4 ms·

That looks interesting. However I think evidence would be something actually linking the hacks with that group. The group was accused, but no evidence was pres

That looks interesting. However I think evidence would be something actually linking the hacks with that group. The group was accused, but no evidence was presented linking it, just speculation.

nl 10y ago
I don't think there is any serious doubt that ATP28 was the group that did the hack (Bad assumption on my part in this case - most of the time people have accepted that but have doubts about it being a state actor). I think CrowdStrike was the first firm to attribute it to them[1]. Note that APT28 is also known as "Fancy Bear", so you may see some reports attributing it with that name. Nothing forcing you to believe it of course, but in the world of cyber attribution this is pretty decent evidence. [1] https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ https://www.crowdstrike.com/blog/bears-midst-intrusion-democ...
- cmdrfred 10y ago
  That crowdstrike article reads like an advertisement I'd prefer something more authoritative before flirting with war with a nuclear power. I think the real question is, why is a Russian military unit so hapless they can be caught by a firm like this? Doesn't that sort of undermine the claim that they are a major threat and instead make the DNC look like helpless idiots tricked by Russian teenagers?
  - nl 10y ago
    Yes, the DNC were helpless idiots. But a proper forensic investigation will almost always find out how an intruder got in. That doesn't make the intruder any less competent.
    - cmdrfred 10y ago
      I understand it will reveal the method of entry, but a smart criminal won't leave his drivers license at the scene of the crime as the "Russians" have seemingly done here.
      - nl 10y ago
        Well the "method of entry" is what was used to identify them, and they had to leave it there so they could re-access the system. There isn't much unusual about this - a similar thing happened with the Shadow Brokers/Equation Group (NSA) hack for example[1] (although in that case some of the control tools were taken instead of just the payload). It would be exceptionally unusual for nothing to be found. [1] https://securelist.com/blog/incidents/75812/the-equation-giveaway/ https://securelist.com/blog/incidents/75812/the-equation-giv...
- stefantalpalaru 10y ago
  > I don't think there is any serious doubt that ATP28 was the group that did the hack If you have "showdead" set to "yes", this is your lucky day: https://medium.com/@jeffreycarr https://medium.com/@jeffreycarr https://theintercept.com/2016/11/01/heres-the-problem-with-the-story-connecting-russia-to-donald-trumps-email-server/ https://theintercept.com/2016/11/01/heres-the-problem-with-t... https://theintercept.com/2017/01/06/underwhelming-intel-report-shows-need-for-congressional-investigation-of-dnc-hack/ https://theintercept.com/2017/01/06/underwhelming-intel-repo... https://theintercept.com/2016/12/10/anonymous-leaks-to-the-washpost-about-the-cias-russia-beliefs-are-no-substitute-for-evidence/ https://theintercept.com/2016/12/10/anonymous-leaks-to-the-w... http://www.commondreams.org/author/veteran-intelligence-professionals-sanity http://www.commondreams.org/author/veteran-intelligence-prof...

That looks interesting. However I think evidence would be something actually linking the hacks with that group. The group was accused, but no evidence was presented linking it, just speculation.

nl 10y ago

I don't think there is any serious doubt that ATP28 was the group that did the hack (Bad assumption on my part in this case - most of the time people have accepted that but have doubts about it being a state actor). I think CrowdStrike was the first firm to attribute it to them[1]. Note that APT28 is also known as "Fancy Bear", so you may see some reports attributing it with that name. Nothing forcing you to believe it of course, but in the world of cyber attribution this is pretty decent evidence. [1] https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ https://www.crowdstrike.com/blog/bears-midst-intrusion-democ...

cmdrfred 10y ago
That crowdstrike article reads like an advertisement I'd prefer something more authoritative before flirting with war with a nuclear power. I think the real question is, why is a Russian military unit so hapless they can be caught by a firm like this? Doesn't that sort of undermine the claim that they are a major threat and instead make the DNC look like helpless idiots tricked by Russian teenagers?
- nl 10y ago
  Yes, the DNC were helpless idiots. But a proper forensic investigation will almost always find out how an intruder got in. That doesn't make the intruder any less competent.
  - cmdrfred 10y ago
    I understand it will reveal the method of entry, but a smart criminal won't leave his drivers license at the scene of the crime as the "Russians" have seemingly done here.
    - nl 10y ago
      Well the "method of entry" is what was used to identify them, and they had to leave it there so they could re-access the system. There isn't much unusual about this - a similar thing happened with the Shadow Brokers/Equation Group (NSA) hack for example[1] (although in that case some of the control tools were taken instead of just the payload). It would be exceptionally unusual for nothing to be found. [1] https://securelist.com/blog/incidents/75812/the-equation-giveaway/ https://securelist.com/blog/incidents/75812/the-equation-giv...
stefantalpalaru 10y ago
> I don't think there is any serious doubt that ATP28 was the group that did the hack If you have "showdead" set to "yes", this is your lucky day: https://medium.com/@jeffreycarr https://medium.com/@jeffreycarr https://theintercept.com/2016/11/01/heres-the-problem-with-the-story-connecting-russia-to-donald-trumps-email-server/ https://theintercept.com/2016/11/01/heres-the-problem-with-t... https://theintercept.com/2017/01/06/underwhelming-intel-report-shows-need-for-congressional-investigation-of-dnc-hack/ https://theintercept.com/2017/01/06/underwhelming-intel-repo... https://theintercept.com/2016/12/10/anonymous-leaks-to-the-washpost-about-the-cias-russia-beliefs-are-no-substitute-for-evidence/ https://theintercept.com/2016/12/10/anonymous-leaks-to-the-w... http://www.commondreams.org/author/veteran-intelligence-professionals-sanity http://www.commondreams.org/author/veteran-intelligence-prof...