14 ms·

That's the real absurdity of this debacle to me. Many of the whitepapers that I read about the DNC hack listed the attack's "sophistication" as proof that it c

That's the real absurdity of this debacle to me. Many of the whitepapers that I read about the DNC hack listed the attack's "sophistication" as proof that it came from a state actor, yet it was the most routine, simple attack conceivable. No rootkits, no 0 days, just simple phishing and social engineering.

heartbreak 10y ago
The sophistication cited by CrowdStrike was the actions taken on the DNC servers, not the initial penetration.
- randyrand 10y ago
  Could you elaborate? Once you have a password shouldn't it be as easy as just downloading all the emails? Any email client should have the functionality built in. edit: seeing some reports they used "sophisticated" SQL injection... okay...I mean for a lay person it seems sophisticated, sure. But for anyone in the industry it's one of the oldest and easiest tricks in the book. I really suspect news sources are knowingly exaggerating about the sophistication of this "hack" in order to make up-play Russia's role and downplay the DNC's culpability.
  - cloakandswagger 10y ago
    You can read about the backdoors they used here: https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ https://www.crowdstrike.com/blog/bears-midst-intrusion-democ... The summary: One used Powershell modules and Windows Scheduler to run scripts. Another used a combination of Twitter and public sites like Github/Dropbox for command and control. In my opinion, neither is impressively sophisticated, and a skilled application developer could whip up something similar in a week or two. Using popular sites like Twitter/Dropbox for C&C has been common for years, and you can purchase similar backdoors/RATs for less than $100. edit: Another interesting point from the link above: the two exploits stole exactly the same info once inside the DNC network. This would obviously be a big no-no for a sophisticated state actor as it doubles your chance of being compromised, but the author explains it away by claiming that Russia's intelligence agencies are disorganized and adversarial.
    - cmdrfred 10y ago
      I have personally written that exact tool while learning Python. A RAT using Twitter for C & C. Uses PGP for encryption and verification. The twitter handles for the C & C change based on a hash of Googles lastest Doodle so you can access it without fear of account deletion. TIL I'm as good as a state level intelligence team. Hey CIA/NSA we know you are reading this, my contact info is in my profile. Hire me.
      - politician 10y ago
        Tomorrow: "Cyberhacker admits to Russian hacker tools" > Yesterday, an Internet cyber hacker using the alias "cmdrfred" claimed on "HackerNews", an elite underground hacker site, that he or she personally built the hacking tools used by Russia to breach the DNC email servers and change the outcome of the recent election. > "I have personally written that exact tool [it] uses ... encryption ... so you can access [the DNC] without fear." > "I'm as good as a state level intelligence team." > cmdrfred went on to taunt American intelligence agencies while admitting that he was aware that elite anti-cyberhacking teams from the NSA and CIA were monitoring his operations. > The owner of HackerNews Paul Graham -- venture capitalist, flamboyant playboy, and known Russian sympathizer -- could not be reached for comment.
      - jocro 10y ago
        > TIL I'm as good as a state level intelligence team. Not to totally ignore the pithiness, but I feel like your comment touches on something I see a ton here (and elsewhere): an offhand dismissal of the 'state level' intelligence capacity. At the end of the day, the systems were exploited. That more sophisticated methods went unused should be a measure of efficiency and not necessarily execution. Why break out the trick play if your opponent can't keep from you running it up the middle?
        avn2109 10y ago
        True. But the absence of sophistication constitutes evidence neither in favor nor against the "State Actor" hypothesis.
  - frozenport 10y ago
    RNC got hacked but nothing was leaked.
    - leesalminen 10y ago
      Source?
      - deleted 10y ago
        [deleted]
      - c4mden 10y ago
        “We now have high confidence that they hacked the D.N.C. and the R.N.C., and conspicuously released no documents” from the Republican organization, one senior administration official said, referring to the Russians. http://www.nytimes.com/2016/12/09/us/obama-russia-election-hack.html http://www.nytimes.com/2016/12/09/us/obama-russia-election-h...
        ericlavigne 10y ago
        The article is very unclear. Here's another quote in the same article that says the hacks against the RNC failed. The NY Times is basically telling us that they received conflicting reports from different anonymous and similarly credible sources. "One senior government official, who had been briefed on an F.B.I. investigation into the matter, said that while there were attempts to penetrate the Republican committee’s systems, they were not successful."
- ethbro 10y ago
  Exactly, why burn zero-days when you're targeting a technologically unsophisticated adversary with a huge organizational attack surface? Sure, HDD firmware hacks are cool, but in terms of R&D time far less efficient if you're willing to spam attempts to get in the front door. And I'd say they chose the appropriate level of sophistication given the success of the penetration. The DNC isn't exactly an air-gapped Iranian nuclear centrifuge.
  - CountSessine 10y ago
    Exactly, why burn zero-days when you're targeting a technologically unsophisticated adversary with a huge organizational attack surface? Then how is this evidence of a 'state-sponsored actor'? And how did the narrative of this story ever get derailed from what it should have been, which was, "The DNC, and John Podesta in particular who had both his gmail and his Twitter accounts hacked, are incompetent", to "this is Russian interference in a US election"?
    - smsm42 10y ago
      There are a lot of people who would benefit from the latter conclusion and not a lot of people who would benefit from the former.
      - xapata 10y ago
        > not a lot of people There are many Republicans.
        smsm42 10y ago
        Republicans as such don't have a lot of motivation to prove DNC incompetence by them being hacked, now that Republicans won the election - that would be much larger claim that DNC is less than competent than being hacked.
        xapata 10y ago
mynameisvinn124 10y ago
"Many breach announcements this year pointed to a “sophisticated attacker” as a narrative of their issue. This usually is followed up by criticism when an initial means of their compromise is revealed. Most breaches begin with spear phishing, commodity exploits, a leaked key, or some other obvious or preventable detail. However, this is almost never the “sophisticated” aspect of a breach worth talking about. It’s easy to point at an embarrassing vector and dismiss the rest of an attack. Thus, do not judge an adversary by the vector they’ve chosen. An adversary may show you what “sophistication” means after advancing from their beachhead." * https://medium.com/starting-up-security/learning-from-a-year-of-security-breaches-ed036ea05d9b#.e602eepey https://medium.com/starting-up-security/learning-from-a-year...
- cloakandswagger 10y ago
  Valid point, but I should clarify my original comment: I don't find either aspect of the attack--the entry or the payload--to be particularly sophisticated. Everything I've read indicates the bulk of work was done by Powershell scripts, along with a backdoor process running in the open. If you told me that the backdoor was a kernel level rootkit or something similar then I could get onboard, but as it stands I don't think the attack's complexity is a solid argument for "Russia did it"
  - codedokode 10y ago
    The main arguments might be not technical. The political emails are pretty boring stuff for an outsider so it should be some government or politician bothering to get them. I also remember that some gmail accounts of people from DNC staff were hacked. Gmail probably has logged what IP addresses were used when logging in with stolen passwords and they could be used as a hint too (though most probably they point to cheap VPS bought by some anonymous person or Tor node, I doubt anyone would use a stolen password from their real IP address).
    - unclepresent 10y ago
      nobody except complete amateurs is using its own computer to do hacking. there are thousands if not millions of compromized computers in aws cloud and similar hosting services that in turn work as robot-hackers to compromise other sites. it is like a self building hacking network where each cell works to infect other cells. so atack, if it was any atack (as document does not have any evidence that it was one) was unlikely be runnig from a real IP but from a random AWS instance registered by some junior software developer from India who bought it to deploy a pet project that was hacked without him even knowing this weeks ago before the event.
deleted 10y ago
[deleted]
EthanHeilman 10y ago
The report just didn't get into that much detail but they did say: "the code delivers Remote Access Tools (RATs) and evades detection using a range of techniques." A "range of techniques" includes things like rootkits. >No rootkits, The attackers did use stealthy persistence techniques often called 'rootkits". "the SeaDaddy implant developed in Python and compiled with py2exe and another Powershell backdoor with persistence accomplished via Windows Management Instrumentation (WMI) system,[..] The Powershell backdoor is ingenious in its simplicity and power" [0] >no 0 days The same group used six 0-days in 2015. Either they didn't need to use them in this attack or they used them and deleted the evidence. Senit is APT28 see quote below: "One of the striking characteristics of the Sednit group is its ability to come up with brand-new 0-day vulnerabilities regularly. In 2015, the group exploited no fewer than six 0-day vulnerabilities" [1] >yet it was the most routine, simple attack conceivable. The attack involved multiple pieces of custom written software and carefully researched spearfishing, the attackers spent time and effort to hide their tracks, maintain persistence and exfil data without detection. This level of effort and time does not qualify as routine, some intelligence agencies can't even write their own RATs. [0]: https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ https://www.crowdstrike.com/blog/bears-midst-intrusion-democ... [1]: http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part1.pdf http://www.welivesecurity.com/wp-content/uploads/2016/10/ese...
- smsm42 10y ago
  Can't one just buy a RAT? Also, the WMI think they describe doesn't look like rootkit, more like cron analogue for Windows. I.e. on Unix it would be like installing a command inside crontab. That's not what is usually called a rootkit - a tool that is designed to conceals its presence (and other tools presence) from regular OS tools.
  - EthanHeilman 10y ago
    You can buy RATs. The several RATs used in this campaign were never for sale. For example the RAT named X-Agent was one of several used in the DNC hack. It has never been put up for sale and it was used in previous Russian intelligence operations (for example tracking Ukraine artillery[0]). >That's not what is usually called a rootkit It doesn't appear that anyone has reverse engineered the PC version of X-Agent but the android variant (which may be very different from the one used in the DNC hack) does take some steps to hide itself. Granted nothing suggests anything like kernel syscall hooking but those sorts of rootkit techniques are overrated because they leave obvious and detectable patterns of compromise. [0]: https://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-update-ios-espionage-app-found/ https://blog.trendmicro.com/trendlabs-security-intelligence/...
smsm42 10y ago
Journalists routinely do that - underline that whatever malfeasance is done, the perpetrator is not a usual random criminal but especially heinous one and thus this story is worth your attention. With computer crime it's especially obvious because most journalists don't know enough to understand what's hard and what's not, so they take the word of law enforcement, and law enforcement has big motivation to make it sound as bad as possible, since it enhances their significance and their success for catching one. "I've caught a sophisticated hacker" sounds better than "I've found a 13-year old kid that sent someone an email saying 'give me your password' and the poor shmoe was silly enough to do just that". So there won't be a lot of reports about catching unsophisticated hackers. Usually it's always "highly sophisticated" ones. OTOH, I think the actual (claimed) proof was using of certain bit.ly account etc. not sophistication per se. Also, it looks like there were at least 3 attacks on the DNC, and phishing was only involved in one. Maybe the whitepapers talked about the other ones.
- Natsu 10y ago
  This is the spear phishing email that we have every reason to believe got Podesta that happened not long before the dump ends: https://wikileaks.org/podesta-emails/emailid/34899 https://wikileaks.org/podesta-emails/emailid/34899 This is the stats page for the bit.ly phishing link from that email showing two clicks in the right time frame: https://bitly.com/1PibSU0+ https://bitly.com/1PibSU0+ It's not rocket science to dump the emails out of a Gmail account: https://support.google.com/accounts/answer/3024190?hl=en https://support.google.com/accounts/answer/3024190?hl=en But the Podesta leaks aren't the same as the DNC leaks, which Wikileaks has long claimed came from an insider who was upset by their treatment of Bernie. It's also interesting to note that even if the DNC was hacked, that doesn't actually prove where the information given to Wikileaks came from. Given how careless they are in other regards, I have to think that any insider that wants it can get their data. Just read the PDF on this email to see how Colin Powell & Hillary Clinton treat OPSEC: https://wikileaks.org/clinton-emails/emailid/30324 https://wikileaks.org/clinton-emails/emailid/30324 "When I asked why not they gave me all kinds of nonsense about how they gave out signals that could be read by spies, etc. Same reason they tried to keep mobile phones out of the suite. I had numerous meetings with them. We even opened one up for them to try to explain to me why it was more dangerous than say, a remote control for one of the many tvs in the suite. Or something embedded in my shoe heel. They never satisfied me and NSA/CIA wouldn't back off. So, we just went about our business and stopped asking. I had an ancient version of a PDA and used it. In general, the suite was so sealed that it is hard to get signals in or out wirelessly." Also, the DNC has long been planning to reach for the Putin angle: "Best approach is to slaughter Donald for his bromance with Putin, but not go too far betting on Putin re Syria. Brent" https://wikileaks.org/podesta-emails/emailid/25651 https://wikileaks.org/podesta-emails/emailid/25651

heartbreak 10y ago

The sophistication cited by CrowdStrike was the actions taken on the DNC servers, not the initial penetration.

randyrand 10y ago
Could you elaborate? Once you have a password shouldn't it be as easy as just downloading all the emails? Any email client should have the functionality built in. edit: seeing some reports they used "sophisticated" SQL injection... okay...I mean for a lay person it seems sophisticated, sure. But for anyone in the industry it's one of the oldest and easiest tricks in the book. I really suspect news sources are knowingly exaggerating about the sophistication of this "hack" in order to make up-play Russia's role and downplay the DNC's culpability.
- cloakandswagger 10y ago
  You can read about the backdoors they used here: https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ https://www.crowdstrike.com/blog/bears-midst-intrusion-democ... The summary: One used Powershell modules and Windows Scheduler to run scripts. Another used a combination of Twitter and public sites like Github/Dropbox for command and control. In my opinion, neither is impressively sophisticated, and a skilled application developer could whip up something similar in a week or two. Using popular sites like Twitter/Dropbox for C&C has been common for years, and you can purchase similar backdoors/RATs for less than $100. edit: Another interesting point from the link above: the two exploits stole exactly the same info once inside the DNC network. This would obviously be a big no-no for a sophisticated state actor as it doubles your chance of being compromised, but the author explains it away by claiming that Russia's intelligence agencies are disorganized and adversarial.
  - cmdrfred 10y ago
    I have personally written that exact tool while learning Python. A RAT using Twitter for C & C. Uses PGP for encryption and verification. The twitter handles for the C & C change based on a hash of Googles lastest Doodle so you can access it without fear of account deletion. TIL I'm as good as a state level intelligence team. Hey CIA/NSA we know you are reading this, my contact info is in my profile. Hire me.
    - politician 10y ago
      Tomorrow: "Cyberhacker admits to Russian hacker tools" > Yesterday, an Internet cyber hacker using the alias "cmdrfred" claimed on "HackerNews", an elite underground hacker site, that he or she personally built the hacking tools used by Russia to breach the DNC email servers and change the outcome of the recent election. > "I have personally written that exact tool [it] uses ... encryption ... so you can access [the DNC] without fear." > "I'm as good as a state level intelligence team." > cmdrfred went on to taunt American intelligence agencies while admitting that he was aware that elite anti-cyberhacking teams from the NSA and CIA were monitoring his operations. > The owner of HackerNews Paul Graham -- venture capitalist, flamboyant playboy, and known Russian sympathizer -- could not be reached for comment.
    - jocro 10y ago
      > TIL I'm as good as a state level intelligence team. Not to totally ignore the pithiness, but I feel like your comment touches on something I see a ton here (and elsewhere): an offhand dismissal of the 'state level' intelligence capacity. At the end of the day, the systems were exploited. That more sophisticated methods went unused should be a measure of efficiency and not necessarily execution. Why break out the trick play if your opponent can't keep from you running it up the middle?
      - avn2109 10y ago
        True. But the absence of sophistication constitutes evidence neither in favor nor against the "State Actor" hypothesis.
- frozenport 10y ago
  RNC got hacked but nothing was leaked.
  - leesalminen 10y ago
    Source?
    - deleted 10y ago
      [deleted]
    - c4mden 10y ago
      “We now have high confidence that they hacked the D.N.C. and the R.N.C., and conspicuously released no documents” from the Republican organization, one senior administration official said, referring to the Russians. http://www.nytimes.com/2016/12/09/us/obama-russia-election-hack.html http://www.nytimes.com/2016/12/09/us/obama-russia-election-h...
      - ericlavigne 10y ago
        The article is very unclear. Here's another quote in the same article that says the hacks against the RNC failed. The NY Times is basically telling us that they received conflicting reports from different anonymous and similarly credible sources. "One senior government official, who had been briefed on an F.B.I. investigation into the matter, said that while there were attempts to penetrate the Republican committee’s systems, they were not successful."
ethbro 10y ago
Exactly, why burn zero-days when you're targeting a technologically unsophisticated adversary with a huge organizational attack surface? Sure, HDD firmware hacks are cool, but in terms of R&D time far less efficient if you're willing to spam attempts to get in the front door. And I'd say they chose the appropriate level of sophistication given the success of the penetration. The DNC isn't exactly an air-gapped Iranian nuclear centrifuge.
- CountSessine 10y ago
  Exactly, why burn zero-days when you're targeting a technologically unsophisticated adversary with a huge organizational attack surface? Then how is this evidence of a 'state-sponsored actor'? And how did the narrative of this story ever get derailed from what it should have been, which was, "The DNC, and John Podesta in particular who had both his gmail and his Twitter accounts hacked, are incompetent", to "this is Russian interference in a US election"?
  - smsm42 10y ago
    There are a lot of people who would benefit from the latter conclusion and not a lot of people who would benefit from the former.
    - xapata 10y ago
      > not a lot of people There are many Republicans.
      - smsm42 10y ago
        Republicans as such don't have a lot of motivation to prove DNC incompetence by them being hacked, now that Republicans won the election - that would be much larger claim that DNC is less than competent than being hacked.
        xapata 10y ago

mynameisvinn124 10y ago

"Many breach announcements this year pointed to a “sophisticated attacker” as a narrative of their issue. This usually is followed up by criticism when an initial means of their compromise is revealed. Most breaches begin with spear phishing, commodity exploits, a leaked key, or some other obvious or preventable detail. However, this is almost never the “sophisticated” aspect of a breach worth talking about. It’s easy to point at an embarrassing vector and dismiss the rest of an attack. Thus, do not judge an adversary by the vector they’ve chosen. An adversary may show you what “sophistication” means after advancing from their beachhead." * https://medium.com/starting-up-security/learning-from-a-year-of-security-breaches-ed036ea05d9b#.e602eepey https://medium.com/starting-up-security/learning-from-a-year...

cloakandswagger 10y ago
Valid point, but I should clarify my original comment: I don't find either aspect of the attack--the entry or the payload--to be particularly sophisticated. Everything I've read indicates the bulk of work was done by Powershell scripts, along with a backdoor process running in the open. If you told me that the backdoor was a kernel level rootkit or something similar then I could get onboard, but as it stands I don't think the attack's complexity is a solid argument for "Russia did it"
- codedokode 10y ago
  The main arguments might be not technical. The political emails are pretty boring stuff for an outsider so it should be some government or politician bothering to get them. I also remember that some gmail accounts of people from DNC staff were hacked. Gmail probably has logged what IP addresses were used when logging in with stolen passwords and they could be used as a hint too (though most probably they point to cheap VPS bought by some anonymous person or Tor node, I doubt anyone would use a stolen password from their real IP address).
  - unclepresent 10y ago
    nobody except complete amateurs is using its own computer to do hacking. there are thousands if not millions of compromized computers in aws cloud and similar hosting services that in turn work as robot-hackers to compromise other sites. it is like a self building hacking network where each cell works to infect other cells. so atack, if it was any atack (as document does not have any evidence that it was one) was unlikely be runnig from a real IP but from a random AWS instance registered by some junior software developer from India who bought it to deploy a pet project that was hacked without him even knowing this weeks ago before the event.

deleted 10y ago

[deleted]

EthanHeilman 10y ago

The report just didn't get into that much detail but they did say: "the code delivers Remote Access Tools (RATs) and evades detection using a range of techniques." A "range of techniques" includes things like rootkits. >No rootkits, The attackers did use stealthy persistence techniques often called 'rootkits". "the SeaDaddy implant developed in Python and compiled with py2exe and another Powershell backdoor with persistence accomplished via Windows Management Instrumentation (WMI) system,[..] The Powershell backdoor is ingenious in its simplicity and power" [0] >no 0 days The same group used six 0-days in 2015. Either they didn't need to use them in this attack or they used them and deleted the evidence. Senit is APT28 see quote below: "One of the striking characteristics of the Sednit group is its ability to come up with brand-new 0-day vulnerabilities regularly. In 2015, the group exploited no fewer than six 0-day vulnerabilities" [1] >yet it was the most routine, simple attack conceivable. The attack involved multiple pieces of custom written software and carefully researched spearfishing, the attackers spent time and effort to hide their tracks, maintain persistence and exfil data without detection. This level of effort and time does not qualify as routine, some intelligence agencies can't even write their own RATs. [0]: https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ https://www.crowdstrike.com/blog/bears-midst-intrusion-democ... [1]: http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part1.pdf http://www.welivesecurity.com/wp-content/uploads/2016/10/ese...

smsm42 10y ago
Can't one just buy a RAT? Also, the WMI think they describe doesn't look like rootkit, more like cron analogue for Windows. I.e. on Unix it would be like installing a command inside crontab. That's not what is usually called a rootkit - a tool that is designed to conceals its presence (and other tools presence) from regular OS tools.
- EthanHeilman 10y ago
  You can buy RATs. The several RATs used in this campaign were never for sale. For example the RAT named X-Agent was one of several used in the DNC hack. It has never been put up for sale and it was used in previous Russian intelligence operations (for example tracking Ukraine artillery[0]). >That's not what is usually called a rootkit It doesn't appear that anyone has reverse engineered the PC version of X-Agent but the android variant (which may be very different from the one used in the DNC hack) does take some steps to hide itself. Granted nothing suggests anything like kernel syscall hooking but those sorts of rootkit techniques are overrated because they leave obvious and detectable patterns of compromise. [0]: https://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-update-ios-espionage-app-found/ https://blog.trendmicro.com/trendlabs-security-intelligence/...

smsm42 10y ago

Journalists routinely do that - underline that whatever malfeasance is done, the perpetrator is not a usual random criminal but especially heinous one and thus this story is worth your attention. With computer crime it's especially obvious because most journalists don't know enough to understand what's hard and what's not, so they take the word of law enforcement, and law enforcement has big motivation to make it sound as bad as possible, since it enhances their significance and their success for catching one. "I've caught a sophisticated hacker" sounds better than "I've found a 13-year old kid that sent someone an email saying 'give me your password' and the poor shmoe was silly enough to do just that". So there won't be a lot of reports about catching unsophisticated hackers. Usually it's always "highly sophisticated" ones. OTOH, I think the actual (claimed) proof was using of certain bit.ly account etc. not sophistication per se. Also, it looks like there were at least 3 attacks on the DNC, and phishing was only involved in one. Maybe the whitepapers talked about the other ones.

Natsu 10y ago
This is the spear phishing email that we have every reason to believe got Podesta that happened not long before the dump ends: https://wikileaks.org/podesta-emails/emailid/34899 https://wikileaks.org/podesta-emails/emailid/34899 This is the stats page for the bit.ly phishing link from that email showing two clicks in the right time frame: https://bitly.com/1PibSU0+ https://bitly.com/1PibSU0+ It's not rocket science to dump the emails out of a Gmail account: https://support.google.com/accounts/answer/3024190?hl=en https://support.google.com/accounts/answer/3024190?hl=en But the Podesta leaks aren't the same as the DNC leaks, which Wikileaks has long claimed came from an insider who was upset by their treatment of Bernie. It's also interesting to note that even if the DNC was hacked, that doesn't actually prove where the information given to Wikileaks came from. Given how careless they are in other regards, I have to think that any insider that wants it can get their data. Just read the PDF on this email to see how Colin Powell & Hillary Clinton treat OPSEC: https://wikileaks.org/clinton-emails/emailid/30324 https://wikileaks.org/clinton-emails/emailid/30324 "When I asked why not they gave me all kinds of nonsense about how they gave out signals that could be read by spies, etc. Same reason they tried to keep mobile phones out of the suite. I had numerous meetings with them. We even opened one up for them to try to explain to me why it was more dangerous than say, a remote control for one of the many tvs in the suite. Or something embedded in my shoe heel. They never satisfied me and NSA/CIA wouldn't back off. So, we just went about our business and stopped asking. I had an ancient version of a PDA and used it. In general, the suite was so sealed that it is hard to get signals in or out wirelessly." Also, the DNC has long been planning to reach for the Putin angle: "Best approach is to slaughter Donald for his bromance with Putin, but not go too far betting on Putin re Syria. Brent" https://wikileaks.org/podesta-emails/emailid/25651 https://wikileaks.org/podesta-emails/emailid/25651