DNC Leak

From A Closer Look On Syria
Jump to navigation Jump to search
Putin hacked Clinton?
Donald J. Trump, the best president Russia can hack

Claims of Russian hacking

June 2016

October 2016

December 2016

Grizzly Steppe

See also Profexer‎
Yara Signature of Grizzly Steppe according to U.S. Department of Homeland Security

Burlington Electric Department

  • Russian operation hacked a Vermont utility, showing risk to U.S. electrical grid security, officials say - Juliet Eilperin, Washington Post, December 30, 2016
    A code associated with the Russian hacking operation dubbed Grizzly Steppe by the Obama administration has been detected within the system of a Vermont utility, according to U.S. officials.
    While the Russians did not actively use the code to disrupt operations, according to officials who spoke on the condition of anonymity to discuss a security matter, the discovery underscores the vulnerabilities of the nation’s electrical grid. And it raises fears in the U.S. government that Russian government hackers are actively trying to penetrate the grid to carry out potential attacks.
  • Vermont Electricity Department Finds Malware Linked to Russian Hackers - Phil Helsel, NBC News, December 31, 2016
    A Vermont electricity provider said it found malware linked to an alleged Russian campaign to hack political entities in a laptop, after U.S. utilities were warned about the "Grizzly Steppe" affiliated code by the federal government.
  • Russia penetrated Vermont utility company computer - USA Today, December 31, 2016
    BURLINGTON, Vt. — Malicious software believed tied to a Russian hacking group associated with attempts to influence the U.S. presidential election was found Friday within a computer that belongs to Burlington Electric, one of Vermont’s electrical utilities.
  • How The Washington Post's Defense Of Its Russian Hacking Story Unraveled Through Web Archiving - Kalev Leetaru, Forbes, January 2, 2016
    How the Internet Archive’s historical snapshots of the Post’s story undermined the…

January 2017

  • 'Russian meddling doubters should wait to see report, says Brennan' (on video) - PBS, 4 January, 2017
    (Detailed report to be provided to the US President who is to decide what and how to share...)
  • U.S. obtained evidence after election that Russia leaked emails: officials -Arshad Mohammed and Jonathan Landay , Reuters, January 5, 2017
    U.S. intelligence agencies obtained what they considered to be conclusive evidence after the November election that Russia provided hacked material from the Democratic National Committee to WikiLeaks through a third party, three U.S. officials said on Wednesday.
  • Foreign Cyber Threats to the United States - US Senate Committee hearing, January 5, 2017
    (In response to Sen. McCain question: 'we stand by our previous assessment' from October)
  • @realDonaldTrump, January 5, 2017
    The Democratic National Committee would not allow the FBI to study or see its computer info after it was supposedly hacked by Russia......So how and why are they so sure about hacking if they never even requested an examination of the computer servers? What is going on?
  • Background to “Assessing Russian Activities and Intentions in Recent US Elections”: The Analytic Process and Cyber Incident Attribution, dni.gov, 6 January 2017

June 2017

  • TOP-SECRET NSA REPORT DETAILS RUSSIAN HACKING EFFORT DAYS BEFORE 2016 ELECTION - The Intercept, June 5 2017
  • In response to a question 'does he have any doubt', ex-FBI director James Comey (a lawyer by background) testified that he has 'no doubt' that Russia attempted to influence elections and was behind DNC and DCCC intrusions and subsequent leaks -live stream, vox.com, June 8, 2017
    BURR: Do you have any doubt that Russia attempted to interfere in the 2016 elections?
    COMEY: None.
    BURR: Do you have any doubt that the Russian government was behind the intrusions in the DNC and the DCCC systems, and the subsequent leaks of that information?
    COMEY: No, no doubt.
    BURR: Do you have any doubt that the Russian government was behind the cyber intrusion in the state voter files?
    COMEY: No.
    BURR: Do you have any doubt that officials of the Russian government were fully aware of these activities?
    COMEY: No doubt. (NY Times transcript)(video).
    (later, answering Heinrich)
    The — there should be no fuzz on this whatsoever. The Russians interfered in our election during the 2016 cycle. They did it with purpose. They did it with sophistication. They did it with overwhelming technical efforts. And it was an active-measures campaign driven from the top of that government. There is no fuzz on that.
    It is a high-confidence judgment of the entire intelligence community, and — and the members of this committee have — have seen the intelligence. It’s not a close call. That happened. That’s about as un-fake as you can possibly get, and is very, very serious, which is why it’s so refreshing to see a bipartisan focus on that, because this is about America, not about any particular party.

Recall earlier Robert Parry commentary:

Repeating an accusation over and over again is not evidence that the accused is guilty, no matter how much “confidence” the accuser asserts about the conclusion.
the case, as presented (DNI report), is one-sided and lacks any actual proof. Further, the continued use of the word “assesses” – as in the U.S. intelligence community “assesses” that Russia is guilty – suggests that the underlying classified information also may be less than conclusive because, in intelligence-world-speak, “assesses” often means “guesses.”
The DNI report admits as much, saying, “Judgments are not intended to imply that we have proof that shows something to be a fact. Assessments are based on collected information, which is often incomplete or fragmentary, as well as logic, argumentation, and precedents.”


February 2018

  • Mueller Indicts 13 Russians for Hacking During U.S. Election
    Indictment.
    Internet Research Agency, Prigozhin, see also here and here; all claims as per respective sources.
    --Resup (talk) 18:03, 16 February 2018 (UTC)
    12 b. Co-conspirators arranged for a poster Happy 55 th Birthday Dear Boss in front of the White House (matching Prigozhin birthday)
    Counts: (1) 8. Conspiracy to defraud the US (2) 86. conspiracy of wire and bank fraud (3-8) 96. aggravated identity theft, details in the linked document

--Resup (talk) 18:23, 16 February 2018 (UTC)

April 2019

June 2019

July, 2019

Recall (above) that Crowdstrike report is June 15, 2016. Guccifer 2.0 claim emerged on June 15, 2016, and it contained a document "from Hillary’s PC she worked with as the Secretary of State." He lists some other documents, eg "HRC election plans" and concludes: The main part of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.

The report claim is:

Within approximately five hours of Trump’s statement, GRU officers targeted for the first time Clinton’s personal office. After candidate Trump’s remarks, Unit 26165 created and sent malicious links targeting 15 email accounts at the domain ■■■■■■■■■ including an email account belonging to Clinton aide ■■■■■■■■■ The investigation did not find evidence of earlier GRU attempts to compromise accounts hosted on this domain. It is unclear how the GRU was able to identify these email accounts, which were not public.

This does not sound like a successful or particularly sophisticated attempt

The report itself describes alleged earlier hacking. Allegation evidence is not specified and apparently is coming from the Crowdstrike.

a. Initial Access
By no later than April 12, 2016, the GRU had gained access to the DCCC computer network using the credentials stolen from a DCCC employee who had been successfully spearphished the week before. Over the ensuing weeks, the GRU traversed the network, identifying different computers connected to the DCCC network. By stealing network access credentials along the way (including those of IT administrators with unrestricted access to the system), the GRU compromised approximately 29 different computers on the DCCC network.
Approximately six days after first hacking into the DCCC network, on April 18, 2016, GRU officers gained access to the DNC network via a virtual private network (VPN) connection between the DCCC and DNC networks. Between April 18, 2016 and June 8, 2016, Unit 26165 compromised more than 30 computers on the DNC network, including the DNC mail server and shared file server.
b. Implantation of Malware on DCCC and DNC Networks
Unit 26165 implanted on the DCCC and DNC networks two types of customized malware, known as “X-Agent” and “X-Tunnel”; Mimikatz, a credential-harvesting tool; and rar.exe, a tool used in these intrusions to compile and compress materials for exfiltration.

Also recall, US v. George Papadopoulos - Statement of the Offense -justice.gov, October 5, 2017 :

  • the professor told defendant PAPADOPOULOS about the "thousands of emails" on or about April 26, 2016, when defendant PAPADOPOULOS had been a foreign policy adviser to the Campaign for over a month.

2020: We have no proof!

Denials and rebuttals

Wordfence

P.A.S. malware portal, according to Wordfence , December 30, 2016 (Mark Maunder).

Veteran Intelligence Professionals for Sanity

No, I did it!

Guccifer 2.0

Moved to Guccifer 2.0

Craig Murray

Seth Rich?

Main article: Seth Rich

No public comment

  • Assange meets U.S. congressman, vows to prove Russia did not leak him documents - The Hill, August 16, 2017
    Congressman Dana Rohrabacher recounted his conversation with Assange to The Hill.Our three-hour meeting covered a wide array of issues, including the WikiLeaks exposure of the DNC emails during last year's presidential election,” Rohrabacher said, “Julian emphatically stated that the Russians were not involved in the hacking or disclosure of those emails. Pressed for more detail on the source of the documents, Rohrabacher said he had information to share privately with President Donald Trump

Roger Stone

Crowdstrike?

A theory (number ****) by conspiracy journalist Georg Webb (starts around 9:30 here). He claims that McAfee/Networks Associates in the early days bought a company of Russian hackers, kept 12 of them to keep writing viruses, while in another office the anti-viruses were produced (veracity of this is entirely on George Webb). With Alperovich coming from McAffe, he thinks it might go along similar lines with Crowdstrike. (No real evidence for that, of course, but a curious thought).

Now, from John McAfee interview:

“When the FBI or when any other agency says the Russians did it or the Chinese did something or the Iranians did something – that's a fallacy,”
“Any hacker capable of breaking into something is extraordinarily capable of hiding their tracks. If I were the Chinese and I wanted to make it look like the Russians did it I would use Russian language within the code.
“This is what the FBI and other agencies want us to believe so that they can manipulate our opinions, but I can promise you – if it looks like the Russians did it, then I can guarantee you it was not the Russians.”

Servers

  • Comey Testifying On The Russia Hacks, January 10, 2017. FBI Director James Comey testifies before the 115th Congress, saying despite multiple requests from different levels of the FBI, that the FBI did not have direct acces to the DNC servers nor Podesto's personal electronics. They relied on "highly respected" third party affliates to do their investigation.
    Mirror: FBI requested DNC servers multiple times, and denied - James Comey, video published June 1, 2017. FBI access was denied, and eventually it was agreed that a 'highly respected private company' got access and shared 'what they saw'.
  • In reply to Roger Stone filing (Politico, 20 June, 2019; PDF file), the US government says that it (independently) "gathered evidence" of hacking, without saying what that evidence is.

Other sources

Analysis

Indictments

Comments (USA).

Comments (Russia)

Alleged Timeline

  • (Private server): March, 2016 WikiLeaks launched a searchable archive of emails sent to/from Sec. Clinton private email server
  • (Russians): Allegedly, on April 22, 2016 'gigabytes of data' compressed, and on April 26, 2016 transferred to moved the compressed DNC data using X-Tunnel to a GRU-leased computer located in Illinois (Indictment, 28), by indicted Russians
  • (Allegedly hack noticed): 'DNC leaders were tipped to the hack in late April (2016). Chief executive Amy Dacey got a call from her operations chief saying that their information technology team had noticed some unusual network activity. Within 24 hours, CrowdStrike had installed software on the DNC’s computers so that it could analyze data '. (WaPo)
  • More leaks threatened by Wikileaks , June 12, 2016:
  • (Alleged hack reported): WaPo, June 14, 2016; Crowdstrike, June 16, 2016


Some details

Military Units from the indictment:

  • 'Federal State Military Unit 26165' listing, map
  • 'Federal State Military Unit 74455', listing not found, the unit and address, military camp No. 48/1, Moscow, Svoboda street (ulitsa Svobody), 21/2, mentioned in this unrelated court document, map.
    However, Mueller indictment has (18)'...Unit 74455 was located at 22 Kirova Street, Khimki, Moscow, a building referred to within the GRU as the “Tower.” ...map 1, 2
    Added: svoboda.org (below) discussed those and some other addresses.

People:

  • VIKTOR BORISOVICH NETYKSHO (Нетыкшо Виктор Борисович) (dissertation). Some info given by svoboda.org (below)
Sources
Comments.

Some units and people appear to be real and potentially capable. Mueller still has to show that they were involved. What he provides is some @mail.com email address said to be used. It is not really clear (to me) how this establishes involvement of two military units and 12 people, said to be officers. --Resup (talk) 09:55, 22 July 2018 (UTC)

X agent

  • https://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-update-ios-espionage-app-found/ , February 4, 2015
    We found two malicious iOS applications in Operation Pawn Storm. One is called XAgent (detected as IOS_XAGENT.A) and the other one uses the name of a legitimate iOS game, MadCap (detected as IOS_ XAGENT.B). After analysis, we concluded that both are applications related to SEDNIT.
    Analysis of XAgent ...Installing the malware into an iOS 8 device yields different results. The icon is not hidden and it also cannot restart automatically. This suggests that the malware was designed prior to the release of iOS 8 last September 2014.
  • https://www.crowdstrike.com/blog/danger-close-fancy-bear-tracking-ukrainian-field-artillery-units/
    From late 2014 and through 2016, FANCY BEAR X-Agent implant was covertly distributed on Ukrainian military forums within a legitimate Android application developed by Ukrainian artillery officer Yaroslav Sherstuk.
    The original application enabled artillery forces to more rapidly process targeting data for the Soviet-era D-30 Howitzer employed by Ukrainian artillery forces reducing targeting time from minutes to under 15 seconds. According to Sherstuk’s interviews with the press, over 9000 artillery personnel have been using the application in Ukrainian military.
    Open source reporting indicates that Ukrainian artillery forces have lost over 50% of their weapons in the 2 years of conflict and over 80% of D-30 howitzers, the highest percentage of loss of any other artillery pieces in Ukraine’s arsenal.
  • Defense ministry denies reports of alleged artillery losses because of Russian hackers' break into software -Interfax.ua, 06.01.2017
    "The information of the Command of Missile Troops and Artillery of the Ukrainian Ground Forces is that losses in artillery weapons during the Anti-Terrorist operation were way below those reported [by the media, which claimed 80% of D-30 howitzers were lost] and have nothing to do with the stated cause.

X tunnel

Notes

3-point answer of Putin to Fox, Russia could not affect election results, hacked materials were genuine (but all the attention is away from it), the guilt has to be decided in courts (offering questioning and investigation in Russia procedure, also stated in the summit press conference). I thought before the summit the Russian answer will be referring it to courts (but no cosmic good to make this point early here). With Putin's law enforcement/services background, references to law/legal process appear natural/genuine (and different from investigative approach I favor, or other approaches). An argument can be made how courts are not ideal, and more points how it is even more so in Russia. But the alternative when claims are never investigated competitively (even if imperfectly) and used forever in partisan propaganda or 'hybrid wars' is not exactly a bright alternative either. --00:51, 17 July 2018 (UTC)

Retrieved from "https://acloserlookonsyria.shoutwiki.com/w/index.php?title=DNC_Leak&oldid=58140"