22 ms·

Why Some U.S. Ex-Spies Don't Buy the Russia Story

157 points by necessity 9y ago

tootie 9y ago
I don't get either of their arguments. Yes, 180mbps is pretty fast for residential internet, but it's certainly not hard to get nor is there any reason to believe he was using residential broadband. The MS Word thing I didn't follow at all.
- jerkstate 9y ago
  Here's some technical background on the MS Word thing: http://g-2.space/intent-conclusion.html http://g-2.space/intent-conclusion.html Make of it what you will
- jgacook 9y ago
  According to the website of "Adam Carter" (linked in the article: http://g-2.space/ http://g-2.space/) the 180MBPS is only unusual if you assume the hacker was Russian - it's very fast for a VPN connection and, according to Carter's website, is consistent with USB 2 download speeds. For more about the MS Word stuff, here's the page on that: http://g-2.space/intent/ http://g-2.space/intent/
  - xdissent 9y ago
    Possibly relevant tidbit from a recent Guccifer 1.0 interview: He used 'Russian proxy servers because they were “the fastest.”' I imagine they're referring to VPNs. http://www.foxnews.com/us/2017/08/11/guccifer-calls-fox-from-romania-says-shouldnt-be-sent-back-to-u-s.amp.html http://www.foxnews.com/us/2017/08/11/guccifer-calls-fox-from...
  - mjevans 9y ago
    Was this based on file timestamps in some archive? I'll grant that it could also be related to some way the files were prepared in the interim, but it is at least worthy of considering where that metadata might have come from or been replaced through normal activity or intentional operations.
    - ajross 9y ago
      It was. And in fact afaict the archive was never public.
  - deleted 9y ago
    [deleted]
  - kbenson 9y ago
    It's very easy to copy files preserving timestamps, in which case the timestamps would not represent the time to copy the files during the break in, but the time to copy them to the medium they were stolen from. Did anyone bother to check whether the files were created on that system, or copied originally from some USB disk? Or even copied to the server from some workstation across a gig network but that workstation was copying directly from a plugged in USB drive? There are so many ways to have timestamps originally sourced from USB type transfer speeds in the chain of file management at some point that this is ridiculous.
  - zurn 9y ago
    With most reasonable VPN technologies (IPsec, OpenVPN) there is nothing that would slow down throughput other than CPU processing. And 180 Mbps is not close to VPN CPU bottleneck speeds.
- Clubber 9y ago
  From what I can tell, he's also basing the transfer speed on last modified dates. I'm not overly familiar with the details of Linux last modified date, but I don't believe there is a history of last modified, it's just a single date per file. If that's the case, it only indicates the time of the last copy, which could have been from the downloads (or whatever) folder to a thumb drive after the download. The data was likely initially copied to a computer running Linux, because the file last modified times all reflect the apparent time of the copy and this is a characteristic of the the Linux ‘cp’ command (using default options). Don't get me wrong, I wouldn't put it past either political party to do something like this, but the evidence seems somewhat weak if I'm understanding it correctly.
  - saghm 9y ago
    It's also completely trivial to arbitrarily change the "last modified" date of a file to literally anything you want on Linux with `touch -t`.
  - kbenson 9y ago
    Apparently they've never heard of rsync and -t (--times), which is implied by -a (--archive), which is recursive and copies all relevant data for archival purposes, and is the first flag I use with every single rsync command? There are plenty of file copying/syncing techniques that preserve timestamps, and if the files were previously copied to/from a device that did not (such as a thumb drive to the computer they were eventually stolen from), then it would stand to reason that the modification times would represent the times of that prior copy operation. I mean, file timestamps have been used by some really smart people to make intersting assumptions about what's going secretly on in very interesting ways, such as Tsutomu Shimomura reportedly looking at library access times while covertly on the same remote system as Kevin Mitnick to make assumptions about what he was compiling (I don't recall the source, it may even be made up), but this isn't one of them.
  - nikita2206 9y ago
    I understood it as he compared last modified of two files that were downloaded consecutively. Now if you take the difference between those last modified dates that would be the time spent downloading one of these files (which one is up to which date was greater). That is assuming that files were being copied synchronously one by one (like cp would do)
- SimbaOnSteroids 9y ago
  There were Cyrillic characters in regards to some of the meta data attached to some leaked word documents.
todd8 9y ago
More technical details can be found here: http://g-2.space/sixmonths/ http://g-2.space/sixmonths/
eclipxe 9y ago
The author of this opinion piece: https://en.wikipedia.org/wiki/Leonid_Bershidsky https://en.wikipedia.org/wiki/Leonid_Bershidsky
- nautilus12 9y ago
  Suddenly we are quick to point out opinion pieces in a media landscape where that has become otherwise irrelevant. Left = 'unverified facts', Right = 'opinion piece'
  - arca_vorago 9y ago
    Stop trying to twist everything into a fucking partisan cock-fight.
  - willstrafach 9y ago
    If you check the article, this really is an opinion piece, not an article based on solid verifiable facts.
deleted 9y ago
[deleted]
slackingoff2017 9y ago
This points to using a cheap Linux box at host VPS. AWS micro instances run Linux basically by default and have about 150-250 megabit connections. I assume they loaded the documents onto a hacked AWS box running WordPress or similar and downloaded them later from there. Hackers almost always tunnel through at least one compromised machine because they don't trust a VPN alone for anonymity. In no way does this imply anyone was or was not responsible. This is a common thing to do for any hacking group
nl 9y ago
This is stupid. No intruder is going to copy files straight to their home computer. They'll use a compromised server somewhere, and there is plenty of server to server bandwidth. It's fine to be skeptical of course, and to be very skeptical of direct "hacking the election" (whatever that means) claims. But there is plenty of public evidence that Russia was involved in the DNC hack. This evidence was available before the election, which makes it more credible against claims of political interference. I've posted this before, but I think it's important people understand what public evidence is available: 2014 report into ATP-28: https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html https://www.fireeye.com/blog/threat-research/2014/10/apt28-a..., presenting pretty compelling (if circumstantial) evidence that group is Russian state backed. (July) 2016 report into the DNC hacking, showing it was first breached by ATP-29 (The other Russian state backed hacking group), but the leaks almost certainly came from a second breach by ATP-28 later: https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ https://www.crowdstrike.com/blog/bears-midst-intrusion-democ...
- mc32 9y ago
  My question would be, has Julian lied about sources before, and would he deviate from that if he didn't? His claim is that the source is not Russia --people who were happy to see Julian leak things (and believe his leaks) while Bush was president are now calling him a puppet of Putin. I have no idea if Putin has goods on him. Or whether Julian is just a medium. It is, however, interesting to see people shift along political axes though. If there was a Russian angle, I think their aim was to cause uncertainty regardless of winner. Be it Trump or Hillary, whoever the winner was, the voters of the opposition would question the results --despite there being no actual election hacking (altering the vote count). One interesting thing though is that since the media writ large expected Hillary to win, had she won, this same evidence would have been "page 6" news and would have been rather quickly forgotten but for a few "sore losers".
  - wnevets 9y ago
    >His claim is that the source is not Russia --people who were happy to see Julian leak things (and believe his leaks) while Bush was president are now calling him a puppet of Putin. I have no idea if Putin has goods on him. Or whether Julian is just a medium. It is, however, interesting to see people shift along political axes though. Wikileaks was actively campaigning for trump. Wikileaks came out and said they had "proof" clinton was a witch for christ's sake.
nextstep 9y ago
Even the language used in this article is misleading: “hacked the election”. The actual allegations are that Russia was behind the hacks of the DNC servers. That is not election hacking! Hacking the election sounds like the Russians found some vulnerability with voting machines. There is no evidence of this. In either case, Trump won the election because he won more electoral votes than Hillary. And he did this by winning more popular votes in key states. It’s that simple. The Democrats had an unappealing candidate who ran a weak campaign in key states. And lost. What the DNC leaks do show, however, is that the Democrats ran a fraudulent primary election where they colluded with the Clinton campaign and suppressed any opposition from the left. This resulted in an unpopular candidate in the general election, and a public even more untrusting of the Clintons and the process. The Democrats needs to look in the mirror instead of playing to fears of Russian boogeyman.
- gdudeman 9y ago
  This is incorrect. In one case, Trump won the election by very narrowly winning more popular votes in key states. Those votes could have been influenced by the news. What the DNC leaks show is also the messiness underbelly of virtually any campaign. You can call it collusion, but I'd say it's the DNC doing their job to try to get an electable candidate on the ballot. The RNC did the same thing - they just failed this time. Had the Trump team's email leaked in the same way, I suspect the election would have gone the other way.
  - nextstep 9y ago
    All votes are influenced by the news. That’s how our modern democracy works. You learn about the candidates through a (hopefully free) media and then you cast a vote.
    - blackrose 9y ago
      That's the point -- the CIA, FBI, and NSA determined with "high confidence" [0] that Russia worked to influence us through (among other outlets) the media -- especially social media. It worked, and because of it our votes weren't free. > Moscow’s influence campaign followed a Russian messaging strategy that blends covert intelligence operations—such as cyber activity—with overt efforts by Russian Government agencies, state-funded media, third-party intermediaries, and paid social media users or “trolls.” [0] https://www.dni.gov/files/documents/ICA_2017_01.pdf https://www.dni.gov/files/documents/ICA_2017_01.pdf
Cacti 9y ago
This is an interesting analysis, but determining download speeds (and the resulting conclusions about how the data was moved about) from zip file metadata is still basically guesswork. You have to make a number of assumptions for this to work out, and yes, they are reasonable assumptions, I guess, but they are still assumptions. I would also point out that this article is mostly revolving around whether _some_ portion of the DNC emails were purposefully leaked, but it doesn't say much at all about the remaining incidents and data. It certainly doesn't disprove the "russia story."
- thomasko 9y ago
  Additionally the claims they make about timezones are also only based on the difference of timestamps. Eg they see that the difference between 7z (Unix timestamps thus UTC) and RAR3 (MS-DOS localtime) is three hours. The way they then conclude it's Eastern time is very flimsy. In fact that that alle files, even those in rar-files were all modified on the same time, convinces me more that the timestamps have nothing to do with the transmission. But that someone altered them after the hack, or that but more unlikely is that all the timestamps are still untouched and exactly on how they were on the DNC server
  - swiley 9y ago
    Eastern time is 4 hours (and at the time, probably 5) from UTC. 3 hours is somewhere in the ocean.
willstrafach 9y ago
> CrowdStrike, the firm whose conclusions informed much of the intelligence community's assessment I don't think this is true at all. I do recall CS releasing their own report in early summer, but my understanding is the January IC assessment was a completely separate document which did not cite the CS report in any way. (If I am missing something here, happy to be corrected, this aspect just stuck out to me)
- monocasa 9y ago
  The IC assessment was just regurgitating CS's report. The IC just took CS at their word since they would have contracted out to someone like CS to begin with. The FBI, for instance, wasn't allowed to look at any of the evidence directly. AFAIK, no government entities have looked at the raw data. Edit: http://www.politifact.com/truth-o-meter/statements/2017/jul/11/donald-trump/did-john-podesta-deny-cia-and-fbi-access-dnc-serve/ http://www.politifact.com/truth-o-meter/statements/2017/jul/... > In his testimony in January on the cyber attacks, then-director of the FBI James Comey said the agency never got access to the machines themselves, but obtained access to the forensics from a review of the system performed by CrowdStrike, a third-party cybersecurity firm.
  - willstrafach 9y ago
    To clarify, this is the report I am referring to, and it does not appear to mention CrowdStrike at all: https://www.dni.gov/files/documents/ICA_2017_01.pdf https://www.dni.gov/files/documents/ICA_2017_01.pdf
    - monocasa 9y ago
      Sure, they didn't cite CrowdStrike, but there's no extra information in that report other than what came from CrowdStrike's report.
      - willstrafach 9y ago
        There definitely appears to be additional information in the IC assessment though.
bradleyjg 9y ago
It's odd that the bloomberg piece has a whole bunch of links but doesn't link the VIPS letter. It's here: https://consortiumnews.com/2017/07/24/intel-vets-challenge-russia-hack-evidence/ https://consortiumnews.com/2017/07/24/intel-vets-challenge-r... Also it goes out it's way to mention William Binney, and The Nation article linked from it mentions other ex-government employees associated with VIPS, but neither mentions the mysterious Skip Folden that VIPS relied on as thier technical expert. This is what the VIPS letter says about him: Independent analyst Skip Folden, who retired after 25 years as the IBM Program Manager for Information Technology but if he spent 25 years as a high or even medium level employee at IBM I would expect some kind of internet trail and I couldn't find one.
- Animats 9y ago
  The name is "Norman (Skip) Folden", and people on Reddit have been trying to ID him.[1] There's someone 85 years old with that name, but that seems an unlikely match. "Program Manager for Information Technology" is usually a job title at a customer site, says Payscale.[2] An "IBM Program Manager for Information Technology" may just designate someone who ran an IBM mainframe shop. [1] https://www.reddit.com/r/conspiracy/comments/6q49di/july_5_2016_in_the_early_evening_someone_working/ https://www.reddit.com/r/conspiracy/comments/6q49di/july_5_2... [2] http://www.payscale.com/research/US/Job=Program_Manager%2C_IT/Salary http://www.payscale.com/research/US/Job=Program_Manager%2C_I...
  - PhantomGremlin 9y ago
    may just designate someone who ran an IBM mainframe shop It's quite possible that he worked for IBM running mainframes on site for the NSA or CIA or any of a myriad of relatively secretive US government agencies. If so, together with IBM's historic penchant for secrecy, and given that Folden is perhaps closer in age to The Greatest Generation than to The Millenials, he just might not be very visible on Google. I'd bet that searching "real" databases, e.g. DMV records, Social Security records, IBM employee payroll lists, property tax records, etc, would be far more productive.
redm 9y ago
I find it interesting that no one is discussing the fact that the DNC's leaks were damaging only because they were not operating impartially. Regardless if the leaks came from Russia or a whistleblower in the DNC, isn't the fallout somewhat self inflicted?
- grandalf 9y ago
  Yes, and the only reason I was interested in the leaked information was because of the transparency it provided into the DNC and Clinton Foundation. In a democracy, transparency is a good thing. There are still a variety of things that were in the emails pertaining to campaign finance violations and DOJ improprieties that have essentially been ignored. Regardless of how the American people came to know about these things, they should be the focus of the investigation.
- prostoalex 9y ago
  Yep, the most severe outcome of a similar hacking of Macron's campaign in France was an extreme amount of boredom the leaks induced.
- tootie 9y ago
  That's beside the point of the hacking. If a foreign nation deliberately interfered in our electoral system to the benefit or possibly in collusion with their preferred party, that's a way bigger deal. It's criminal. Secondly, the amount of dirt they uncovered was so minimal. Of course they favored Clinton. She was a party loyalist and the one they considered most likely to win the general. If you think both parties don't operate like this all the time, you're nuts. They'd be nuts not to. I can't even imagine the level of freak out at the RNC when Trump took the lead.
fulafel 9y ago
Obviously wrong bit: "Downloading such files this quickly [at 22.6 megabytes per second] over the internet, especially over a VPN (most hackers would use one), would have been all but impossible because the network infrastructure through which the traffic would have to pass would further slow the traffic."
deleted 9y ago
[deleted]
discardorama 9y ago
> VIPS instead surmises that, after WikiLeaks' Julian Assange announced on June 12, 2016 his intention to publish Hillary Clinton-related emails, the DNC rushed to fabricate evidence that it had been hacked by Russia to defuse any potential WikiLeaks disclosures. This is laughably stupid. Why would attributing the hack to Russia instead of Wikileaks or whatever make any difference to the contents of the hacks?
- arca_vorago 9y ago
  Because the media and the mass conciousness is that easily manipulated? It worked, didn't it?
ece 9y ago
So, as a motive, one possibility could be the DNC orchestrated the DNC leaks to blunt the effect of trickling podesta/wikileaks emails if it was somehow an insider. Why become the news during a campaign where every moment Trump spoke his poll numbers went down? And show their own favoritism? It doesn't seem plausible. This could all be more Russian disinformation. As far as the podesta/wikileaks emails go: 1) Russia's history when it comes to election meddling and spreading dis-information speaks for itself, yes the US does it too, but the Russia is on another level (Every eastern European country has been a public target from the same groups). 2) Russia had a lot more to fear from Hillary than Trump. The sanctions and military ratcheting would likely be more in force than it is now under Trump and a dysfunctional congress. Hillary was a known hawk on Russia, compared with Manafort/Flynn on Russia. 3) Putin himself said "some patriotic Russians might have done stuff" like sending phishing emails. When Russia faced the lemon of a Hillary administration, they made lemonade. Arguably, it wasn't that hard and paid for itself. We as the voting public knew most of this before the election, including partly about Trump's intent of collusion and possibly collusion, and voted the way we did anyway. Assange is kind of irrelevant, he has always had his own motives, and it's pretty clearly being anti-US. Offering Damore a job with wikileaks, really?
wbillingsley 9y ago
There's something I don't get about the "Trump-Russia scandal": It seems to me the chances are Russia tries to hack most US politician's emails every day, and probably twice on Sundays. Even the nice ol' US was caught in 2009 spying on the UN Secretary General and the Security Council delegations of its allies; do we really for one moment think that famously-spy-heavy bad-guy Russia and its ex-spy-master President wouldn't be constantly trying to get its hands on the emails of its Cold War enemy? In which case, hunting whether Trump encouraged Russia seems like hunting for who asked the clouds to rain this morning. Which makes the US reaction not smell right. It smells somehow like a game of pretexts. So having "not got that" about the scandal -- something seems fishy here -- it looks to my amateur, non-US, non-politician, probably-too-cynical eyes, like there's five parties having a political fight for control (and yes I am being deliberately simplistic and caricaturing): - The Trump team, who seem like they're recruited like the Dirty Dozen (you're so unsuitable for any normal administration, and possibly borderline insane, that you've got nothing to lose with this crazy mission...) - The powers that be / senior civil servants. Trump spent his entire campaign calling Washington "the swamp" and declaring he'd drain it. Did you think they wouldn't fight back, the FBI wouldn't leak, they wouldn't try to undermine this braggart who's just come marching in telling them he's going to rip them apart? - The Republican establishment (McCain, etc). Did you really think parts of the Republican party that spent so long wanting anyone but Trump would grow to like him? - The left-of-centre echo chamber (us techie types, journalists, other professionals), whose typical MO is to use the levers of embarrassment, twitterstorms, and rhetoric to try to shovel any government we are unfortunate enough to have over us into following our agenda - Modern industry, which seems to have cottoned onto the idea that if publicly you say enough "left" things (equality, diversity) and sound passionate about social progress, you can pursue a "right" agenda (not paying tax, disempowering employees, building private monopolies with moats around them) without anybody making much fuss. And though that may be a gross caricature, in that model somehow the behaviour seems to make sense. For example, the Trump-Russia scandal as a way of tying Trump's hands and forcing him down foreign policy lines he doesn't want. The administration's seeming dysfunction, because anyone who joins them knows it is the only administration they will ever serve, so you can only get amateurs who don't know the game of White House politics or think they can change how it is played. The constant storms over his latest tweet, despite his tweets having been incoherent for years, because raising the level of outrage creates social roadblocks -- making avenues hopefully too sensitive and already too explosive for him to travel further down them. Which makes Russia seem like an irrelevant bystander -- doing what it does every day (which happens to be trying to hack American servers for everything it can get, while trying to nibble at gaining more control and influence in Eastern Europe and the Mediterranean).
Hasknewbie 9y ago
So, maybe I'm missing something here, but since when does the Russian hacking stand for "the Russian story" as a whole? Manaford's no-knock warrant, Jared's Russian embassy back channel, or Donnie Junior's e-mails seem like much more important items in said story so far. Within that context the DNC hacking seems to me to be only a small piece of the puzzle. Its validity (or not) does not call the other elements's veracity into question.

157 points by necessity 9y ago

I don't get either of their arguments. Yes, 180mbps is pretty fast for residential internet, but it's certainly not hard to get nor is there any reason to believe he was using residential broadband. The MS Word thing I didn't follow at all.

jerkstate 9y ago
Here's some technical background on the MS Word thing: http://g-2.space/intent-conclusion.html http://g-2.space/intent-conclusion.html Make of it what you will
jgacook 9y ago
According to the website of "Adam Carter" (linked in the article: http://g-2.space/ http://g-2.space/) the 180MBPS is only unusual if you assume the hacker was Russian - it's very fast for a VPN connection and, according to Carter's website, is consistent with USB 2 download speeds. For more about the MS Word stuff, here's the page on that: http://g-2.space/intent/ http://g-2.space/intent/
- xdissent 9y ago
  Possibly relevant tidbit from a recent Guccifer 1.0 interview: He used 'Russian proxy servers because they were “the fastest.”' I imagine they're referring to VPNs. http://www.foxnews.com/us/2017/08/11/guccifer-calls-fox-from-romania-says-shouldnt-be-sent-back-to-u-s.amp.html http://www.foxnews.com/us/2017/08/11/guccifer-calls-fox-from...
- mjevans 9y ago
  Was this based on file timestamps in some archive? I'll grant that it could also be related to some way the files were prepared in the interim, but it is at least worthy of considering where that metadata might have come from or been replaced through normal activity or intentional operations.
  - ajross 9y ago
    It was. And in fact afaict the archive was never public.
- deleted 9y ago
  [deleted]
- kbenson 9y ago
  It's very easy to copy files preserving timestamps, in which case the timestamps would not represent the time to copy the files during the break in, but the time to copy them to the medium they were stolen from. Did anyone bother to check whether the files were created on that system, or copied originally from some USB disk? Or even copied to the server from some workstation across a gig network but that workstation was copying directly from a plugged in USB drive? There are so many ways to have timestamps originally sourced from USB type transfer speeds in the chain of file management at some point that this is ridiculous.
- zurn 9y ago
  With most reasonable VPN technologies (IPsec, OpenVPN) there is nothing that would slow down throughput other than CPU processing. And 180 Mbps is not close to VPN CPU bottleneck speeds.
Clubber 9y ago
From what I can tell, he's also basing the transfer speed on last modified dates. I'm not overly familiar with the details of Linux last modified date, but I don't believe there is a history of last modified, it's just a single date per file. If that's the case, it only indicates the time of the last copy, which could have been from the downloads (or whatever) folder to a thumb drive after the download. The data was likely initially copied to a computer running Linux, because the file last modified times all reflect the apparent time of the copy and this is a characteristic of the the Linux ‘cp’ command (using default options). Don't get me wrong, I wouldn't put it past either political party to do something like this, but the evidence seems somewhat weak if I'm understanding it correctly.
- saghm 9y ago
  It's also completely trivial to arbitrarily change the "last modified" date of a file to literally anything you want on Linux with `touch -t`.
- kbenson 9y ago
  Apparently they've never heard of rsync and -t (--times), which is implied by -a (--archive), which is recursive and copies all relevant data for archival purposes, and is the first flag I use with every single rsync command? There are plenty of file copying/syncing techniques that preserve timestamps, and if the files were previously copied to/from a device that did not (such as a thumb drive to the computer they were eventually stolen from), then it would stand to reason that the modification times would represent the times of that prior copy operation. I mean, file timestamps have been used by some really smart people to make intersting assumptions about what's going secretly on in very interesting ways, such as Tsutomu Shimomura reportedly looking at library access times while covertly on the same remote system as Kevin Mitnick to make assumptions about what he was compiling (I don't recall the source, it may even be made up), but this isn't one of them.
- nikita2206 9y ago
  I understood it as he compared last modified of two files that were downloaded consecutively. Now if you take the difference between those last modified dates that would be the time spent downloading one of these files (which one is up to which date was greater). That is assuming that files were being copied synchronously one by one (like cp would do)
SimbaOnSteroids 9y ago
There were Cyrillic characters in regards to some of the meta data attached to some leaked word documents.

todd8 9y ago

More technical details can be found here: http://g-2.space/sixmonths/ http://g-2.space/sixmonths/

eclipxe 9y ago

The author of this opinion piece: https://en.wikipedia.org/wiki/Leonid_Bershidsky https://en.wikipedia.org/wiki/Leonid_Bershidsky

nautilus12 9y ago
Suddenly we are quick to point out opinion pieces in a media landscape where that has become otherwise irrelevant. Left = 'unverified facts', Right = 'opinion piece'
- arca_vorago 9y ago
  Stop trying to twist everything into a fucking partisan cock-fight.
- willstrafach 9y ago
  If you check the article, this really is an opinion piece, not an article based on solid verifiable facts.

deleted 9y ago

[deleted]

slackingoff2017 9y ago

This points to using a cheap Linux box at host VPS. AWS micro instances run Linux basically by default and have about 150-250 megabit connections. I assume they loaded the documents onto a hacked AWS box running WordPress or similar and downloaded them later from there. Hackers almost always tunnel through at least one compromised machine because they don't trust a VPN alone for anonymity. In no way does this imply anyone was or was not responsible. This is a common thing to do for any hacking group

nl 9y ago

This is stupid. No intruder is going to copy files straight to their home computer. They'll use a compromised server somewhere, and there is plenty of server to server bandwidth. It's fine to be skeptical of course, and to be very skeptical of direct "hacking the election" (whatever that means) claims. But there is plenty of public evidence that Russia was involved in the DNC hack. This evidence was available before the election, which makes it more credible against claims of political interference. I've posted this before, but I think it's important people understand what public evidence is available: 2014 report into ATP-28: https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html https://www.fireeye.com/blog/threat-research/2014/10/apt28-a..., presenting pretty compelling (if circumstantial) evidence that group is Russian state backed. (July) 2016 report into the DNC hacking, showing it was first breached by ATP-29 (The other Russian state backed hacking group), but the leaks almost certainly came from a second breach by ATP-28 later: https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ https://www.crowdstrike.com/blog/bears-midst-intrusion-democ...

mc32 9y ago
My question would be, has Julian lied about sources before, and would he deviate from that if he didn't? His claim is that the source is not Russia --people who were happy to see Julian leak things (and believe his leaks) while Bush was president are now calling him a puppet of Putin. I have no idea if Putin has goods on him. Or whether Julian is just a medium. It is, however, interesting to see people shift along political axes though. If there was a Russian angle, I think their aim was to cause uncertainty regardless of winner. Be it Trump or Hillary, whoever the winner was, the voters of the opposition would question the results --despite there being no actual election hacking (altering the vote count). One interesting thing though is that since the media writ large expected Hillary to win, had she won, this same evidence would have been "page 6" news and would have been rather quickly forgotten but for a few "sore losers".
- wnevets 9y ago
  >His claim is that the source is not Russia --people who were happy to see Julian leak things (and believe his leaks) while Bush was president are now calling him a puppet of Putin. I have no idea if Putin has goods on him. Or whether Julian is just a medium. It is, however, interesting to see people shift along political axes though. Wikileaks was actively campaigning for trump. Wikileaks came out and said they had "proof" clinton was a witch for christ's sake.

nextstep 9y ago

Even the language used in this article is misleading: “hacked the election”. The actual allegations are that Russia was behind the hacks of the DNC servers. That is not election hacking! Hacking the election sounds like the Russians found some vulnerability with voting machines. There is no evidence of this. In either case, Trump won the election because he won more electoral votes than Hillary. And he did this by winning more popular votes in key states. It’s that simple. The Democrats had an unappealing candidate who ran a weak campaign in key states. And lost. What the DNC leaks do show, however, is that the Democrats ran a fraudulent primary election where they colluded with the Clinton campaign and suppressed any opposition from the left. This resulted in an unpopular candidate in the general election, and a public even more untrusting of the Clintons and the process. The Democrats needs to look in the mirror instead of playing to fears of Russian boogeyman.

gdudeman 9y ago
This is incorrect. In one case, Trump won the election by very narrowly winning more popular votes in key states. Those votes could have been influenced by the news. What the DNC leaks show is also the messiness underbelly of virtually any campaign. You can call it collusion, but I'd say it's the DNC doing their job to try to get an electable candidate on the ballot. The RNC did the same thing - they just failed this time. Had the Trump team's email leaked in the same way, I suspect the election would have gone the other way.
- nextstep 9y ago
  All votes are influenced by the news. That’s how our modern democracy works. You learn about the candidates through a (hopefully free) media and then you cast a vote.
  - blackrose 9y ago
    That's the point -- the CIA, FBI, and NSA determined with "high confidence" [0] that Russia worked to influence us through (among other outlets) the media -- especially social media. It worked, and because of it our votes weren't free. > Moscow’s influence campaign followed a Russian messaging strategy that blends covert intelligence operations—such as cyber activity—with overt efforts by Russian Government agencies, state-funded media, third-party intermediaries, and paid social media users or “trolls.” [0] https://www.dni.gov/files/documents/ICA_2017_01.pdf https://www.dni.gov/files/documents/ICA_2017_01.pdf

Cacti 9y ago

This is an interesting analysis, but determining download speeds (and the resulting conclusions about how the data was moved about) from zip file metadata is still basically guesswork. You have to make a number of assumptions for this to work out, and yes, they are reasonable assumptions, I guess, but they are still assumptions. I would also point out that this article is mostly revolving around whether _some_ portion of the DNC emails were purposefully leaked, but it doesn't say much at all about the remaining incidents and data. It certainly doesn't disprove the "russia story."

thomasko 9y ago
Additionally the claims they make about timezones are also only based on the difference of timestamps. Eg they see that the difference between 7z (Unix timestamps thus UTC) and RAR3 (MS-DOS localtime) is three hours. The way they then conclude it's Eastern time is very flimsy. In fact that that alle files, even those in rar-files were all modified on the same time, convinces me more that the timestamps have nothing to do with the transmission. But that someone altered them after the hack, or that but more unlikely is that all the timestamps are still untouched and exactly on how they were on the DNC server
- swiley 9y ago
  Eastern time is 4 hours (and at the time, probably 5) from UTC. 3 hours is somewhere in the ocean.

willstrafach 9y ago

> CrowdStrike, the firm whose conclusions informed much of the intelligence community's assessment I don't think this is true at all. I do recall CS releasing their own report in early summer, but my understanding is the January IC assessment was a completely separate document which did not cite the CS report in any way. (If I am missing something here, happy to be corrected, this aspect just stuck out to me)

monocasa 9y ago
The IC assessment was just regurgitating CS's report. The IC just took CS at their word since they would have contracted out to someone like CS to begin with. The FBI, for instance, wasn't allowed to look at any of the evidence directly. AFAIK, no government entities have looked at the raw data. Edit: http://www.politifact.com/truth-o-meter/statements/2017/jul/11/donald-trump/did-john-podesta-deny-cia-and-fbi-access-dnc-serve/ http://www.politifact.com/truth-o-meter/statements/2017/jul/... > In his testimony in January on the cyber attacks, then-director of the FBI James Comey said the agency never got access to the machines themselves, but obtained access to the forensics from a review of the system performed by CrowdStrike, a third-party cybersecurity firm.
- willstrafach 9y ago
  To clarify, this is the report I am referring to, and it does not appear to mention CrowdStrike at all: https://www.dni.gov/files/documents/ICA_2017_01.pdf https://www.dni.gov/files/documents/ICA_2017_01.pdf
  - monocasa 9y ago
    Sure, they didn't cite CrowdStrike, but there's no extra information in that report other than what came from CrowdStrike's report.
    - willstrafach 9y ago
      There definitely appears to be additional information in the IC assessment though.

bradleyjg 9y ago

It's odd that the bloomberg piece has a whole bunch of links but doesn't link the VIPS letter. It's here: https://consortiumnews.com/2017/07/24/intel-vets-challenge-russia-hack-evidence/ https://consortiumnews.com/2017/07/24/intel-vets-challenge-r... Also it goes out it's way to mention William Binney, and The Nation article linked from it mentions other ex-government employees associated with VIPS, but neither mentions the mysterious Skip Folden that VIPS relied on as thier technical expert. This is what the VIPS letter says about him: Independent analyst Skip Folden, who retired after 25 years as the IBM Program Manager for Information Technology but if he spent 25 years as a high or even medium level employee at IBM I would expect some kind of internet trail and I couldn't find one.

Animats 9y ago
The name is "Norman (Skip) Folden", and people on Reddit have been trying to ID him.[1] There's someone 85 years old with that name, but that seems an unlikely match. "Program Manager for Information Technology" is usually a job title at a customer site, says Payscale.[2] An "IBM Program Manager for Information Technology" may just designate someone who ran an IBM mainframe shop. [1] https://www.reddit.com/r/conspiracy/comments/6q49di/july_5_2016_in_the_early_evening_someone_working/ https://www.reddit.com/r/conspiracy/comments/6q49di/july_5_2... [2] http://www.payscale.com/research/US/Job=Program_Manager%2C_IT/Salary http://www.payscale.com/research/US/Job=Program_Manager%2C_I...
- PhantomGremlin 9y ago
  may just designate someone who ran an IBM mainframe shop It's quite possible that he worked for IBM running mainframes on site for the NSA or CIA or any of a myriad of relatively secretive US government agencies. If so, together with IBM's historic penchant for secrecy, and given that Folden is perhaps closer in age to The Greatest Generation than to The Millenials, he just might not be very visible on Google. I'd bet that searching "real" databases, e.g. DMV records, Social Security records, IBM employee payroll lists, property tax records, etc, would be far more productive.

redm 9y ago

I find it interesting that no one is discussing the fact that the DNC's leaks were damaging only because they were not operating impartially. Regardless if the leaks came from Russia or a whistleblower in the DNC, isn't the fallout somewhat self inflicted?

grandalf 9y ago
Yes, and the only reason I was interested in the leaked information was because of the transparency it provided into the DNC and Clinton Foundation. In a democracy, transparency is a good thing. There are still a variety of things that were in the emails pertaining to campaign finance violations and DOJ improprieties that have essentially been ignored. Regardless of how the American people came to know about these things, they should be the focus of the investigation.
prostoalex 9y ago
Yep, the most severe outcome of a similar hacking of Macron's campaign in France was an extreme amount of boredom the leaks induced.
tootie 9y ago
That's beside the point of the hacking. If a foreign nation deliberately interfered in our electoral system to the benefit or possibly in collusion with their preferred party, that's a way bigger deal. It's criminal. Secondly, the amount of dirt they uncovered was so minimal. Of course they favored Clinton. She was a party loyalist and the one they considered most likely to win the general. If you think both parties don't operate like this all the time, you're nuts. They'd be nuts not to. I can't even imagine the level of freak out at the RNC when Trump took the lead.

fulafel 9y ago

Obviously wrong bit: "Downloading such files this quickly [at 22.6 megabytes per second] over the internet, especially over a VPN (most hackers would use one), would have been all but impossible because the network infrastructure through which the traffic would have to pass would further slow the traffic."

deleted 9y ago

[deleted]

discardorama 9y ago

> VIPS instead surmises that, after WikiLeaks' Julian Assange announced on June 12, 2016 his intention to publish Hillary Clinton-related emails, the DNC rushed to fabricate evidence that it had been hacked by Russia to defuse any potential WikiLeaks disclosures. This is laughably stupid. Why would attributing the hack to Russia instead of Wikileaks or whatever make any difference to the contents of the hacks?

arca_vorago 9y ago
Because the media and the mass conciousness is that easily manipulated? It worked, didn't it?

ece 9y ago

So, as a motive, one possibility could be the DNC orchestrated the DNC leaks to blunt the effect of trickling podesta/wikileaks emails if it was somehow an insider. Why become the news during a campaign where every moment Trump spoke his poll numbers went down? And show their own favoritism? It doesn't seem plausible. This could all be more Russian disinformation. As far as the podesta/wikileaks emails go: 1) Russia's history when it comes to election meddling and spreading dis-information speaks for itself, yes the US does it too, but the Russia is on another level (Every eastern European country has been a public target from the same groups). 2) Russia had a lot more to fear from Hillary than Trump. The sanctions and military ratcheting would likely be more in force than it is now under Trump and a dysfunctional congress. Hillary was a known hawk on Russia, compared with Manafort/Flynn on Russia. 3) Putin himself said "some patriotic Russians might have done stuff" like sending phishing emails. When Russia faced the lemon of a Hillary administration, they made lemonade. Arguably, it wasn't that hard and paid for itself. We as the voting public knew most of this before the election, including partly about Trump's intent of collusion and possibly collusion, and voted the way we did anyway. Assange is kind of irrelevant, he has always had his own motives, and it's pretty clearly being anti-US. Offering Damore a job with wikileaks, really?

wbillingsley 9y ago

There's something I don't get about the "Trump-Russia scandal": It seems to me the chances are Russia tries to hack most US politician's emails every day, and probably twice on Sundays. Even the nice ol' US was caught in 2009 spying on the UN Secretary General and the Security Council delegations of its allies; do we really for one moment think that famously-spy-heavy bad-guy Russia and its ex-spy-master President wouldn't be constantly trying to get its hands on the emails of its Cold War enemy? In which case, hunting whether Trump encouraged Russia seems like hunting for who asked the clouds to rain this morning. Which makes the US reaction not smell right. It smells somehow like a game of pretexts. So having "not got that" about the scandal -- something seems fishy here -- it looks to my amateur, non-US, non-politician, probably-too-cynical eyes, like there's five parties having a political fight for control (and yes I am being deliberately simplistic and caricaturing): - The Trump team, who seem like they're recruited like the Dirty Dozen (you're so unsuitable for any normal administration, and possibly borderline insane, that you've got nothing to lose with this crazy mission...) - The powers that be / senior civil servants. Trump spent his entire campaign calling Washington "the swamp" and declaring he'd drain it. Did you think they wouldn't fight back, the FBI wouldn't leak, they wouldn't try to undermine this braggart who's just come marching in telling them he's going to rip them apart? - The Republican establishment (McCain, etc). Did you really think parts of the Republican party that spent so long wanting anyone but Trump would grow to like him? - The left-of-centre echo chamber (us techie types, journalists, other professionals), whose typical MO is to use the levers of embarrassment, twitterstorms, and rhetoric to try to shovel any government we are unfortunate enough to have over us into following our agenda - Modern industry, which seems to have cottoned onto the idea that if publicly you say enough "left" things (equality, diversity) and sound passionate about social progress, you can pursue a "right" agenda (not paying tax, disempowering employees, building private monopolies with moats around them) without anybody making much fuss. And though that may be a gross caricature, in that model somehow the behaviour seems to make sense. For example, the Trump-Russia scandal as a way of tying Trump's hands and forcing him down foreign policy lines he doesn't want. The administration's seeming dysfunction, because anyone who joins them knows it is the only administration they will ever serve, so you can only get amateurs who don't know the game of White House politics or think they can change how it is played. The constant storms over his latest tweet, despite his tweets having been incoherent for years, because raising the level of outrage creates social roadblocks -- making avenues hopefully too sensitive and already too explosive for him to travel further down them. Which makes Russia seem like an irrelevant bystander -- doing what it does every day (which happens to be trying to hack American servers for everything it can get, while trying to nibble at gaining more control and influence in Eastern Europe and the Mediterranean).

Hasknewbie 9y ago

So, maybe I'm missing something here, but since when does the Russian hacking stand for "the Russian story" as a whole? Manaford's no-knock warrant, Jared's Russian embassy back channel, or Donnie Junior's e-mails seem like much more important items in said story so far. Within that context the DNC hacking seems to me to be only a small piece of the puzzle. Its validity (or not) does not call the other elements's veracity into question.