DNC Leak

From A Closer Look On Syria
Jump to: navigation, search
Putin hacked Clinton?
Donald J. Trump, the best president Russia can hack

Claims of Russian hacking

June 2016

October 2016

December 2016

Grizzly Steppe

See also Profexer‎
Yara Signature of Grizzly Steppe according to U.S. Department of Homeland Security

Burlington Electric Department

  • Russian operation hacked a Vermont utility, showing risk to U.S. electrical grid security, officials say - Juliet Eilperin, Washington Post, December 30, 2016
    A code associated with the Russian hacking operation dubbed Grizzly Steppe by the Obama administration has been detected within the system of a Vermont utility, according to U.S. officials.
    While the Russians did not actively use the code to disrupt operations, according to officials who spoke on the condition of anonymity to discuss a security matter, the discovery underscores the vulnerabilities of the nation’s electrical grid. And it raises fears in the U.S. government that Russian government hackers are actively trying to penetrate the grid to carry out potential attacks.
  • Vermont Electricity Department Finds Malware Linked to Russian Hackers - Phil Helsel, NBC News, December 31, 2016
    A Vermont electricity provider said it found malware linked to an alleged Russian campaign to hack political entities in a laptop, after U.S. utilities were warned about the "Grizzly Steppe" affiliated code by the federal government.
  • Russia penetrated Vermont utility company computer - USA Today, December 31, 2016
    BURLINGTON, Vt. — Malicious software believed tied to a Russian hacking group associated with attempts to influence the U.S. presidential election was found Friday within a computer that belongs to Burlington Electric, one of Vermont’s electrical utilities.
  • How The Washington Post's Defense Of Its Russian Hacking Story Unraveled Through Web Archiving - Kalev Leetaru, Forbes, January 2, 2016
    How the Internet Archive’s historical snapshots of the Post’s story undermined the…

January 2017

  • 'Russian meddling doubters should wait to see report, says Brennan' (on video) - PBS, 4 January, 2017
    (Detailed report to be provided to the US President who is to decide what and how to share...)
  • U.S. obtained evidence after election that Russia leaked emails: officials -Arshad Mohammed and Jonathan Landay , Reuters, January 5, 2017
    U.S. intelligence agencies obtained what they considered to be conclusive evidence after the November election that Russia provided hacked material from the Democratic National Committee to WikiLeaks through a third party, three U.S. officials said on Wednesday.
  • Foreign Cyber Threats to the United States - US Senate Committee hearing, January 5, 2017
    (In response to Sen. McCain question: 'we stand by our previous assessment' from October)
  • @realDonaldTrump, January 5, 2017
    The Democratic National Committee would not allow the FBI to study or see its computer info after it was supposedly hacked by Russia......So how and why are they so sure about hacking if they never even requested an examination of the computer servers? What is going on?
  • Background to “Assessing Russian Activities and Intentions in Recent US Elections”: The Analytic Process and Cyber Incident Attribution, dni.gov, 6 January 2017

June 2017

  • TOP-SECRET NSA REPORT DETAILS RUSSIAN HACKING EFFORT DAYS BEFORE 2016 ELECTION - The Intercept, June 5 2017
  • In response to a question 'does he have any doubt', ex-FBI director James Comey (a lawyer by background) testified that he has 'no doubt' that Russia attempted to influence elections and was behind DNC and DCCC intrusions and subsequent leaks -live stream, vox.com, June 8, 2017
    BURR: Do you have any doubt that Russia attempted to interfere in the 2016 elections?
    COMEY: None.
    BURR: Do you have any doubt that the Russian government was behind the intrusions in the DNC and the DCCC systems, and the subsequent leaks of that information?
    COMEY: No, no doubt.
    BURR: Do you have any doubt that the Russian government was behind the cyber intrusion in the state voter files?
    COMEY: No.
    BURR: Do you have any doubt that officials of the Russian government were fully aware of these activities?
    COMEY: No doubt. (NY Times transcript)(video).
    (later, answering Heinrich)
    The — there should be no fuzz on this whatsoever. The Russians interfered in our election during the 2016 cycle. They did it with purpose. They did it with sophistication. They did it with overwhelming technical efforts. And it was an active-measures campaign driven from the top of that government. There is no fuzz on that.
    It is a high-confidence judgment of the entire intelligence community, and — and the members of this committee have — have seen the intelligence. It’s not a close call. That happened. That’s about as un-fake as you can possibly get, and is very, very serious, which is why it’s so refreshing to see a bipartisan focus on that, because this is about America, not about any particular party.

Recall earlier Robert Parry commentary:

Repeating an accusation over and over again is not evidence that the accused is guilty, no matter how much “confidence” the accuser asserts about the conclusion.
the case, as presented (DNI report), is one-sided and lacks any actual proof. Further, the continued use of the word “assesses” – as in the U.S. intelligence community “assesses” that Russia is guilty – suggests that the underlying classified information also may be less than conclusive because, in intelligence-world-speak, “assesses” often means “guesses.”
The DNI report admits as much, saying, “Judgments are not intended to imply that we have proof that shows something to be a fact. Assessments are based on collected information, which is often incomplete or fragmentary, as well as logic, argumentation, and precedents.”

February 2018

  • Mueller Indicts 13 Russians for Hacking During U.S. Election
    Indictment.
    Internet Research Agency, Prigozhin, see also here and here; all claims as per respective sources.
    --Resup (talk) 18:03, 16 February 2018 (UTC)
    12 b. Co-conspirators arranged for a poster Happy 55 th Birthday Dear Boss in front of the White House (matching Prigozhin birthday)
    Counts: (1) 8. Conspiracy to defraud the US (2) 86. conspiracy of wire and bank fraud (3-8) 96. aggravated identity theft, details in the linked document

--Resup (talk) 18:23, 16 February 2018 (UTC)

Denials and rebuttals

Wordfence

P.A.S. malware portal, according to Wordfence , December 30, 2016 (Mark Maunder).

Veteran Intelligence Professionals for Sanity

No, I did it!

Guccifer 2.0

  • ‘Guccifer 2.0’ Is Likely a Russian Government Attempt to Cover Up Its Own Hack - Lorenzo Franceschi-Bicchierai, Motherboard, June 16 2016
  • We Spoke to DNC Hacker 'Guccifer 2.0' - Lorenzo Franceschi-Bicchierai, Motherboard, June 21 2016
    Last week, a mysterious hacker using the handle "Guccifer 2.0" emerged to claim responsibility for the data breach at the Democratic National Committee, which democrats and several cybersecurity firms attributed to two groups of Russian hackers, likely working for Vladimir Putin's government.
  • "Did the Russians really hack the DNC or is this another Sony Pictures moment? You decide" - The Register, July 27, 2016 + threatconnect
    We're told Team Guccifer used AOL France's webmail to exchange messages with journalists; these messages, sent from guccifer20@aol.fr, were stamped with a French IP address – 95.130.15.34 – by AOL's infrastructure, meaning the sender was using that network address at the time
    ...It is important to note that the IP address seen in the Guccifer 2.0 AOL communications – 95.130.15.34 – is not listed as an option within Elite VPN Service, although it has an identical SSH fingerprint and has the exact same port (1723, PPTP) open as the listed options. This demonstrates the server was cloned from the same server image as all the Elite VPN servers but may be a private or dedicated version of the service." ThreatConnect also notes that the 95.130.15.34 IP address has been used in a few swindles, including a Russian mail-order bride scam in 2014 and attacks against WordPress blogs last year. The IP address also crops up in a Russian-language text message proxy service and a node list for crypto-currency EDR
    Russian foreign minister Sergey Lavrov gave a simple reply when asked about the matter by the press. "I don't want to use four-letter words," he said.
  • ‘Lone DNC Hacker’ Guccifer 2.0 Slipped Up and Revealed He Was a Russian Intelligence Officer -The Daily Beast', March 22, 2018
    Claims made; no supporting data provided.
    But on one occasion, The Daily Beast has learned, Guccifer failed to activate the VPN client before logging on. As a result, he left a real, Moscow-based Internet Protocol address in the server logs of an American social media company, according to a source familiar with the government’s Guccifer investigation. Twitter and WordPress were Guccifer 2.0’s favored outlets. Neither company would comment for this story, and Guccifer did not respond to a direct message on Twitter.
    How do you distinguish 'VPN' from a 'real IP address' in the 'logs of a social media company'? Just how much info is actually recorded?
  • Habakkuk on metadata, David Habbakkuk, July 18, 2018
  • Forensic Data Proves DNC Was Not Hacked by Russia - Forbidden Knowledge TV, July 17, 2018

Was Guccifer 2.0 a cover-up?

Charges

see below

Craig Murray

Seth Rich?

Main article: Seth Rich

No public comment

  • Assange meets U.S. congressman, vows to prove Russia did not leak him documents - The Hill, August 16, 2017
    Congressman Dana Rohrabacher recounted his conversation with Assange to The Hill.Our three-hour meeting covered a wide array of issues, including the WikiLeaks exposure of the DNC emails during last year's presidential election,” Rohrabacher said, “Julian emphatically stated that the Russians were not involved in the hacking or disclosure of those emails. Pressed for more detail on the source of the documents, Rohrabacher said he had information to share privately with President Donald Trump

Crowdstrike?

A theory (number ****) by conspiracy journalist Georg Webb (starts around 9:30 here). He claims that McAfee/Networks Associates in the early days bought a company of Russian hackers, kept 12 of them to keep writing viruses, while in another office the anti-viruses were produced (veracity of this is entirely on George Webb). With Alperovich coming from McAffe, he thinks it might go along similar lines with Crowdstrike. (No real evidence for that, of course, but a curious thought).

Now, from John McAfee interview:

“When the FBI or when any other agency says the Russians did it or the Chinese did something or the Iranians did something – that's a fallacy,”
“Any hacker capable of breaking into something is extraordinarily capable of hiding their tracks. If I were the Chinese and I wanted to make it look like the Russians did it I would use Russian language within the code.
“This is what the FBI and other agencies want us to believe so that they can manipulate our opinions, but I can promise you – if it looks like the Russians did it, then I can guarantee you it was not the Russians.”

Other sources

Analysis

Indictments

Comments (USA).

Comments (Russia)

Alleged Timeline

  • (Private server): March, 2016 WikiLeaks launched a searchable archive of emails sent to/from Sec. Clinton private email server
  • (Russians): Allegedly, on April 22, 2016 'gigabytes of data' compressed, and on April 26, 2016 transferred to moved the compressed DNC data using X-Tunnel to a GRU-leased computer located in Illinois (Indictment, 28), by indicted Russians
  • (Allegedly hack noticed): 'DNC leaders were tipped to the hack in late April (2016). Chief executive Amy Dacey got a call from her operations chief saying that their information technology team had noticed some unusual network activity. Within 24 hours, CrowdStrike had installed software on the DNC’s computers so that it could analyze data '. (WaPo)
  • More leaks threatened by Wikileaks , June 12, 2016:
  • (Alleged hack reported): WaPo, June 14, 2016; Crowdstrike, June 16, 2016


Some details

Military Units from the indictment:

  • 'Federal State Military Unit 26165' listing, map
  • 'Federal State Military Unit 74455', listing not found, the unit and address, military camp No. 48/1, Moscow, Svoboda street (ulitsa Svobody), 21/2, mentioned in this unrelated court document, map.
    However, Mueller indictment has (18)'...Unit 74455 was located at 22 Kirova Street, Khimki, Moscow, a building referred to within the GRU as the “Tower.” ...map 1, 2
    Added: svoboda.org (below) discussed those and some other addresses.

People:

  • VIKTOR BORISOVICH NETYKSHO (Нетыкшо Виктор Борисович) (dissertation). Some info given by svoboda.org (below)
Sources
Comments.

Some units and people appear to be real and potentially capable. Mueller still has to show that they were involved. What he provides is some @mail.com email address said to be used. It is not really clear (to me) how this establishes involvement of two military units and 12 people, said to be officers. --Resup (talk) 09:55, 22 July 2018 (UTC)

X agent

  • https://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-update-ios-espionage-app-found/ , February 4, 2015
    We found two malicious iOS applications in Operation Pawn Storm. One is called XAgent (detected as IOS_XAGENT.A) and the other one uses the name of a legitimate iOS game, MadCap (detected as IOS_ XAGENT.B). After analysis, we concluded that both are applications related to SEDNIT.
    Analysis of XAgent ...Installing the malware into an iOS 8 device yields different results. The icon is not hidden and it also cannot restart automatically. This suggests that the malware was designed prior to the release of iOS 8 last September 2014.
  • https://www.crowdstrike.com/blog/danger-close-fancy-bear-tracking-ukrainian-field-artillery-units/
    From late 2014 and through 2016, FANCY BEAR X-Agent implant was covertly distributed on Ukrainian military forums within a legitimate Android application developed by Ukrainian artillery officer Yaroslav Sherstuk.
    The original application enabled artillery forces to more rapidly process targeting data for the Soviet-era D-30 Howitzer employed by Ukrainian artillery forces reducing targeting time from minutes to under 15 seconds. According to Sherstuk’s interviews with the press, over 9000 artillery personnel have been using the application in Ukrainian military.
    Open source reporting indicates that Ukrainian artillery forces have lost over 50% of their weapons in the 2 years of conflict and over 80% of D-30 howitzers, the highest percentage of loss of any other artillery pieces in Ukraine’s arsenal.
  • Defense ministry denies reports of alleged artillery losses because of Russian hackers' break into software -Interfax.ua, 06.01.2017
    "The information of the Command of Missile Troops and Artillery of the Ukrainian Ground Forces is that losses in artillery weapons during the Anti-Terrorist operation were way below those reported [by the media, which claimed 80% of D-30 howitzers were lost] and have nothing to do with the stated cause.

X tunnel

Notes

3-point answer of Putin to Fox, Russia could not affect election results, hacked materials were genuine (but all the attention is away from it), the guilt has to be decided in courts (offering questioning and investigation in Russia procedure, also stated in the summit press conference). I thought before the summit the Russian answer will be referring it to courts (but no cosmic good to make this point early here). With Putin's law enforcement/services background, references to law/legal process appear natural/genuine (and different from investigative approach I favor, or other approaches). An argument can be made how courts are not ideal, and more points how it is even more so in Russia. But the alternative when claims are never investigated competitively (even if imperfectly) and used forever in partisan propaganda or 'hybrid wars' is not exactly a bright alternative either. --00:51, 17 July 2018 (UTC)