4 ms·

Because it's been confirmed by multiple, independent private organizations: >The U.S. Intelligence Community concluded that some of the genuine leaks that Gucc

Because it's been confirmed by multiple, independent private organizations: >The U.S. Intelligence Community concluded that some of the genuine leaks that Guccifer 2.0 has said were part of a series of cyberattacks on the DNC were committed by two Russian intelligence groups. This conclusion is based on analyses conducted by various private sector cybersecurity individuals and firms, including CrowdStrike, Fidelis Cybersecurity, Fireeye's Mandiant, SecureWorks, ThreatConnect, Trend Micro, and the security editor for Ars Technica. https://en.wikipedia.org/wiki/Guccifer_2.0 https://en.wikipedia.org/wiki/Guccifer_2.0

a_tractor 8y ago
The citations for that wikipedia entry don't back up the assertion as conclusively as you would probably like. > This conclusion is based on analyses conducted by various private sector cybersecurity individuals and firms, including CrowdStrike, Fidelis Cybersecurity, Fireeye's Mandiant, SecureWorks, ThreatConnect, Trend Micro, and the security editor for Ars Technica We know the CrowdStrike was the firm hired by the DNC to investigate breach. They allege that the hack belongs to groups named FANCY BEAR and COZY BEAR. As far as I knew, that was the only firm that was given access to the DNC side of things. So what did all these other firms use to support their claims? And actually, what claims did they really support? For the second firm listed, Fidelis CyberSecurity, two articles are cited, one of them the paywalled WaPo, referencing a blog post: https://www.fidelissecurity.com/threatgeek/2016/06/findings-analysis-dnc-intrusion-malware https://www.fidelissecurity.com/threatgeek/2016/06/findings-... The evidence they used were malware samples provided by CrowdStrike. WaPo also reported about Mandriant's claims: >Mandiant, a cyber-forensics firm owned by FireEye, based its analysis on five DNC malware samples. In a statement to The Washington Post, Mandiant researcher Marshall Heilman said that the malware and associated servers are consistent with those previously used by “APT 28 and APT 29,’’ which are Mandiant’s names for Fancy Bear and Cozy Bear, respectively. Mandriant's allegations against APT 29 is that they use spearfishing to gain entry into an individual or group's google accounts. The WaPo article that also reported on Fidelis reported on the ThreatConnect: > Meanwhile, a third cyber-analysis firm, ThreatConnect, followed up on CrowdStrike’s analysis by looking at computer Internet protocol addresses that CrowdStrike said it had found while investigating the DNC intrusion. It discovered an Internet domain name that looked suspiciously like that of the firm the DNC had hired to manage its computer network, MIS Department. Again, per the wikipedia source, both firms used sample data provided by CrowdStrike. Then a blogpost by Threatconnect tries to build the case that Guccifer2.0 was not a lone-actor. They basically analyze Guccifer2.0 behavior and apply conjecture, essentially evaluating two opposing narratives. This is their attempt at a "conclusion": > There appears to be strong, yet still circumstantial, evidence supporting the assertions that Guccifer 2.0 is part of a D&D campaign, and not an independent actor Could be... Might be... Secureworks wrote about TG-4127 group conducting a spear phishing campaign that targeted individuals and groups using google services. The citation for TendMicro was to a PDF produced by TM describing the work of a group called "PAWN STORM," also known as Fancy Bear and Apt 28. As far as relevance to the DNC, they haven't actually done any research themselves. They simple repeat the claims made by Crowdstike: >In 2016 the Democratic National Committee (DNC) was allegedly hacked by Pawn Storm. Stolen emails were published by WikiLeaks and a site called dcleaks[.]com, a domain very likely controlled by Pawn Storm. Allegedly. Likely. I dont see conclusively. >A study of ThreatConnect showed that Guccifer 2.0 approached news media and offered them exclusive access to password-protected parts of the dcleaks[.]com site. Oh cool they are citing ThreatConnect now, who used samples provided by CrowdStrike, who the DNC paid to investigate, instead of the FBI. So they are all sourcing on CrowdStrike, or trying to support that narrative, basically. So, I dunno about that wikileaks article. There isn't really anything conclusive, and all you can do is trust CrowdStrike and the circumstantial claims made by a handful of other "Cyber Security" groups... Seems to me that someone really wants to sell this narrative and thinks throwing a bunch of "sources" that most people wont actually check is good enough. It still doesn't add up, however. This is the gist of the type of reasoning being used by all of these firms: >Registering domains that look similar to a legitimate domain name is a technique used by Fancy Bear, CrowdStrike has reported. As if "Fancy Bear" has a monopoly on this technique. I mean, wow. Who buys this crap that isn't desperate to be sold?

a_tractor 8y ago

The citations for that wikipedia entry don't back up the assertion as conclusively as you would probably like. > This conclusion is based on analyses conducted by various private sector cybersecurity individuals and firms, including CrowdStrike, Fidelis Cybersecurity, Fireeye's Mandiant, SecureWorks, ThreatConnect, Trend Micro, and the security editor for Ars Technica We know the CrowdStrike was the firm hired by the DNC to investigate breach. They allege that the hack belongs to groups named FANCY BEAR and COZY BEAR. As far as I knew, that was the only firm that was given access to the DNC side of things. So what did all these other firms use to support their claims? And actually, what claims did they really support? For the second firm listed, Fidelis CyberSecurity, two articles are cited, one of them the paywalled WaPo, referencing a blog post: https://www.fidelissecurity.com/threatgeek/2016/06/findings-analysis-dnc-intrusion-malware https://www.fidelissecurity.com/threatgeek/2016/06/findings-... The evidence they used were malware samples provided by CrowdStrike. WaPo also reported about Mandriant's claims: >Mandiant, a cyber-forensics firm owned by FireEye, based its analysis on five DNC malware samples. In a statement to The Washington Post, Mandiant researcher Marshall Heilman said that the malware and associated servers are consistent with those previously used by “APT 28 and APT 29,’’ which are Mandiant’s names for Fancy Bear and Cozy Bear, respectively. Mandriant's allegations against APT 29 is that they use spearfishing to gain entry into an individual or group's google accounts. The WaPo article that also reported on Fidelis reported on the ThreatConnect: > Meanwhile, a third cyber-analysis firm, ThreatConnect, followed up on CrowdStrike’s analysis by looking at computer Internet protocol addresses that CrowdStrike said it had found while investigating the DNC intrusion. It discovered an Internet domain name that looked suspiciously like that of the firm the DNC had hired to manage its computer network, MIS Department. Again, per the wikipedia source, both firms used sample data provided by CrowdStrike. Then a blogpost by Threatconnect tries to build the case that Guccifer2.0 was not a lone-actor. They basically analyze Guccifer2.0 behavior and apply conjecture, essentially evaluating two opposing narratives. This is their attempt at a "conclusion": > There appears to be strong, yet still circumstantial, evidence supporting the assertions that Guccifer 2.0 is part of a D&D campaign, and not an independent actor Could be... Might be... Secureworks wrote about TG-4127 group conducting a spear phishing campaign that targeted individuals and groups using google services. The citation for TendMicro was to a PDF produced by TM describing the work of a group called "PAWN STORM," also known as Fancy Bear and Apt 28. As far as relevance to the DNC, they haven't actually done any research themselves. They simple repeat the claims made by Crowdstike: >In 2016 the Democratic National Committee (DNC) was allegedly hacked by Pawn Storm. Stolen emails were published by WikiLeaks and a site called dcleaks[.]com, a domain very likely controlled by Pawn Storm. Allegedly. Likely. I dont see conclusively. >A study of ThreatConnect showed that Guccifer 2.0 approached news media and offered them exclusive access to password-protected parts of the dcleaks[.]com site. Oh cool they are citing ThreatConnect now, who used samples provided by CrowdStrike, who the DNC paid to investigate, instead of the FBI. So they are all sourcing on CrowdStrike, or trying to support that narrative, basically. So, I dunno about that wikileaks article. There isn't really anything conclusive, and all you can do is trust CrowdStrike and the circumstantial claims made by a handful of other "Cyber Security" groups... Seems to me that someone really wants to sell this narrative and thinks throwing a bunch of "sources" that most people wont actually check is good enough. It still doesn't add up, however. This is the gist of the type of reasoning being used by all of these firms: >Registering domains that look similar to a legitimate domain name is a technique used by Fancy Bear, CrowdStrike has reported. As if "Fancy Bear" has a monopoly on this technique. I mean, wow. Who buys this crap that isn't desperate to be sold?