12 ms·

Relevent paragraphs: > [An intelligence researcher] led an investigation at ThreatConnect that tried to track down Guccifer from the metadata in his emails. Bu

by geowwy 9y ago

Relevent paragraphs: > [An intelligence researcher] led an investigation at ThreatConnect that tried to track down Guccifer from the metadata in his emails. But the trail always ended at the same data center in France. Ehmke eventually uncovered that Guccifer was connecting through an anonymizing service called Elite VPN, a virtual private networking service that had an exit point in France but was headquartered in Russia. > But on one occasion, The Daily Beast has learned, Guccifer failed to activate the VPN client before logging on. As a result, he left a real, Moscow-based Internet Protocol address in the server logs of an American social media company, according to a source familiar with the government’s Guccifer investigation. Twitter and WordPress were Guccifer 2.0’s favored outlets. Neither company would comment for this story, and Guccifer did not respond to a direct message on Twitter. > Working off the IP address, U.S. investigators identified Guccifer 2.0 as a particular GRU officer working out of the agency’s headquarters on Grizodubovoy Street in Moscow. (The Daily Beast’s sources did not disclose which particular officer worked as Guccifer.)

rbanffy 9y ago
What I find unlikely is that it was possible for the officer to log into the account from anything but a computer connected to a secured network. The computers that could be connected directly should never have the constructed persona's credentials. These are not amateurs. They should know better.
- dragonwriter 9y ago
  > These are not amateurs. They should know better. Yeah, in every field there are lots of cases where people end up saying this because professionals who should know better don't. Or cut corners because of resource constraints. Or, just screw up something they actually do know. Or...
  - YarickR 9y ago
    Or this is bullshit, plain and simple . You don't think outgoing connections are unproxied and unmonitored at GRU (GRU, of all things ? This is military intelligence, BTW) , do you ?
    - deleted 9y ago
      [deleted]
    - polotics 9y ago
      military intelligence... greed, incompetence, office politics
    - chillwaves 9y ago
      Have you worked with the US Gov't in any capacity? They are just regular people. It's not a world of super spies. I am sure GRU is not that much different. Even the top folks eat corn flakes like everyone else. People make mistakes all the time. This might be bullshit but just saying so is hardly a compelling argument. I will wait for more evidence one way or another myself, with the obvious disclaimer that anything could be bullshit.
      - cc81 9y ago
        For example when CIA accidentally lost control over all those hacker tools.
- zaroth 9y ago
  Or one log entry was altered to insert the desired IP address — because the chain of custody of these logs is so ironclad? Or a MITM altering packets to generate the desired log entry.... “We found an IP address in a log which lets us tie Guccifer 2.0 to a specific GRU agent” is laughable on the face of it. But with the absolute shitshow that the investigation has been to-date I personally am way past caring, and way past beleiving anything at all to do with the Russia narrative.
  - tiles 9y ago
    Thirteen indictments of foreign agents is a shitshow?
    - sattoshi 9y ago
      Seems like a political show, yes.
      - enraged_camel 9y ago
        Why? edit: lol, even asking a simple question is worth downvotes apparently. Oh well, I got karma to burn. Bring it on.
      - ineedasername 9y ago
        Political? Meuller is a Republican, appointed by a Republican. Our country was attacked, maybe you should start acting like that's not just some "political" narrative, because it's still happening
        red_monk 9y ago
        some trolling on facebook == attack? yea, I think the radical lseft is scoring the biggest attacks on western culture everyday but the news media doesn't cover it whatsoever.
        zaroth 9y ago
        If you think it's not absolutely a political narrative (and a shitshow) I really don't know what to say. I'm not sure what you mean by "it's still happening" but if you're talking about abusing social networks to spread discord, I mean, we're watching the implosion of Facebook in real-time, I'd say that the wheels are pretty certainly fucking turning. Where we end up, and if it's better than where we started, well... The only thing I know is this -- no one is right, no one is good, no one is clean, and there's enough corruption on all sides of this to make anyone sick. You can pick whichever specific aspects of it support one side or another, but I personally think the things we do have hard evidence of point to; 1) An incredibly fucked up situation at the top of the FBI and Justice Department 2) A media which has largely lost the ability to separate reporting from editorial 3) A little trolling by Russian during the election to stir the pot 4) A very close election which was won by the "wrong" person, and a large percentage of Americans who are desperate to unseat him by any means possible
- nickpsecurity 9y ago
  Our people screwed this basic principle up regularly with an otherwise secure product per a defector from a foreign, intelligence service: "If you have a STU-III secure telephone, use it, but remember that even the STU-III depends upon strict telephone security discipline. A defector from one of the foreign intelligence services that monitor U.S. communications reports that STU-III encryption is fairly secure. However, he also advised that the chitchat that occurs before the STU-III is switched to secure mode and after it is switched off of secure mode is a bonanza of valuable information. Communications monitors can identify STU-III lines, so these phone numbers are obvious targets. Therefore, a STU-III line being used in non-secure mode may be more likely to be monitored than another line that never carries encrypted communications. Maintaining strict telephone security discipline is critical." (my emphasis added) http://www.tscm.com/stu.html http://www.tscm.com/stu.html I'll also note that stopping these accidental leaks was part of the motivation for the Compartmented Mode Workstations that weren't secure enough at B1 class to stop well-funded attacks that B3 or A1 might. Risks ranged from cut/paste to classified docs making it onto unclassified networks. The systems' security kernels would look at the labels to catch that. The kinds of leaks they addressed still happen to both innocent users and criminals.
dahdum 9y ago
Glad to see actual evidence, too often we see tenuous links that are touted as proof positive. The DNC leaks were pretty bad for the campaign, but ultimately of their own doing. Edit: downvoted I assume for not specifying technical evidence, like this garbage news story about dns traffic: http://www.slate.com/articles/news_and_politics/cover_story/2016/10/was_a_server_registered_to_the_trump_organization_communicating_with_russia.html http://www.slate.com/articles/news_and_politics/cover_story/...
- Amezarak 9y ago
  "A source familiar with the government's investigation" is about as far from actual evidence as you can get. Especially in the past year, but certainly throughout the past half-century, "anonymous" government sources have been demonstrated to be completely wrong or intentionally lying to advance a political agenda. Moreover, note the weasel wording. For all we know, "familiar with the government's investigation" just means "the guy who brings in the water bottles overheard some office gossip." I would take this story with a grain of salt.
  - dahdum 9y ago
    Oh for sure, but at least they are claiming something that passes the smell test technically. I read some of the BS reports that firms have put out, often they made their conclusion first (since they were paid on that basis) and connected the dots like /r/pizzagate to prove it.
    - Amezarak 9y ago
      Understood. I think the idea that it could be traced back to the GRU is highly likely, though I do have some trouble with the idea they were able to identify a specific agent based on the IP address - what, does Russia assign static IPs to each and every agent in the office? Of course, there could have been more legwork we're not told about, or this could be a case of parallel construction, but who knows. I did want to point out the sourcing either way, though. It's really distressing to me the way anonymous sourcing has really taken off lately, and that most people appear to be entirely credulous despite the lessons we learned back during the Bush administration. It rarely even gets questioned, though even the past year in particular has served up frequent and egregious object lessons of why anonymous government sources cannot simply be taken at their word. The sad fact of the matter is that the vast majority of anonymous sources are not leaking information to edify the American people. They are leaking information because they have an agenda. That doesn't mean that we can simply ignore them. Sometimes the information is false, sometimes critical context is left out, but sometimes it is true and extremely important. It means we have to consider what they say very carefully and why they might be saying it.
deleted 9y ago
[deleted]
bigiain 9y ago
Opsec is hard - you only need to fuck up once...
- CapacitorSet 9y ago
  If all it takes is "one occasion" for investigators to believe you're Russian, it's also definitely easy to throw investigations off course.
  - kbenson 9y ago
    One very hard to fake set of connected facts that corroborate each other, validate a suspicion, and match a motive. It generally only takes one occasion of a videotape catching you stealing and an eyewitness corroboration for you to be believed the thief as well.
    - vageli 9y ago
      This isn't video evidence though, it's an IP address. I don't think this metaphor is similar at all.
      - pwtweet 9y ago
        There was real time video surveillance of the building, both external/internal by Dutch and another unnamed European agency. Also RT published the names of the two officers who controlled the G2 account: Sergei Afanasyev, GRU Deputy Chief and Grigoriy Viktorovich Molchanov, Head of the GRU Academy.
        rdtsc 9y ago
        > Also RT published the names of the two officers who controlled the G2 account: Sergei Afanasyev, GRU Deputy Chief and Grigoriy Viktorovich Molchanov, Head of the GRU Academy. It's surprising that RT published those. I thought it was an entity controlled by the Russian government. Why would it be publishing the names of its own officers when supposedly the said officers went out of their way to appear Romanian and not Russian.
YarickR 9y ago
Where did they publish "IP-to-street address" yellow books for GRU ? Is the same data available for CIA ? For MI6 ? You know, trying to convince specifically knowledgeable audience isn't something you can do easily .
qwaitwhat 9y ago
Keeping yourself private is a hard problem, what with so many places in your software stack where you can leak your identity. This is why we need software that will _continuously_ and _automatically_ anonymize you on all your devices, from desktops to laptops to smartphones. And, then, on the end of your internet travels, all exit node vulnerabilities (in Tor Browser) need to be _automatically_ and _always_ mitigated. May I point you to my project which solves these problems? I am just asking for your comments on my project description, not any money. You can see the link to my HN posting in my profile. I think the scourge of mass surveillance (indirectly the problem of seeking complete anonymity) can be defeated with some patient work.
chatmasta 9y ago
How do they know the Moscow IP was not another proxy?
- threeseed 9y ago
  Probably because they have seen that IP before whilst investigating other cases.
  - blhack 9y ago
    How does that answer the question?
    - chillwaves 9y ago
      Look, you have access to the same information as the person you are asking. Do you really expect them to know the answer? Wait for more evidence to come out.
- forapurpose 9y ago
  It was in GRU offices, and attributable to a particular officer. The article has more.
JarlUlvi 9y ago
"Guccifer 2.0 sprang into existence on June 15, 2016, hours after a report by a computer security firm forensically tied Russia to an intrusion at the Democratic National Committee." There have already been serious questions raised about the accuracy of the Crowdstrike attribution, particularly when the alternative theory about Seth Rich taking it via USB has a stronger evidentiary trail. https://theforensicator.wordpress.com/guccifer-2-ngp-van-metadata-analysis/ https://theforensicator.wordpress.com/guccifer-2-ngp-van-met...
1337biz 9y ago
I hope those investigators know about cascading VPNs and hacked personal Computers that are used as VPNs/proxies...

by geowwy 9y ago

rbanffy 9y ago

What I find unlikely is that it was possible for the officer to log into the account from anything but a computer connected to a secured network. The computers that could be connected directly should never have the constructed persona's credentials. These are not amateurs. They should know better.

dragonwriter 9y ago
> These are not amateurs. They should know better. Yeah, in every field there are lots of cases where people end up saying this because professionals who should know better don't. Or cut corners because of resource constraints. Or, just screw up something they actually do know. Or...
- YarickR 9y ago
  Or this is bullshit, plain and simple . You don't think outgoing connections are unproxied and unmonitored at GRU (GRU, of all things ? This is military intelligence, BTW) , do you ?
  - deleted 9y ago
    [deleted]
  - polotics 9y ago
    military intelligence... greed, incompetence, office politics
  - chillwaves 9y ago
    Have you worked with the US Gov't in any capacity? They are just regular people. It's not a world of super spies. I am sure GRU is not that much different. Even the top folks eat corn flakes like everyone else. People make mistakes all the time. This might be bullshit but just saying so is hardly a compelling argument. I will wait for more evidence one way or another myself, with the obvious disclaimer that anything could be bullshit.
    - cc81 9y ago
      For example when CIA accidentally lost control over all those hacker tools.
zaroth 9y ago
Or one log entry was altered to insert the desired IP address — because the chain of custody of these logs is so ironclad? Or a MITM altering packets to generate the desired log entry.... “We found an IP address in a log which lets us tie Guccifer 2.0 to a specific GRU agent” is laughable on the face of it. But with the absolute shitshow that the investigation has been to-date I personally am way past caring, and way past beleiving anything at all to do with the Russia narrative.
- tiles 9y ago
  Thirteen indictments of foreign agents is a shitshow?
  - sattoshi 9y ago
    Seems like a political show, yes.
    - enraged_camel 9y ago
      Why? edit: lol, even asking a simple question is worth downvotes apparently. Oh well, I got karma to burn. Bring it on.
    - ineedasername 9y ago
      Political? Meuller is a Republican, appointed by a Republican. Our country was attacked, maybe you should start acting like that's not just some "political" narrative, because it's still happening
      - red_monk 9y ago
        some trolling on facebook == attack? yea, I think the radical lseft is scoring the biggest attacks on western culture everyday but the news media doesn't cover it whatsoever.
      - zaroth 9y ago
        If you think it's not absolutely a political narrative (and a shitshow) I really don't know what to say. I'm not sure what you mean by "it's still happening" but if you're talking about abusing social networks to spread discord, I mean, we're watching the implosion of Facebook in real-time, I'd say that the wheels are pretty certainly fucking turning. Where we end up, and if it's better than where we started, well... The only thing I know is this -- no one is right, no one is good, no one is clean, and there's enough corruption on all sides of this to make anyone sick. You can pick whichever specific aspects of it support one side or another, but I personally think the things we do have hard evidence of point to; 1) An incredibly fucked up situation at the top of the FBI and Justice Department 2) A media which has largely lost the ability to separate reporting from editorial 3) A little trolling by Russian during the election to stir the pot 4) A very close election which was won by the "wrong" person, and a large percentage of Americans who are desperate to unseat him by any means possible
nickpsecurity 9y ago
Our people screwed this basic principle up regularly with an otherwise secure product per a defector from a foreign, intelligence service: "If you have a STU-III secure telephone, use it, but remember that even the STU-III depends upon strict telephone security discipline. A defector from one of the foreign intelligence services that monitor U.S. communications reports that STU-III encryption is fairly secure. However, he also advised that the chitchat that occurs before the STU-III is switched to secure mode and after it is switched off of secure mode is a bonanza of valuable information. Communications monitors can identify STU-III lines, so these phone numbers are obvious targets. Therefore, a STU-III line being used in non-secure mode may be more likely to be monitored than another line that never carries encrypted communications. Maintaining strict telephone security discipline is critical." (my emphasis added) http://www.tscm.com/stu.html http://www.tscm.com/stu.html I'll also note that stopping these accidental leaks was part of the motivation for the Compartmented Mode Workstations that weren't secure enough at B1 class to stop well-funded attacks that B3 or A1 might. Risks ranged from cut/paste to classified docs making it onto unclassified networks. The systems' security kernels would look at the labels to catch that. The kinds of leaks they addressed still happen to both innocent users and criminals.

dahdum 9y ago

Glad to see actual evidence, too often we see tenuous links that are touted as proof positive. The DNC leaks were pretty bad for the campaign, but ultimately of their own doing. Edit: downvoted I assume for not specifying technical evidence, like this garbage news story about dns traffic: http://www.slate.com/articles/news_and_politics/cover_story/2016/10/was_a_server_registered_to_the_trump_organization_communicating_with_russia.html http://www.slate.com/articles/news_and_politics/cover_story/...

Amezarak 9y ago
"A source familiar with the government's investigation" is about as far from actual evidence as you can get. Especially in the past year, but certainly throughout the past half-century, "anonymous" government sources have been demonstrated to be completely wrong or intentionally lying to advance a political agenda. Moreover, note the weasel wording. For all we know, "familiar with the government's investigation" just means "the guy who brings in the water bottles overheard some office gossip." I would take this story with a grain of salt.
- dahdum 9y ago
  Oh for sure, but at least they are claiming something that passes the smell test technically. I read some of the BS reports that firms have put out, often they made their conclusion first (since they were paid on that basis) and connected the dots like /r/pizzagate to prove it.
  - Amezarak 9y ago
    Understood. I think the idea that it could be traced back to the GRU is highly likely, though I do have some trouble with the idea they were able to identify a specific agent based on the IP address - what, does Russia assign static IPs to each and every agent in the office? Of course, there could have been more legwork we're not told about, or this could be a case of parallel construction, but who knows. I did want to point out the sourcing either way, though. It's really distressing to me the way anonymous sourcing has really taken off lately, and that most people appear to be entirely credulous despite the lessons we learned back during the Bush administration. It rarely even gets questioned, though even the past year in particular has served up frequent and egregious object lessons of why anonymous government sources cannot simply be taken at their word. The sad fact of the matter is that the vast majority of anonymous sources are not leaking information to edify the American people. They are leaking information because they have an agenda. That doesn't mean that we can simply ignore them. Sometimes the information is false, sometimes critical context is left out, but sometimes it is true and extremely important. It means we have to consider what they say very carefully and why they might be saying it.

deleted 9y ago

[deleted]

bigiain 9y ago

Opsec is hard - you only need to fuck up once...

CapacitorSet 9y ago
If all it takes is "one occasion" for investigators to believe you're Russian, it's also definitely easy to throw investigations off course.
- kbenson 9y ago
  One very hard to fake set of connected facts that corroborate each other, validate a suspicion, and match a motive. It generally only takes one occasion of a videotape catching you stealing and an eyewitness corroboration for you to be believed the thief as well.
  - vageli 9y ago
    This isn't video evidence though, it's an IP address. I don't think this metaphor is similar at all.
    - pwtweet 9y ago
      There was real time video surveillance of the building, both external/internal by Dutch and another unnamed European agency. Also RT published the names of the two officers who controlled the G2 account: Sergei Afanasyev, GRU Deputy Chief and Grigoriy Viktorovich Molchanov, Head of the GRU Academy.
      - rdtsc 9y ago
        > Also RT published the names of the two officers who controlled the G2 account: Sergei Afanasyev, GRU Deputy Chief and Grigoriy Viktorovich Molchanov, Head of the GRU Academy. It's surprising that RT published those. I thought it was an entity controlled by the Russian government. Why would it be publishing the names of its own officers when supposedly the said officers went out of their way to appear Romanian and not Russian.

YarickR 9y ago

Where did they publish "IP-to-street address" yellow books for GRU ? Is the same data available for CIA ? For MI6 ? You know, trying to convince specifically knowledgeable audience isn't something you can do easily .

qwaitwhat 9y ago

Keeping yourself private is a hard problem, what with so many places in your software stack where you can leak your identity. This is why we need software that will _continuously_ and _automatically_ anonymize you on all your devices, from desktops to laptops to smartphones. And, then, on the end of your internet travels, all exit node vulnerabilities (in Tor Browser) need to be _automatically_ and _always_ mitigated. May I point you to my project which solves these problems? I am just asking for your comments on my project description, not any money. You can see the link to my HN posting in my profile. I think the scourge of mass surveillance (indirectly the problem of seeking complete anonymity) can be defeated with some patient work.

chatmasta 9y ago

How do they know the Moscow IP was not another proxy?

threeseed 9y ago
Probably because they have seen that IP before whilst investigating other cases.
- blhack 9y ago
  How does that answer the question?
  - chillwaves 9y ago
    Look, you have access to the same information as the person you are asking. Do you really expect them to know the answer? Wait for more evidence to come out.
forapurpose 9y ago
It was in GRU offices, and attributable to a particular officer. The article has more.

JarlUlvi 9y ago

"Guccifer 2.0 sprang into existence on June 15, 2016, hours after a report by a computer security firm forensically tied Russia to an intrusion at the Democratic National Committee." There have already been serious questions raised about the accuracy of the Crowdstrike attribution, particularly when the alternative theory about Seth Rich taking it via USB has a stronger evidentiary trail. https://theforensicator.wordpress.com/guccifer-2-ngp-van-metadata-analysis/ https://theforensicator.wordpress.com/guccifer-2-ngp-van-met...

1337biz 9y ago

I hope those investigators know about cascading VPNs and hacked personal Computers that are used as VPNs/proxies...