For example, in the muller report, a more extensive investigation, the specific hacking unit is identified. Whether or not crowdstrike knew in 2017 doesn't matter. Today we know APT-28 was responsible, and they're members of the GRU.

How exactly did they arrive at that attribution?

> Today we know APT-28 was responsible, and they're members of the GRU.

How do we know that? No offense, but out of all the places I thought at least people on HN should be aware about the massive caveats that modern-day cyber attribution comes with.

The vast majority of times it's just "educated guesses" based on identifiers that any smart adversary will know how to spoof and thus utilize as false leads.

It's something that feels like was generally recognized and agreed on circa a decade ago, but somehow got lost in the flood of sensationalist headlines trying to sell any nmap scan or somewhat noteworthy ransomware infestation as Russia/China/Iran starting cyber world war 3.

> The vast majority of times it's just "educated guesses" based on identifiers that any smart adversary will know how to spoof and thus utilize as false leads.

No, I'd say people on hn often vastly overstate the lengths people are willing to go to to create these false flag attacks. If we believed hn, no attacks are done, every cyber attack is actually spoofed by an even more formidable spy ring.

Sometimes the simplest answer is the right one. The attack, carried out with many technical signifiers of a Russian state backed attack, that was used to geopolitically help Russia was Russian.

The alternative is that someone (who?) was capable enough to infiltrate Russian cyber intelligence resources to then launch an attack on the us, which they then used to geopolitically assist Russia.

I'm not sure I can think of any attack where someone tried to successfully frame another nation. This doesn't mean they don't happen, but that they're rare. It also means that if they do happen, they're always successful, which seems unlikely. Far more likely is that successfully impersonating a state cyber attack is actually really really difficult, because doing so successfully would in general require persistent access to the state actor you're impersonating.

Why can't you just spell out the method of attribution, instead requiring me to read trough dozens of, mostly political, reports?

> The attack, carried out with many technical signifiers of a Russian state backed attack, that was used to geopolitically help Russia was Russian.

Technical signifiers are not difficult to spoof, nothing about them requires any nation state backing as they rely on heuristics which are semi-public.

That's been the reality of the "cyber theater" for decades: It's asymmetric, there's been more than one example of some lone kid on the spectrum, living in their parents basement, pwning very important and advanced national infrastructure at scale.

That's why I'm very skeptical when a cyber incident is instantly declared as "state level!", usually that's just part of PR and damage control script, along the lines of: "The adversary was a whole nation state, there's nothing we could have done to prevent this from happening!".

Even when the methods deployed are anything but exclusive to nation state actors: Spear-phishing and social engineering are not types of attacks that require nation state resources or knowledge, there's a whole grey market industry offering such attacks as a service.

> The alternative is that someone (who?) was capable enough to infiltrate Russian cyber intelligence resources to then launch an attack on the us, which they then used to geopolitically assist Russia.

Why would that be the only alternative? Your alternative assumes that the attribution to the Russian cyber intelligence is a fact beyond doubt.

> I'm not sure I can think of any attack where someone tried to successfully frame another nation.

That's because if said attack is successful, you wouldn't even know about it being such an attack, that's the crux of the problem.

> Far more likely is that successfully impersonating a state cyber attack is actually really really difficult, because doing so successfully would in general require persistent access to the state actor you're impersonating.

As mentioned before: Nobody needs to impersonate a state cyber attack because by now that's the default assumption not just by media but often enough by those affected themselves to cover up for their own InfoSec negligence.

"We got pwned by the whole Russian intelligence apparatus using massive resources!" sounds much more impressive, and sympathy inducing ,than "We got pwned by some kid from Ukraine because we don't patch our stuff/one of our employees got phished".

So, yes, someone would need to have piggybacked on Russian state controlled servers.

> Technical signifiers are not difficult to spoof, nothing about them requires any nation state backing as they rely on heuristics which are semi-public

Do you work in this field? I've basically only seen lay people suggest this.

> That's because if said attack is successful, you wouldn't even know about it being such an attack, that's the crux of the problem.

Hence my second point: that we've never seen evidence of an unsuccessful attempt, meaning that there's a 100% success rate of spoofing. You're telling me that's realistic? That the spoofers are just so incredibly more competent than everyone else that they never fuck up? That the random Ukrainian kid is so much better at hacking than various state agencies that when he impersonates them he always does it perfectly? That every Ukrainian kid is that competent? Come on.

Your thesis is essentially that state actors are the least competent "cyber actors", because everyone can impersonate them and none of them can tell. That's counter to basically everything else we know.

If you could be more specific, we could address this. However, you cannot, because the allegations are all this vague. If it's the assertion that I think it is, the "command and control servers" were asserted by Crowdstrike to be under Russian control, and its evidence for this, again, were somewhere deep in a rabbit warren of cross- and circular references[1].

> Do you work in this field? I've basically only seen lay people suggest this.

I have seen journalists claim that only lay people suggest this.

To your vague and amorphous allegations of "state actors", I reply with this specific analysis of the few concrete indicators of compromise supplied by the departments of the government making the allegation. It's farcical. If Russiagate were to be true, the Russian hackers are no better than script kiddies, using outdated PHP malware as they do. https://www.wordfence.com/blog/2016/12/russia-malware-ip-hac...

[1] Furthermore, IP addresses change constantly. Again, if you're referring to the assertion I think you are, that IP address had been defunct for over 2 years before the attack See https://www.wordfence.com/blog/2017/01/election-hack-faq/

An IP that was being used by Russian Intelligence today to hack a target may be used by another attacker to hack a different target a few days later. This can happen for several reasons:

- A hacked IP can be used by one attacker and then be compromised by a different attacker later on to also launch attacks.

- IP addresses change ownership from time to time. A Linode IP may be hacked by Russia and used to launch attacks. Then it may be shut down by Linode, change ownership and the new owner’s site can get hacked. Then that IP address is attacking once again, but the attacker is someone else.

- IP addresses are also dynamic if they belong to an internet service provider (ISP). Some of the IP’s in the Grizzly Steppe report do belong to ISP’s. For example we can see IP’s belonging to Yota.ru, a Russian internet service provider. The hostnames are ‘wimax-client.yota.ru’ which suggests that they are wifi customers. These IP’s are probably dynamic and regularly change hands. They may be used by one attacker today and a different attacker tomorrow.

Why do you cite older and less extensive reporting as though it debunks more recent and more thorough investigation?

> Furthermore, IP addresses change constantly

Yes, and if this was the only evidence, you'd maybe have a point. But, the collection of evidence is:

    - a russian-state associated IP was used to
     - deploy software developed by the Russian government
     - to steal data that would be beneficial to Russia if published
     - and was ultimately published via channels known to be associated with Russia (I'm not talking strictly WikiLeaks here, but also how they got the data)

Your alternative explanation is what, exactly? A random ukranian group hacking for the lulz successfully stole this info and either did it so well that the us thought it was actually Russia, or the us lied and claimed it was Russia. That lulzy group proceeded to publish the data via russian-appearing channels or Russia then stole the data from the hackers to publish it. And said group never took credit, even though "we tricked the CIA" is about as much cyber hacker cred as you can get.

I apply Occam's razor. What's your excuse?

Keep in mind, I can apply exactly your logic and say that appearing amateurish is good operational practice for a state actor as it will make it more likey for people to claim that the attacker wasn't a state actor. That's the problem with unfalsifiable claims like yours, I can simply invent a better conspiracy, so to speak.

Not an argument or a refutation. A fallacy, in point of fact. Its age has nothing to do with the correctness of its argument.

Have you not read any of the comments above? All of these "more recent and thorough reports" - and again, here, as to which specific reports you're being as vague as the "reports" themselves - are obfuscating, designed to confuse and redirect, at the end of which is always "trust us, here are some other trustworthy reports that say the same thing".

By contrast, the word fence report goes through specific allegations and adresses them point by point. Clear, simple, straightforward. In all of the reports demonstrating that Russians hack the DNC, not one is as clear and straightforward, because it never can be.

Your alternative explanation is what, exactly?

You haven't really refuted anything here, and your reference to Occams Razor should come only after clear logical steps from evidence to conclusion, which you do not have.

I don't know who did it. Which is the point. No one does, and no one can know, given the evidence presented so far.

I can tell you this, though: politically, the content of the emails themselves were deeply embarrassing to the DNC. Collusion with the media, including the Washington Post and the New York Times, to kneecap Sander's campaign; Donna Brazile passing debate questions to Clinton; Clinton's strategy to promote Trump as the easy win, etc.

Now, however, any time anyone discusses the content of the emails, true believers such as yourself will interrupt to talk about how Trump won only because of Russians. It was such a stupidly transparent strategy I was stunned it actually grew legs and walked. Skeptical, but open, I eagerly awaited the evidence which never materialized, sadly.

...us lied and claimed it was Russia. That lulzy group proceeded to publish the data via russian-appearing channels or Russia then stole the data from the hackers to publish it. And said group never took credit, even though "we tricked the CIA" is about as much cyber hacker cred as you can get.

Here you kind of rhetorically descend into incoherence. I get it. You don't want to steel-man alternative ideas, because "Russians" is what you have been told and "Russians" is what you believe. But almost any other explanation is as plausible as Russians.

I listed 4 bullet points. You've agreed with 2 of them (the first, that a russian-state associated IP was used in the hack), and 3, that the data if published would be beneficial to russia (by being beneficial to trump). Those 4 evidence based claims, some of which you've admitted you agree are true, point to a simple answer: Russia was the culprit.

Yes, there are other alternative explanations, but all are vastly more complex, or fail to sufficiently address all of the evidence presented, hence my reference Occam's razor.

> Now, however, any time anyone discusses the content of the emails, true believers such as yourself will interrupt to talk about how Trump won only because of Russians.

I've never said this.

> I get it. You don't want to steel-man alternative ideas, because "Russians" is what you have been told and "Russians" is what you believe. But almost any other explanation is as plausible as Russians.

No, that's my point. That was my steel man. Your argument is incoherent. You're free to prove me wrong. Its easy: provide the alternative explanation that is more likely than it haivng been russia. Provide an explanation that better explains the facts we agree on:

     1. A russian state-affiliated IP was used in the attack
     2. The data stolen and leaked was geopolitically beneficial to russia.

Looking directly at the evidence, the simplest, and far and away most likely answer, is that Russia was the culprit. Other answers are, perhaps, possible, but that doesn't make them as likely, unless you want to pretend that two explanations of the same phenomena are always equally likely. That's simply a failure to reason correctly, and I'd expect better of someone who wants to bring up fallacies.

Put another way, there's some evidence that supports the claim that it was Russia. There's no evidence that supports the claim that it was the Ukraine. This doesn't mean that it had to be Russia, yes, alternative explanations are possible, but looking solely at the evidence, all of it points to Russia, and none of it points to anyone else.

You can create alternate hypothesis, but they all rely on the evidence being somehow misleading ("The US government is lying", "The Ukranian teenager spoofed a Russian attack"). By Occam's Razor, those explanations are less likely, because they are more complex. You're welcome to present some additional evidence that makes those explanations more likely, but you haven't presented any, you've simply said the evidence we have isn't conclusive (which I agree with), and because of that all possibilities are equally likely, which is terrible reasoning.

An extraordinary claim should have unambiguous, clear, unassailable proof. A skeptic should be able to look at all the evidence and verify it for oneself. One cannot do that with each important assertion. Instead, one must rely on assertions by "persons familiar with the matter".

A flood of circumstantial evidence of dubious provenance, no matter how earnestly believed by the politically motivated, should not be enough to destabilize the Office of US Presidency (no matter how much one finds the holder of the office distasteful) nor make dangerous accusations of foreign nations.

This is a no-brainer. Yet here we are, talking about 2-year old IP addresses as if it were some smoking gun.

Perhaps I'm confused here, what do you believe the facts are? I don't want to misrepresent you, so here are my questions, numbered for easy reference:

1. Was the IP address in the crowdstrike report you cited ever affiliated with the Russian government?

2. Who or what developed the X-Agent software?

3. Do you believe the X-agent software was used in the DNC attack? If not, how do you believe the DNC hacked?

4. Do you believe the data stolen in the DNC hack and later leaked was geopolitically useful to the Russian government? (keep in mind that the Democratic party has recently been far more anti-Russia than the Republican Party, so the evidence I have suggests that Democratic foreign policy would be more aggressive towards Russia than Republican. Obama, Trump, and Biden's actual foreign policy actions, e.g. in Syria, support this hypothesis)

5. Do you believe the account in [0] is reliable? If not, what is your explanation of what occurred, and what evidence do you use to reach your conclusion?

6. Do you believe that this[1] highly redacted senate report is evidence? That is, do you put believe that anything can be inferred from the fact that US intelligence services believe that this attack was undertaken by Russia, and have presented that conclusion (and, presumably, some evidence supporting this conclusion) to the Senate Intelligence Committee? Related does it hold any value to you that no one on the SIC has denied that this hack was Russian-originated (and in fact a number of Repulbican members have agreed that he hack was done by Russian state actors)?

Please note "I don't know" isn't a valid answer to any of these questions, you must have some belief that is most likely, even if none is held with much confidence, please provide that belief.

> An extraordinary claim should have unambiguous, clear, unassailable proof.

My claim is that based on the evidence we have, the most likely explanation is that the attack was undertaken by Russia. What about this is "extraordinary"? If you mean the broader claim, "Russia did a successful cyberattack against the US", I again don't see what is extraordinary about that claim.

> A flood of circumstantial evidence of dubious provenance, no matter how earnestly believed by the politically motivated, should not be enough to destabilize the Office of US Presidency (no matter how much one finds the holder of the office distasteful) nor make dangerous accusations of foreign nations.

I'm confused, I'm not making any claim about the any president. I'm making claims about a cyberattack.

I'm unclear what about "The Russian government undertook cyber-espionage against the US" is a dangerous claim. I'd make the same claim, in general, about the US. I'm quite confident that the US undertakes cyber-espionage against Russia too. I just don't have any particular examples at hand, but if you cited one, I wouldn't consider it "dangerous".

> The proof of all of which, if it exists at all, is buried under a warren of circular self-references, and journalists who breathlessly report them as known.

I'm confused, I'm referencing an[0] indictment by Robert Muller against the named GRU agents accused of carrying out the attack in question. There's no journalists involved at all.

[0]: https://www.justice.gov/file/1080281/download

[1]: https://www.intelligence.senate.gov/sites/default/files/docu...

This level of requirement is beyond what’s required to convict someone of murder in a court of law. It’ll basically never be met under any conditions.

It’s also almost certainly selectively applied to cases where they don’t want to accept a conclusion.

It’s admirable to lay out details, but I’m skeptical you’ll make any progress here. If their responses are in good faith maybe it’ll have some affect, maybe they think they’re responding in good faith? It feels strongly driven by motivated reasoning rather than a genuine interest in what’s likely to be true.

Wait, what? I don't know most of these answers. Neither do you.

"Who wrote X-Agent?" "It was definitely Russians" is not a valid answer, either.

An indictment is not evidence. It's an accusation. Show the evidence, let it be examined, cross-examined, etc.

No, spooks' testimony is not credible by itself, not after they repeatedly lied under oath, to both congress and the public.

> "Do you believe the data stolen in the DNC hack and later leaked was geopolitically useful to the Russian government? "

"geopolitically" not to nitpick, but you probably mean plain "politically"

Not necessarily. Clinton was already cosy with the Russians as State Secretary. Trump was an unknown quantity. Asserting anything else is a retcon.

> "The Russian government undertook cyber-espionage against the US"

You're literally putting quotes around something I did not write. The accusation was far stronger than that. The accusation was that the Russians, WikiLeaks and the Trump campaign colluded to get Trump elected in exchange for preferential treatment. The DNC hack was a small part of it. But no, there's no evidence of that small part, either.

Ok, I think it's clear that there's no more fruitful exchange to happen on this topic. I tried to demonstrate that the evidence must be extraordinary and that it does not rise to that level. You disagree. You tried to demonstrate to me that the evidence is extraordinary. I disagree.

Know that I'll read your reply, and absorb it, and think on it, but likely won't answer. Let us amicably agree to disagree on this.

You're absolutely correct, but based on the weight of the evidence we have, we can find a most likely explanation. You've previously stated that all explanations bare equally likely, but that's not true. Bayesian reasoning allows us to look at various pieces of evidence and priors and weigh them, even when all are individually of dubious use.

It's clear you don't want to answer any of those questions. They're simpler questions, my assumption here, again based on the weight of the evidence is that you're avoiding answering them because they demonstrate that Russia being responsible is the most likely answer.

As another user mentions, you're showing lots of examples of motivated reasoning, and that's unfortunate. Even more so that you're then projecting these accusations upon me. Hopefully your inability to engage with the substance of what I've presented will demonstrate that to any other readers.

> You're literally putting quotes around something I did not write.

Yes and, this is a valid rhetorical act when, for example suggesting the abstract idea one is discussing.

> The accusation was far stronger than that. The accusation was that the Russians, WikiLeaks and the Trump campaign colluded to get Trump elected in exchange for preferential treatment. The DNC hack was a small part of it. But no, there's no evidence of that small part, either.

That's not an accusation I made. Nor did any one else in this thread. And I'd agree that it is less likely than what I'm actually suggesting, which is that there wasn't collusion per say, but simply mutually beneficial actions. This is what is supported by the weight of the evidence and claimed in government reports, for example. That Russia hacked and leaked DNC data, to the benefit of the trump campaign and Russia itself, obviously. I'm unclear why you feel it necessary to inflate the accusations made to something less likely. This feels very motte-and-bailey, although I can't tell if it was intentional or a subconscious way to protect your preconception.