6 ms·

A Russian Expat Leading the Fight to Protect America

42 points by pmcpinto 10y ago

sschueller 10y ago
CrowdStrike is very close to the FBI. I would take anything they say with a grain of salt.
- jessaustin 10y ago
  A headline with the phrase "Leading the Fight to Protect America" encourages skepticism as well. TFA, Alperovitch, and one supposes the ruling party as well, can't seem to make up their mind about Alperovitch. For a security dude, he seems to make a lot of political judgments. Maybe that's a natural part of the whole attribution "know thy enemy" shtick, but it does undermine the impartiality of his attributions. Then again, maybe they do need some help with diplomacy: Administration officials asked Alperovitch to attend a meeting to consider what to do. He was the only native Russian in the room.
  - turar 10y ago
    > He was the only native Russian in the room. An ugly bit of trivia. This sentence would actually sound different to a Russian speaker than to an English speaker, particularly an American one. In English, "Russian" can mean both "of ethnic Russian origin" and "a citizen/national of Russia". In Russian, those two concepts have different words. With antisemitism still being strong in Russia, and in the context of the article, many Russians (as in both ethnic origin and citizenship) would be quick to point out that Alperovitch is not a "native Russian" in both of these senses like them.
    - jessaustin 10y ago
      Russia probably isn't unique in that sense, although progress continues everywhere. I've actually been pretty shocked that no one in the current Missouri governor's election has brought up the fact that the "not a politician", "I like to blow shit up", "like Trump without the creepiness", "I donated to my nonprofit before I took a 6-figure salary from it", Navy Seal, Republican candidate Eric Greitens is Jewish. Of course, if he were running as a Democrat, I imagine someone would have printed some "educational" flyers.
  - hourislate 10y ago
    If you're to take the article at face value, I find the following interesting. >"You have to let them save face," he told the group. "escalation will not end well." Why is it these so called Russian friends always encourage everyone to do nothing, it's always something like "best not to do anything and just let it go". Seems like that would just encourage more of the same. Now who knows what was really said and this is just an article that isn't any official report. Its not like the Administration is going to tell Esquire their plans. Never the less if that is what he said I would be hesitant to trust such a person.
    - jessaustin 10y ago
      I really don't agree. The interests of USA citizens would not be served by going to war with Russia over the pretext of hacked emails.
    - Bartweiss 10y ago
      > escalation will not end well This seems like a good moment to differentiate what we want to do from what we can do. One reading of this is "just ignore the bully and they won't make things worse", which I agree is silly. But the other reading is "holy shit guys, don't set a norm of publicizing state hacking efforts, we will not look good." Granting the claim that Russia did this, it's worth following up with the possibility that the Equation Group auction was done to embarrass the TAO and the US more broadly. A few people I've seen (including the grugq, who is hardly a partisan) have suggested that it was revealed to threaten escalation if the US keeps pushing to embarrass Russia over hacking. In which case, the compliance argument may be totally reasonable. It wouldn't be giving in, it'd just be counseling politicians that maybe they don't want to take the moral high ground here.
- rahrahrah 10y ago
  I suggest that the title be changed to > A Russian Expat Leading the Fight to Protect Clinton's Campaign More accurate.
- 086421357909764 10y ago
  More than close with the FBI, A lot of their guys still roam halls at Fort Meade.
binarray2000 10y ago
> AND PUTIN'S WORST NIGHTMARE Yes, we know that the "U.S. No Longer An Actual Democracy" [1] but, can the US MSM at least TRY to make us think that it is? I mean, look at these: http://static3.businessinsider.com/image/54dca6ffeab8ea393e4a3dec-800-/screen%20shot%202015-02-12%20at%208.12.25%20am.png http://static3.businessinsider.com/image/54dca6ffeab8ea393e4... http://gdb.rferl.org/4881AF9E-1328-47C6-B468-559DBCE349DF_w974_n_s.jpg http://gdb.rferl.org/4881AF9E-1328-47C6-B468-559DBCE349DF_w9... http://gdb.rferl.org/4D8132DF-9979-4338-8545-2FE3A9B7E259_w974_n_s.jpg http://gdb.rferl.org/4D8132DF-9979-4338-8545-2FE3A9B7E259_w9... http://cdn.spectator.co.uk/content/uploads/2016/10/cover_spec_22-oct_issues-426x570.jpg http://cdn.spectator.co.uk/content/uploads/2016/10/cover_spe... http://cdn.static-economist.com/sites/default/files/imagecache/print-cover-full/print-covers/20161022_cuk400.jpg http://cdn.static-economist.com/sites/default/files/imagecac... (This is just a small excerpt. Search Google images for putin cover page. Just for fun, Google search for trump cover page as well.) Is this objective, non-partisan, peace-oriented media? Or lying, partisan and warmongering media? Where are the evidences that Russia or Putin himself are breaking into US servers? No one provides one. Why is this not a headline news: James Clapper: Non-state actor likely to blame for massive cyberattack http://www.cbsnews.com/news/james-clapper-non-state-actor-likely-to-blame-for-massive-cyberattack/ http://www.cbsnews.com/news/james-clapper-non-state-actor-li... Where is Joe Biden to threaten Russia after these revelations by Clapper? Listen, I want to live in peace and prosperity and not have to die (or be maimed) in some war or to be a refugee or to have to build my home. And, I hope, neither do YOU. [1] Don't believe me. Believe the son of the US billionaire Herbert Sandler: https://wikileaks.org/podesta-emails/emailid/3723#efmAMnANJANLAN9 https://wikileaks.org/podesta-emails/emailid/3723#efmAMnANJA...
- zimpenfish 10y ago
  > Why is this not a headline news: You linked to a highlighted story on their sci/tech section. What more do you want? There's tens of outlets reporting his comments - just check Google News.
- M_Grey 10y ago
  So your solution to what you perceive to be propaganda, is lower quality propaganda? I guess you took a look at "credible arguments" and decided, no, you'll just stick to the other side of the false dichotomy.
legacynl 10y ago
"Falcon had identified not one but two Russian intruders: Cozy Bear, ... and Fancy Bear ..." I'm not that knowledgeable about current hacking technologies so maybe this is a dumb question, but how can they 'identify' the origin of these spy-/malwares? Wouldn't a group with equal or more knowledge be able to obfuscate their origin? I think it's kind of suspicious that Russian state hackers would send the data to a server that's apparently already known to be owned by Russia.
- strictnein 10y ago
  Reading a report on one of the groups, I believe they only worked during Russian business hours, took off Russian holidays, etc. I mean, sure, you could do all that from Tahiti, but you couple that with other indicators and it starts to form a clearer picture.
  - Bartweiss 10y ago
    As I understand it, similar logic fingered the Equation Group as a US actor. Their timestamps and activity logs all accommodated US timezones, and specifically US Government working hours and holiday schedules. None of which is ironclad, but frankly there's not much reason for e.g. a Russian actor to bother faking that. Both states have groups doing this stuff, they're not really hiding it, and they might as well work on a reasonable timeframe.
  - legacynl 10y ago
    That is pretty flimsy, any other examples of those indicators?
    - strictnein 10y ago
      I was just offering an example of another indicator, not that it was proof of anything by itself. Some technical indicators: https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ https://www.crowdstrike.com/blog/bears-midst-intrusion-democ...
- 10y ago
deleted 10y ago
[deleted]
lifeisstillgood 10y ago
It looks good but ... how does Falcon allow crowdstrike to monitor a network? It presumably is an endpoint installed agent with root access, but if the attacker has got there first how do you trust your install. And even if you trust it (maybe they have not subourned the kernel) but even so ... how? Is it as simple as "we know what code they are using, so we look for that code?"
- lifeisstillgood 10y ago
  So it seems they have a database of known exploits (their homemade page shows a "sticky-keys" exploit of windows login). They had come across the Russian malware before - to the extent of decompiling it enough to extract comments or variable names - so they had a pretty good idea of what to look for. Interesting - I suppose the only way to get good at this game is to start and collect as you go along. Pokemon for IDS
jessaustin 10y ago
Is Esquire always like this? "A tall, bald fifty-four-year-old"... "met a striking dark-haired computer geek"... "her friend was short, swarthy, and squint-eyed". "Alperovitch was in New York when"... "on a rare vacation, in Italy"... "while piloting his hand-built Polynesian proa around Cape Horn." Too many inane trivial details!
- Bartweiss 10y ago
  Yes, they're always like that. Grantland and Vice and Vanity Fair are the same. It's a very specific kind of journalism that's contorting straight-news reporting into human interest column space by focusing on individuals and appearances. I often don't like it, but the alternative for Esquire was running an essay on mixology or something, not a cleaner version of this piece.

42 points by pmcpinto 10y ago

sschueller 10y ago

CrowdStrike is very close to the FBI. I would take anything they say with a grain of salt.

jessaustin 10y ago
A headline with the phrase "Leading the Fight to Protect America" encourages skepticism as well. TFA, Alperovitch, and one supposes the ruling party as well, can't seem to make up their mind about Alperovitch. For a security dude, he seems to make a lot of political judgments. Maybe that's a natural part of the whole attribution "know thy enemy" shtick, but it does undermine the impartiality of his attributions. Then again, maybe they do need some help with diplomacy: Administration officials asked Alperovitch to attend a meeting to consider what to do. He was the only native Russian in the room.
- turar 10y ago
  > He was the only native Russian in the room. An ugly bit of trivia. This sentence would actually sound different to a Russian speaker than to an English speaker, particularly an American one. In English, "Russian" can mean both "of ethnic Russian origin" and "a citizen/national of Russia". In Russian, those two concepts have different words. With antisemitism still being strong in Russia, and in the context of the article, many Russians (as in both ethnic origin and citizenship) would be quick to point out that Alperovitch is not a "native Russian" in both of these senses like them.
  - jessaustin 10y ago
    Russia probably isn't unique in that sense, although progress continues everywhere. I've actually been pretty shocked that no one in the current Missouri governor's election has brought up the fact that the "not a politician", "I like to blow shit up", "like Trump without the creepiness", "I donated to my nonprofit before I took a 6-figure salary from it", Navy Seal, Republican candidate Eric Greitens is Jewish. Of course, if he were running as a Democrat, I imagine someone would have printed some "educational" flyers.
- hourislate 10y ago
  If you're to take the article at face value, I find the following interesting. >"You have to let them save face," he told the group. "escalation will not end well." Why is it these so called Russian friends always encourage everyone to do nothing, it's always something like "best not to do anything and just let it go". Seems like that would just encourage more of the same. Now who knows what was really said and this is just an article that isn't any official report. Its not like the Administration is going to tell Esquire their plans. Never the less if that is what he said I would be hesitant to trust such a person.
  - jessaustin 10y ago
    I really don't agree. The interests of USA citizens would not be served by going to war with Russia over the pretext of hacked emails.
  - Bartweiss 10y ago
    > escalation will not end well This seems like a good moment to differentiate what we want to do from what we can do. One reading of this is "just ignore the bully and they won't make things worse", which I agree is silly. But the other reading is "holy shit guys, don't set a norm of publicizing state hacking efforts, we will not look good." Granting the claim that Russia did this, it's worth following up with the possibility that the Equation Group auction was done to embarrass the TAO and the US more broadly. A few people I've seen (including the grugq, who is hardly a partisan) have suggested that it was revealed to threaten escalation if the US keeps pushing to embarrass Russia over hacking. In which case, the compliance argument may be totally reasonable. It wouldn't be giving in, it'd just be counseling politicians that maybe they don't want to take the moral high ground here.
rahrahrah 10y ago
I suggest that the title be changed to > A Russian Expat Leading the Fight to Protect Clinton's Campaign More accurate.
086421357909764 10y ago
More than close with the FBI, A lot of their guys still roam halls at Fort Meade.

binarray2000 10y ago

> AND PUTIN'S WORST NIGHTMARE Yes, we know that the "U.S. No Longer An Actual Democracy" [1] but, can the US MSM at least TRY to make us think that it is? I mean, look at these: http://static3.businessinsider.com/image/54dca6ffeab8ea393e4a3dec-800-/screen%20shot%202015-02-12%20at%208.12.25%20am.png http://static3.businessinsider.com/image/54dca6ffeab8ea393e4... http://gdb.rferl.org/4881AF9E-1328-47C6-B468-559DBCE349DF_w974_n_s.jpg http://gdb.rferl.org/4881AF9E-1328-47C6-B468-559DBCE349DF_w9... http://gdb.rferl.org/4D8132DF-9979-4338-8545-2FE3A9B7E259_w974_n_s.jpg http://gdb.rferl.org/4D8132DF-9979-4338-8545-2FE3A9B7E259_w9... http://cdn.spectator.co.uk/content/uploads/2016/10/cover_spec_22-oct_issues-426x570.jpg http://cdn.spectator.co.uk/content/uploads/2016/10/cover_spe... http://cdn.static-economist.com/sites/default/files/imagecache/print-cover-full/print-covers/20161022_cuk400.jpg http://cdn.static-economist.com/sites/default/files/imagecac... (This is just a small excerpt. Search Google images for putin cover page. Just for fun, Google search for trump cover page as well.) Is this objective, non-partisan, peace-oriented media? Or lying, partisan and warmongering media? Where are the evidences that Russia or Putin himself are breaking into US servers? No one provides one. Why is this not a headline news: James Clapper: Non-state actor likely to blame for massive cyberattack http://www.cbsnews.com/news/james-clapper-non-state-actor-likely-to-blame-for-massive-cyberattack/ http://www.cbsnews.com/news/james-clapper-non-state-actor-li... Where is Joe Biden to threaten Russia after these revelations by Clapper? Listen, I want to live in peace and prosperity and not have to die (or be maimed) in some war or to be a refugee or to have to build my home. And, I hope, neither do YOU. [1] Don't believe me. Believe the son of the US billionaire Herbert Sandler: https://wikileaks.org/podesta-emails/emailid/3723#efmAMnANJANLAN9 https://wikileaks.org/podesta-emails/emailid/3723#efmAMnANJA...

zimpenfish 10y ago
> Why is this not a headline news: You linked to a highlighted story on their sci/tech section. What more do you want? There's tens of outlets reporting his comments - just check Google News.
M_Grey 10y ago
So your solution to what you perceive to be propaganda, is lower quality propaganda? I guess you took a look at "credible arguments" and decided, no, you'll just stick to the other side of the false dichotomy.

legacynl 10y ago

"Falcon had identified not one but two Russian intruders: Cozy Bear, ... and Fancy Bear ..." I'm not that knowledgeable about current hacking technologies so maybe this is a dumb question, but how can they 'identify' the origin of these spy-/malwares? Wouldn't a group with equal or more knowledge be able to obfuscate their origin? I think it's kind of suspicious that Russian state hackers would send the data to a server that's apparently already known to be owned by Russia.

strictnein 10y ago
Reading a report on one of the groups, I believe they only worked during Russian business hours, took off Russian holidays, etc. I mean, sure, you could do all that from Tahiti, but you couple that with other indicators and it starts to form a clearer picture.
- Bartweiss 10y ago
  As I understand it, similar logic fingered the Equation Group as a US actor. Their timestamps and activity logs all accommodated US timezones, and specifically US Government working hours and holiday schedules. None of which is ironclad, but frankly there's not much reason for e.g. a Russian actor to bother faking that. Both states have groups doing this stuff, they're not really hiding it, and they might as well work on a reasonable timeframe.
- legacynl 10y ago
  That is pretty flimsy, any other examples of those indicators?
  - strictnein 10y ago
    I was just offering an example of another indicator, not that it was proof of anything by itself. Some technical indicators: https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ https://www.crowdstrike.com/blog/bears-midst-intrusion-democ...
10y ago

deleted 10y ago

[deleted]

lifeisstillgood 10y ago

It looks good but ... how does Falcon allow crowdstrike to monitor a network? It presumably is an endpoint installed agent with root access, but if the attacker has got there first how do you trust your install. And even if you trust it (maybe they have not subourned the kernel) but even so ... how? Is it as simple as "we know what code they are using, so we look for that code?"

lifeisstillgood 10y ago
So it seems they have a database of known exploits (their homemade page shows a "sticky-keys" exploit of windows login). They had come across the Russian malware before - to the extent of decompiling it enough to extract comments or variable names - so they had a pretty good idea of what to look for. Interesting - I suppose the only way to get good at this game is to start and collect as you go along. Pokemon for IDS

jessaustin 10y ago

Is Esquire always like this? "A tall, bald fifty-four-year-old"... "met a striking dark-haired computer geek"... "her friend was short, swarthy, and squint-eyed". "Alperovitch was in New York when"... "on a rare vacation, in Italy"... "while piloting his hand-built Polynesian proa around Cape Horn." Too many inane trivial details!

Bartweiss 10y ago
Yes, they're always like that. Grantland and Vice and Vanity Fair are the same. It's a very specific kind of journalism that's contorting straight-news reporting into human interest column space by focusing on individuals and appearances. I often don't like it, but the alternative for Esquire was running an essay on mixology or something, not a cleaner version of this piece.