11 ms·

It's not as certain as the moon landings. I agree Russia is almost certainly responsible. There is a ton of publicly available circumstantial evidence that poi

It's not as certain as the moon landings. I agree Russia is almost certainly responsible. There is a ton of publicly available circumstantial evidence that points to them. But without libpcap dumps showing what really went down, we can only take the word of various conflicted people. It's totally possible the NSA had the hackers bugged, and even saw the order come in from their Russian handler, but we haven't seen anything like this ourselves.

nl 9y ago
You can download the malware samples and do forensics yourself. http://contagiodump.blogspot.com.au/2017/02/russian-apt-apt28-collection-of-samples.html http://contagiodump.blogspot.com.au/2017/02/russian-apt-apt2... has the ATP28 samples (do verify the hashes though!) https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf https://www.fireeye.com/content/dam/fireeye-www/global/en/cu... has the techniques they used to identify developers. I agree it is circumstantial, but it's pretty strong and systemic. I personally find this more compelling than a pcap which would just show the last jump.
- staunch 9y ago
  I'm referring to dumps of the hackers themselves, detailing their chat logs, emails, bitcoin transactions, ssh traffic, etc. Not just the exploit-based traffic. If I ran the NSA, I'd have every hacker group I could find under total surveillance. I have video of the moon landings and the testimony of thousands of people that were physically involved.
  - losteric 9y ago
    > I'm referring to dumps of the hackers themselves, detailing their chat logs, emails, bitcoin transactions, ssh traffic, etc. Not just the exploit-based traffic. Do you think this is how the NSA operates? They have that big ol' office building so they can email each other incriminating evidence, pay themselves with bitcoin, and ssh into rooted boxes from government facilities? This is state-sponsored warfare, not script kiddies or hacker gangs.
    - staunch 9y ago
      It sounds like you're confused...I'm saying the NSA may have chat logs of the hacking group itself. These "hacking groups" range from script kiddies that can barely phish, to world class programmers working with billions in resources. Regardless of who did it, it's entirely possible that the NSA has damning evidence of what went down.
      - losteric 9y ago
        No, I think you're confused. I pointed out that: * NSA is a top-tier state-sponsored actor. * NSA doesn't leave chat logs, bitcoin transactions, or email logs lying around to be hacked. * Another top-tier state-sponsored actor would act the same way (no chat logs). * If a foreign state was behind those attacks, the NSA would not be able to find chat logs (because they don't exist). * Therefore, your acceptance that the Kremlin was behind the attacks cannot depend on the NSA releasing that kind of evidence. It's paradoxical. The evidence wouldn't exist if that fact held true. Honestly, I would be more suspicious if the NSA released the kind of evidence you were asking for. Not to say it's true or false either. These are spy games, there's never 100% confidence...
- KekDemaga 9y ago
  My case as already been said better by others: "In the physical world of crime investigation, common sense dictates that the perpetrator of a crime may use any weapon and not just one made in the country of his birth, and that the developer or manufacturer of the weapon most likely isn’t the criminal. And yet, those seemingly crazy assumptions are made every day by cybersecurity companies involved in incident response and threat intelligence. The malware was written in Russian? It was a Russian who attacked you. Chinese characters in the code? You’ve been hacked by the Peoples Liberation Army." https://medium.com/@jeffreycarr/the-dnc-breach-and-the-hijacking-of-common-sense-20e89dacfc2b https://medium.com/@jeffreycarr/the-dnc-breach-and-the-hijac...
  - staunch 9y ago
    "The person or persons responsible are unknown, but let’s assume that CrowdStrike is correct and the responsible party are Russian hackers employed by one or more of Russia’s intelligence services. They used APT28 malware developed and maintained by a Russian lab." Another out-of-context quote from the same article...this is fun ;-) No informed person is claiming Russia did it merely because it was "written in Russian". They're all basing it on many pieces of circumstantial evidence. Don't crime investigators also look at the criminal history, motivations, and opportunity of the suspect? I'd say you're doing a disservice to that author by taking his quote out of context. He's very clearly not making the simplistic straw man argument that you are. It sounds like he suspects the Russians did it, as is rational, but wants real proof -- and not just circumstantial evidence. That is a totally reasonable demand.
    - KekDemaga 9y ago
      >It sounds like he suspects the Russians did it, as is rational, but wants real proof -- and not just circumstantial evidence. That is a totally reasonable demand. That is all I ask as well. Considering we are accusing a nation with nuclear weapons of an act of war the evidence must be much more than circumstantial. The FBI wasn't even permitted to investigate the server personally yet, let's start there instead of relying on private contractors paid by the DNC.
mannykannot 9y ago
The problem with 'how can you be sure' is that it is usually an attempt to cut off discussion and investigation, by implying that only irrefutable facts are admissible.
- model_m_warrior 9y ago
  "by implying that only irrefutable facts are admissible" lol.
  - dsfyu404ed 9y ago
    I prefer living wage, non-gmo tautology free facts.
- rorykoehler 9y ago
  I'm not trying to cut off discussion. I was asking a genuine question because while it's entirely plausible the Russians did attempt to influence American politics a number of other scenarios are also entirely plausible. Are we just taking what the intelligence community say at face value now without seeing actual proof? That seems far more dangerous than whatever you're worried about. It's not like the US intelligence community have a flawless record when it comes to this type of activity either.
  - mannykannot 9y ago
    Sorry, you are right - statements like the one mentioned by rdtsc are fair game.
- rdtsc 9y ago
  Or it's an attempt to find out and learn more. If the claims is really something as serious as "Russians overturned the result of the election" it should come with very clear evidence. Otherwise it is conspiracy theory. Granted it is a good one and a great PR campaign. But I think it has run its course by and it's time to switch to something else. I also heard about "17 intelligence agencies agreeing on the fact". Maybe 25th Air Force (one of the agencies) can tell us more about what they have found there.
soundwave106 9y ago
The evidence pointing to Russia involvement in hacking the United States election is way more certain than the lack of evidence for an alternative scenario the drive-by downvoters are giving. :) It's not like the United States or other countries have never been involved in similar hacking shenanigans. I mean, for instance: there is some interesting circumstantial evidence tying Stuxnet to United States and/or Israel intelligence agencies. "Officially", there is no proof tying Stuxnet to anything, that has been de-classified for now at least. But several intelligence intelligence agencies in Europe and the Middle East have concluded that Stuxnet is a US / Israel product. Likewise, there is a lot of interesting circumstantial evidence typing Russia to the election hacking. Again, nothing 100% "certain" that is de-classified. But a lot of intelligence agencies have reached this conclusion. Added to this, I haven't seen any good counter-explanations. Beyond mere intelligence agencies reaching this conclusion, there has been a lot of US government action related to this issue (in that Russian diplomats were expelled and sanctions were applied in part due to the election hacking). If all of that was for some illusion or show, that frankly would be strange to me. "You never know", of course. But the probability of Russians being involved in the hacking seems very high.

nl 9y ago

You can download the malware samples and do forensics yourself. http://contagiodump.blogspot.com.au/2017/02/russian-apt-apt28-collection-of-samples.html http://contagiodump.blogspot.com.au/2017/02/russian-apt-apt2... has the ATP28 samples (do verify the hashes though!) https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf https://www.fireeye.com/content/dam/fireeye-www/global/en/cu... has the techniques they used to identify developers. I agree it is circumstantial, but it's pretty strong and systemic. I personally find this more compelling than a pcap which would just show the last jump.

staunch 9y ago
I'm referring to dumps of the hackers themselves, detailing their chat logs, emails, bitcoin transactions, ssh traffic, etc. Not just the exploit-based traffic. If I ran the NSA, I'd have every hacker group I could find under total surveillance. I have video of the moon landings and the testimony of thousands of people that were physically involved.
- losteric 9y ago
  > I'm referring to dumps of the hackers themselves, detailing their chat logs, emails, bitcoin transactions, ssh traffic, etc. Not just the exploit-based traffic. Do you think this is how the NSA operates? They have that big ol' office building so they can email each other incriminating evidence, pay themselves with bitcoin, and ssh into rooted boxes from government facilities? This is state-sponsored warfare, not script kiddies or hacker gangs.
  - staunch 9y ago
    It sounds like you're confused...I'm saying the NSA may have chat logs of the hacking group itself. These "hacking groups" range from script kiddies that can barely phish, to world class programmers working with billions in resources. Regardless of who did it, it's entirely possible that the NSA has damning evidence of what went down.
    - losteric 9y ago
      No, I think you're confused. I pointed out that: * NSA is a top-tier state-sponsored actor. * NSA doesn't leave chat logs, bitcoin transactions, or email logs lying around to be hacked. * Another top-tier state-sponsored actor would act the same way (no chat logs). * If a foreign state was behind those attacks, the NSA would not be able to find chat logs (because they don't exist). * Therefore, your acceptance that the Kremlin was behind the attacks cannot depend on the NSA releasing that kind of evidence. It's paradoxical. The evidence wouldn't exist if that fact held true. Honestly, I would be more suspicious if the NSA released the kind of evidence you were asking for. Not to say it's true or false either. These are spy games, there's never 100% confidence...
KekDemaga 9y ago
My case as already been said better by others: "In the physical world of crime investigation, common sense dictates that the perpetrator of a crime may use any weapon and not just one made in the country of his birth, and that the developer or manufacturer of the weapon most likely isn’t the criminal. And yet, those seemingly crazy assumptions are made every day by cybersecurity companies involved in incident response and threat intelligence. The malware was written in Russian? It was a Russian who attacked you. Chinese characters in the code? You’ve been hacked by the Peoples Liberation Army." https://medium.com/@jeffreycarr/the-dnc-breach-and-the-hijacking-of-common-sense-20e89dacfc2b https://medium.com/@jeffreycarr/the-dnc-breach-and-the-hijac...
- staunch 9y ago
  "The person or persons responsible are unknown, but let’s assume that CrowdStrike is correct and the responsible party are Russian hackers employed by one or more of Russia’s intelligence services. They used APT28 malware developed and maintained by a Russian lab." Another out-of-context quote from the same article...this is fun ;-) No informed person is claiming Russia did it merely because it was "written in Russian". They're all basing it on many pieces of circumstantial evidence. Don't crime investigators also look at the criminal history, motivations, and opportunity of the suspect? I'd say you're doing a disservice to that author by taking his quote out of context. He's very clearly not making the simplistic straw man argument that you are. It sounds like he suspects the Russians did it, as is rational, but wants real proof -- and not just circumstantial evidence. That is a totally reasonable demand.
  - KekDemaga 9y ago
    >It sounds like he suspects the Russians did it, as is rational, but wants real proof -- and not just circumstantial evidence. That is a totally reasonable demand. That is all I ask as well. Considering we are accusing a nation with nuclear weapons of an act of war the evidence must be much more than circumstantial. The FBI wasn't even permitted to investigate the server personally yet, let's start there instead of relying on private contractors paid by the DNC.

mannykannot 9y ago

The problem with 'how can you be sure' is that it is usually an attempt to cut off discussion and investigation, by implying that only irrefutable facts are admissible.

model_m_warrior 9y ago
"by implying that only irrefutable facts are admissible" lol.
- dsfyu404ed 9y ago
  I prefer living wage, non-gmo tautology free facts.
rorykoehler 9y ago
I'm not trying to cut off discussion. I was asking a genuine question because while it's entirely plausible the Russians did attempt to influence American politics a number of other scenarios are also entirely plausible. Are we just taking what the intelligence community say at face value now without seeing actual proof? That seems far more dangerous than whatever you're worried about. It's not like the US intelligence community have a flawless record when it comes to this type of activity either.
- mannykannot 9y ago
  Sorry, you are right - statements like the one mentioned by rdtsc are fair game.
rdtsc 9y ago
Or it's an attempt to find out and learn more. If the claims is really something as serious as "Russians overturned the result of the election" it should come with very clear evidence. Otherwise it is conspiracy theory. Granted it is a good one and a great PR campaign. But I think it has run its course by and it's time to switch to something else. I also heard about "17 intelligence agencies agreeing on the fact". Maybe 25th Air Force (one of the agencies) can tell us more about what they have found there.

soundwave106 9y ago

The evidence pointing to Russia involvement in hacking the United States election is way more certain than the lack of evidence for an alternative scenario the drive-by downvoters are giving. :) It's not like the United States or other countries have never been involved in similar hacking shenanigans. I mean, for instance: there is some interesting circumstantial evidence tying Stuxnet to United States and/or Israel intelligence agencies. "Officially", there is no proof tying Stuxnet to anything, that has been de-classified for now at least. But several intelligence intelligence agencies in Europe and the Middle East have concluded that Stuxnet is a US / Israel product. Likewise, there is a lot of interesting circumstantial evidence typing Russia to the election hacking. Again, nothing 100% "certain" that is de-classified. But a lot of intelligence agencies have reached this conclusion. Added to this, I haven't seen any good counter-explanations. Beyond mere intelligence agencies reaching this conclusion, there has been a lot of US government action related to this issue (in that Russian diplomats were expelled and sanctions were applied in part due to the election hacking). If all of that was for some illusion or show, that frankly would be strange to me. "You never know", of course. But the probability of Russians being involved in the hacking seems very high.