"the code delivers Remote Access Tools (RATs) and evades detection using a range of techniques."
A "range of techniques" includes things like rootkits.
>No rootkits,
The attackers did use stealthy persistence techniques often called 'rootkits".
"the SeaDaddy implant developed in Python and compiled with py2exe and another Powershell backdoor with persistence accomplished via Windows Management Instrumentation (WMI) system,[..] The Powershell backdoor is ingenious in its simplicity and power" [0]
>no 0 days
The same group used six 0-days in 2015. Either they didn't need to use them in this attack or they used them and deleted the evidence. Senit is APT28 see quote below:
"One of the striking characteristics of the Sednit group is its ability to come up with brand-new 0-day vulnerabilities regularly. In 2015, the group exploited no fewer than six 0-day vulnerabilities" [1]
>yet it was the most routine, simple attack conceivable.
The attack involved multiple pieces of custom written software and carefully researched spearfishing, the attackers spent time and effort to hide their tracks, maintain persistence and exfil data without detection. This level of effort and time does not qualify as routine, some intelligence agencies can't even write their own RATs.
[0]: https://www.crowdstrike.com/blog/bears-midst-intrusion-democ...
[1]: http://www.welivesecurity.com/wp-content/uploads/2016/10/ese...
Also, the WMI think they describe doesn't look like rootkit, more like cron analogue for Windows. I.e. on Unix it would be like installing a command inside crontab. That's not what is usually called a rootkit - a tool that is designed to conceals its presence (and other tools presence) from regular OS tools.
For example the RAT named X-Agent was one of several used in the DNC hack. It has never been put up for sale and it was used in previous Russian intelligence operations (for example tracking Ukraine artillery[0]).
>That's not what is usually called a rootkit
It doesn't appear that anyone has reverse engineered the PC version of X-Agent but the android variant (which may be very different from the one used in the DNC hack) does take some steps to hide itself. Granted nothing suggests anything like kernel syscall hooking but those sorts of rootkit techniques are overrated because they leave obvious and detectable patterns of compromise.
[0]: https://blog.trendmicro.com/trendlabs-security-intelligence/...
I've written custom software (which was a lot harder to find than some python WMI hooks) for hacking a lot lower profile organisations. I've consulted for organisations that were hacked by Chinese hackers for bitcoin ransom that had custom software written too. I mean, high profile target, more effort can be expected. It does not mean the government is involved (although a lot of hacking groups seem to have government sidelines in China, though it does not appear to be their primary activity. I mean unless the Chinese government is itself into bitcoin ransoming).
But more seriously, if a component of our government that is this central to our democracy can be hacked by sending emails "open this exe", then ... I mean seriously. Sorry to say, but if that works, you deserve what happens. Is this really the level of competency in the people that are currently organising the government ?
Also the main thing this report does is validate that the information leaked to the press is indeed true (I figured as much, I mean why put so much effort into fighting fake news unless the real target information is not fake ?).
So Hillary and the DNC is in fact in the pocket of wall street. She DID use the DNC organisation to sabotage Bernie Sanders. There are in fact foreign donors to Hillary and the DNC that are illegal under rules that Hillary's government department is supposed to enforce ... this report mostly confirms that this is indeed the view that the top of the DNC has.
Certainly malware which costs serious resources to develop, like stuxnet, says something about the capabilities of the attacker. Given that at the high end of the resource spectrum it is mostly governments, resources required are suggestive of a government, but resources are not conclusive in and of themselves.
The attribution of the DNC hack to APT28 and APT29 was not based on its sophistication but on the similarity to the methods used, tradecraft fingerprints, and the sharing of C&C servers to past attacks.
The closest I can find is when McAfee says: "If it looks like the Russians it isn't the Russians." I said "It looks like the Russians." These statements don't contradict each other.
We do disagree on attribution, but I haven't discussed that in this thread. He is radically skeptical about ever attributing any state sponsored hacking, although in the same interview he does attribute Stuxnet to the US/Israel and the OPM hack to China.
Garrett Graff
... Hillary seems to actually be a very persnickety technology user. She is
not very comfortable with most technology, only liked to use a BlackBerry and,
more specifically, only liked to use a specific type of increasingly older and
more out-of-date BlackBerry.
She doesn't know how to use a desktop computer. She--
Sean Cole
Wait, wait, wait. Back up. Back up. She doesn't know how to use a
desktop computer.
Garrett Graff
Hillary Clinton, the Democratic presidential nominee in 2016,
does not know how to use a desktop computer, according to multiple sources
interviewed by the FBI.
Sean Cole
How is that possible?
Garrett Graff
The short answer is, I don't know...
Most breaches begin with spear phishing, commodity exploits, a leaked key, or some other obvious or preventable detail. However, this is almost never the “sophisticated” aspect of a breach worth talking about. It’s easy to point at an embarrassing vector and dismiss the rest of an attack. Thus, do not judge an adversary by the vector they’ve chosen.
An adversary may show you what “sophistication” means after advancing from their beachhead."
* https://medium.com/starting-up-security/learning-from-a-year...
Everything I've read indicates the bulk of work was done by Powershell scripts, along with a backdoor process running in the open. If you told me that the backdoor was a kernel level rootkit or something similar then I could get onboard, but as it stands I don't think the attack's complexity is a solid argument for "Russia did it"
I also remember that some gmail accounts of people from DNC staff were hacked. Gmail probably has logged what IP addresses were used when logging in with stolen passwords and they could be used as a hint too (though most probably they point to cheap VPS bought by some anonymous person or Tor node, I doubt anyone would use a stolen password from their real IP address).
They also sucked all the money from the state level campaigns into Hillary's campaign, hurting the entire party when they lost after spending so much money trying to force Hillary through.
https://wikileaks.org/podesta-emails/emailid/22224
https://wikileaks.org/dnc-emails/emailid/11056
https://wikileaks.org/dnc-emails/emailid/5477
https://wikileaks.org/podesta-emails/emailid/24440
https://wikileaks.org/podesta-emails/emailid/10669#efmAO0APK...
https://wikileaks.org/podesta-emails/emailid/5688
https://wikileaks.org/dnc-emails/emailid/9999%20
https://wikileaks.org/podesta-emails/emailid/5423
> They also sucked all the money from the state level campaigns into Hillary's campaign.
You're misreading the Politico article about the Hillary Victory Fund. In that article, the DNC said it was using the initial money to set up common infrastructure for the state parties to use. The money that was supposed to go to the state parties did eventually go to the state parties as you can see here: https://www.opensecrets.org/jfc/summary.php?id=C00586537. To refresh your memory, the first [FEC maximum contribution amount] donated by an individual to the Hillary Victory Fund would go to her primary campaign, the next [max amount] would go to her general election campaign, the next [max amount] would go to the DNC, and the rest would be distributed among the state parties.
Also, I'm curious: whom would you consider a big name Democrat worthy of challenging Clinton not as a token opponent?
Wasserman-Schultz resigned to get out of the spotlight, which she believed would put more attention on Clinton for the general election.
We have the DNC's full email history here. Surely if they rigged the primary for Clinton, there would be at least one email showing it.
You know instead of the Hillary campaign saying, no no, you shouldn't appoint her, we have evidence that she is corrupt, here's the evidence.
And then after the evidence came to light the DNC was like, oh that's fine.
I hope that Hillary and the DNC are able to get their day in court so the evidence can be heard by a jury of their peers rather than the court of public opinion.
Be specific. Which emails are evidence of guilt? None of the emails I've seen have shown any evidence of the DNC rigging the primaries. Why would the resignations be evidence of guilt if the stated reasons for resignation are just as plausible?
Do you realize how much you sound like a conspiracy theorist?
For example, if I had to compete against someone in a drawing competition, and one of the judges was the parent of my competitor, and that judge has gone out of his way to train and groom his child for years for this competition, I may lament that the contest is rigged, even if the judge doesn't stuff the ballot box.
The DNC had "groomed" Clinton insofar as she had run in the primaries before and was familiar with the rules. She didn't receive any special treatment from the DNC during the primaries as far as their emails showed.
https://www.merriam-webster.com/dictionary/rigged
See sense 3
1. to manipulate or control usually by deceptive or dishonest means <rig an election>
2. to fix in advance for a desired result <rig the contest>
Editted to add second part of sense 3.
I'm not sure why you would think otherwise, though if you're implying that the example of extra, specialized training you provided above is an example of "fix in advance", I disagree. To "fix in advance" would mean that the outcome is predetermined, such as by bribes. This sense of fix is here:
https://www.merriam-webster.com/dictionary/fix
7b. to influence the actions, outcome, or effect of by improper or illegal methods <the race had been fixed>
If you have some other meaning implied by your comment, please explain. I find I'm a terrible mind reader.
Never mind the fact that Sanders was treated much more gently by the Clinton campaign than Obama was in '08, the only salient fact is that minority voters should have yielded their preference for a man who has spent 30+ years in Washington and yet has largely failed to build any power base.
> high-ranking DNC officials discussed the possibility of making Sanders' religion a campaign issue in southern states
Did they do so? If so, thats clear meddling. If not, its shows intent of meddling.
> Paustenbach suggested that a past incident could be used to promote a "narrative for a story, which is that Bernie never had his act together, that his campaign was a mess."
Again, suggestion to do acts of meddling but not clear if they went through with it.
> Wasserman Schultz resigned as DNC chair after the leak, and was replaced by Donna Brazile and the Democratic National Committee issued an apology to Sanders.[52] Speaking on CNN, Sanders responded to the email leak: "...it is an outrage and sad that you would have people in important positions in the DNC trying to undermine my campaign.
Regardless if the intended meddling happed or not, it is clear that even the party itself know that they were in the wrong.
They did not bring up Sanders's religion, so there was no meddling there.
> Paustenbach suggested that a past incident could be used to promote a "narrative for a story, which is that Bernie never had his act together, that his campaign was a mess."
This is out of context. Sanders was attacking the DNC in the media for following pre-agreed-upon rules in Nevada. They were discussing how to respond to those frankly ridiculous attacks. http://www.politifact.com/nevada/statements/2016/may/18/jeff...
> Regardless if the intended meddling happed or not, it is clear that even the party itself know that they were in the wrong.
To recap, we have their full email history here, yet we still can't find a single instance of them acting to rig the primaries against Sanders. Wasserman-Schultz resigned to get out of the spotlight, which she believed would put more attention on Clinton for the general election.
That led to a lot of acquaintances of mine that supported Sanders to continue bashing Clinton after the primaries were already over, when it would have been really helpful for the Democratic party to have been unified throughout all of that.
Again, I refer to them as delusional because the '16 primary fight was about 1/3 as dirty as the '08 primaries, and somehow Sanders supporters feel being treated gently isn't good enough, what they expected was a clear majority of democratic voters to simply hand over the reins of the Democratic Party. They truly expected politics to revolutionize itself because of Sanders presidential run, and somehow tricks would not be a part of politics instantly and forevermore.
I think my big takeaway regarding the primaries is that most 'progressive' Sanders voters simply wanted to hurt the American establishment, and if they couldn't do it with Bernie they wanted to cry, pick up their ball, and go home.
One might note that this author stops short of saying rather than merely insinuating that "publishing emails" constitutes "rigging an election", but he sure wrote a lot of words in that effort.
[0] http://www.cnbc.com/2016/12/29/russia-election-hack-obama-re...
Maybe you are not an American. Do you know what the primaries are?
Sure, that's obviously true in general, but given the current absence of evidence of "sophistication," there is no reason to assume its presence.
With computer crime it's especially obvious because most journalists don't know enough to understand what's hard and what's not, so they take the word of law enforcement, and law enforcement has big motivation to make it sound as bad as possible, since it enhances their significance and their success for catching one. "I've caught a sophisticated hacker" sounds better than "I've found a 13-year old kid that sent someone an email saying 'give me your password' and the poor shmoe was silly enough to do just that".
So there won't be a lot of reports about catching unsophisticated hackers. Usually it's always "highly sophisticated" ones.
OTOH, I think the actual (claimed) proof was using of certain bit.ly account etc. not sophistication per se.
Also, it looks like there were at least 3 attacks on the DNC, and phishing was only involved in one. Maybe the whitepapers talked about the other ones.
https://wikileaks.org/podesta-emails/emailid/34899
This is the stats page for the bit.ly phishing link from that email showing two clicks in the right time frame:
It's not rocket science to dump the emails out of a Gmail account:
https://support.google.com/accounts/answer/3024190?hl=en
But the Podesta leaks aren't the same as the DNC leaks, which Wikileaks has long claimed came from an insider who was upset by their treatment of Bernie. It's also interesting to note that even if the DNC was hacked, that doesn't actually prove where the information given to Wikileaks came from.
Given how careless they are in other regards, I have to think that any insider that wants it can get their data. Just read the PDF on this email to see how Colin Powell & Hillary Clinton treat OPSEC: https://wikileaks.org/clinton-emails/emailid/30324
"When I asked why not they gave me all kinds of nonsense about how they gave out signals that could be read by spies, etc. Same reason they tried to keep mobile phones out of the suite. I had numerous meetings with them. We even opened one up for them to try to explain to me why it was more dangerous than say, a remote control for one of the many tvs in the suite. Or something embedded in my shoe heel. They never satisfied me and NSA/CIA wouldn't back off. So, we just went about our business and stopped asking. I had an ancient version of a PDA and used it. In general, the suite was so sealed that it is hard to get signals in or out wirelessly."
Also, the DNC has long been planning to reach for the Putin angle:
"Best approach is to slaughter Donald for his bromance with Putin, but not go too far betting on Putin re Syria. Brent"
Sure, HDD firmware hacks are cool, but in terms of R&D time far less efficient if you're willing to spam attempts to get in the front door. And I'd say they chose the appropriate level of sophistication given the success of the penetration.
The DNC isn't exactly an air-gapped Iranian nuclear centrifuge.
Then how is this evidence of a 'state-sponsored actor'?
And how did the narrative of this story ever get derailed from what it should have been, which was, "The DNC, and John Podesta in particular who had both his gmail and his Twitter accounts hacked, are incompetent", to "this is Russian interference in a US election"?
The news is why that particular person was targeted.
For which no proof is being presented. Lots of stuff about hacking tools, nothing really about identifying hackers. Lots of anonymous high level sources offering vague assurances and excuses for why we can't present info...
Although the media and many in politics are saying this, it's plainly false. There is no serious claim that the Russians interfered in our election.
The claims are that the Russians interfered in a presidential campaign. There's a huge difference between the process of campaigning, versus the election process of casting and counting votes.
Sowing this confusion is useful on at least two levels. Most obviously, it serves to undermine the legitimacy of the incoming President. But it's also useful in setting stage for future debate about campaign finance laws. It's important in that debate to keep separate the ideas of election - which the government must protect to ensure its faithfulness to the voters - versus the idea of campaigning, which the government may never interfere with, which is the primary purpose of the First Amendment.
There are many Republicans.
The world doesn't come with nice "I did it" notes. You make the best decisions you can with the information you have.
edit: seeing some reports they used "sophisticated" SQL injection... okay...I mean for a lay person it seems sophisticated, sure. But for anyone in the industry it's one of the oldest and easiest tricks in the book.
I really suspect news sources are knowingly exaggerating about the sophistication of this "hack" in order to make up-play Russia's role and downplay the DNC's culpability.
https://www.crowdstrike.com/blog/bears-midst-intrusion-democ...
The summary: One used Powershell modules and Windows Scheduler to run scripts. Another used a combination of Twitter and public sites like Github/Dropbox for command and control.
In my opinion, neither is impressively sophisticated, and a skilled application developer could whip up something similar in a week or two. Using popular sites like Twitter/Dropbox for C&C has been common for years, and you can purchase similar backdoors/RATs for less than $100.
edit: Another interesting point from the link above: the two exploits stole exactly the same info once inside the DNC network. This would obviously be a big no-no for a sophisticated state actor as it doubles your chance of being compromised, but the author explains it away by claiming that Russia's intelligence agencies are disorganized and adversarial.
If it turned out that Russia was not behind these attacks, the scale of the bad publicity for Crowdstrike, Fidelis, Palo Alto Networks, etc. would nearly put them out of business. Unlike you, they have skin in the game and don't make these claims lightly.
This is the next generation of warfare, attribution is simply impossible. Even if there existed actual forensic evidence it could not be relied upon.
Reacting to purported attacks at face value will leave you like a 1-layer chess player, potentially acting on behalf of your adversary.
That one is more likely to be used by the Chinese: https://www.invincea.com/2016/07/tunnel-of-gov-dnc-hack-and-...
The Chinese implementation of the XTunnel protocol is in Java (the GitHub project is written in Java, and you can see an embedded JRE in your blog post's link to the Chinese tool in the strings here: https://cynomix.invincea.com/sample/e2101519714f8a4056a9de18...). The FancyBear implementation is not (no embedded JRE here: https://cynomix.invincea.com/sample/f09780ba9eb7f7426f93126b...).
If you want to see how professionals do it, take a look at https://www.eset.com/int/about/newsroom/research/dissection-....
TIL I'm as good as a state level intelligence team.
Hey CIA/NSA we know you are reading this, my contact info is in my profile. Hire me.
> Yesterday, an Internet cyber hacker using the alias "cmdrfred" claimed on "HackerNews", an elite underground hacker site, that he or she personally built the hacking tools used by Russia to breach the DNC email servers and change the outcome of the recent election.
> "I have personally written that exact tool [it] uses ... encryption ... so you can access [the DNC] without fear."
> "I'm as good as a state level intelligence team."
> cmdrfred went on to taunt American intelligence agencies while admitting that he was aware that elite anti-cyberhacking teams from the NSA and CIA were monitoring his operations.
> The owner of HackerNews Paul Graham -- venture capitalist, flamboyant playboy, and known Russian sympathizer -- could not be reached for comment.
Not to totally ignore the pithiness, but I feel like your comment touches on something I see a ton here (and elsewhere): an offhand dismissal of the 'state level' intelligence capacity.
At the end of the day, the systems were exploited. That more sophisticated methods went unused should be a measure of efficiency and not necessarily execution. Why break out the trick play if your opponent can't keep from you running it up the middle?
http://security.stackexchange.com/questions/55279/how-easy-i...
I question how efficient it is to get caught red handed in the cookie jar of the worlds only super power.
Sure Vladimir Putin could invite President Obama to a state dinner and then proceed to blow his head off with an AK-47 but that would lack the subterfuge I expect from "state level actors". If this is indeed the Russians, they are as laughably incompetent as our elected officials in regards to infosec and thus a threat to no one.
"One senior government official, who had been briefed on an F.B.I. investigation into the matter, said that while there were attempts to penetrate the Republican committee’s systems, they were not successful."
Many of the whitepapers that I read about the DNC hack listed the attack's "sophistication" as proof that it came from a state actor, yet it was the most routine, simple attack conceivable. No rootkits, no 0 days, just simple phishing and social engineering.