Hacker News new | ask | show | jobs
by nl 3232 days ago
This is stupid. No intruder is going to copy files straight to their home computer. They'll use a compromised server somewhere, and there is plenty of server to server bandwidth.

It's fine to be skeptical of course, and to be very skeptical of direct "hacking the election" (whatever that means) claims.

But there is plenty of public evidence that Russia was involved in the DNC hack. This evidence was available before the election, which makes it more credible against claims of political interference.

I've posted this before, but I think it's important people understand what public evidence is available:

2014 report into ATP-28: https://www.fireeye.com/blog/threat-research/2014/10/apt28-a..., presenting pretty compelling (if circumstantial) evidence that group is Russian state backed.

(July) 2016 report into the DNC hacking, showing it was first breached by ATP-29 (The other Russian state backed hacking group), but the leaks almost certainly came from a second breach by ATP-28 later: https://www.crowdstrike.com/blog/bears-midst-intrusion-democ...

5 comments

My question would be, has Julian lied about sources before, and would he deviate from that if he didn't?

His claim is that the source is not Russia --people who were happy to see Julian leak things (and believe his leaks) while Bush was president are now calling him a puppet of Putin. I have no idea if Putin has goods on him. Or whether Julian is just a medium. It is, however, interesting to see people shift along political axes though.

If there was a Russian angle, I think their aim was to cause uncertainty regardless of winner. Be it Trump or Hillary, whoever the winner was, the voters of the opposition would question the results --despite there being no actual election hacking (altering the vote count).

One interesting thing though is that since the media writ large expected Hillary to win, had she won, this same evidence would have been "page 6" news and would have been rather quickly forgotten but for a few "sore losers".

It should be noted that the entirety of the material leaked by Assange would be consistent with "Russian agent" theory (including variations along the lines of him not being directly in service, but getting backing because of being useful, even if he has his own reasons).

It might not be very obvious from inside US, but the whole mess with Iraq and Afghan wars, and especially everything that Wikileaks exposed about them, is one of the biggest providers of source material for Russian "whataboutism" (see also: https://en.wikipedia.org/wiki/And_you_are_lynching_negroes). In early 00s, it was mainly useful to justify the way Russia handled Chechnya. But from 2008 on, it became more and more important - South Ossetia, Crimea, Donbass, Syria.

With that in mind, leaks about any American administration serve those goals. Bush was certainly fair game. As do any leaks that concern any Western countries, their allies, and affiliated countries. Which happens to be exactly what Wikileaks has been focusing on.

Now, this doesn't mean that those leaks don't have any further value, in particular, to citizens of the affected countries. This part of it is where you generally see a lot of partisanship when judging said value.

I don't get why people are so trustful of Assagne's assurances the source wasn't Russian. Unless he hacked it himself or was looking over the shoulder of the guy who hacked it, he simply cannot know who the ultimate source of the material is. The person he got it from may very well not have been Russian. But who did that person get it from? It's no different than a Tor exit node delivering information it receives: it simply isn't in a position to know the true origin.
The fact that Assange has come out very hard trying to imply it was Seth Rich and not Russians is itself the most suspicious thing.

1. He can't possibly know if Russia is the true source.

2. Seth Rich is a classic KGB style conspiracy theory with literally not one shred of evidence, at all.

So he's doing two very odd things here that he's never done. He's saying Russia is NOT the source AND Seth Rich IS the source.

It's typical for someone with good intentions to find themselves owned by a spy agency. Assange is most likely in so deep he can't fix it.

It's a fact he's taken money from Russia and the theory of him being compromised by them goes back years before the election. He's the one that arranged for Snowden to go to Russia.

So he's compromised and a tool now. It doesn't matter if he was once free or not at this point.

Putin's goal is to do whatever benefits him. Sowing dissent and confusion in the US works to his benefit. I'm sure Russian intelligence had a hand in things, either directly or by proxy, but like any intelligence operation, creating distractions, promoting false leads and casting dispersion is part of the game. Putin was a KGB counter-intelligence officer. His administration is packed with ex KGB and FSB personnel. He knows what's he doing and Russia is playing our political divisions against us and manipulating us.
From the intelligence community assessment [0]:

> The Kremlin’s principal international propaganda outlet RT (formerly Russia Today) has actively collaborated with WikiLeaks. RT’s editor-in-chief visited WikiLeaks founder Julian Assange at the Ecuadorian Embassy in London in August 2013, where they discussed renewing his broadcast contract with RT, according to Russian and Western media. Russian media subsequently announced that RT had become "the only Russian media company" to partner with WikiLeaks and had received access to "new leaks of secret information." RT routinely gives Assange sympathetic coverage and provides him a platform to denounce the United States.

[0] https://www.dni.gov/files/documents/ICA_2017_01.pdf

WL also worked with the NYT and The Guardian and no one was calling him a puppet of the US or the UK.

Sure, it's possible he's FSB (or whatever) secret unit and he's their Trojan horse --but no one was saying that during the Bush years (or even Obama minus '16). Only now do they say, oh, he's such a puppet. It's hard to take the allegation seriously when previously many of the same people had no problem with him.

There's a big difference between NYT/Guardian, which de facto are somewhat independent private media (and not quite aligned with Trump and May), and RT, which is a fully controlled instrument of the state, implementing only state policy.
People in the intelligence community consider Snowden a Russian asset now. Russia could've flipped or co-opted Assange since the Bush years, or maybe it's only now coming out. Either way much of this stuff is classified, so we can't really know details one way or the other. But if you keep up with folks in the IC and look into how Russia does warfare, you see they've been doing this forever, and they're pros at it.
This is speculation and personal opinion, unlike the stuff I wrote above.

I suspect what happened is that the hacking groups gave Wikileaks the dump via a cut-out. It's entirely possible that cut-out isn't aware how the data was obtained.

I don't think Assange is a Russian agent (even though he receives money from RT etc). I think he has his own motives. At the time this was more anti-Clinton that pro-Trump specifically.

More recently his Tweets have become more supportive of Trump personally (although interestingly not really his agendas necessarily). My uncharitable suspicion is that he's hoping for a presidential pardon.

this same evidence would have been "page 6" news and would have been rather quickly forgotten but for a few "sore losers".

Of course. There's plenty of similar evidence that the Russians also supported the Green party and Sanders campaigns in various forms. No one talks about them because they ended up not mattering.

Isn't it most plausible Russia is in every party and branch as much as possible, so whoever wins they win? We need Russia out of our government all together and not make it a partisan issue.
If you want Russia to pull back, you have to pull back too (ala Bill Clinton detente) Pull back on the sanctions, pull back on hovering over and picking up pieces in their former sphere of influence (former central Asia soviet reps).

We might be able to influence N Korea with these tactics, but Russia has a lot of natural resources, people and materiel. It's a diff game.

You have had (some) people on the left defending Kim Jun-un's actions as predictable (he's being bullied, etc). Putin's are predictable too, given what he has to work with.

I think we'd be better off reluctantly working with him (in the ME, for ex.) than blocking them every corner. It sets them back into a cold-war mentality. We (the world) need the biggest powers, US, CN, RU, to get along, if not be friends. We don't see eye to eye in many things (human rights wise, ex, pollution, ex) but we can work toward a more stable planet.

Why do you believe that the Russian reaction to pulling back would be to pull back as well? If anything, all experience shows that they'll use that to do a power grab in the neighbouring countries instead. Treating "sphere of influence" as a valid concept is immoral, it essentially means allowing Russia to do whatever they want to others against their will; there's a good reason why their neighbours are allying with the west - it's because they want protection from being "sphereofinfluenced".

If anything, we can say that the current sanctions and other have been somewhat effective in deescalating violence, and if the west would have pulled back, then we'd have Ukraine dismembered by now through increased direct Russian military involvement.

Nothing "sets back" Russia to cold war mentality; they have never left it, won't will without a regime change, they won't stop treating the west as their enemy and they will aggressively (re)take the now independent states we let them to.

Do you think the West has no sphere of influence?

And, was it Russia that expanded to the NATO borders, or were the NATO borders that expanded to eventually reach Russia?

(I'm an American).

Amazing doesn't even begin to cover Americans complaining about foreign interference in our elections.

There's hardly a country up and down Central and South America, North Africa, and the Middle East whose elections we haven't meddled in. Start with the Shah of Iran, Mubarak, Hussein before he turned on us, the Bay of Pigs, Allende/Pinochet, etc.

Which is not to say we shouldn't push back on Russian interference in our elections, but just wow. I'd like to see us keep out of everyone else's elections too.

I mean, yes and no.

Back in those days it was more do or die. Let the soviets gain ground and grow their ideology or stop it within reason [stop short of no-proxy hot wars].

If we look at the toll paid by countries which went 2nd world vs those that stayed/coherced on our side, the suffering was much greater in those that went full soviet.

And often times people who point to Allende etc as bad will not point to Ghadafy or all the rest in N. Africa Obama set loose.

The sanctions are for stuff like them hacking another government or invading a sovereign country. It's hard to be friends with a nation through those situations (and irresponsible not to react at all)
What did we do about Ukraine? A little slap? He does not care. Looks like Hillary was comms with Ukraine, presumably to act tougher towards Moscow.

We just need to recall how we felt when they pranced around Cuba. We're doing similar in the eastern block (not the same degree) but all the same it gets in their craw.

Russian infiltrated US parties voting sanctions on Russia. Really?
I'm willing to go along with that.

I too would not be surprised if he favors Trump via omission rather than commission. Julian likely is severely allergic to establishment politicians because he rightfully sees them as two sides of the same coin who like Hillary see him as a US enemy, while Trump seems more pragmatic about it.

He doesn't know the source. The source claims not to be Russia, and Assange believes it because he's a useful idiot.
Assange hardly seems like an idiot.

Spiteful interloper who carefully chooses his words, relishing his part in the political upheaval of a nation-state which has effectively imprisoned him in a London embassy? Maybe.

How's that working out for him? Trump is no more in his court than Clinton was, Ecuador has cut off his Internet access, and he's squandered any support he had by helping elect an even bigger idiot.
On the other hand, he hasn't joked about extrajudicially "droning him". So there is that. On the other hand, most of DC saw Hillary as a war hawk.
The source of that purported joke is "sources in the State Department" that talked to TruePundit. If you believe TruePundit had sources in Clinton's State Department, you might believe that Seth Rich leaked the DNC emails to WikiLeaks after participating in child sex trafficking in the basement of a basement-less pizza parlor.
In October - before the election - Trump said "I love Wikileaks"[1].

It hasn't worked out well, but the logic is reasonable.

[1] http://thehill.com/blogs/blog-briefing-room/news/330052-wiki...

> It's fine to be skeptical of course, and to be very skeptical of direct "hacking the election" (whatever that means) claims.

It means hacking provably vulnerable voting systems [1] at a small number of polling locations in pivotal counties in swing states.

"Hacking the election" is neither inconceivable nor intractable. It's just something the media and government have to ensure we don't think about.

[1] http://www.gizmodo.co.uk/2017/08/a-conference-of-hackers-tot...

Yes, that's the most defensible position to take on what "hacking the election" could mean.

There are plenty of other possible meanings, and people feel differently about the many possible definitions.

The word "Hack" does not just mean "illegal intrusion of a computer system"

I quite enjoy the irony of pointing this out on HackerNews...

The other piece of irony is that leading up to election night "our voting systems are secure", "we have taken steps to ensure your vote is not tampered", etc., etc. since Hillary was predicted and landslide, no one bothered to care. But after the upset, now all those assurances are disbelieved.
The other piece of irony is that leading up to election night "our voting systems are secure", "we have taken steps to ensure your vote is not tampered", etc., etc. since Hillary was predicted and landslide, no one bothered to care.

Only if you weren't paying attention! There was plenty of noise around about the attacks at the time, if you looked for the signs.

In August 2016 The Federal Government made some moves to designate the election machines and systems as critical infrastructure so they could protect them[1]. Predictably, this was opposed[2].

After the election, Obama did it anyway[3]. As it turns out many states had asked for assistance securing their systems[4].

[1] http://www.politico.com/story/2016/08/election-cyber-securit...

[2] http://www.nextgov.com/cybersecurity/2016/08/some-swing-stat...

[3] https://www.theatlantic.com/technology/archive/2017/01/why-t...

[4] http://edition.cnn.com/2017/08/02/politics/cyber-hacking-rus...

Wasn't the server in question unpatched for quite some time, meaning that any number of adversaries might have hacked it while it was vulnerable?

Chances are at least a half dozen state actors and another half dozen private entities would have had a strong chance of being privy to the exploits used to hack the server and would likely have been on the ball enough to do so when it was vulnerable.

In any case, the "who exploited the vulnerable server?" question is less relevant to American democracy than digging into the questionable conduct revealed by the emails.

It's insane that this is still being discussed. But I guess stuff gets obfuscated when it becomes politicized. I've got a (non-comprehensive) chronological list of public reports on this hack and its attribution-

Croudstrike (June 15 2016) https://www.crowdstrike.com/blog/bears-midst-intrusion-democ... "are believed to be closely linked to the Russian government’s powerful and highly capable intelligence services"

SecureWorks (June 16 2016) https://www.secureworks.com/research/threat-group-4127-targe... "moderate confidence that the group is operating from the Russian Federation and is gathering intelligence on behalf of the Russian government"

Fidelis (June 20 2016) http://www.threatgeek.com/2016/06/dnc_update.html https://archive.fo/yPp9K "this settles the question of “who was responsible for the DNC attack,”"

SecureWorks - 2nd Post (June 26 2016) https://www.secureworks.com/research/threat-group-4127-targe... "The range of targets demonstrates that the threat group poses a broad threat to individuals and groups associated with U.S. politics, to organizations and individuals in the government and defense verticals, and to those whose business involves commenting on Russia."

Threatconnect (June 29 2016) https://www.threatconnect.com/blog/guccifer-2-0-dnc-breach/ "we assess Guccifer 2.0 most likely is a Russian denial and deception (D&D) effort that has been cast to sow doubt about the prevailing narrative of Russian perfidy"

Threatconnect (July 26 2016) https://www.threatconnect.com/blog/guccifer-2-all-roads-lead... "strengthens our ongoing assessment that Guccifer 2.0 is a Russian propaganda effort and not an independent actor."

Crowdstrike - 2nd Post (December 22 2016) https://www.crowdstrike.com/blog/danger-close-fancy-bear-tra... "further supports CrowdStrike’s previous assessments that FANCY BEAR is likely affiliated with the Russian military intelligence (GRU), and works closely with Russian military forces"

I read most of the reports you listed and honestly I am not convinced. Faking the digital evidences is not something new. Take a look at the links in the "Evading forensics and anti-virus" chapter from recent CIA leaks: https://wikileaks.org/ciav7p1/ for a good overview. Basically, I would not trust any digital evidences unless it involves digital signatures with strong keys (or similar stuff).
You are taking crowdstrike at their word. I don't. I see hearsay, I don't see any evidence. Just because a private company paid by the DNC says, "that's what we found", along with a few (advanced persistent threat) wordsalad, doesn't show us jack shit. On top of that, most of networking type guys know, especially with some of the more recent attribution-faking tool leaks, that attribution is not that fucking easy. So they have some cyrillic and some IP's in russia? Probability goes up, yes, but acting as if the question is answered and as if it's silly anyone questions it still is ridiculously intellectually dishonest. The DNC got caught being shady as shit if not illegal, and when they got caught, then lost the election, they turned the narrative against to Russia. It's like #3 in the classic machiavellian realpolitik media pr propaganda playbook. Crowdstrike has a lot of ties that make it's output even that much more questionable (the same report from anyone would get the same response, but their connections make them deserving of extra scrutiny.)

http://old.warisacrime.org/content/obamas-last-chance-face-d...

https://www.linkedin.com/pulse/crowdstrike-needs-address-har...

http://g-2.space/

https://www.opensecrets.org/orgs/summary.php?id=D000000801

https://www.opensecrets.org/orgs/summary.php?id=D000031277

https://www.welivesecurity.com/wp-content/uploads/2016/10/es...

https://i.imgur.com/O9z33Dq.png

C&C server IP Addresses 185.106.120.101 185.86.149.223 31.220.43.99 5.135.183.154 69.12.73.174 89.32.40.4 92.114.92.125 93.115.38.125 131.72.136.165 167.114.214.63 176.31.112.10 176.31.96.178 192.95.12.5 46.183.216.209 80.255.10.236 80.255.3.93 81.17.30.29 95.215.46.27

Netherlands, France, Canada, Latvia, Germany, Switzerland and Sweden, US, Bulgaria.

Notice an absence of a country?

Fun Bonus: All this reveals the corporate nature of parties!(that's their defense for not handing over the servers/drives.) Part of the corruption, both of them!

PS. I shouldn't have to point this out, but in this climate of hysteria I think it might be necessary. Just because there are technical doubts about the DNC-Russia story, doesn't mean those doubts can be used to deny or affirm any other possible US-Russia espionage issues such as collusion, coercion, etc.

What could possibly convince you?

We have a pretty well respected company saying "this is what we found", before anyone knew how important it would end up being.

The links you have posted appear to be a fairly random set of unrelated things that I guess are supposed to undermine the report, but to me they look.. unrelated?

The OpenSecret links aren't for CrowdStrike.

https://www.opensecrets.org/orgs/summary.php?id=D000000801 is for Warburg Pincus and shows are very even mix of Republican and Democratic recipients.

https://www.opensecrets.org/orgs/summary.php?id=D000031277 is for Accel Partners, and again shows an even spread, with the exception of a $176,580 donation to Right To Rise USA which is a Jeb Bush SuperPac.

The rest seem.. I don't even know what to say about them. https://i.imgur.com/O9z33Dq.png is just a ToC of report??

>pretty well respected company

Not well respected, especially after their multiple past fuckups.

>fairly random set of unrelated things

VIPS report, relevant donation information of crowdstrike affiliated persons, a report from a third-party who crowdstrike allowed to look at data... not unrelated at all.

A start for transparency to relieve skepticism would be to release the data that shows the C&C ip's match past Russian affiliated attacks. That's what it boils down to, Crowdstrike claims that those ip's match a past or known group of Russian pivot servers, but haven't offered the data to verify this.

I have training in computer/network forensics. Do you?

A few points:

>Not well respected

Did you criticize Crowdstike before the 2016 election? Because they're very highly regarded.

>You are taking crowdstrike at their word.

You don't have to trust Crowdstrike, as there are other organizations that did analysis. Most of my links were not from Crowdstrike.

The analyses do not rely solely on C&C IPs, and the fact that you keep harking on that makes me think you haven't read those links. There's lots of TTP and malware analysis.

>that's their defense for not handing over the servers/drives.

It is extremely common for groups to share imaged versions of a computer.

You are obviously not interested in intellectually honest discussion, so I'm not wasting anymore time with you.
His name was Seth Rich.
Yes, and WikiLeaks has offered a reward for information leading to the arrest of his killers.

Weird coincidence: Seth Rich and at least one of the Awan family hung out at a bar the night prior to hus shooting.

Sure it wasn't Comet Pizza? You guys blew the chance for one absurd conspiracy in this affair. Everyone just laughs at you when you try it again.
Has WikiLeaks' Twitter account been hacked?

https://twitter.com/wikileaks/status/822213093065367553?lang...

Do you deny that WL is offering this reward?

No, they are just attempting to forum slide.
This is a seriously debunked conspiracy theory [0][1] that damages us all when people continually spread it.

[0] http://www.snopes.com/seth-conrad-rich/

[1] http://www.npr.org/2017/08/01/540783715/lawsuit-alleges-fox-...

Yeah, of course it's a seriously debunked conspiracy.

It was merely a coincidence that, 5 days after a large number of files were copied from DNC computers, DNC employee Seth Rich winds up with a couple of bullets in his back, "and yet they never took anything".

https://en.wikipedia.org/wiki/Murder_of_Seth_Rich#Shooting_a...

Yes, it literally is. You just needed to scroll down the page a little more.

https://en.wikipedia.org/wiki/Murder_of_Seth_Rich#Conspiracy...