U.S. Senate Hearing on Russian Hacking - Top US Intelligence Officials Testify LIVE

In a blog post on the subject, renowned infosec expert, firewall pioneer and IANS Faculty Marcus Ranum noted the JAR’s detailed account of the methods of APT28 and APT29, two alleged Russian hacking campaigns, were little more than a recitation of typical hacking by typical hackers using typical tools available to most anyone with a connected PC and bad intentions.

“This is how it’s been done since about 2002 or so,” Ranum said of the report’s hacking rundown. “You carpet-bomb a link to a malware dropper, and you get a few gomers, then you see what you’ve caught and exploit the most exciting ones.

“So someone sent someone at a U.S. political party some malware, and they opened it, and some hacker did like every other hacker ever. I’m still waiting to see how and why this is Russians. In fact, the methods described are the exact same methods that the Chinese that hacked OPM, the North Koreans that hacked Sony, [and] the kid down the street use. How do they know this was Russians and not North Koreans?

“I really need to emphasize that this is standard operating procedure,” Ranum added. “The penetration testers that I know use exactly the same techniques, as do the hackers.”

To be sure, some elements of the JAR strain credulity. One has to believe, for example, that well-trained, well-funded Russian cyberwarfare forces have a preference for outdated, off-the-shelf Ukranian-made malware, for example. Incongruities like this set off a firestorm of debate in the infosec community almost as soon as the DHS-FBI report was issued.

As a number of security experts have pointed out, the bulk of the indicators of compromise listed in the slim report (the JAR is 13 pages but eight of those are reprints of basic defense strategies repurposed from previous CERT and DHS papers) are generic, non-specific and hardly indicative of nation-state activity much less proof of Russian involvement.

The JAR’s accompanying CSV lists more than 870 IP addresses that are a mostly useless mix of TOR exit nodes, proxies, virtual private servers and assorted unclassified sites. Another head-scratcher is the report’s mish-mashed list of APT campaigns, malware and vulnerability categories, which the report’s authors refer to as “Reported Russian Military and Civilian Intelligence Services (RIS).” The list conflates hacking campaign names like COZYDUKE and Fancy Bear with malware names such as Black Energy and Twain_64.dll as well as vague kinds of common hacker capabilities such as “Powershell backdoor.”

“In this situation we now have net negative credibility,” Ranum told IANS. “The U.S. government is coasting on the trust that people have built in it. They’re now saying ‘We’re the U.S. government and we have this amazing intelligence community and we say it’s the Russians and we’re not going to tell you anything more.’ Then they provide this insultingly bad information.”