Sure, HDD firmware hacks are cool, but in terms of R&D time far less efficient if you're willing to spam attempts to get in the front door. And I'd say they chose the appropriate level of sophistication given the success of the penetration.

The DNC isn't exactly an air-gapped Iranian nuclear centrifuge.

Then how is this evidence of a 'state-sponsored actor'?

And how did the narrative of this story ever get derailed from what it should have been, which was, "The DNC, and John Podesta in particular who had both his gmail and his Twitter accounts hacked, are incompetent", to "this is Russian interference in a US election"?

The news is why that particular person was targeted.

For which no proof is being presented. Lots of stuff about hacking tools, nothing really about identifying hackers. Lots of anonymous high level sources offering vague assurances and excuses for why we can't present info...

Although the media and many in politics are saying this, it's plainly false. There is no serious claim that the Russians interfered in our election.

The claims are that the Russians interfered in a presidential campaign. There's a huge difference between the process of campaigning, versus the election process of casting and counting votes.

Sowing this confusion is useful on at least two levels. Most obviously, it serves to undermine the legitimacy of the incoming President. But it's also useful in setting stage for future debate about campaign finance laws. It's important in that debate to keep separate the ideas of election - which the government must protect to ensure its faithfulness to the voters - versus the idea of campaigning, which the government may never interfere with, which is the primary purpose of the First Amendment.

There are many Republicans.

The world doesn't come with nice "I did it" notes. You make the best decisions you can with the information you have.

edit: seeing some reports they used "sophisticated" SQL injection... okay...I mean for a lay person it seems sophisticated, sure. But for anyone in the industry it's one of the oldest and easiest tricks in the book.

I really suspect news sources are knowingly exaggerating about the sophistication of this "hack" in order to make up-play Russia's role and downplay the DNC's culpability.

https://www.crowdstrike.com/blog/bears-midst-intrusion-democ...

The summary: One used Powershell modules and Windows Scheduler to run scripts. Another used a combination of Twitter and public sites like Github/Dropbox for command and control.

In my opinion, neither is impressively sophisticated, and a skilled application developer could whip up something similar in a week or two. Using popular sites like Twitter/Dropbox for C&C has been common for years, and you can purchase similar backdoors/RATs for less than $100.

edit: Another interesting point from the link above: the two exploits stole exactly the same info once inside the DNC network. This would obviously be a big no-no for a sophisticated state actor as it doubles your chance of being compromised, but the author explains it away by claiming that Russia's intelligence agencies are disorganized and adversarial.

If it turned out that Russia was not behind these attacks, the scale of the bad publicity for Crowdstrike, Fidelis, Palo Alto Networks, etc. would nearly put them out of business. Unlike you, they have skin in the game and don't make these claims lightly.

This is the next generation of warfare, attribution is simply impossible. Even if there existed actual forensic evidence it could not be relied upon.

Reacting to purported attacks at face value will leave you like a 1-layer chess player, potentially acting on behalf of your adversary.

That one is more likely to be used by the Chinese: https://www.invincea.com/2016/07/tunnel-of-gov-dnc-hack-and-...

The Chinese implementation of the XTunnel protocol is in Java (the GitHub project is written in Java, and you can see an embedded JRE in your blog post's link to the Chinese tool in the strings here: https://cynomix.invincea.com/sample/e2101519714f8a4056a9de18...). The FancyBear implementation is not (no embedded JRE here: https://cynomix.invincea.com/sample/f09780ba9eb7f7426f93126b...).

If you want to see how professionals do it, take a look at https://www.eset.com/int/about/newsroom/research/dissection-....

TIL I'm as good as a state level intelligence team.

Hey CIA/NSA we know you are reading this, my contact info is in my profile. Hire me.

> Yesterday, an Internet cyber hacker using the alias "cmdrfred" claimed on "HackerNews", an elite underground hacker site, that he or she personally built the hacking tools used by Russia to breach the DNC email servers and change the outcome of the recent election.

> "I have personally written that exact tool [it] uses ... encryption ... so you can access [the DNC] without fear."

> "I'm as good as a state level intelligence team."

> cmdrfred went on to taunt American intelligence agencies while admitting that he was aware that elite anti-cyberhacking teams from the NSA and CIA were monitoring his operations.

> The owner of HackerNews Paul Graham -- venture capitalist, flamboyant playboy, and known Russian sympathizer -- could not be reached for comment.

Not to totally ignore the pithiness, but I feel like your comment touches on something I see a ton here (and elsewhere): an offhand dismissal of the 'state level' intelligence capacity.

At the end of the day, the systems were exploited. That more sophisticated methods went unused should be a measure of efficiency and not necessarily execution. Why break out the trick play if your opponent can't keep from you running it up the middle?

http://security.stackexchange.com/questions/55279/how-easy-i...

I question how efficient it is to get caught red handed in the cookie jar of the worlds only super power.

Sure Vladimir Putin could invite President Obama to a state dinner and then proceed to blow his head off with an AK-47 but that would lack the subterfuge I expect from "state level actors". If this is indeed the Russians, they are as laughably incompetent as our elected officials in regards to infosec and thus a threat to no one.

"One senior government official, who had been briefed on an F.B.I. investigation into the matter, said that while there were attempts to penetrate the Republican committee’s systems, they were not successful."