a threat group known as APT28 (active since 2007) as having Russian origin, based upon political identities of targets, language markers, timezone data, and compiler settings. This analysis is from 2014. [EDIT: added this step later on to solidify Russian attribution] Sources: - https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html https://www.fireeye.com/blog/threat-research/2014/10/apt28-a... (blog) - https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf https://www.fireeye.com/content/dam/fireeye-www/global/en/cu... (long-form report PDF) 1. CrowdStrike & SecureWorks identifying the DNC breaches originating from the well-known Russian state threat actor APT28. Sources: - https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ https://www.crowdstrike.com/blog/bears-midst-intrusion-democ... - https://www.secureworks.com/research/threat-group-4127-targets-hillary-clinton-presidential-campaign https://www.secureworks.com/research/threat-group-4127-targe... 2. This Motherboard article revealing the custom bitly links used in the Podesta phishing email. Sources: - [OP] http://motherboard.vice.com/read/how-hackers-broke-into-john-podesta-and-colin-powells-gmail-accounts http://motherboard.vice.com/read/how-hackers-broke-into-john... 3. Politico confirming with SecureWorks that the Podesta spoofed phishing domain from step 2 has previously been used by threat actor APT28: "'The Google-spoofing domain in the Motherboard article is one we observed used by Fancy Bear,' SecureWorks researcher Tom Finney told POLITICO in an email." Sources: - http://www.politico.com/story/2016/10/russia-responsible-podesta-wikileaks-hack-230095 http://www.politico.com/story/2016/10/russia-responsible-pod... This Politico article is the better summary. It also links to 2 other quality corroborating stories from ThreatConnect and Esquire. The Motherboard one is key but doesn't tie the whole story together. Sorry to disappoint parent commenter but the evidence does involve bitly custom domains! I'm not 100% clear whether this was simply a decently-executed vanilla phishing attack or if there were some advanced techniques used, but none of the evidence above hinges on that.

revelation 10y ago
There is no evidence here. The "Sources" are thinly veiled advertisements for their Security^TM products.
- cypherpunks01 10y ago
  So if I hear you correctly, you are essentially claiming that the 4 security companies CrowdStrike, SecureWorks, Fidelis and ThreatConnect all conspired together to manufacture evidence in order to mislead the DNC & USGOVT in this investigation because it would be good advertising for their industry? Personally, I would consider that a somewhat extraordinary claim. Is there anyone familiar with this sector who can comment on this?
  - tptacek 10y ago
    It is very unlikely that Crowdstrike is making things up. I think very few people on HN understand how Crowdstrike works. Know how every Fortune-1000 company in the world has McAfee or Norton Antivirus installed (or at least used to)? Crowdstrike is like that, except they hoover up all the malware detection stuff they do on endpoints to a central data center and correlate it across customers.
    - hueving 10y ago
      Hats off to a company that can convince companies to become a member of its botnet and charge for the privilege!
      - tptacek 10y ago
        What widely-deployed desktop software can you not say this about?
        hueving 10y ago
        grep More seriously, anything not phoning home with traffic patterns for things that 'might be attacks'.
  - revelation 10y ago
    I don't get it. How do you go from "there is no evidence here" to "conspiracy"? It's fine to explain how malware works and turn it into a PR piece with fancy pictures of minified JavaScript, but none of that is proof of some Russian connection. Neither are professional sounding statements like "we have medium confidence the attackers are Russian actors" or similar baloney. All there is is Stratfor style analysis along the lines of "we think NATO countries X, Y, Z got exploited so it must be Russia" when in reality that's probably just because all their customers are NATO countries X, Y, Z.
imron 10y ago
Assange has publicly stated that the DNC servers being hacked and Wikileaks obtaining DNC emails are two separate things and it seems that journalists conflating them are unable to count to 2.
- dimino 10y ago
  Exactly, why can't it be possible that Assange is an ass, but Wikileaks isn't in cahoots with Russia, and Russia hacked the DNC?
- bduerst 10y ago
  If Assange were say that any state other than Russia were behind the attacks, I'd be inclined to believe him, but since it's Russia and Assange works for RT, I wouldn't put money on anything he says about the Russia state activity.

revelation 10y ago

There is no evidence here. The "Sources" are thinly veiled advertisements for their Security^TM products.

cypherpunks01 10y ago
So if I hear you correctly, you are essentially claiming that the 4 security companies CrowdStrike, SecureWorks, Fidelis and ThreatConnect all conspired together to manufacture evidence in order to mislead the DNC & USGOVT in this investigation because it would be good advertising for their industry? Personally, I would consider that a somewhat extraordinary claim. Is there anyone familiar with this sector who can comment on this?
- tptacek 10y ago
  It is very unlikely that Crowdstrike is making things up. I think very few people on HN understand how Crowdstrike works. Know how every Fortune-1000 company in the world has McAfee or Norton Antivirus installed (or at least used to)? Crowdstrike is like that, except they hoover up all the malware detection stuff they do on endpoints to a central data center and correlate it across customers.
  - hueving 10y ago
    Hats off to a company that can convince companies to become a member of its botnet and charge for the privilege!
    - tptacek 10y ago
      What widely-deployed desktop software can you not say this about?
      - hueving 10y ago
        grep More seriously, anything not phoning home with traffic patterns for things that 'might be attacks'.
- revelation 10y ago
  I don't get it. How do you go from "there is no evidence here" to "conspiracy"? It's fine to explain how malware works and turn it into a PR piece with fancy pictures of minified JavaScript, but none of that is proof of some Russian connection. Neither are professional sounding statements like "we have medium confidence the attackers are Russian actors" or similar baloney. All there is is Stratfor style analysis along the lines of "we think NATO countries X, Y, Z got exploited so it must be Russia" when in reality that's probably just because all their customers are NATO countries X, Y, Z.

imron 10y ago

Assange has publicly stated that the DNC servers being hacked and Wikileaks obtaining DNC emails are two separate things and it seems that journalists conflating them are unable to count to 2.

dimino 10y ago
Exactly, why can't it be possible that Assange is an ass, but Wikileaks isn't in cahoots with Russia, and Russia hacked the DNC?
bduerst 10y ago
If Assange were say that any state other than Russia were behind the attacks, I'd be inclined to believe him, but since it's Russia and Assange works for RT, I wouldn't put money on anything he says about the Russia state activity.