22 ms·

Guccifer 2.0 Slipped Up and Revealed He Was a Russian Intelligence Officer

449 points by hownottowrite 9y ago

alva 9y ago
"Working off the IP address, U.S. investigators identified Guccifer 2.0 as a particular GRU officer" Not a network whizz but doesn't that sound unlikely? They would have to have 1. Static IPs 2. Deep enough penetration of their systems to have IP/Officer mapping -> in which case they would have known this was going on anyways? Seems necessary to edit: I understand the NSA is the most powerful player and likely had penetrated their systems. My point is that if their networks were penetrated anyways, why are receiving this reasoning about the accident with the VPN? The only plausible explanation I can see is what another commenter put out which is the Officer had also used the non-VPNd connection to something personal. Now this would be a big fuck up Saying they could identify an individual officer from an IP leads you to assume they had penetrated the network. In which case, why not disclose that? That would be the assumption from the other side.
- ryanlol 9y ago
  If it was a residential IP, this would have been very easy. But would GRU officers really work from home?
  - jlgaddis 9y ago
    The rest of the sentence quoted above is "... working out of the agency’s headquarters on Grizodubovoy Street in Moscow."
    - zrobotics 9y ago
      Which could also mean an intelligence officer('s personal machine, who is known to be) working out of the agency's hq... It implies that the IP was from GRU HQ, but the only definite statement is that it is this specific officer, who works at this specific location.
  - erric 9y ago
    It wouldn’t be too hard for the Russian govt to set up shop in a residential neighborhood.
    - rbanffy 9y ago
      Or, at least, have a network exit point at an unsuspecting family home.
  - alva 9y ago
    Yes I suppose that could be the other explanation
    - runciblespoon 9y ago
      @walshemj: "But would they actually work from a known location id assume that US offensive operations are not done directly from Langley" You forget this story is aimed at people who mostly get their news from Faux Television ..
  - walshemj 9y ago
    But would they actually work from a known location id assume that US offensive operations are not done directly from Langley
- deleted 9y ago
  [deleted]
- erric 9y ago
  >But on one occasion, The Daily Beast has learned, Guccifer failed to activate the VPN client before logging on. As a result, he left a real, Moscow-based Internet Protocol address in the server logs of an American social media company, according to a source familiar with the government’s Guccifer investigation. He forgot to use the VPN that was masking him.
  - alva 9y ago
    I understand that, the question is regarding mapping the IP to an individual officer.
    - marshray 9y ago
      He probably logged into other services with his real name from that IP.
    - NN88 9y ago
      Do you not realize what the NSA is?
- jlgaddis 9y ago
  Rest assured that all of the evidence they have of this identification is not included in this article.
  - avn2109 9y ago
    This might be true and probably is, but I'm in general not the sort of person who is convinced by "We have more evidence but we're not showing it here, just believe us!" It just strikes me as very sloppy epistemology, and sort of insulting to my abilities to draw my own conclusions.
- dragonwriter 9y ago
  “Working off” does not mean it was a one-step IP -> name mapping, orn that the IP address was the only relevant piece of information, just the thing that got them past the VPN exit point in France that was the dead end before that unprotected access was discovered. The IP address could have led to GRU HQ (specifically identified as where he was working out of), and other information could have narrowed it down from there to a particular officer.
  - avn2109 9y ago
    I agree that this is possible, but I too would like to see them explain precisely how they narrowed it down to a single workstation in a building full of workstations, and then how they mapped a workstation to a human. A comment downthread suggests that he logged into a real-name service from the same IP without a VPN. This too is possible, but I find it at least somewhat surprising that an intelligence service doesn't prohibit logging in to real-name services from State computers. For example, some civilian employers prohibit this, even when they provably have nothing to hide.
    - ramphastidae 9y ago
      Are you really expecting the NSA to publish 0-days they are actively exploiting for intelligence gathering operations? :)
      - dragonwriter 9y ago
        Or, even worse, expecting other involved intel agencies to reveal HUMINT sources that were used to narrow the identification once technical means got them something past the VPN exit?
    - gwern 9y ago
      There's a lot of possibilities. Remember how the Dutch hacked Cozy Bear's security cameras? One could do a lot with info like that, and it seems unlikely that those were the only vulnerable cameras, since that's not usually how IoT ('the S stands for Secure') stuff works.
- NN88 9y ago
  Do you all ever stop and think "Hey, maybe even knowing this much means the government knows more?" No. You just come in with the: "This doesn't seem right. Isn't the NSA basically on college 101 level?" Dude, they did it. Dutch intel even pwn3d their networks and video cameras.
  - deleted 9y ago
    [deleted]
  - YarickR 9y ago
    Oh rly ? They just showed a bunch of camera-quality records and told everyone this is IRA headquarters' CCTV footage . Any reason to believe that ?
- croon 9y ago
  NSA is the NSA, but they could probably corroborate it with stuff like this: https://yro.slashdot.org/story/18/01/28/0529257/dutch-intelligence-agents-watched-russia-hack-the-dnc https://yro.slashdot.org/story/18/01/28/0529257/dutch-intell...
- stordoff 9y ago
  If it's a GRU machine, I find it highly likely that the NSA would at least be trying to monitor communications from it[1]. It's possible that they can't get an active tap on the GRU's internal network (at least on-going, and doing so might not immediately reveal the source if the documents are only transferred over the active VPN connection -- having network access doesn't necessarily imply access to endpoints), but can tap the upstream connection. Once the source has been identified as a particular connection/building, I can think of a number of ways it could then be narrowed to an individual: * Agent embedded in the office - they might not know about the operation beforehand if it's well compartmentalised, but may be able to find out more now they have that initial information, or rule out enough people to narrow it down * Breach the internal network, knowing that access will be short-lived and discovered, but for long enough to get the information you need * A further slip-up that, e.g., includes a name or some other identifying piece of information (e.g. cookie to a non-HTTP site), or accessing GRU systems that the US have previously breached or are otherwise improperly secured from the same machine * Forge the VPN set up so that the user connects to NSA-controlled servers -- doesn't seem out of the realm of the NAS's capabilities; or * Work with Elite VPN (unlikely--they appear to be a Russian company) or breach their systems (I imagine their security is less than GRU's, especially if they have servers in France which would likely allow the NSA or their French counterparts to compel physical access) to gain access to the VPN traffic. Once you have that, insert a zero-day into the traffic to gain access to the GRU machine * Use a QUANTUM-style attack to embed a zero-day into non-VPN requests made over that connection It's unlikely that you could immediately go from IP address to GRU officer, but working from that IP address you certainly have options that could lead you to an individual. I think it's quite clear why NSA would not want to reveal which technique(s) they used, particularly as it could lead GRU's countermeasures to be specifically targeted against useful methods. I'm also not particularly sure it matters all that much. It's quite possibly the work of a team (even if the actual postings come from an individual) and will at least (presumably) have command authorisation. The article notes "[s]ometime after its hasty launch, the Guccifer persona was handed off to a more experienced GRU officer". Attributing it to an individual, rather than just the GRU, doesn't seem to make much difference. [1] I find it possible that traffic analysis was used to uncover this -- find that Guccifer 2.0 is posting via Elite VPN, then correlate traffic in to Elite with possible sources. I'm surprised that GRU wouldn't use a machine that is forced to connect to a VPN for this, particularly if the machine's public IP points back to GRU/Russia, so it being something more that "agent forgot to enable VPN" would not be shocking. Edit: fix list formatting
lokopodium 9y ago
Unwritten Cold War rules pretty much said you don't pursue the opposing officers unless you catch them on your turf. It's obvious that the troll factory people and Guccifer 2.0 were acting on behalf of Russia with the direct approval from Putin. Why bother indicting individuals?
- toyg 9y ago
  Unwritten cold war rules have gone out of the window. Russian agents used isotopes and nerve gas in GCHQ’s backyard. The sitting US President might have received their help to win the election. Russia just made the only major territory annexation by a superpower since WWII (iirc). Obviously we didn’t start the fire, as Billy Joel would say, but we certainly live in interesting times.
  - dahdum 9y ago
    We interfere all the time in foreign elections, and so many countries tried to influence ours I don’t see anything innately wrong with it. Other than possibly the fact they played a little dirty. So did the DNC (per emails), the RNC (because why would they be better?), and many political groups. Unless Trump made a deal with them to do so, this looks like business as usual to me.
    - Analemma_ 9y ago
      It’s amusing to watch that as the walls close in, you guys are gradually changing your story from “There was no collusion!” to “There was collusion... but it’s no big deal”. Should I expect you’ll be fully switched over, with no acknowledgement a shift ever occurred, by the time Muller hands out indictments?
      - dahdum 9y ago
        Us guys? I was not and am not a Trump supporter, but to believe collusion requires actual proof.
geowwy 9y ago
Relevent paragraphs: > [An intelligence researcher] led an investigation at ThreatConnect that tried to track down Guccifer from the metadata in his emails. But the trail always ended at the same data center in France. Ehmke eventually uncovered that Guccifer was connecting through an anonymizing service called Elite VPN, a virtual private networking service that had an exit point in France but was headquartered in Russia. > But on one occasion, The Daily Beast has learned, Guccifer failed to activate the VPN client before logging on. As a result, he left a real, Moscow-based Internet Protocol address in the server logs of an American social media company, according to a source familiar with the government’s Guccifer investigation. Twitter and WordPress were Guccifer 2.0’s favored outlets. Neither company would comment for this story, and Guccifer did not respond to a direct message on Twitter. > Working off the IP address, U.S. investigators identified Guccifer 2.0 as a particular GRU officer working out of the agency’s headquarters on Grizodubovoy Street in Moscow. (The Daily Beast’s sources did not disclose which particular officer worked as Guccifer.)
- rbanffy 9y ago
  What I find unlikely is that it was possible for the officer to log into the account from anything but a computer connected to a secured network. The computers that could be connected directly should never have the constructed persona's credentials. These are not amateurs. They should know better.
  - dragonwriter 9y ago
    > These are not amateurs. They should know better. Yeah, in every field there are lots of cases where people end up saying this because professionals who should know better don't. Or cut corners because of resource constraints. Or, just screw up something they actually do know. Or...
    - YarickR 9y ago
      Or this is bullshit, plain and simple . You don't think outgoing connections are unproxied and unmonitored at GRU (GRU, of all things ? This is military intelligence, BTW) , do you ?
mindslight 9y ago
So then, if Russian Intelligence is responsible for helping to expose a significant criminal conspiracy in the US, maybe the news media will stop with all of the nouveau cold war bullshit and instead just thank them?
- krapp 9y ago
  >So then, if Russian Intelligence is responsible for helping to expose a significant criminal conspiracy in the US... Please point to any "significant criminal conspiracy" which was exposed, and which laws it was in violation of, if possible. And for bonus points, please tell us why Trump hasn't thrown Hillary into prison yet, as promised.
  - stale2002 9y ago
    Sure, I'll give one. 30 thousand emails were illegally deleted, even after a court order was given telling the Hillary tech people in charge of their email service not to do so. The law broken is the court order telling them to hand over all the emails. The reason for no prosecution is because of politics. That's how the world works, shrug. Some of the hacked emails in question, could have been some of the ones that were illegally deleted in the first place. So they were in effect, undeleting emails that were illegally deleted.
    - djur 9y ago
      The hacked emails were from the DNC, dated 2015-2016. The deleted emails were on Hillary Clinton's private server, which she used during her tenure as Secretary of State, 2009-2013. There is no connection between the two sets of email whatsoever. Remember when Donald Trump responded to the DNC leaks by asking the Russians to leak Hillary's deleted emails? Yeah. That's because they're not the same thing.
  - mindslight 9y ago
    The "Democratic National Committee". On its face, election fraud. Besides the loftier stuff like subverting the will of the people and the authorized government. > And for bonus points, please tell us why Trump hasn't thrown Hillary into prison yet, as promised. Because they play golf at the same country clubs, and their IRL actions aren't bound by the marketing characters they play? It would be kind of like shooting someone after you beat them in chess - totally uncool. But I don't see how this is relevant, unless you assume that by criticizing one ignorance club I must be a cheerleader for its twin?
c3534l 9y ago
I was expecting some real hightech spycraft and intrigue. Nope, the dude forgot turn on his VPN. Even well-funded state actors can be dumbasses.
- ortuna 9y ago
  I feel like these things are made to be found. They undermine our election process and democracy.
- stevenwoo 9y ago
  My VPN sometimes just goes down. There's a little icon in the tray that turns from green to red. I could set my system to not allow internet access without the VPN but that mucks about with the boot process and I'm not running spycraft.
  - cynwoody 9y ago
    I'm sure GRU possesses the technical chops to put in place safeguards to guarantee against ever connecting other than through the VPN. They should do that and then hire Kaspersky to come over and audit their setup.
  - fwdpropaganda 9y ago
    What I do is that I have a firewall always set up so that all connections are blocked, except connections to the one VPN IP entry point that I'm using. When VPN connection goes down, my internet goes down. Coincidentally, this also solves the problem of DNS leaks.
tardygrad 9y ago
While pointing fingers at Russia or impeaching Trump may be the options that feel good at the moment, I hope this is an opportunity to make sure something like this never happens again. This is a pipe dream and I'm not sure this is even possible, but I think the best outcome of this is to pass legislation to try and ensure that: 1. Political campaigns don't engage in the type of behaviour in the first place, and 2. Make communications more public in general - official campaigns of people running for public office must operate under the light of greater public scrutiny Democracy is only possible if accurate information is available, and the biggest takeaway for me in the last elections was just how many secrets all political players have.
- catawbasam 9y ago
  There need to be clear consequences, to serve as a deterrent. Having a functioning democracy is a core interest of the United States, so the consequences should be severe.
  - polotics 9y ago
    Well, treason is already well defined in law. https://en.wikipedia.org/wiki/Treason_laws_in_the_United_States https://en.wikipedia.org/wiki/Treason_laws_in_the_United_Sta... No one has been executed for treason against the federal government. Yet.
- aphextron 9y ago
  It all comes down to campaign finance. We need pblicly funded elections with absolutely no tolerance for private money, and a set equal amount for each major party candidate. Until Citizens United is overturned, and we get some kind of legislation like this, money will continue to dominate everything. And as long as that’s the case, there will always be unethical behavior because the incentives are too great.
  - orangecat 9y ago
    money will continue to dominate everything The Clinton campaign raised and spent much more money than the Trump campaign: https://www.bloomberg.com/politics/graphics/2016-presidential-campaign-fundraising/ https://www.bloomberg.com/politics/graphics/2016-presidentia...
eeks 9y ago
If GRU agents use only a single hop to ambiguate their connections when attacking their mightiest foreign opponent then we don't have much to fear from these guys.
cmurf 9y ago
Trump>Stone>Guccifer 2.0>GRU>Putin And today Trump ejects his sane national security advisor, H.R. McMaster, in favor of the hawk who was one of the four architects of the Iraq war, John Bolton. John Bolton penned the WSJ article The Legal Case for Striking North Korea First published Feb 28 2018.
runciblespoon 9y ago
This feeds into the Russia plotted to sabotage Hillarys campaign and promote Trump narrative. Which is most probably a concoction dreamed up by the deep-state as part of a conspiracy to depose a sitting president. The state security apparatus engaged in a palace coup against a sitting president.
- dd36 9y ago
  And 9/11 was an inside job and we never landed on the moon.
  - jakeogh 9y ago
    It's really convenient to use easily debunked stuff to prevent people from looking into other things. For example, "flat earth" is not designed to convince any normal person Earth is actually flat. Paradoxically, you just "fell for" the actual utility of the "we didn't land on the moon" stuff, sure you can find genuine people that believe just about anything, but that's just a side issue. This is very common if you study disinformation a bit.
  - dbt00 9y ago
    No credible evidence of either of those theories have ever been put forward. Meanwhile we have George Papadopoulos pleading guilty to lying to the FBI about his involvement in a Trump-Russia conspiracy. If anything this whole event should prove how hard it is to really pull off this kind of shady conspiracy without leaving a real trail of evidence, something the 9/11 truthers, the moon landing loons, or the false flag school shooting assholes have never been able to find because it's not there.
badrabbit 9y ago
This is why you shouldn't do VPN (or Tor) on end devices. A network device routing your traffic should do that.
throwaway84742 9y ago
From the article: "according to a source familiar with the government’s Guccifer investigation", "Working off the IP address, U.S. investigators identified Guccifer 2.0 as a particular GRU officer working out of the agency’s headquarters on Grizodubovoy Street in Moscow". IOW, they don't have jack shit, which is why the stuff I quoted above is buried towards the end of the article. How does one tie an IP address to a street address? Or to a specific person? And what does "working off" an IP address even mean? And why would he be running this from the GRU headquarters rather than from some obscure Russian bunker? I smell massive quantities of clickbait manure.
barnesto 9y ago
this is all a moot point since the DNC servers weren't hacked. just ask Wikileaks and Kim Dotcom. oh then there's all the evidence suggesting that the "hack" was indeed an inside job as the transfer rates for the data could only happen on a usb not over a tcp network.
barnesto 9y ago
this is all moot, right? there was no hack of the DNC servers. it was an inside job. https://lawandcrime.com/high-profile/bombshell-nsa-experts-say-dnc-hack-was-actually-a-leak-and-inside-job/ https://lawandcrime.com/high-profile/bombshell-nsa-experts-s... or just ask Wikileaks or Kim Dotcom.
saas_co_de 9y ago
Yeah, I am sure The Daily Beast got this story because they are such a well respected journalistic outlet. More like nobody at the NYT or WP willing to tarnish their reputation with this crap. Which is pretty bad given what they will publish.
- dbt00 9y ago
  Spencer Ackerman is a stellar reporter with over 15 years experience writing for TNR, Wired, and The Guardian. He's gotten a huge of scoops on the national security beat throughout the years and none of his reporting has ever been called into question.
  - saas_co_de 9y ago
    > none of his reporting has ever been called into question In 2013, Ackerman was forced to take down one of his Wired stories on what he claimed was a "North Korean propaganda video", after it was revealed the film was a satire video by British travel writer Alun Hill.[16] https://en.wikipedia.org/wiki/Spencer_Ackerman https://en.wikipedia.org/wiki/Spencer_Ackerman
    - dbt00 9y ago
      Point taken. He was once taken in by a popular hoax and wrote a post on his wired blog about it, after which he apologized on twitter. https://twitter.com/attackerman/status/311868261945978881 https://twitter.com/attackerman/status/311868261945978881 To remind everyone where the plot is, I was responding to this phrase: > Yeah, I am sure The Daily Beast got this story because they are such a well respected journalistic outlet. None of his sourced reporting has ever been called into question. The original commenter was way off base with this insinuation.
      - equalunique 9y ago
        Perhaps this new Daily Beast story is evidence he has been taken in by another hoax.
- 9y ago
rdtsc 9y ago
Wonder how this jives alongside this other story with a confession letter from someone saying they were ordered to hack the DNC: http://www.newsweek.com/russian-hacker-stealing-clintons-emailshacking-dnc-putinsfsb-745555 http://www.newsweek.com/russian-hacker-stealing-clintons-ema... --- Konstantin Kozlovsky, a Russian citizen working for a hacker group called Lurk, confessed to hacking Clinton’s emails during a hearing about his arrest in August. An audio recording and minutes from the hearing were posted on Kozlovsky’s Facebook page, and their authenticity was reportedly confirmed by The Bell. --- He allegedly worked with someone from FSB: --- Kozlovsky identified his FSB handler as Dmitry Dokuchaev, a cybersecurity expert who worked as a hacker before joining the FSB. Dokuchaev, who used the moniker “Forb,” has been linked to a group of hackers called Shaltai Boltai, or Humpty Dumpty, --- Perhaps the DNC was hacked by both? It was a pretty large target and multiple state actors gave it a try.
- retsibsi 9y ago
  The book Russian Roulette says that data was stolen from the DNC by two groups of Russian hackers, who seemed to be acting separately. It says that one group was linked to Russian military intelligence (presumably the GRU) and the other was suspected of being linked to Russian intelligence, 'most likely the SVR'.
  - rdtsc 9y ago
    Thanks for the book suggestion.
- djur 9y ago
  That headline is terrible. The DNC emails were not "Clinton's". The emails we have from Hillary Clinton were not hacked, they were released by Congress or in response to FOIA requests. There were two separate hacks of the DNC (leaked in July 2016) and John Podesta's email (leaked in October 2016), but those are unrelated.
question_that 9y ago
I can't trust anything these days but if the information is legitimate - both the government investigation and the reporting - then forgetting to use your VPN has taken down both Guccifer 2.0 and Dread Pirate Roberts. That's incredible given these comments are full of advice on how to prevent that from happening.
boipucci2point0 9y ago
I just really hate the name "Guccifer 2.0" and hope they shoot this fuck, whoever it is, because anyone who'd refer to themselves with a handle like that is bound to be a piece of shit.
lamarpye 9y ago
Interesting story. What is The Daily Beast's batting average? How often do they make contact with the Truth? Looking at their website, I learned that Joe Biden could beat up Trump because he took on a gangster name "Corn Pop" back in the day. Pretty damning stuff.
cocktailpeanuts 9y ago
Since this is "Hacker News" I would like to ask an honest question: Which is more likely of the two? 1. The hacker mistakenly sign in from Russia once. 2. The hacker intentionally sign in from Russia once. I really have no bias towards all this issue and don't really care, but I do care about media making interpretations that mislead the public, which is why I draw this question. One widely used hacking technique is to intentionally leave a trail that leads investigators down the wrong track, not just for hacking but for all crimes. I'm just having hard time understanding how people are taking for granted that a competent hacker is more likely to leave a trail by mistake instead of leaving one intentionally, because in most cases it's the latter.
- Nihilartikel 9y ago
  If we knew that, then we would know a lot more of the hidden variables of the current geopolitical state of play. Was the DNC hacking done for its own benefits to the hackers, or was it done as a move in a larger strategic game of indirection and manipulation? A false flag attack? A timebomb reveal set to sow chaos in the US political system after the fact? Was it the latter, but still goofed by good old human fallibility?
- notacoward 9y ago
  Which is the more likely of the two? 1. The hacker actually worked for GRU, which was already known to engage in such activities, and slipped up once? 2. Somebody hacked into a GRU office so they could connect from there one time and hope somebody would notice?
  - cix_pkez 9y ago
    2. Governmental incompetence is all a great charade meant to make their flawlessly-executed deceptions and conspiracies more believable.
  - duncanawoods 9y ago
    3. Using notepad.exe, Dave typed the GRU IP address into the server log before passing them on to Susan for her analysis
tmpacc23098 9y ago
All fake. No russians ever hacked any elections. This is just missinformation by USA. To eventually go to war with Russian.
akvadrako 9y ago
It's nice to finally have some evidence in this story, but it's good to keep in mind that there is also evidence it's an internal leak. (1) Wikileaks stated their source wasn't Russia and (2) The timestamps on the leak point to a local copy over USB2: https://theforensicator.wordpress.com/guccifer-2-ngp-van-metadata-analysis/ https://theforensicator.wordpress.com/guccifer-2-ngp-van-met...
puppetmaster400 9y ago
Media also told us reason for war is WMD. His name is Seth Rich. Wikileaks has email from Podesta say he wants him to be example. DNC chairperson Donna said on national tv she also fears for her life. Ready downvotes.
ohiovr 9y ago
So I guess we gotta use esp to figure out what these faded posts are all about. If you are going to reply to a post, maybe consider not downvoting it?
igivanov 9y ago
For what it is worth, let me quote someone's reddit comment: >"So many 'slip-ups' pointing to Russia from this guy.. you could be forgiven for thinking he's not Russian, and was in fact created by the DNC. >He CHOSE to name his computer account after the founder of the Soviet Secret Police. >He CHOSE to create/open and then save documents so the Russian name was written to metadata. >He CHOSE to use a Russian VPN service to cloak his IP address. >He CHOSE to use public web-based email services that would forward his cloaked IP. >He CHOSE to use the above to contact various media outlets on the same day. >Odd behaviour for an elite hacker. >Also, still today, none of his claims of hacking can be verified." https://www.reddit.com/r/worldnews/comments/86gglv/lone_dnc_hacker_guccifer_20_slipped_up_and/dw4ybzm/ https://www.reddit.com/r/worldnews/comments/86gglv/lone_dnc_...
- shaki-dora 9y ago
  The reason may actually be that Russia always wanted to be caught. They never thought Trump would win–the prize they were aiming for was general distrust of the election's integrity. It's very similar to Russia's choice to poison Litvienko with Polonium–an unnatural radioactive element that can easily be traced back to the reactor where it originated. And, similarly, the very recent chemical weapons attack in the UK, using a nerve agent only ever produced by Russia.
  - TazeTSchnitzel 9y ago
    In fairness, the UK came close to not detecting the Polonium (it was just luck they had the right someone on the team) and they weren't sure Russia could have known the UK was actually capable of detecting it.
- CabSauce 9y ago
  To play devil's advocate... If the DNC were responsible for their own 'hack': They CHOSE to release embarrassing and damaging information right before a major election, in case they lost, so they would have an excuse if it happened? And the DNC is so competent at information security that they were able to deceive 17 (or whatever the number is) government agencies and several independent researchers?
equalunique 9y ago
This story was broke by The Daily Beast. So the person who HACKED THE DNC was dumb enough to forget to turn on his VPN and then a news outlet where Chelsea Clinton is a board member caught him? It's a totally rediculous story and likley fabricated. Unless the DNC's cybersecurity was run by literal children, the kind of sophistication needed to pull off that hack would not be by the caliber of person who would allow themselves to be traced back in the basic way this story claims. Not only that, but the original Guccifer 2.0. story was discredited many times. The documents that were released were deemed to be fake, multiple times, not just on fringe websites, but also by the MSM. "VIPS instead surmises that, after WikiLeaks' Julian Assange announced on June 12, 2016 his intention to publish Hillary Clinton-related emails, the DNC rushed to fabricate evidence that it had been hacked by Russia to defuse any potential WikiLeaks disclosures. To this end, the theory goes, the DNC used the Guccifer 2.0 online persona to release mostly harmless DNC data." https://www.bloomberg.com/view/articles/2017-08-10/why-some-u-s-ex-spies-don-t-buy-the-russia-story https://www.bloomberg.com/view/articles/2017-08-10/why-some-... Maybey this is the "insurance policy" discussed in text messages between FBI agents Peter Strzok, Lisa Page, and Andrew McCabe. The release of the new story has sleery timing with McCabe's firing last week. The whole internet was talking about how Guccifer 2.0 was fake and now today they have decided it was real. Lol!
- throwawaymanbot 9y ago
  The fact you used the the acronym MSM already tells me enough about your opinions. And sure enough, I look and you are on /r/thedonald... we know the type that hang there. Your Dezinformatsiya skills are laughably weak comrade.
- pkilgore 9y ago
  This is like ranting that Google couldn't have developed Chrome because their PR person doesn't know how to code.
  - equalunique 9y ago
    Note that the story was broke by a news outlet linked to Chelsea Clinton: https://medium.com/@jashobell/the-daily-beast-is-owned-by-iac-and-chelsea-clinton-sits-on-their-board-of-directors-d6978d1e9ee5 https://medium.com/@jashobell/the-daily-beast-is-owned-by-ia...
petegrif 9y ago
How can we be confident that some of us on this forum are not trolls working to discredit the story? We can't be.
- softawre 9y ago
  That's exactly what a troll would say! Have some vodka, American friend.
- akvadrako 9y ago
  It seems very likely at least some commenters are paid trolls. If you were running a $1m disinformation campaign for either side, wouldn't you put assign a few sock puppets to hacker news?
master1puppet 9y ago
(Shadow-banning by HN moderators is free speech banning. I have to VPN just to say this:) Media also told us reason for war is WMD. His name is Seth Rich. Wikileaks has email from Podesta say he wants him to be example. DNC chairperson Donna said on national tv she also fears for her life. Ready downvotes.

449 points by hownottowrite 9y ago

alva 9y ago

"Working off the IP address, U.S. investigators identified Guccifer 2.0 as a particular GRU officer" Not a network whizz but doesn't that sound unlikely? They would have to have 1. Static IPs 2. Deep enough penetration of their systems to have IP/Officer mapping -> in which case they would have known this was going on anyways? Seems necessary to edit: I understand the NSA is the most powerful player and likely had penetrated their systems. My point is that if their networks were penetrated anyways, why are receiving this reasoning about the accident with the VPN? The only plausible explanation I can see is what another commenter put out which is the Officer had also used the non-VPNd connection to something personal. Now this would be a big fuck up Saying they could identify an individual officer from an IP leads you to assume they had penetrated the network. In which case, why not disclose that? That would be the assumption from the other side.

ryanlol 9y ago
If it was a residential IP, this would have been very easy. But would GRU officers really work from home?
- jlgaddis 9y ago
  The rest of the sentence quoted above is "... working out of the agency’s headquarters on Grizodubovoy Street in Moscow."
  - zrobotics 9y ago
    Which could also mean an intelligence officer('s personal machine, who is known to be) working out of the agency's hq... It implies that the IP was from GRU HQ, but the only definite statement is that it is this specific officer, who works at this specific location.
- erric 9y ago
  It wouldn’t be too hard for the Russian govt to set up shop in a residential neighborhood.
  - rbanffy 9y ago
    Or, at least, have a network exit point at an unsuspecting family home.
- alva 9y ago
  Yes I suppose that could be the other explanation
  - runciblespoon 9y ago
    @walshemj: "But would they actually work from a known location id assume that US offensive operations are not done directly from Langley" You forget this story is aimed at people who mostly get their news from Faux Television ..
- walshemj 9y ago
  But would they actually work from a known location id assume that US offensive operations are not done directly from Langley
deleted 9y ago
[deleted]
erric 9y ago
>But on one occasion, The Daily Beast has learned, Guccifer failed to activate the VPN client before logging on. As a result, he left a real, Moscow-based Internet Protocol address in the server logs of an American social media company, according to a source familiar with the government’s Guccifer investigation. He forgot to use the VPN that was masking him.
- alva 9y ago
  I understand that, the question is regarding mapping the IP to an individual officer.
  - marshray 9y ago
    He probably logged into other services with his real name from that IP.
  - NN88 9y ago
    Do you not realize what the NSA is?
jlgaddis 9y ago
Rest assured that all of the evidence they have of this identification is not included in this article.
- avn2109 9y ago
  This might be true and probably is, but I'm in general not the sort of person who is convinced by "We have more evidence but we're not showing it here, just believe us!" It just strikes me as very sloppy epistemology, and sort of insulting to my abilities to draw my own conclusions.
dragonwriter 9y ago
“Working off” does not mean it was a one-step IP -> name mapping, orn that the IP address was the only relevant piece of information, just the thing that got them past the VPN exit point in France that was the dead end before that unprotected access was discovered. The IP address could have led to GRU HQ (specifically identified as where he was working out of), and other information could have narrowed it down from there to a particular officer.
- avn2109 9y ago
  I agree that this is possible, but I too would like to see them explain precisely how they narrowed it down to a single workstation in a building full of workstations, and then how they mapped a workstation to a human. A comment downthread suggests that he logged into a real-name service from the same IP without a VPN. This too is possible, but I find it at least somewhat surprising that an intelligence service doesn't prohibit logging in to real-name services from State computers. For example, some civilian employers prohibit this, even when they provably have nothing to hide.
  - ramphastidae 9y ago
    Are you really expecting the NSA to publish 0-days they are actively exploiting for intelligence gathering operations? :)
    - dragonwriter 9y ago
      Or, even worse, expecting other involved intel agencies to reveal HUMINT sources that were used to narrow the identification once technical means got them something past the VPN exit?
  - gwern 9y ago
    There's a lot of possibilities. Remember how the Dutch hacked Cozy Bear's security cameras? One could do a lot with info like that, and it seems unlikely that those were the only vulnerable cameras, since that's not usually how IoT ('the S stands for Secure') stuff works.
NN88 9y ago
Do you all ever stop and think "Hey, maybe even knowing this much means the government knows more?" No. You just come in with the: "This doesn't seem right. Isn't the NSA basically on college 101 level?" Dude, they did it. Dutch intel even pwn3d their networks and video cameras.
- deleted 9y ago
  [deleted]
- YarickR 9y ago
  Oh rly ? They just showed a bunch of camera-quality records and told everyone this is IRA headquarters' CCTV footage . Any reason to believe that ?
croon 9y ago
NSA is the NSA, but they could probably corroborate it with stuff like this: https://yro.slashdot.org/story/18/01/28/0529257/dutch-intelligence-agents-watched-russia-hack-the-dnc https://yro.slashdot.org/story/18/01/28/0529257/dutch-intell...
stordoff 9y ago
If it's a GRU machine, I find it highly likely that the NSA would at least be trying to monitor communications from it[1]. It's possible that they can't get an active tap on the GRU's internal network (at least on-going, and doing so might not immediately reveal the source if the documents are only transferred over the active VPN connection -- having network access doesn't necessarily imply access to endpoints), but can tap the upstream connection. Once the source has been identified as a particular connection/building, I can think of a number of ways it could then be narrowed to an individual: * Agent embedded in the office - they might not know about the operation beforehand if it's well compartmentalised, but may be able to find out more now they have that initial information, or rule out enough people to narrow it down * Breach the internal network, knowing that access will be short-lived and discovered, but for long enough to get the information you need * A further slip-up that, e.g., includes a name or some other identifying piece of information (e.g. cookie to a non-HTTP site), or accessing GRU systems that the US have previously breached or are otherwise improperly secured from the same machine * Forge the VPN set up so that the user connects to NSA-controlled servers -- doesn't seem out of the realm of the NAS's capabilities; or * Work with Elite VPN (unlikely--they appear to be a Russian company) or breach their systems (I imagine their security is less than GRU's, especially if they have servers in France which would likely allow the NSA or their French counterparts to compel physical access) to gain access to the VPN traffic. Once you have that, insert a zero-day into the traffic to gain access to the GRU machine * Use a QUANTUM-style attack to embed a zero-day into non-VPN requests made over that connection It's unlikely that you could immediately go from IP address to GRU officer, but working from that IP address you certainly have options that could lead you to an individual. I think it's quite clear why NSA would not want to reveal which technique(s) they used, particularly as it could lead GRU's countermeasures to be specifically targeted against useful methods. I'm also not particularly sure it matters all that much. It's quite possibly the work of a team (even if the actual postings come from an individual) and will at least (presumably) have command authorisation. The article notes "[s]ometime after its hasty launch, the Guccifer persona was handed off to a more experienced GRU officer". Attributing it to an individual, rather than just the GRU, doesn't seem to make much difference. [1] I find it possible that traffic analysis was used to uncover this -- find that Guccifer 2.0 is posting via Elite VPN, then correlate traffic in to Elite with possible sources. I'm surprised that GRU wouldn't use a machine that is forced to connect to a VPN for this, particularly if the machine's public IP points back to GRU/Russia, so it being something more that "agent forgot to enable VPN" would not be shocking. Edit: fix list formatting

lokopodium 9y ago

Unwritten Cold War rules pretty much said you don't pursue the opposing officers unless you catch them on your turf. It's obvious that the troll factory people and Guccifer 2.0 were acting on behalf of Russia with the direct approval from Putin. Why bother indicting individuals?

toyg 9y ago
Unwritten cold war rules have gone out of the window. Russian agents used isotopes and nerve gas in GCHQ’s backyard. The sitting US President might have received their help to win the election. Russia just made the only major territory annexation by a superpower since WWII (iirc). Obviously we didn’t start the fire, as Billy Joel would say, but we certainly live in interesting times.
- dahdum 9y ago
  We interfere all the time in foreign elections, and so many countries tried to influence ours I don’t see anything innately wrong with it. Other than possibly the fact they played a little dirty. So did the DNC (per emails), the RNC (because why would they be better?), and many political groups. Unless Trump made a deal with them to do so, this looks like business as usual to me.
  - Analemma_ 9y ago
    It’s amusing to watch that as the walls close in, you guys are gradually changing your story from “There was no collusion!” to “There was collusion... but it’s no big deal”. Should I expect you’ll be fully switched over, with no acknowledgement a shift ever occurred, by the time Muller hands out indictments?
    - dahdum 9y ago
      Us guys? I was not and am not a Trump supporter, but to believe collusion requires actual proof.

geowwy 9y ago

Relevent paragraphs: > [An intelligence researcher] led an investigation at ThreatConnect that tried to track down Guccifer from the metadata in his emails. But the trail always ended at the same data center in France. Ehmke eventually uncovered that Guccifer was connecting through an anonymizing service called Elite VPN, a virtual private networking service that had an exit point in France but was headquartered in Russia. > But on one occasion, The Daily Beast has learned, Guccifer failed to activate the VPN client before logging on. As a result, he left a real, Moscow-based Internet Protocol address in the server logs of an American social media company, according to a source familiar with the government’s Guccifer investigation. Twitter and WordPress were Guccifer 2.0’s favored outlets. Neither company would comment for this story, and Guccifer did not respond to a direct message on Twitter. > Working off the IP address, U.S. investigators identified Guccifer 2.0 as a particular GRU officer working out of the agency’s headquarters on Grizodubovoy Street in Moscow. (The Daily Beast’s sources did not disclose which particular officer worked as Guccifer.)

rbanffy 9y ago
What I find unlikely is that it was possible for the officer to log into the account from anything but a computer connected to a secured network. The computers that could be connected directly should never have the constructed persona's credentials. These are not amateurs. They should know better.
- dragonwriter 9y ago
  > These are not amateurs. They should know better. Yeah, in every field there are lots of cases where people end up saying this because professionals who should know better don't. Or cut corners because of resource constraints. Or, just screw up something they actually do know. Or...
  - YarickR 9y ago
    Or this is bullshit, plain and simple . You don't think outgoing connections are unproxied and unmonitored at GRU (GRU, of all things ? This is military intelligence, BTW) , do you ?

mindslight 9y ago

So then, if Russian Intelligence is responsible for helping to expose a significant criminal conspiracy in the US, maybe the news media will stop with all of the nouveau cold war bullshit and instead just thank them?

krapp 9y ago
>So then, if Russian Intelligence is responsible for helping to expose a significant criminal conspiracy in the US... Please point to any "significant criminal conspiracy" which was exposed, and which laws it was in violation of, if possible. And for bonus points, please tell us why Trump hasn't thrown Hillary into prison yet, as promised.
- stale2002 9y ago
  Sure, I'll give one. 30 thousand emails were illegally deleted, even after a court order was given telling the Hillary tech people in charge of their email service not to do so. The law broken is the court order telling them to hand over all the emails. The reason for no prosecution is because of politics. That's how the world works, shrug. Some of the hacked emails in question, could have been some of the ones that were illegally deleted in the first place. So they were in effect, undeleting emails that were illegally deleted.
  - djur 9y ago
    The hacked emails were from the DNC, dated 2015-2016. The deleted emails were on Hillary Clinton's private server, which she used during her tenure as Secretary of State, 2009-2013. There is no connection between the two sets of email whatsoever. Remember when Donald Trump responded to the DNC leaks by asking the Russians to leak Hillary's deleted emails? Yeah. That's because they're not the same thing.
- mindslight 9y ago
  The "Democratic National Committee". On its face, election fraud. Besides the loftier stuff like subverting the will of the people and the authorized government. > And for bonus points, please tell us why Trump hasn't thrown Hillary into prison yet, as promised. Because they play golf at the same country clubs, and their IRL actions aren't bound by the marketing characters they play? It would be kind of like shooting someone after you beat them in chess - totally uncool. But I don't see how this is relevant, unless you assume that by criticizing one ignorance club I must be a cheerleader for its twin?

c3534l 9y ago

I was expecting some real hightech spycraft and intrigue. Nope, the dude forgot turn on his VPN. Even well-funded state actors can be dumbasses.

ortuna 9y ago
I feel like these things are made to be found. They undermine our election process and democracy.
stevenwoo 9y ago
My VPN sometimes just goes down. There's a little icon in the tray that turns from green to red. I could set my system to not allow internet access without the VPN but that mucks about with the boot process and I'm not running spycraft.
- cynwoody 9y ago
  I'm sure GRU possesses the technical chops to put in place safeguards to guarantee against ever connecting other than through the VPN. They should do that and then hire Kaspersky to come over and audit their setup.
- fwdpropaganda 9y ago
  What I do is that I have a firewall always set up so that all connections are blocked, except connections to the one VPN IP entry point that I'm using. When VPN connection goes down, my internet goes down. Coincidentally, this also solves the problem of DNS leaks.

tardygrad 9y ago

While pointing fingers at Russia or impeaching Trump may be the options that feel good at the moment, I hope this is an opportunity to make sure something like this never happens again. This is a pipe dream and I'm not sure this is even possible, but I think the best outcome of this is to pass legislation to try and ensure that: 1. Political campaigns don't engage in the type of behaviour in the first place, and 2. Make communications more public in general - official campaigns of people running for public office must operate under the light of greater public scrutiny Democracy is only possible if accurate information is available, and the biggest takeaway for me in the last elections was just how many secrets all political players have.

catawbasam 9y ago
There need to be clear consequences, to serve as a deterrent. Having a functioning democracy is a core interest of the United States, so the consequences should be severe.
- polotics 9y ago
  Well, treason is already well defined in law. https://en.wikipedia.org/wiki/Treason_laws_in_the_United_States https://en.wikipedia.org/wiki/Treason_laws_in_the_United_Sta... No one has been executed for treason against the federal government. Yet.
aphextron 9y ago
It all comes down to campaign finance. We need pblicly funded elections with absolutely no tolerance for private money, and a set equal amount for each major party candidate. Until Citizens United is overturned, and we get some kind of legislation like this, money will continue to dominate everything. And as long as that’s the case, there will always be unethical behavior because the incentives are too great.
- orangecat 9y ago
  money will continue to dominate everything The Clinton campaign raised and spent much more money than the Trump campaign: https://www.bloomberg.com/politics/graphics/2016-presidential-campaign-fundraising/ https://www.bloomberg.com/politics/graphics/2016-presidentia...

eeks 9y ago

If GRU agents use only a single hop to ambiguate their connections when attacking their mightiest foreign opponent then we don't have much to fear from these guys.

cmurf 9y ago

Trump>Stone>Guccifer 2.0>GRU>Putin And today Trump ejects his sane national security advisor, H.R. McMaster, in favor of the hawk who was one of the four architects of the Iraq war, John Bolton. John Bolton penned the WSJ article The Legal Case for Striking North Korea First published Feb 28 2018.

runciblespoon 9y ago

This feeds into the Russia plotted to sabotage Hillarys campaign and promote Trump narrative. Which is most probably a concoction dreamed up by the deep-state as part of a conspiracy to depose a sitting president. The state security apparatus engaged in a palace coup against a sitting president.

dd36 9y ago
And 9/11 was an inside job and we never landed on the moon.
- jakeogh 9y ago
  It's really convenient to use easily debunked stuff to prevent people from looking into other things. For example, "flat earth" is not designed to convince any normal person Earth is actually flat. Paradoxically, you just "fell for" the actual utility of the "we didn't land on the moon" stuff, sure you can find genuine people that believe just about anything, but that's just a side issue. This is very common if you study disinformation a bit.
- dbt00 9y ago
  No credible evidence of either of those theories have ever been put forward. Meanwhile we have George Papadopoulos pleading guilty to lying to the FBI about his involvement in a Trump-Russia conspiracy. If anything this whole event should prove how hard it is to really pull off this kind of shady conspiracy without leaving a real trail of evidence, something the 9/11 truthers, the moon landing loons, or the false flag school shooting assholes have never been able to find because it's not there.

badrabbit 9y ago

This is why you shouldn't do VPN (or Tor) on end devices. A network device routing your traffic should do that.

throwaway84742 9y ago

From the article: "according to a source familiar with the government’s Guccifer investigation", "Working off the IP address, U.S. investigators identified Guccifer 2.0 as a particular GRU officer working out of the agency’s headquarters on Grizodubovoy Street in Moscow". IOW, they don't have jack shit, which is why the stuff I quoted above is buried towards the end of the article. How does one tie an IP address to a street address? Or to a specific person? And what does "working off" an IP address even mean? And why would he be running this from the GRU headquarters rather than from some obscure Russian bunker? I smell massive quantities of clickbait manure.

barnesto 9y ago

this is all a moot point since the DNC servers weren't hacked. just ask Wikileaks and Kim Dotcom. oh then there's all the evidence suggesting that the "hack" was indeed an inside job as the transfer rates for the data could only happen on a usb not over a tcp network.

barnesto 9y ago

this is all moot, right? there was no hack of the DNC servers. it was an inside job. https://lawandcrime.com/high-profile/bombshell-nsa-experts-say-dnc-hack-was-actually-a-leak-and-inside-job/ https://lawandcrime.com/high-profile/bombshell-nsa-experts-s... or just ask Wikileaks or Kim Dotcom.

saas_co_de 9y ago

Yeah, I am sure The Daily Beast got this story because they are such a well respected journalistic outlet. More like nobody at the NYT or WP willing to tarnish their reputation with this crap. Which is pretty bad given what they will publish.

dbt00 9y ago
Spencer Ackerman is a stellar reporter with over 15 years experience writing for TNR, Wired, and The Guardian. He's gotten a huge of scoops on the national security beat throughout the years and none of his reporting has ever been called into question.
- saas_co_de 9y ago
  > none of his reporting has ever been called into question In 2013, Ackerman was forced to take down one of his Wired stories on what he claimed was a "North Korean propaganda video", after it was revealed the film was a satire video by British travel writer Alun Hill.[16] https://en.wikipedia.org/wiki/Spencer_Ackerman https://en.wikipedia.org/wiki/Spencer_Ackerman
  - dbt00 9y ago
    Point taken. He was once taken in by a popular hoax and wrote a post on his wired blog about it, after which he apologized on twitter. https://twitter.com/attackerman/status/311868261945978881 https://twitter.com/attackerman/status/311868261945978881 To remind everyone where the plot is, I was responding to this phrase: > Yeah, I am sure The Daily Beast got this story because they are such a well respected journalistic outlet. None of his sourced reporting has ever been called into question. The original commenter was way off base with this insinuation.
    - equalunique 9y ago
      Perhaps this new Daily Beast story is evidence he has been taken in by another hoax.
9y ago

rdtsc 9y ago

Wonder how this jives alongside this other story with a confession letter from someone saying they were ordered to hack the DNC: http://www.newsweek.com/russian-hacker-stealing-clintons-emailshacking-dnc-putinsfsb-745555 http://www.newsweek.com/russian-hacker-stealing-clintons-ema... --- Konstantin Kozlovsky, a Russian citizen working for a hacker group called Lurk, confessed to hacking Clinton’s emails during a hearing about his arrest in August. An audio recording and minutes from the hearing were posted on Kozlovsky’s Facebook page, and their authenticity was reportedly confirmed by The Bell. --- He allegedly worked with someone from FSB: --- Kozlovsky identified his FSB handler as Dmitry Dokuchaev, a cybersecurity expert who worked as a hacker before joining the FSB. Dokuchaev, who used the moniker “Forb,” has been linked to a group of hackers called Shaltai Boltai, or Humpty Dumpty, --- Perhaps the DNC was hacked by both? It was a pretty large target and multiple state actors gave it a try.

retsibsi 9y ago
The book Russian Roulette says that data was stolen from the DNC by two groups of Russian hackers, who seemed to be acting separately. It says that one group was linked to Russian military intelligence (presumably the GRU) and the other was suspected of being linked to Russian intelligence, 'most likely the SVR'.
- rdtsc 9y ago
  Thanks for the book suggestion.
djur 9y ago
That headline is terrible. The DNC emails were not "Clinton's". The emails we have from Hillary Clinton were not hacked, they were released by Congress or in response to FOIA requests. There were two separate hacks of the DNC (leaked in July 2016) and John Podesta's email (leaked in October 2016), but those are unrelated.

question_that 9y ago

I can't trust anything these days but if the information is legitimate - both the government investigation and the reporting - then forgetting to use your VPN has taken down both Guccifer 2.0 and Dread Pirate Roberts. That's incredible given these comments are full of advice on how to prevent that from happening.

boipucci2point0 9y ago

I just really hate the name "Guccifer 2.0" and hope they shoot this fuck, whoever it is, because anyone who'd refer to themselves with a handle like that is bound to be a piece of shit.

lamarpye 9y ago

Interesting story. What is The Daily Beast's batting average? How often do they make contact with the Truth? Looking at their website, I learned that Joe Biden could beat up Trump because he took on a gangster name "Corn Pop" back in the day. Pretty damning stuff.

cocktailpeanuts 9y ago

Since this is "Hacker News" I would like to ask an honest question: Which is more likely of the two? 1. The hacker mistakenly sign in from Russia once. 2. The hacker intentionally sign in from Russia once. I really have no bias towards all this issue and don't really care, but I do care about media making interpretations that mislead the public, which is why I draw this question. One widely used hacking technique is to intentionally leave a trail that leads investigators down the wrong track, not just for hacking but for all crimes. I'm just having hard time understanding how people are taking for granted that a competent hacker is more likely to leave a trail by mistake instead of leaving one intentionally, because in most cases it's the latter.

Nihilartikel 9y ago
If we knew that, then we would know a lot more of the hidden variables of the current geopolitical state of play. Was the DNC hacking done for its own benefits to the hackers, or was it done as a move in a larger strategic game of indirection and manipulation? A false flag attack? A timebomb reveal set to sow chaos in the US political system after the fact? Was it the latter, but still goofed by good old human fallibility?
notacoward 9y ago
Which is the more likely of the two? 1. The hacker actually worked for GRU, which was already known to engage in such activities, and slipped up once? 2. Somebody hacked into a GRU office so they could connect from there one time and hope somebody would notice?
- cix_pkez 9y ago
  2. Governmental incompetence is all a great charade meant to make their flawlessly-executed deceptions and conspiracies more believable.
- duncanawoods 9y ago
  3. Using notepad.exe, Dave typed the GRU IP address into the server log before passing them on to Susan for her analysis

tmpacc23098 9y ago

All fake. No russians ever hacked any elections. This is just missinformation by USA. To eventually go to war with Russian.

akvadrako 9y ago

It's nice to finally have some evidence in this story, but it's good to keep in mind that there is also evidence it's an internal leak. (1) Wikileaks stated their source wasn't Russia and (2) The timestamps on the leak point to a local copy over USB2: https://theforensicator.wordpress.com/guccifer-2-ngp-van-metadata-analysis/ https://theforensicator.wordpress.com/guccifer-2-ngp-van-met...

puppetmaster400 9y ago

Media also told us reason for war is WMD. His name is Seth Rich. Wikileaks has email from Podesta say he wants him to be example. DNC chairperson Donna said on national tv she also fears for her life. Ready downvotes.

ohiovr 9y ago

So I guess we gotta use esp to figure out what these faded posts are all about. If you are going to reply to a post, maybe consider not downvoting it?

igivanov 9y ago

For what it is worth, let me quote someone's reddit comment: >"So many 'slip-ups' pointing to Russia from this guy.. you could be forgiven for thinking he's not Russian, and was in fact created by the DNC. >He CHOSE to name his computer account after the founder of the Soviet Secret Police. >He CHOSE to create/open and then save documents so the Russian name was written to metadata. >He CHOSE to use a Russian VPN service to cloak his IP address. >He CHOSE to use public web-based email services that would forward his cloaked IP. >He CHOSE to use the above to contact various media outlets on the same day. >Odd behaviour for an elite hacker. >Also, still today, none of his claims of hacking can be verified." https://www.reddit.com/r/worldnews/comments/86gglv/lone_dnc_hacker_guccifer_20_slipped_up_and/dw4ybzm/ https://www.reddit.com/r/worldnews/comments/86gglv/lone_dnc_...

shaki-dora 9y ago
The reason may actually be that Russia always wanted to be caught. They never thought Trump would win–the prize they were aiming for was general distrust of the election's integrity. It's very similar to Russia's choice to poison Litvienko with Polonium–an unnatural radioactive element that can easily be traced back to the reactor where it originated. And, similarly, the very recent chemical weapons attack in the UK, using a nerve agent only ever produced by Russia.
- TazeTSchnitzel 9y ago
  In fairness, the UK came close to not detecting the Polonium (it was just luck they had the right someone on the team) and they weren't sure Russia could have known the UK was actually capable of detecting it.
CabSauce 9y ago
To play devil's advocate... If the DNC were responsible for their own 'hack': They CHOSE to release embarrassing and damaging information right before a major election, in case they lost, so they would have an excuse if it happened? And the DNC is so competent at information security that they were able to deceive 17 (or whatever the number is) government agencies and several independent researchers?

equalunique 9y ago

This story was broke by The Daily Beast. So the person who HACKED THE DNC was dumb enough to forget to turn on his VPN and then a news outlet where Chelsea Clinton is a board member caught him? It's a totally rediculous story and likley fabricated. Unless the DNC's cybersecurity was run by literal children, the kind of sophistication needed to pull off that hack would not be by the caliber of person who would allow themselves to be traced back in the basic way this story claims. Not only that, but the original Guccifer 2.0. story was discredited many times. The documents that were released were deemed to be fake, multiple times, not just on fringe websites, but also by the MSM. "VIPS instead surmises that, after WikiLeaks' Julian Assange announced on June 12, 2016 his intention to publish Hillary Clinton-related emails, the DNC rushed to fabricate evidence that it had been hacked by Russia to defuse any potential WikiLeaks disclosures. To this end, the theory goes, the DNC used the Guccifer 2.0 online persona to release mostly harmless DNC data." https://www.bloomberg.com/view/articles/2017-08-10/why-some-u-s-ex-spies-don-t-buy-the-russia-story https://www.bloomberg.com/view/articles/2017-08-10/why-some-... Maybey this is the "insurance policy" discussed in text messages between FBI agents Peter Strzok, Lisa Page, and Andrew McCabe. The release of the new story has sleery timing with McCabe's firing last week. The whole internet was talking about how Guccifer 2.0 was fake and now today they have decided it was real. Lol!

throwawaymanbot 9y ago
The fact you used the the acronym MSM already tells me enough about your opinions. And sure enough, I look and you are on /r/thedonald... we know the type that hang there. Your Dezinformatsiya skills are laughably weak comrade.
pkilgore 9y ago
This is like ranting that Google couldn't have developed Chrome because their PR person doesn't know how to code.
- equalunique 9y ago
  Note that the story was broke by a news outlet linked to Chelsea Clinton: https://medium.com/@jashobell/the-daily-beast-is-owned-by-iac-and-chelsea-clinton-sits-on-their-board-of-directors-d6978d1e9ee5 https://medium.com/@jashobell/the-daily-beast-is-owned-by-ia...

petegrif 9y ago

How can we be confident that some of us on this forum are not trolls working to discredit the story? We can't be.

softawre 9y ago
That's exactly what a troll would say! Have some vodka, American friend.
akvadrako 9y ago
It seems very likely at least some commenters are paid trolls. If you were running a $1m disinformation campaign for either side, wouldn't you put assign a few sock puppets to hacker news?

master1puppet 9y ago

(Shadow-banning by HN moderators is free speech banning. I have to VPN just to say this:) Media also told us reason for war is WMD. His name is Seth Rich. Wikileaks has email from Podesta say he wants him to be example. DNC chairperson Donna said on national tv she also fears for her life. Ready downvotes.