> If all it takes is "one occasion"

Depends on the occasion, no? There's a difference between "the target account once used phrasing more typical of a Russian speaker than a Romanian speaker" and "the target connected to the server from inside GRU headquarters".

> it's also definitely easy to throw investigations off course

Connecting to a server from GRU headquarters isn't something I'd call "definitely easy". If the claim is true, Occam's Razor suggests that the GRU was involved in some fashion. What's the alternative? That the DNC compromised the network of a Russian intelligence agency?

(How much faith to put in an anonymously sourced claim about what was in the logs of an unnamed social network is a separate question, of course.)

You've added something that was not in the article. The IP address was not necessarily in the GRU HQ. The IP was in Moscow. The IP allowed the agent to be identified. That might mean the IP was in the GRU HQ but not necessarily. Once the agent was identified, they knew (possibly based on other intel collection) that he works out of (has as a "home" office) the GRU HQ.

It is in the article:

> U.S. investigators identified Guccifer 2.0 as a particular GRU officer working out of the agency’s headquarters on Grizodubovoy Street in Moscow.

This quote still leaves open the details on how they connected the IP to the officer or actual locale.

Ha ha. I'll go get the complete top secret NSA report and post it here, and then we can arrange a Q&A with the NSA officers to address your further questions, as there certainly will be some.

Which we should take at face value

> (How much faith to put in an anonymously sourced claim about what was in the logs of an unnamed social network is a separate question, of course.)

Parent already addressed this. Unless you have evidence to the contrary the "what if" game does not take us very far.

I like to play the "what if" game as well as the "who profits" and "what has happened historically" game...

As well as the whatabboutism game ("what about the other side pointing fingers? Who has done worse?").

I don't like thought stoppers.

With any intelligence information 'what if' is most reasonable approach. It is absurd to trust anyone that has the objective to spread misinformation.

In comparison why would you trust anybody who is a professional liar on any information? Just because you have no other more reliable information does not turn the liars lie into a truth.

That seems WILDLY unprovable.

Tell me; how did The Daily Beast, an org that has Chelsea Clinton on their board, get the external IP addresses of the Russian Intellegence headquarters?

Please read the article properly before commenting - It helps you to stop jumping to wild, crazy conclusions

It wasn't the DailyBeast conducting the investigation, they are just reporting on it

Tracked to a specific office in their HQ... by an external IP address... lol, ok.

You are not as anonymous as you think when you are online - An IP address can easily identify a particular office in a government building

There are many, many cases where a journalist has tracked down specific wikipedia edits to a particular office or intranet in a government building all from their IP address

You can find a ton of stories with a quick google search: https://www.independent.co.uk/news/uk/home-news/government-w... https://www.smh.com.au/politics/federal/investigation-into-o...

Yep. I agree - it's pretty easy to slip up and public IPs are fairly easy to monitor.

It reminds me of this project https://github.com/edsu/anon which "lets you tweet about anonymous Wikipedia edits from particular IP address ranges"

You can see it working at Congress Edits - https://twitter.com/congressedits

>Yep. I agree - it's pretty easy to slip up and public IPs are fairly easy to monitor.

Public IPs are NOT easy to monitor correctly when A. It's supposedly Russian Intelligence HQ B. They are claiming they can identify the specific office it came from

The Clinton boogie man at it again eh?

Did I post something incorrect? Do you want to explain who maintains the current and past list of external IP addresses belonging to Russian Intel?

The NSA and/or the CIA?

Teenagers can hack NASA [0] so I don't think a sufficiently motivated attacker, possibly backed by a nation state, couldn't pull off something like this as a false flag.

[0]: https://abcnews.go.com/Technology/story?id=119423&page=1

> Teenagers can hack NASA [...] so I don't think a sufficiently motivated attacker [...] couldn't pull off something like this

Right, the fact someone could compromise a random government agency in the 90s clearly means someone else could compromise Russian military intelligence in 2016, because NASA's IT security in the 90s is totally comparable to the GRU today, absolutely.

> possibly backed by a nation state

Which nation state, exactly?

Considering a U.S. ally had their tendrils so deep inside GRU that they had a live video feed, you should probably reevaluate your assigned probabilities.

You mean the recent story which broke by Dutch intel?

There is no public video recording to substantiate their claim. You'd think this entire debate would be settled if on YouTube we could all just watch visual proof of Russians hacking the US.

They also claimed that the video feed came from a university building in Moscow's Red Square. I challenge you to find such a building on a map of the Red Square.

Your entire posting history is devoted to obscure conspiracy screeds whenever Russia is involved – it's truly remarkable your account has persisted this long.

That's an extremely offensive thing to say. Also, that is not a true characterization of my comment history. If you do want to discuss that topic, I am more than happy to engage in discussions supported by sourced material.

Did you find that university building inside the red square yet? Where is it on google maps?

The story which made it to HN: https://arstechnica.com/information-technology/2018/01/dutch...

My analysis is below, but I encourage you to look at Suzie Dawson's epic takedown here: https://steemit.com/steemit/@suzi3d/10-reasons-the-dutch-rus...

So, just because the US intelligence community gets attribution details in 2014 doesn't mean they didn't fake the attribution for the 2016 DNC hack. That's like me registering an account with your username on some site and posting stuff with it - many digital "fingerprints" can be faked. Readers of HN should know this (lol).

Also, the author's claim that the US intelligence community attributed the DNC hack is dubious. James Clapper did, and he threw around a debunked "17 intelligence agencies" slogan[0], but the man's a retired partisan[1]. Recall that the DNC would not let the FBI do actual forensics on their hacked server[2] - well, there's one intelligence agency that didn't get a chance to make an official attribution. Recall too that the Crowdstrike's hack report claims were debunked by the Ukranian army[3] & authenticity of the C&C software was questioned by many in the cyber security community[4].

Like, who didn't know that Russia had hackers? We also know that the DNC/DeepState have a scapegoat.

[0] https://www.realclearpolitics.com/video/2017/07/06/clapper_c...

[1] https://www.usnews.com/news/articles/2016-11-17/lawmakers-re...

[2] http://www.slate.com/blogs/future_tense/2017/05/09/the_fbi_i...

[3] https://www.voanews.com/a/cyber-firm-rewrites-part-disputed-...

[4] http://www.zdnet.com/article/no-smoking-gun-for-russian-dnc-...

>Right, the fact someone could compromise a random government agency in the 90s clearly means someone else could compromise Russian military intelligence in 2016, because NASA's IT security in the 90s is totally comparable to the GRU today, absolutely.

Because such hacks don't happen today?

>Which nation state, exactly?

Well, which nation state likes false flags and BS excuses like WMDs for their target du jour?

Are you referring to the Kremlin? There is a wealth of allegations of such activities attributed to them:

The most infamous (and heinous) oft sighted example...

https://en.wikipedia.org/wiki/Russian_apartment_bombings

And there are plenty of more recent allegations such as the framing of North Korea for the attempts to disrupt the Winter Olympics:

https://www.wired.com/story/russia-false-flag-hacks/

Parkland shootings etc etc

http://www.politifact.com/truth-o-meter/article/2018/feb/22/...

https://www.washingtonpost.com/opinions/after-the-parkland-s...

I find it amusing that those who call false flag sound as if they are the ones flying a false flag. It's exactly the sort of action one would expect to call out if I was trying to turn a population in on itself. False flag is a recently common accusation which did not used to be common on the internet.

False flag is the quicksand of online drama. People allude to them a lot more often than they are found in the wild.

Blaming everything on "Russian hackers" also didn't use to be "common on the internet".

As words, phrases and fads spreads on the press, so they do on the internet.

Where have you been? "Russian hackers" has been an internet trope before memes were a thing.

Not referring to the internet trope (or the existence of hackers in Russia and/or Eastern Europe), but the actual BS press "Russian hackers behind this and that", which is the "WMDs" of late 2010s.

What do you mean "WMDs of late 2010s"? The WMD excuse I'm familiar with was the one to invade Iraq was early 2000's, and anyone with half a critical mind could see that it was a flimsy argument at best in order to appeal to the hawks at home who wanted blood after September 11th. And American citizens who had studied Islam at all would understand that the only reason the Sunni, Shia, (and Kurds, ethnic not religious minority) had not openly killed each other in Iraq was due to Saddam's non-discriminating iron fist, and that invading could have potentially destabilized the country into a pariah state.

I'm not going to change your mind on what you think is BS, but I do disagree with you. If you have the chance, I highly suggest talking to retired CIA operatives that were active during the Cold War -- the stuff they talk about (when allowed) can be pretty eye-opening.

Back in my day it used to be "chinese hackers" but I guess we have always been at war with Eurasia.

Why would NASA's defences be comparable to GRU?

...and NASA is known to have top opsec?

And it's still 1999?

One very hard to fake set of connected facts that corroborate each other, validate a suspicion, and match a motive.

It generally only takes one occasion of a videotape catching you stealing and an eyewitness corroboration for you to be believed the thief as well.

This isn't video evidence though, it's an IP address. I don't think this metaphor is similar at all.

There was real time video surveillance of the building, both external/internal by Dutch and another unnamed European agency. Also RT published the names of the two officers who controlled the G2 account: Sergei Afanasyev, GRU Deputy Chief and Grigoriy Viktorovich Molchanov, Head of the GRU Academy.

> Also RT published the names of the two officers who controlled the G2 account: Sergei Afanasyev, GRU Deputy Chief and Grigoriy Viktorovich Molchanov, Head of the GRU Academy.

It's surprising that RT published those. I thought it was an entity controlled by the Russian government. Why would it be publishing the names of its own officers when supposedly the said officers went out of their way to appear Romanian and not Russian.

Yea... I’m going to call BS on RT posting embarrassing Russian Intellegence mistakes - that are true.

It's very hard to spoof a log of a TCP connection in one country from an IP address assigned to the residential internet connection of an intelligence official in another country. It's certainly not impossible, but it's not as easy as just adding an email header or something.

It really is super easy. Even since 2007, malware like Zeus and SpyEye, and a million different Remote Access Tools (RATs) take over your machine and allow all activity to emanate from it. Very easy to plant a false flag or incriminating evidence.

and please note the careful wording: "Working off the IP address, U.S. investigators identified Guccifer 2.0 as a particular GRU officer working out of the agency’s headquarters on Grizodubovoy Street in Moscow. "

interpretation 1: The guy accessed the device from his GRU office

Interpretation 2: The IP belongs to a guy (maybe his residential connection), and he happens (from other sources) to work at the GRU office. Assuming the GRU device is relatively secure, is it possible that other devices on his home have malware on them? If the latter, all the devices would appear as coming from that same residential IP address.

I work in this field and false attribution happens all the time. Evidence is really easy to fake.

If you have gained remote access to a Russian intelligence officer's computer, I feel like spoofing an HTTP request to a social media site is the least exciting thing to do with that access.

Don't confuse the ease of installing tools that let you maintain access once you have gained access with the ease of gaining access in the first place.

If you have access to a device of some low level employee there is no harm in burning it for a high profile operation like the guccifer story. This was not just a random Twitter bot, but potentially at a global-scandal level. Whoever coordinated this was certainly not a some random fool.

It's called a watering hole attack. You infect many of the devices way ahead of time (that are interested in whatever subject area you targeted), and pick your victim when you need to. If you haven't prosecuted these cases, you'd be surprised how often it happens:

https://www.cyberscoop.com/winter-olympics-hack-attribution-...

https://krebsonsecurity.com/2017/08/blowing-the-whistle-on-b...

https://blog.trendmicro.com/trendlabs-security-intelligence/...

https://blog.talosintelligence.com/2018/02/who-wasnt-respons...

All of the articles you link are about trying to derive attribution using signatures from the malware itself, which is unrelated to the thing you're talking about. I agree that trying to find meaningful attribution from the evidence left on the machine is unlikely to work and that spoofing this evidence is easy.

But that has nothing to do with a watering hole attack - are you claiming that successful watering hole attacks against GRU personnel are commonplace?

Great question: Apologies if I wasn't being clear.

For example: the Chinese government has been waging war against the Free Tibet movement for years: https://www.google.com.sg/search?q=chinese+malware+free+tibe...

There's a bunch of articles there. One technique is they put up a pro-Free Tibet site, and put malware on it. The visitors get infected and they have an insight into who is interested in that topic and their IP addresses for basic geo location, and maybe remote control of their machines.

If we pick a topic that's super interesting for government intelligence people (like the Guccifer blog site itself), and put some awesome non-detectable malware on there, you could potentially infect multiple intelligence officers from multiple countries.

When the bots phone home, they will report username, domain name, email addresses, visited URLs, security certificates (or basically anything you want). So you now have a rolodex of machines you can manipulate. Mossad did it...nope....North Korea....nope CIA...nope FBI etc etc

Now this is super hard to do in practice. But you only have to be lucky once.

"Very easy"? to fake a connection from the ip address of "of an intelligence official in another country"?

OK - show us. Doesn't need to be GRU - I'd settle for an NSA or Mossad ip address instead. Go on, install a RAT and make a connection...

Here you go....from my 2012 Blackhat presentation. It then shows the issues of attribution as everything comes from the infected machine...sorry it's dated but nothing has really changed

https://www.youtube.com/watch?v=XvoiI5gJ7-0

Nobody is disputing that, given a remote-access tool running on a machine, actions taken by that tool are seen to come from that machine.

What is being disputed is that making it look like it came from a Russian intelligence officer specifically, as opposed to from some random infected machine somewhere, is easy. I see that you're claiming that if you set up a botnet and start infecting people and wait, you'll eventually get someone who works for a bank or someone who works for the military, sure. But what are the changes that you'll find someone who happens to work for the specific intelligence agency that is widely suspected as being the actual perpetrator?

Are you claiming that lots of botnet operators happen to have infected so many machines that their chance of being able to get to the machine of an employee of any government agency in the world is high? That the average GRU officer has hundreds of RATs in their home from hundreds of bored teenagers around the world?

Hopefully I addressed it in the section above.

I believe that intelligence agencies are targeted all the time, and keeping machines clean is not that easy. Certain governments (like Singapore) adopted an air-gap approach, so the machines you use for work don't touch the internet.

But even then, it would be a lot easier to infect that persons's home machine.....Many of the people visiting Guccifers site were normal people, some were from intelligence agencies (proportionally probably a lot more than visit a normal site).

Assuming you had AWESOME undetectable malware, you'd have to infect the lot, get them to report in, and ferret out the interesting ones. Not exactly a weekend project, but if this was your passion in life, very achievable.

Spear phishing these guys is hard, watering hole may be easier.

Nice talk! I just 1.5x-ed thru the first ~30 mins.

I still think we're talking at cross purposes though - I'm not disputing Zeus works, I'm disputing that it's "super easy" to identify and then infect a machine attributable to "an intelligence official in another country".

I mean - if all I need to do is make a tcp connection - all I need is an <img> tag in a web page - the big problem is getting that webpage and/or RAT onto a GRU officer's work computer.

(And if you _do_ cover how to do that in the remaining bit of the talk, I'd love to know...)

Don't you also have to somehow get the up-to-date list of IP Address to Employee Name (as seems to be the claim)?

(For the record - do not do this. It's a _spectacularly_ bad idea...)

Wow.. can you imagine seeing this in the news in 3 years time:

"bigian" (an alias) taunted kenbaylor on an internet message board call Hacker News to attack the NSA or Mossad"...

Yes. Yes I can imagine that... :sigh:

You also have to know which IP address to spoof.

That means that if it it wasn't Russia then it must be some "deep state" conspiracy. Which so far hasn't been backed up by any decent evidence.

Seems like a massive opsec hole. Why not force all outbound connections through an offshore VPN or proxy at their internet gateway.

It's odd on a site like HN that ideas like this occur to hardly anyone. Well, on certain subject matter of course.

Lets see what Jonathan Haidt has to say on the matter:

https://www.youtube.com/watch?v=v6nNT0JtHT8

Something like this?

"“With UMBRAGE and related projects the CIA cannot only increase its total number of attack types, but also misdirect attribution by leaving behind the ‘fingerprints’ of the groups that the attack techniques were stolen from,” Wikileaks said in a statement."

https://www.usatoday.com/story/news/2017/03/07/wikileaks-cia...

and for remote control:

"In April this year, WikiLeaks disclosed a brief information about Project Hive, revealing that the project is an advanced command-and-control server (malware control system) that communicates with malware to send commands to execute specific tasks on the targets and receive exfiltrated information from the target machines. Hive is a multi-user all-in-one system that can be used by multiple CIA operators to remotely control multiple malware implants used in different operations."

https://thehackernews.com/2017/11/cia-hive-malware-code.html

No, nothing like a project to re-use commodity code, or a C&C server platform.

How would either be relevant?

True.

Except the Russians haven't worked very hard to try to deny it.

And - more importantly - everything else they do aligns with this same goal.

It's like during WW2 finding a person spying in London, finding they were passing information on English plans to attack German air defenses to someone in Berlin and saying "Well.. they might have been American, because the US and the UK were rivals during the Washington Naval treaty process during the 1920s". Yes.. they might. But there's a lot of evidence pointing the other way, and German actions indicate it was the kind of thing they would like.

Same here.

That's literally not what happened. There is a lot of other evidence to support this claim. It wasn't just this one simple thing that pointed to Russia.