There are better ways to hide. From experience (I work in security), the ones I would use are (individually or combined):
- Have the VPN set up in my router using OpenWRT (the R7000 is great for that) and drop all connections when VPN disconnects (with a script).
- Rent a VPS on a botnet friendly host that accepts Bitcoins (i.e Hostsailor).
- Then do all my shady stuff from the VPS or even better, configure Tor and proxychains on the VPS then use proxychains when doing anything on a remote host.
I think the guy was just lazy and preferred convenience.
Having a separate browser that jumps through all the well-audited crypto hoops you want doesn't really help you if you have a native Safari window sitting next to it where you read your gmail.
Opsec is hard. Technology can only solve so much, the weak link will always be the wet spongy tissue.
This is not about being an 'idiot', this is perfectly normal behavior to happen once in a few years over hundreds or thousands of people.
And now I'm defending a Russian agent doing stuff I think sucks.
What you're asking for, fundamentally, is for people not to make mistakes. You probably don't hold that opinion in your professional life (yeah, I'm assuming you're a programmer). Why here?
For example, Rudolf Abel was caught because he paid with a fake nickel on accident.
Edit: you could even configure Little Snitch to ask for permission for every app and domain your Mac wants to connect to. That way you would even catch yourself accidentally surfing to the wrong URL or using the wrong browser.
Usually you don't have a choice, you use what your friends use.
That totally says "false trail" rather than "fuck up" to me. /sarcasm
Instead of phone number, think port on the phone company’s switch or a specific pair of wires. That’s hard to spoof.
It’s much easier to spoof a MAC address, which can identify specific hardware associated with the IP address, but that doesn’t make the IP any more difficult to identify.
Depends on the occasion, no? There's a difference between "the target account once used phrasing more typical of a Russian speaker than a Romanian speaker" and "the target connected to the server from inside GRU headquarters".
> it's also definitely easy to throw investigations off course
Connecting to a server from GRU headquarters isn't something I'd call "definitely easy". If the claim is true, Occam's Razor suggests that the GRU was involved in some fashion. What's the alternative? That the DNC compromised the network of a Russian intelligence agency?
(How much faith to put in an anonymously sourced claim about what was in the logs of an unnamed social network is a separate question, of course.)
> U.S. investigators identified Guccifer 2.0 as a particular GRU officer working out of the agency’s headquarters on Grizodubovoy Street in Moscow.
Parent already addressed this. Unless you have evidence to the contrary the "what if" game does not take us very far.
As well as the whatabboutism game ("what about the other side pointing fingers? Who has done worse?").
I don't like thought stoppers.
In comparison why would you trust anybody who is a professional liar on any information? Just because you have no other more reliable information does not turn the liars lie into a truth.
Tell me; how did The Daily Beast, an org that has Chelsea Clinton on their board, get the external IP addresses of the Russian Intellegence headquarters?
It wasn't the DailyBeast conducting the investigation, they are just reporting on it
There are many, many cases where a journalist has tracked down specific wikipedia edits to a particular office or intranet in a government building all from their IP address
You can find a ton of stories with a quick google search: https://www.independent.co.uk/news/uk/home-news/government-w... https://www.smh.com.au/politics/federal/investigation-into-o...
It reminds me of this project https://github.com/edsu/anon which "lets you tweet about anonymous Wikipedia edits from particular IP address ranges"
You can see it working at Congress Edits - https://twitter.com/congressedits
Public IPs are NOT easy to monitor correctly when A. It's supposedly Russian Intelligence HQ B. They are claiming they can identify the specific office it came from
[0]: https://abcnews.go.com/Technology/story?id=119423&page=1
Right, the fact someone could compromise a random government agency in the 90s clearly means someone else could compromise Russian military intelligence in 2016, because NASA's IT security in the 90s is totally comparable to the GRU today, absolutely.
> possibly backed by a nation state
Which nation state, exactly?
There is no public video recording to substantiate their claim. You'd think this entire debate would be settled if on YouTube we could all just watch visual proof of Russians hacking the US.
They also claimed that the video feed came from a university building in Moscow's Red Square. I challenge you to find such a building on a map of the Red Square.
The story which made it to HN: https://arstechnica.com/information-technology/2018/01/dutch...
My analysis is below, but I encourage you to look at Suzie Dawson's epic takedown here: https://steemit.com/steemit/@suzi3d/10-reasons-the-dutch-rus...
So, just because the US intelligence community gets attribution details in 2014 doesn't mean they didn't fake the attribution for the 2016 DNC hack. That's like me registering an account with your username on some site and posting stuff with it - many digital "fingerprints" can be faked. Readers of HN should know this (lol).
Also, the author's claim that the US intelligence community attributed the DNC hack is dubious. James Clapper did, and he threw around a debunked "17 intelligence agencies" slogan[0], but the man's a retired partisan[1]. Recall that the DNC would not let the FBI do actual forensics on their hacked server[2] - well, there's one intelligence agency that didn't get a chance to make an official attribution. Recall too that the Crowdstrike's hack report claims were debunked by the Ukranian army[3] & authenticity of the C&C software was questioned by many in the cyber security community[4].
Like, who didn't know that Russia had hackers? We also know that the DNC/DeepState have a scapegoat.
[0] https://www.realclearpolitics.com/video/2017/07/06/clapper_c...
[1] https://www.usnews.com/news/articles/2016-11-17/lawmakers-re...
[2] http://www.slate.com/blogs/future_tense/2017/05/09/the_fbi_i...
[3] https://www.voanews.com/a/cyber-firm-rewrites-part-disputed-...
[4] http://www.zdnet.com/article/no-smoking-gun-for-russian-dnc-...
Because such hacks don't happen today?
>Which nation state, exactly?
Well, which nation state likes false flags and BS excuses like WMDs for their target du jour?
The most infamous (and heinous) oft sighted example...
https://en.wikipedia.org/wiki/Russian_apartment_bombings
And there are plenty of more recent allegations such as the framing of North Korea for the attempts to disrupt the Winter Olympics:
https://www.wired.com/story/russia-false-flag-hacks/
Parkland shootings etc etc
http://www.politifact.com/truth-o-meter/article/2018/feb/22/...
https://www.washingtonpost.com/opinions/after-the-parkland-s...
As words, phrases and fads spreads on the press, so they do on the internet.
I'm not going to change your mind on what you think is BS, but I do disagree with you. If you have the chance, I highly suggest talking to retired CIA operatives that were active during the Cold War -- the stuff they talk about (when allowed) can be pretty eye-opening.
It generally only takes one occasion of a videotape catching you stealing and an eyewitness corroboration for you to be believed the thief as well.
It's surprising that RT published those. I thought it was an entity controlled by the Russian government. Why would it be publishing the names of its own officers when supposedly the said officers went out of their way to appear Romanian and not Russian.
and please note the careful wording: "Working off the IP address, U.S. investigators identified Guccifer 2.0 as a particular GRU officer working out of the agency’s headquarters on Grizodubovoy Street in Moscow. "
interpretation 1: The guy accessed the device from his GRU office
Interpretation 2: The IP belongs to a guy (maybe his residential connection), and he happens (from other sources) to work at the GRU office. Assuming the GRU device is relatively secure, is it possible that other devices on his home have malware on them? If the latter, all the devices would appear as coming from that same residential IP address.
I work in this field and false attribution happens all the time. Evidence is really easy to fake.
Don't confuse the ease of installing tools that let you maintain access once you have gained access with the ease of gaining access in the first place.
https://www.cyberscoop.com/winter-olympics-hack-attribution-...
https://krebsonsecurity.com/2017/08/blowing-the-whistle-on-b...
https://blog.trendmicro.com/trendlabs-security-intelligence/...
https://blog.talosintelligence.com/2018/02/who-wasnt-respons...
But that has nothing to do with a watering hole attack - are you claiming that successful watering hole attacks against GRU personnel are commonplace?
For example: the Chinese government has been waging war against the Free Tibet movement for years: https://www.google.com.sg/search?q=chinese+malware+free+tibe...
There's a bunch of articles there. One technique is they put up a pro-Free Tibet site, and put malware on it. The visitors get infected and they have an insight into who is interested in that topic and their IP addresses for basic geo location, and maybe remote control of their machines.
If we pick a topic that's super interesting for government intelligence people (like the Guccifer blog site itself), and put some awesome non-detectable malware on there, you could potentially infect multiple intelligence officers from multiple countries.
When the bots phone home, they will report username, domain name, email addresses, visited URLs, security certificates (or basically anything you want). So you now have a rolodex of machines you can manipulate. Mossad did it...nope....North Korea....nope CIA...nope FBI etc etc
Now this is super hard to do in practice. But you only have to be lucky once.
OK - show us. Doesn't need to be GRU - I'd settle for an NSA or Mossad ip address instead. Go on, install a RAT and make a connection...
What is being disputed is that making it look like it came from a Russian intelligence officer specifically, as opposed to from some random infected machine somewhere, is easy. I see that you're claiming that if you set up a botnet and start infecting people and wait, you'll eventually get someone who works for a bank or someone who works for the military, sure. But what are the changes that you'll find someone who happens to work for the specific intelligence agency that is widely suspected as being the actual perpetrator?
Are you claiming that lots of botnet operators happen to have infected so many machines that their chance of being able to get to the machine of an employee of any government agency in the world is high? That the average GRU officer has hundreds of RATs in their home from hundreds of bored teenagers around the world?
I believe that intelligence agencies are targeted all the time, and keeping machines clean is not that easy. Certain governments (like Singapore) adopted an air-gap approach, so the machines you use for work don't touch the internet.
But even then, it would be a lot easier to infect that persons's home machine.....Many of the people visiting Guccifers site were normal people, some were from intelligence agencies (proportionally probably a lot more than visit a normal site).
Assuming you had AWESOME undetectable malware, you'd have to infect the lot, get them to report in, and ferret out the interesting ones. Not exactly a weekend project, but if this was your passion in life, very achievable.
Spear phishing these guys is hard, watering hole may be easier.
I still think we're talking at cross purposes though - I'm not disputing Zeus works, I'm disputing that it's "super easy" to identify and then infect a machine attributable to "an intelligence official in another country".
I mean - if all I need to do is make a tcp connection - all I need is an <img> tag in a web page - the big problem is getting that webpage and/or RAT onto a GRU officer's work computer.
(And if you _do_ cover how to do that in the remaining bit of the talk, I'd love to know...)
"bigian" (an alias) taunted kenbaylor on an internet message board call Hacker News to attack the NSA or Mossad"...
That means that if it it wasn't Russia then it must be some "deep state" conspiracy. Which so far hasn't been backed up by any decent evidence.
Lets see what Jonathan Haidt has to say on the matter:
"“With UMBRAGE and related projects the CIA cannot only increase its total number of attack types, but also misdirect attribution by leaving behind the ‘fingerprints’ of the groups that the attack techniques were stolen from,” Wikileaks said in a statement."
https://www.usatoday.com/story/news/2017/03/07/wikileaks-cia...
and for remote control:
"In April this year, WikiLeaks disclosed a brief information about Project Hive, revealing that the project is an advanced command-and-control server (malware control system) that communicates with malware to send commands to execute specific tasks on the targets and receive exfiltrated information from the target machines. Hive is a multi-user all-in-one system that can be used by multiple CIA operators to remotely control multiple malware implants used in different operations."
https://thehackernews.com/2017/11/cia-hive-malware-code.html
How would either be relevant?
Except the Russians haven't worked very hard to try to deny it.
And - more importantly - everything else they do aligns with this same goal.
It's like during WW2 finding a person spying in London, finding they were passing information on English plans to attack German air defenses to someone in Berlin and saying "Well.. they might have been American, because the US and the UK were rivals during the Washington Naval treaty process during the 1920s". Yes.. they might. But there's a lot of evidence pointing the other way, and German actions indicate it was the kind of thing they would like.
Same here.
Doing something shady from a regular workstation is either a mark of noobiness, or it's someone trying to disguise as someone else. Relying on manually launching a commercial VPN each time when you want anonymity? It's not really opsec per se.
These are not amateurs. They should know better.
"If you have a STU-III secure telephone, use it, but remember that even the STU-III depends upon strict telephone security discipline. A defector from one of the foreign intelligence services that monitor U.S. communications reports that STU-III encryption is fairly secure. However, he also advised that the chitchat that occurs before the STU-III is switched to secure mode and after it is switched off of secure mode is a bonanza of valuable information. Communications monitors can identify STU-III lines, so these phone numbers are obvious targets. Therefore, a STU-III line being used in non-secure mode may be more likely to be monitored than another line that never carries encrypted communications. Maintaining strict telephone security discipline is critical." (my emphasis added)
I'll also note that stopping these accidental leaks was part of the motivation for the Compartmented Mode Workstations that weren't secure enough at B1 class to stop well-funded attacks that B3 or A1 might. Risks ranged from cut/paste to classified docs making it onto unclassified networks. The systems' security kernels would look at the labels to catch that. The kinds of leaks they addressed still happen to both innocent users and criminals.
Yeah, in every field there are lots of cases where people end up saying this because professionals who should know better don't. Or cut corners because of resource constraints. Or, just screw up something they actually do know. Or...
They are just regular people. It's not a world of super spies. I am sure GRU is not that much different. Even the top folks eat corn flakes like everyone else.
People make mistakes all the time.
This might be bullshit but just saying so is hardly a compelling argument. I will wait for more evidence one way or another myself, with the obvious disclaimer that anything could be bullshit.
“We found an IP address in a log which lets us tie Guccifer 2.0 to a specific GRU agent” is laughable on the face of it. But with the absolute shitshow that the investigation has been to-date I personally am way past caring, and way past beleiving anything at all to do with the Russia narrative.
Indeed, Trump has already said something like that:
“Somebody did say if he did do it, you won’t have found out about it. Which is a very interesting point.”
Yes.
"He has cautioned in the past of a plan to create a North American Union with a single currency for the United States, Mexico and Canada, and a stealth United Nations campaign to confiscate civilian handguns. He has repeatedly referred to the “tyranny” of the federal government."
He's a strong libertarian which is, by definition, wackjob territory.
At this point, if you don't want to see to the myriad of evidence that the Trump campaign was either working with or willfully used by Russia its just because you don't want to see it.
http://time.com/5155810/russian-meddling-2018-elections/
https://www.nytimes.com/2018/02/13/us/politics/russia-sees-m...
https://www.cnn.com/2018/02/13/politics/intelligence-chiefs-...
Oh yeah, and from Facebook.
You know, reliable sources unlike the failing NYT and WaPo.
The only thing I know is this -- no one is right, no one is good, no one is clean, and there's enough corruption on all sides of this to make anyone sick. You can pick whichever specific aspects of it support one side or another, but I personally think the things we do have hard evidence of point to;
1) An incredibly fucked up situation at the top of the FBI and Justice Department
2) A media which has largely lost the ability to separate reporting from editorial
3) A little trolling by Russian during the election to stir the pot
4) A very close election which was won by the "wrong" person, and a large percentage of Americans who are desperate to unseat him by any means possible
And why he insists on breaking all protocols to do this, such as meeting without his own translator? For so many reasons this is a terrible idea.
Why would Trump meet with the Russian ambassador and tell him Comey is taken care of? And do this secretly? Why would Trump have an insult for every US ally and not a single bad word about Russia?
I challenge you right now to find me a single bad word Trump has said about Russia.
Anywho...
I'm tryin' hard not to roll my eyes as I write this, but here goes -
Like everything Trump does, his discussions with Russia are all about Trump. He's probably not just looking at the here and now, but also at his post-Presidency. He is a businessman after all. (Hell, Trump tried landing property deals in Russia BEFORE he'd ever considered running, sooo...)
I'm unsure that Trump told any Russian that 'Comey is taken care of,' but then, I'm skeptical of many things and, in this case, I consider this rabbit hole a waste of time.
For future reference, you'll need more than you've proffered here to convince me (and others) Trump deserves the outrage others have spilled onto this thread considering -
* Had the election gone for Clinton, no one would be tearing after her for all the good turns she did Russia in the Uranium One deal (and this is all-on-the-record-and-verifiable stuff,) and
* Russia ain't the only country trying to influence American elections. China? Israel? Saudi Arabia? The UK? Please name me a major country that ISN'T trying to influence American politics. You really think Russia had more influence this past election than an Australian owning Fox or a Mexican owning the New York Times? That Russian hackery was more influential than non-citizens voting in California? Piffle.
Considering the context, there is no there there, dude/tte.
> Trump Told Russians That Firing ‘Nut Job’ Comey Eased Pressure From Investigation
https://www.nytimes.com/2017/05/19/us/politics/trump-russia-...
You also found the exception that proves the rule. I can't believe you would honestly think Trump is not deferential to Russia if you did try to look for a bad thing he has said any only found that one
The pattern is clear for anyone who wants to look.
The fact remains Trump is much harder on our allies -- all of them -- then Russia. The Trump admin has also been slow to enact sanctions passed by Congress, as is their constitution duty. There is no reasonable explanation behind these actions and actions speak louder than words.
Finally, foreign countries try to influence our politics, but usually not in concert with a candidate and certainly not supplying said candidate with hacked info on their opponents. As more comes out, that may actually be some of the less scandalous ways Russian assets worked with the Trump campaign.
Let's not forget Trump's campaign insisting the RNC change their platform at the party convention to be soft on Russia re: Ukraine.
You are free to have your opinions about this but the facts speak for themselves.
> Diana Denman, a Republican delegate who supported arming U.S. allies in Ukraine, has told people that Trump aide J.D. Gordon said at the Republican Convention in 2016 that Trump directed him to support weakening that position in the official platform.
> Ultimately, the softer position was adopted.
https://www.npr.org/2017/12/04/568310790/2016-rnc-delegate-t...
> It's hard to have discussion with someone who will not acknowledge basic facts.
Let me acknowledge the article as 100% factual, and further let me concede that the New York Times (NYT) didn't leave any pertinent information (context) out or editorialize the meeting. Fair 'nuff for discussion? My next response is, 'So what?' He's free as anyone to talk as he likes to anyone he likes. Unless Congress passed a law saying otherwise... is Congress free these days to negate the First Amendment?
Let's parse your earlier statements regarding the Russian ambassador -
> Why would Trump meet with the Russian ambassador and tell him Comey is taken care of?
Where does Trump say specifically Comey is 'taken care of'? I see no such quote. I see NYT quoted him as saying 'I just fired the head of the F.B.I. He was crazy, a real nut job.... I faced great pressure because of Russia. That's taken off.... I'm not under investigation.' That's all of Trump's quotes in their entirety, the ones NYT thought fit to use.
As you have a hard time discussing things with people who won't accept basic facts, I have an equally hard time with people who spin so-called facts to mean there's only one plausible explanation. So to answer your question - Trump could have said what he's reported to have said because he genuinely hated Comey and was proud of getting rid of him. Or maybe he wanted to show off to the Russian officials and, like he often does, jokingly and in an off-handed way decided to state what he just did to show what a man he was. Who knows? Trump wouldn't be the first person happy to fire a guy.
Before I leave off this, take a look at what NYT itself wrote right after quoting Trump - 'The conversation... reinforces the NOTION that the president dismissed [Comey] primarily because of the bureau's investigation into possible collusion...' (Emphasis mine.) Notion. Not fact. Notion. Belief. Editorial. The fact is Trump dismissed Comey. The fact is Trump took no small amount of glee in it. The fact is, whatever Trump's feelings, as President he had every right to fire Comey. If he smiled when he told the Russians what he did, eh, again, so what? As far as I'm aware, that indicates Trump's a jerk, not that he's breaking a law or colluding with anyone.
Moving on -
> And do this secretly?
If the meeting was recorded and reported on, it's not much of a secret. Besides, I can give at least one good reason why he WOULD want to keep this meeting a secret - because there are folks who will interpret such a meeting in the worst. Possible. Light.
Ahem. Moving on -
> Why would Trump have an insult for every US ally and not a single bad word about Russia?
Mmm, as far as I know Trump's buddies with Benjamin Netanyahu, and Israel's a US ally. I don't recall any insults, but I don't pay much attention to newspapers these days, so there's a chance one's slipped past me. Nor do I recall insults to the prime minsters of Japan and South Korea. But, again, newspapers.
You did ask for a single bad word about Russia, yes? And I provided, yes? I can't help that you move the goal posts.
Then again, I am told I have trouble with basic facts.
P.S. Downvote me, but please explain why.
No, he had the legal power to fire Comey. This is not in dispute (if it were, there would be a question of the validity of the firing, and whether Comey was, in fact, still lawfully the Director of the FBI.) It is also not a question of rights, but of powers vested in particular government officials under the law.
What is in question is whether that firing was an abuse of power (a misfeasance or malfeasance in office), as well as the overlapping question of whether Trump or others had previously committed other crimes (which the firing may have been intended to protect; note that had Trump wished to retroactively license such crimes, the power of the pardon would also be within his legal power, but that would still raise questions of abuse of power, and would be somewhat more overt in its purpose.)
What makes these indictments more political than every other time the FBI prosecuted alleged spies?
Wait for more evidence to come out.
The DNC leaks were pretty bad for the campaign, but ultimately of their own doing.
Edit: downvoted I assume for not specifying technical evidence, like this garbage news story about dns traffic:
http://www.slate.com/articles/news_and_politics/cover_story/...
Moreover, note the weasel wording. For all we know, "familiar with the government's investigation" just means "the guy who brings in the water bottles overheard some office gossip."
I would take this story with a grain of salt.
Recommended reading for understanding attribution: https://www.lawfareblog.com/how-read-news-story-about-invest...
I did want to point out the sourcing either way, though. It's really distressing to me the way anonymous sourcing has really taken off lately, and that most people appear to be entirely credulous despite the lessons we learned back during the Bush administration. It rarely even gets questioned, though even the past year in particular has served up frequent and egregious object lessons of why anonymous government sources cannot simply be taken at their word. The sad fact of the matter is that the vast majority of anonymous sources are not leaking information to edify the American people. They are leaking information because they have an agenda.
That doesn't mean that we can simply ignore them. Sometimes the information is false, sometimes critical context is left out, but sometimes it is true and extremely important. It means we have to consider what they say very carefully and why they might be saying it.
Columbia Journalism Review publishes insightful articles on these and other problems.
With the modern need to push fast headlines for outrage clicks, I don’t see the standards rising anytime soon.
You know, trying to convince specifically knowledgeable audience isn't something you can do easily .
> [An intelligence researcher] led an investigation at ThreatConnect that tried to track down Guccifer from the metadata in his emails. But the trail always ended at the same data center in France. Ehmke eventually uncovered that Guccifer was connecting through an anonymizing service called Elite VPN, a virtual private networking service that had an exit point in France but was headquartered in Russia.
> But on one occasion, The Daily Beast has learned, Guccifer failed to activate the VPN client before logging on. As a result, he left a real, Moscow-based Internet Protocol address in the server logs of an American social media company, according to a source familiar with the government’s Guccifer investigation. Twitter and WordPress were Guccifer 2.0’s favored outlets. Neither company would comment for this story, and Guccifer did not respond to a direct message on Twitter.
> Working off the IP address, U.S. investigators identified Guccifer 2.0 as a particular GRU officer working out of the agency’s headquarters on Grizodubovoy Street in Moscow. (The Daily Beast’s sources did not disclose which particular officer worked as Guccifer.)