US Politics Mega-thread - Page 6425

So I looked quite carefully at what is being talked about as the means and evidence for the Russian hacks, and after doing so I have to say that "plausible deniability" just doesn't quite encompass how tenuous the link is based on the info available.

I'll start with Podesta, because that one is a pretty easy causal link to talk about. Here is the email that basically tells the whole story: https://wikileaks.org/podesta-emails/emailid/34899

So what happens is this:
1. Podesta gets a phish email with a message saying that someone from Ukraine tried to log into his account. By all means that email did a good job of emulating the Google style but nevertheless it's something anyone could have done. I could go make an email just as good in a few hours if I really cared to do so.
2. My first thought was "that IT guy should be fired" but you know, I don't think that's true. He just got punked really hard with a forwarded email that looks completely legitimate, and in the forwarding (a simple job done by an iPhone) the trace of email spoofing disappeared. So there's nothing that says it's a fake other than the bitly link, but it would have appeared as an image and I can easily believe that an IT guy isn't suspecting an elaborate phish in something that looks perfectly real. It's a very human mistake (although the guy has since done fucked up and said he meant to write "an illegitimate email" but made a typo, which is clearly BS since it would be "an legitimate" then).
3. Now here is where it gets funky. It's not Podesta who sent the email to the IT guy, it's Sara Latham. So by the time it gets to Podesta it goes from "this email is legitimate, change your password here" to "guys the email is real, is Podesta as safe as he needs to be?" Subtle difference, but it's subtle enough that someone who probably wakes up at 7 AM or so with a frightening "u got haxed" message might have just clicked the link in the email instead of the link from the IT guy. If you don't get phished at least once you might not realize the difference there. And so he inadvertently gave out his password.
4. From there it's game over. Downloading ALL of the emails from the account is an easy task with a gmail archiving tool. However long they may have stayed there, they could have gotten the entire archive right off the bat just like that. And it's not clear how long it was before they lost access, but even like 2 hours is too long. I haven't been able to find a good indication of the most recent date of an email but all the major stuff was from last year and earlier.

Now, that is a really clever phish and multiple people got severely punked there. The biggest culprit, though, is simply a political man who isn't a cyber security veteran who notices something suspicious, asks for help, and the people who help him get punked in a very subtle way. He could have used a deeper defense on his gmail account but he got hit because he didn't know he needed to do that. But it's still a hack that pretty much anyone could have done. Technically speaking, I could have pulled off a hack like that easily. Which means there is nothing that says it's the Russians rather than just some fucking guy in terms of the hack specifics. I did look into what makes people say that it was the Russians for that hack, and the link there is really tenuous that basically says "this is what Fancy Bear does." Analytics of the bitly link are given there - it's a dot.tk domain. All I can say is that it wasn't a sloppy phishing job - someone really put a lot of thought into that phish. Still, "Fancy Bear makes spoofs like this" is not anything close to proof. It's circumstantial evidence and a tenuous link. I will leave it to the legal folk in this thread to say how much of a case this would be from a criminal prosecution standpoint.

Now the DNC hack is a little more interesting and deeper situation. Unfortunately there is less of a direct causal link that is given but there is the CrowdStrike analysis that has been parroted by just about everyone from intelligence to media who talks about the hack. The story according to them is as follows:
1. Someone somewhere got phished. This is a pretty common issue, isn't it? But look at what I talked about in Podesta and see how easy it is for a chain of minor mistakes could lead to someone getting phished. Problem is that this chain goes back to like 2015, while Podesta got hacked in March 2016.
2. Most of the page talks about the "Fancy Bear" and "Cozy Bear" groups without actually referring to the evidence that it was them. They do provide such an evidence near the end, but just know that most of the context here is background about suspected groups rather than a description of the hack itself. What it does assert, however, is that both groups independently hacked into the DNC servers, and that they didn't share info about their hacks because the two agencies work that way (there is a European Council on Foreign Relations paper on the topic that is biased and political but expository about Russian intelligence structure).
3. Now, the Cozy Bear hack was perpetuated using a pretty complicated backdoor that starts with an encrypted shell command, which downloads a multi-part worm that keeps itself alive and hides evidence of its existence. CrowdStrike found this worm and noted that it is a well-known Cozy Bear worm that was used from around 2013 to 2015. It kept itself alive for the longest time because it's a pretty advanced tool. It's actually a genuinely impressive hack right there.
4. The Fancy Bear hack was much simpler. They downloaded software that has a keylogger, remote access tools, and file transfer. Also found on DNC devices.

Now the hacks themselves, assuming all information provided by CrowdStrike is accurate (they seem to be willing to stake their reputation on this analysis, and everything seems to check out) does appear to be very advanced. But even that doesn't tell the full story. Two sophisticated Russian-affiliated hackers separately installed malware that compromises the data of the DNC. Two separate entities. If that is enough proof to say that the Russians hacked into it (it still isn't but it's close enough that we can just say "sure let's go with that") there is nothing that says that there wasn't a third, fourth, or fifth hack. If the DNC got hacked twice, why not thrice? CrowdStrike shows that groups thought to be affiliated with Russia hacked, but it doesn't show that no one else did.

And here is the final part of the story that just makes this all have a further layer of plausible deniability: no one knows who leaked. Julian Assange probably doesn't know who leaked to him if the source is anonymous. Snopes has an article on Guccifer and notes a Russian codename saved into the metadata, but that means jack shit because it's clearly a troll name that was put in to be found, and it could be a Russian or anyone else who made such a troll name. And so whoever leaked to Assange, maybe it was Russia maybe it was literally anyone else, there's no way to know for sure who it was and who said person is associated with without the confession of someone who does not have to have any physical presence in any place where they might be prosecuted.

While Russia is generally associated with these kinds of hack-and-leaks and I personally see enough of a credible narrative to buy that story, hopefully that gives some understanding of just how little proof there can be of anything concrete. Trump could actually be fully correct in saying that Russia didn't do it - I find that to be a hard story to believe but there is nothing that says that it has to be untrue. Really, quite impossible to prove anything here.