4 ms·

I have seen this and also the criticisms of it. I am not understanding what exactly is the definitive proof here, can you help me understand? To be fair, the c

by mowenz 9y ago

I have seen this and also the criticisms of it. I am not understanding what exactly is the definitive proof here, can you help me understand? To be fair, the criticisms were that they were hired by the DNC after the DNC dragged their feet on giving the FBI access. For some reason they gave this firm the right of way. The original report has also since been revised and had portions retracted... So it wasn't a gold standard of evidence to begin with. To be fair there are many respectable people (who are strongly anti-Trump) questioning this[1]. 1-https://theintercept.com/2016/12/14/heres-the-public-evidence-russia-hacked-the-dnc-its-not-enough/ https://theintercept.com/2016/12/14/heres-the-public-evidenc...

ryanlol 9y ago
>I am not understanding what exactly is the definitive proof here, can you help me understand? There's no definitive proof, there's evidence. This is as definitive as it gets, we've got a report by some of the best people in the field that's also been corroborated by the US DHS. I'm sure this is far better evidence than anything that exists to the contrary, people get convicted on shakier grounds every day. It is not disputable that DNC servers were infected by Russian government malware.
- mowenz 9y ago
  Why is it definitive? Are you able to help me understand that? Was the initial report they retracted more or less definitive? Remember the Iraq War was also started with lies corroborated by the US Gvt and the courts did not pose an obstacle to it... I dont care if men eith epilletes tell me so. I want to see the proof.
  - ryanlol 9y ago
    >Was the initial report they retracted more or less definitive? At this point you're just trolling. >The company removed language that said Ukraine's artillery lost 80 percent of the Soviet-era D-30 howitzers, which used aiming software that purportedly was hacked. Instead, the revised report cites figures of 15 to 20 percent losses in combat operations, attributing the figures to IISS.
    - mowenz 9y ago
      Hey, hey now, I am kindly asking a reasonable question, and I and others are raising reasonable concerns and now you started to slinging mud. Do you actually have any technical facts to substantiate your "as definitive as it gets" statement? Because slinging mud makes you look unreasonable in my eyes and I'd like to know what facts stand behind your argument.
- micheljones 9y ago
  > It is not disputable that DNC servers were infected by Russian government malware. Because the signatures of 'Russian government malware' were found? Same signatures we recently found CIA can (and does) easily fake?
  - openasocket 9y ago
    Did we? Care to cite a source? I'd be very surprised if anyone can fake IOCs and signatures well enough to fool an analyst.
- shard972 9y ago
  > There's no definitive proof, there's evidence. This is as definitive as it gets, we've got a report by some of the best people in the field that's also been corroborated by the US DHS. Last time I checked the DHS hasn't seen the server yet.
trowway21 9y ago
The FBI has still not been given access to the server... Comey just testified to that fact last week. They were stonewalled. They went to crowdstrike instead, eventually, who retracted the the only actual evidence which supported their claims just recently. Crowdstrike retracted upon the internet discovering the relevant dns records were most likely spoofed. Dare you to not refuse to read through this.... https://weaponizedautism.wordpress.com/2017/04/09/trump-dns-logs-fabricated/ https://weaponizedautism.wordpress.com/2017/04/09/trump-dns-...
micheljones 9y ago
Crowdstrike has been wrong before and has some sketchy connections that are summed up nicely in the article here: http://archive.is/CogZx http://archive.is/CogZx The founder of Crowdstrike, Dimitri Alperovitch is a Senior fellow at the Atlantic Council. The Atlantic Council is funded by a guy named Victor Pinchuk who is a Ukrainian (and dislikes Russia), and he donated $25 million to the Clinton Foundation. (story found here: http://archive.is/DUtMN http://archive.is/DUtMN ). Furthermore (read the first link) the DHS report about the DNC hack given after a FOIA request amounted to TWO PAGES with information anyone could have googled from the internet. If you just look at the wikipedia for the Atlantic Council ( https://en.wikipedia.org/wiki/Atlantic_Council https://en.wikipedia.org/wiki/Atlantic_Council ) it states several members have left the organization to work for the Obama Administration including Susan Rice. Susan Rice as you all know illegally unmasked members of the Trump campaign to hinder his presidency. Finally I believe this article is very important: http://archive.is/DUtMN http://archive.is/DUtMN it shows the cozy relationship Victor Pinchuk had with the Clinton state department.
openasocket 9y ago
That criticism is really lacking. The biggest evidence is that it was an X-agent variant that used a known APT 28 IP address as its C2. The author's argument about APT groups wanting to switch IP addresses around as quickly as possible doesn't make sense. If you're using an IP-address-based C2 you want to hold onto it for as long as possible, because the second you give it up you lose the ability to control all your malware. Reusing infrastructure is very common, and is not at all a sign "sloppiness" as the author claims. APT groups generally don't care if you can correlate their different attacks, because it doesn't actually affect them. And having a complete separation of all your infrastructure for every attack is time consuming and has a serious burden of effort that limits the pace at which you can attack, all for very little gain. Infrastructure gets reused all the damn time, as does malware, and even certificates. Source: I'm a member of the security research community.

by mowenz 9y ago

ryanlol 9y ago

>I am not understanding what exactly is the definitive proof here, can you help me understand? There's no definitive proof, there's evidence. This is as definitive as it gets, we've got a report by some of the best people in the field that's also been corroborated by the US DHS. I'm sure this is far better evidence than anything that exists to the contrary, people get convicted on shakier grounds every day. It is not disputable that DNC servers were infected by Russian government malware.

mowenz 9y ago
Why is it definitive? Are you able to help me understand that? Was the initial report they retracted more or less definitive? Remember the Iraq War was also started with lies corroborated by the US Gvt and the courts did not pose an obstacle to it... I dont care if men eith epilletes tell me so. I want to see the proof.
- ryanlol 9y ago
  >Was the initial report they retracted more or less definitive? At this point you're just trolling. >The company removed language that said Ukraine's artillery lost 80 percent of the Soviet-era D-30 howitzers, which used aiming software that purportedly was hacked. Instead, the revised report cites figures of 15 to 20 percent losses in combat operations, attributing the figures to IISS.
  - mowenz 9y ago
    Hey, hey now, I am kindly asking a reasonable question, and I and others are raising reasonable concerns and now you started to slinging mud. Do you actually have any technical facts to substantiate your "as definitive as it gets" statement? Because slinging mud makes you look unreasonable in my eyes and I'd like to know what facts stand behind your argument.
micheljones 9y ago
> It is not disputable that DNC servers were infected by Russian government malware. Because the signatures of 'Russian government malware' were found? Same signatures we recently found CIA can (and does) easily fake?
- openasocket 9y ago
  Did we? Care to cite a source? I'd be very surprised if anyone can fake IOCs and signatures well enough to fool an analyst.
shard972 9y ago
> There's no definitive proof, there's evidence. This is as definitive as it gets, we've got a report by some of the best people in the field that's also been corroborated by the US DHS. Last time I checked the DHS hasn't seen the server yet.

trowway21 9y ago

The FBI has still not been given access to the server... Comey just testified to that fact last week. They were stonewalled. They went to crowdstrike instead, eventually, who retracted the the only actual evidence which supported their claims just recently. Crowdstrike retracted upon the internet discovering the relevant dns records were most likely spoofed. Dare you to not refuse to read through this.... https://weaponizedautism.wordpress.com/2017/04/09/trump-dns-logs-fabricated/ https://weaponizedautism.wordpress.com/2017/04/09/trump-dns-...

micheljones 9y ago

Crowdstrike has been wrong before and has some sketchy connections that are summed up nicely in the article here: http://archive.is/CogZx http://archive.is/CogZx The founder of Crowdstrike, Dimitri Alperovitch is a Senior fellow at the Atlantic Council. The Atlantic Council is funded by a guy named Victor Pinchuk who is a Ukrainian (and dislikes Russia), and he donated $25 million to the Clinton Foundation. (story found here: http://archive.is/DUtMN http://archive.is/DUtMN ). Furthermore (read the first link) the DHS report about the DNC hack given after a FOIA request amounted to TWO PAGES with information anyone could have googled from the internet. If you just look at the wikipedia for the Atlantic Council ( https://en.wikipedia.org/wiki/Atlantic_Council https://en.wikipedia.org/wiki/Atlantic_Council ) it states several members have left the organization to work for the Obama Administration including Susan Rice. Susan Rice as you all know illegally unmasked members of the Trump campaign to hinder his presidency. Finally I believe this article is very important: http://archive.is/DUtMN http://archive.is/DUtMN it shows the cozy relationship Victor Pinchuk had with the Clinton state department.

openasocket 9y ago

That criticism is really lacking. The biggest evidence is that it was an X-agent variant that used a known APT 28 IP address as its C2. The author's argument about APT groups wanting to switch IP addresses around as quickly as possible doesn't make sense. If you're using an IP-address-based C2 you want to hold onto it for as long as possible, because the second you give it up you lose the ability to control all your malware. Reusing infrastructure is very common, and is not at all a sign "sloppiness" as the author claims. APT groups generally don't care if you can correlate their different attacks, because it doesn't actually affect them. And having a complete separation of all your infrastructure for every attack is time consuming and has a serious burden of effort that limits the pace at which you can attack, all for very little gain. Infrastructure gets reused all the damn time, as does malware, and even certificates. Source: I'm a member of the security research community.