11 ms·

The conclusions are of particular note: "The IP addresses that DHS provided may have been used for an attack by a state actor like Russia. But they don’t appea

The conclusions are of particular note: "The IP addresses that DHS provided may have been used for an attack by a state actor like Russia. But they don’t appear to provide any association with Russia. They are probably used by a wide range of other malicious actors, especially the 15% of IP addresses that are Tor exit nodes. The malware sample is old, widely used and appears to be Ukrainian. It has no apparent relationship with Russian intelligence and it would be an indicator of compromise for any website."

gtirloni 10y ago
That's the conclusion anyone working in the security/network area was bound to arrive at. It's really interesting FBI/DHS would make those claims publicly when the chance of having any hard evidence of that would be minimal. But they still did it. Why?
- Gustomaximus 10y ago
  To me the ongoing 'Russia rigged elections' smells like propaganda from the other side. And maybe russia did release the DNC emails, but Assange said that wasn't the case and I feel he's more likely to be telling the truth than state players. And even if they did release these emails it's hardly rigging an election. Comneys email announcement at the 11th hour about reopening email investigation was probably a deciding variable and that was hardly Russian lead. Your question of 'why' seems to be the scariest. US lead activities have been encircling Russia and pressing influence right to their borders for some time. For me I feel its too far and they are cornering the bear. Probably there is too much resource in the 'spy' world and they have to do something to justify their position, hence the older generation keep the pressure on Russia from their cold war agenda or they are looking to pick a fight. The latter being very scary. ...but really I'm no expert and just wonder why countries can put more effort to looking after their own populations needs. All this spy/military expenditure seems so wasteful.
  - threeseed 10y ago
    Nobody said Russia rigged the election. The issue was the attempts to influence the election which Russia has a long, documented history of doing so. And the US had an obligation to respond which they did with minimal effect. So claiming all of this was about propaganda really makes no sense given the facts on the ground. And please remember why Russia's relations with almost all of the world deteriorated in the first place. It's because they annexed Crimea (unprecedented for our generation) and allowed soldiers and weapons to flood into Ukraine which then resulted in Flight 117 being shot down. Nobody is looking for a fight with Russia but capitulating and doing nothing is not an answer either. Diplomatic sanctions have been the correct response and I don't see anyone asking for an escalation of that.
    - Natsu 10y ago
      > Nobody said Russia rigged the election. Nobody sensible said that, but I've seen more than a few comments along those lines on various sites, enough to believe that general sentiment is commonplace. As for Comey, I'd say he let her off easy. Take a look at this: https://www.youtube.com/watch?v=bC1Mc6-RDyQ https://www.youtube.com/watch?v=bC1Mc6-RDyQ Then look at the PDF attached here of an email between Colin Powell and Hillary Clinton and ask whether this looks intentional or not: https://wikileaks.org/clinton-emails/emailid/30324 https://wikileaks.org/clinton-emails/emailid/30324
      - lern_too_spel 10y ago
        How did Comey let her off easy if she didn't break any laws?
        Natsu 10y ago
        Comey claimed not to have charged Clinton because there was a lack of intent. Gowdy is calling him on that, saying that this makes zero sense and going over all the ways they have to prove intent. His point at the end about "negligence" underscores the fact that the entire line of reasoning is nonsensical: intentional negligence is a contradiction in terms. That which is intentional cannot be negligent and vice versa. The law in question is against negligence (which does not require any intent whatsoever). Just to underscore that, I just linked to a document where Colin Powell describes in detail how they're subverting the law: https://wikileaks.org/clinton-emails/emailid/30324 https://wikileaks.org/clinton-emails/emailid/30324 "However, there is a real danger. If it is public that you have a BlackBerry and it [is] government and you are using it, government or not, to do business, it may become an official record and be subject to the law. Reading about the President's BB rules this morning, it sounds like it won't be as useful as it used to be. Be very careful. I got around it all by not saying much and not using systems that captured the data." I don't think it's reasonable to let our politicians get away with this. Inasmuch as people are worried about Russian influence, it seems strange to me that there's no worry about the very leaders to jeopardize our OPSEC with their hubris. Here is Colin Powell, again, saying things that should make HN readers cringe: "Now, the real issue had to do with PDAs, as we called them a few years ago before BlackBerry became a noun. And the issue was DS would not allow them into the secure spaces, especially up your way. When I asked why not they gave me all kinds of nonsense about how they gave out signals that could be read by spies, etc. Same reason they tried to keep mobile phones out of the suite. I had numerous meetings with them. We even opened one up for them to try to explain to me why it was more dangerous than say, a remote control for one of the many tvs in the suite. Or something embedded in my shoe heel. They never satisfied me and NSA/CIA wouldn't back off. So, we just went about our business and stopped asking. I had an ancient version of a PDA and used it. In general, the suite was so sealed that it is hard to get signals in or out wirelessly." If the law is so toothless that high ranking people of either party (Powell is a Republican) can deliberately subvert them, then we're always going to be at the mercy of every country with half-decent spies. This is a problem in its own right, independent from whatever partisan considerations we have here. === Note: The square brackets in the quote are me fixing typos in the original.
- threeseed 10y ago
  a) Anyone who thinks this document is the sole source of evidence is deluding themselves. The intelligence agencies are not going to document their capabilities to the world. Which I am sure would include compromised Tor nodes and DPI (including SSL/encrypted traffic) across many of the key sites/switches/cables. b) It has been claimed that this document is more a guide for other companies and government agencies about the type of techniques that Russia allegedly used. General education about security is still pretty low and the US government et al are going to need to more in this area.
  - Natsu 10y ago
    The problem with a line of reasoning that includes secret evidence we'll never get to see is that it can be used to support any conclusion whatsoever. Inasmuch as it's a guide for other agencies, they'd be better served by OWASP recommendations. It's not clear what anyone could do with a report like this. I don't see any great takeaways that one could add to the next revision of their STIG. There are no 0-days for an IAVA. As long as we're going for pure speculation, I think that Kim Dotcom hired Ukranian hackers and I could potentially find weak circumstantial evidence by going through a timeline of his Tweets. I seem to remember that he had foreknowledge of some of the items to be leaked, though that could've been pure BS and I didn't really investigate it at the time. He also has motive based on this administration's treatment of him. EDIT: Found it - https://www.bloomberg.com/politics/articles/2015-05-14/kim-dotcom-julian-assange-will-be-hillary-clinton-s-worst-nightmare-in-2016 https://www.bloomberg.com/politics/articles/2015-05-14/kim-d...
    - Toe-Rag 10y ago
      Interesting theory about Dotcom. He knew something. I also think that Wikileaks has more material than they released and that Dotcom knows it. His tweets during October suggest that he was expecting something more to drop. It could have been BS, as you say, but I think he knew something.
- gozur88 10y ago
  >It's really interesting FBI/DHS would make those claims publicly when the chance of having any hard evidence of that would be minimal. But they still did it. Why? Occam's razor says it's what the DNC wanted them to say. Politically it's a lot easier cop to being penetrated by a state actor than a group like Anonymous, and it allows the Democrats to deflect the conversation from the content of the emails. Well, to make the attempt, anyway. I'll be curious to see what Trump does with this once he takes office. If there's no compelling evidence of Russian state involvement I suspect he'll direct the relevant agencies to release everything. If he doesn't do that it's going to be difficult for him to cast doubt on the Russian angle.
  - grzm 10y ago
    the DNC Just an observation: I don't recall until very recently the DNC or the RNC to refer to the parties, as opposed to the Democratic Party or Republican Party. I wonder why the shift? The focus on the Podesta/DNC emails? Makes sense during the election, and now it seems to have transferred over to referring to the party as part of the government (e.g., in reference to the FBI or DHS). Last time I remember the DNC being mentioned so much by name was during the Bill Clinton campaigns, in contrast to the Democratic Leadership Council. My memory can be faulty and selective, so I'm wondering if anyone else has noticed this as well. (Anyone else remember Sinbad in Shazam?)
    - nickff 10y ago
      I think people are using 'DNC' and 'RNC' to make it clear that they are referring to the party leadership, not rank-and-file members.
jaclaz 10y ago
Before "those" conclusions, I find of most interest the previous "Malware Conclusions": "The PHP malware sample they have provided appears to be P.A.S. version 3.1.0 which is commonly available and the website that claims to have authored it says they are Ukrainian. It is also several versions behind the most current version of P.A.S which is 4.1.1b. One might reasonably expect Russian intelligence operatives to develop their own tools or at least use current malicious tools from outside sources." The last sentence is IMHO even stronger.

gtirloni 10y ago

That's the conclusion anyone working in the security/network area was bound to arrive at. It's really interesting FBI/DHS would make those claims publicly when the chance of having any hard evidence of that would be minimal. But they still did it. Why?

Gustomaximus 10y ago
To me the ongoing 'Russia rigged elections' smells like propaganda from the other side. And maybe russia did release the DNC emails, but Assange said that wasn't the case and I feel he's more likely to be telling the truth than state players. And even if they did release these emails it's hardly rigging an election. Comneys email announcement at the 11th hour about reopening email investigation was probably a deciding variable and that was hardly Russian lead. Your question of 'why' seems to be the scariest. US lead activities have been encircling Russia and pressing influence right to their borders for some time. For me I feel its too far and they are cornering the bear. Probably there is too much resource in the 'spy' world and they have to do something to justify their position, hence the older generation keep the pressure on Russia from their cold war agenda or they are looking to pick a fight. The latter being very scary. ...but really I'm no expert and just wonder why countries can put more effort to looking after their own populations needs. All this spy/military expenditure seems so wasteful.
- threeseed 10y ago
  Nobody said Russia rigged the election. The issue was the attempts to influence the election which Russia has a long, documented history of doing so. And the US had an obligation to respond which they did with minimal effect. So claiming all of this was about propaganda really makes no sense given the facts on the ground. And please remember why Russia's relations with almost all of the world deteriorated in the first place. It's because they annexed Crimea (unprecedented for our generation) and allowed soldiers and weapons to flood into Ukraine which then resulted in Flight 117 being shot down. Nobody is looking for a fight with Russia but capitulating and doing nothing is not an answer either. Diplomatic sanctions have been the correct response and I don't see anyone asking for an escalation of that.
  - Natsu 10y ago
    > Nobody said Russia rigged the election. Nobody sensible said that, but I've seen more than a few comments along those lines on various sites, enough to believe that general sentiment is commonplace. As for Comey, I'd say he let her off easy. Take a look at this: https://www.youtube.com/watch?v=bC1Mc6-RDyQ https://www.youtube.com/watch?v=bC1Mc6-RDyQ Then look at the PDF attached here of an email between Colin Powell and Hillary Clinton and ask whether this looks intentional or not: https://wikileaks.org/clinton-emails/emailid/30324 https://wikileaks.org/clinton-emails/emailid/30324
    - lern_too_spel 10y ago
      How did Comey let her off easy if she didn't break any laws?
      - Natsu 10y ago
        Comey claimed not to have charged Clinton because there was a lack of intent. Gowdy is calling him on that, saying that this makes zero sense and going over all the ways they have to prove intent. His point at the end about "negligence" underscores the fact that the entire line of reasoning is nonsensical: intentional negligence is a contradiction in terms. That which is intentional cannot be negligent and vice versa. The law in question is against negligence (which does not require any intent whatsoever). Just to underscore that, I just linked to a document where Colin Powell describes in detail how they're subverting the law: https://wikileaks.org/clinton-emails/emailid/30324 https://wikileaks.org/clinton-emails/emailid/30324 "However, there is a real danger. If it is public that you have a BlackBerry and it [is] government and you are using it, government or not, to do business, it may become an official record and be subject to the law. Reading about the President's BB rules this morning, it sounds like it won't be as useful as it used to be. Be very careful. I got around it all by not saying much and not using systems that captured the data." I don't think it's reasonable to let our politicians get away with this. Inasmuch as people are worried about Russian influence, it seems strange to me that there's no worry about the very leaders to jeopardize our OPSEC with their hubris. Here is Colin Powell, again, saying things that should make HN readers cringe: "Now, the real issue had to do with PDAs, as we called them a few years ago before BlackBerry became a noun. And the issue was DS would not allow them into the secure spaces, especially up your way. When I asked why not they gave me all kinds of nonsense about how they gave out signals that could be read by spies, etc. Same reason they tried to keep mobile phones out of the suite. I had numerous meetings with them. We even opened one up for them to try to explain to me why it was more dangerous than say, a remote control for one of the many tvs in the suite. Or something embedded in my shoe heel. They never satisfied me and NSA/CIA wouldn't back off. So, we just went about our business and stopped asking. I had an ancient version of a PDA and used it. In general, the suite was so sealed that it is hard to get signals in or out wirelessly." If the law is so toothless that high ranking people of either party (Powell is a Republican) can deliberately subvert them, then we're always going to be at the mercy of every country with half-decent spies. This is a problem in its own right, independent from whatever partisan considerations we have here. === Note: The square brackets in the quote are me fixing typos in the original.
threeseed 10y ago
a) Anyone who thinks this document is the sole source of evidence is deluding themselves. The intelligence agencies are not going to document their capabilities to the world. Which I am sure would include compromised Tor nodes and DPI (including SSL/encrypted traffic) across many of the key sites/switches/cables. b) It has been claimed that this document is more a guide for other companies and government agencies about the type of techniques that Russia allegedly used. General education about security is still pretty low and the US government et al are going to need to more in this area.
- Natsu 10y ago
  The problem with a line of reasoning that includes secret evidence we'll never get to see is that it can be used to support any conclusion whatsoever. Inasmuch as it's a guide for other agencies, they'd be better served by OWASP recommendations. It's not clear what anyone could do with a report like this. I don't see any great takeaways that one could add to the next revision of their STIG. There are no 0-days for an IAVA. As long as we're going for pure speculation, I think that Kim Dotcom hired Ukranian hackers and I could potentially find weak circumstantial evidence by going through a timeline of his Tweets. I seem to remember that he had foreknowledge of some of the items to be leaked, though that could've been pure BS and I didn't really investigate it at the time. He also has motive based on this administration's treatment of him. EDIT: Found it - https://www.bloomberg.com/politics/articles/2015-05-14/kim-dotcom-julian-assange-will-be-hillary-clinton-s-worst-nightmare-in-2016 https://www.bloomberg.com/politics/articles/2015-05-14/kim-d...
  - Toe-Rag 10y ago
    Interesting theory about Dotcom. He knew something. I also think that Wikileaks has more material than they released and that Dotcom knows it. His tweets during October suggest that he was expecting something more to drop. It could have been BS, as you say, but I think he knew something.
gozur88 10y ago
>It's really interesting FBI/DHS would make those claims publicly when the chance of having any hard evidence of that would be minimal. But they still did it. Why? Occam's razor says it's what the DNC wanted them to say. Politically it's a lot easier cop to being penetrated by a state actor than a group like Anonymous, and it allows the Democrats to deflect the conversation from the content of the emails. Well, to make the attempt, anyway. I'll be curious to see what Trump does with this once he takes office. If there's no compelling evidence of Russian state involvement I suspect he'll direct the relevant agencies to release everything. If he doesn't do that it's going to be difficult for him to cast doubt on the Russian angle.
- grzm 10y ago
  the DNC Just an observation: I don't recall until very recently the DNC or the RNC to refer to the parties, as opposed to the Democratic Party or Republican Party. I wonder why the shift? The focus on the Podesta/DNC emails? Makes sense during the election, and now it seems to have transferred over to referring to the party as part of the government (e.g., in reference to the FBI or DHS). Last time I remember the DNC being mentioned so much by name was during the Bill Clinton campaigns, in contrast to the Democratic Leadership Council. My memory can be faulty and selective, so I'm wondering if anyone else has noticed this as well. (Anyone else remember Sinbad in Shazam?)
  - nickff 10y ago
    I think people are using 'DNC' and 'RNC' to make it clear that they are referring to the party leadership, not rank-and-file members.

jaclaz 10y ago

Before "those" conclusions, I find of most interest the previous "Malware Conclusions": "The PHP malware sample they have provided appears to be P.A.S. version 3.1.0 which is commonly available and the website that claims to have authored it says they are Ukrainian. It is also several versions behind the most current version of P.A.S which is 4.1.1b. One might reasonably expect Russian intelligence operatives to develop their own tools or at least use current malicious tools from outside sources." The last sentence is IMHO even stronger.