No evidence supporting theory Russia hacked DNC says NSA whistleblower

originally posted by: JBurns
a reply to: Dudemo5

But he didn't say anything about a destination or source IP. What he does say is that data was copied in two separate bursts, 12 minutes apart totaling 87 seconds. 16GB is a lot of data to copy in such a short time, and it is unlikely they would do so with such speed over the network/WAN. Doing so would certainly raise red flags, so it would've been split into much smaller chunks and possibly transmitted as another type of data (for instance, HTTP requests/responses).

By "it" what do you mean? The Windows event log? Or /var/log? My point is that USB file transfer wouldn't be documented the same way as data going across a network. Anything having to do with an IP address would be separate from local file transfer disk I/O stuff. You might have a hardware address that is specific to that USB device, but it wouldn't have an assigned IP in any way.

Right. The disk I/O stuff is separate from the network activity. However, we have the destination IP address, so clearly there was an IP address associated with the breach through which logs show significant outbound traffic.

No, the USB drive does not have an IP address.

So a NSA whistleblower said the Russians didn't hack the DNC in a story on Russia Today, the main propaganda arm of the Russian government.

Seems legit.

originally posted by: underwerks
So a NSA whistleblower said the Russians didn't hack the DNC in a story on Russia Today, the main propaganda arm of the Russian government.

Seems legit.

Lol right because I am sure CNN/MSNBC/FOX were all over giving Binny a platform, I mean that is what they did when he was blowing the whistle on the NSA right!?

originally posted by: underwerks
So a NSA whistleblower said the Russians didn't hack the DNC in a story on Russia Today, the main propaganda arm of the Russian government.

Seems legit.

Good lord it's like a non-stop fake-news fest around this place.

a reply to: Dudemo5

See this thread for details:

BOMBSHELL: New Report Shows Guccifer 2.0-DNC Files Were Copied Locally—Not Hacked

Salient excerpt

A mysterious IT specialist, who goes by the name The Forensicator, published a detailed report that appears to disprove the theory that the DNC was hacked by Russia.

The documents were copied on July 5th, five days before Seth Rich was murdered.

The Forensicator summarized the complex report into 10 bullet points.

The report as laid out by The Forensicator:

Based on the analysis that is detailed below, the following key findings are presented:

On 7/5/2016 at approximately 6:45 PM Eastern time, someone copied the data that eventually appears on the “NGP VAN” 7zip file (the subject of this analysis). This 7zip file was published by a persona named Guccifer 2, two months later on September 13, 2016.

So, no, not Crowdstrike but rather an independent examination of the files themselves.

a reply to: Dudemo5

Is it possible there is an error? Sure. I am sure Binney, with his many years of NSA experience thought of that precise thing.

Since he didn't mention any such concern, however, he is confident in his statements as he always is. Binney has never been shown to "just say things" for the sake of saying them. He is a man of integrity, and has a history of honest and unbiased analysis (no doubt from his NSA experience).

How are you so certain he is wrong? You speak almost as though you've seen some actual evidence linking this to Russia. There has been no such evidence released. Crowdstrike's investigation is not classified, there is no reason not to release the evidence and prove their claim definitively.

There are no sources/methods to protect with system logs - every sysadmin/enthusiast knows how to do that. Heck, anyone running MS [popular pentesting application] can even clear those logs in difficult-to-detect ways. This whole thing feels sloppy, especially its conclusion.

If there is evidence to prove this connection, we deserve to see it. I say deserve specifically because after all of the rumors and innuendo driven narrative they put out there, they owe it to the people to prove the basis of these claims.

No one should accept others at their word on important matters, always take the time to verify things yourself and demand facts. We are all intelligent adults capable of making our own informed analysis of facts.

originally posted by: Dudemo5

originally posted by: JBurns
a reply to: Dudemo5

But he didn't say anything about a destination or source IP. What he does say is that data was copied in two separate bursts, 12 minutes apart totaling 87 seconds. 16GB is a lot of data to copy in such a short time, and it is unlikely they would do so with such speed over the network/WAN. Doing so would certainly raise red flags, so it would've been split into much smaller chunks and possibly transmitted as another type of data (for instance, HTTP requests/responses).

By "it" what do you mean? The Windows event log? Or /var/log? My point is that USB file transfer wouldn't be documented the same way as data going across a network. Anything having to do with an IP address would be separate from local file transfer disk I/O stuff. You might have a hardware address that is specific to that USB device, but it wouldn't have an assigned IP in any way.

Right. The disk I/O stuff is separate from the network activity. However, we have the destination IP address, so clearly there was an IP address associated with the breach through which logs show significant outbound traffic.

No, the USB drive does not have an IP address.

From what I gather, nobody has ever examined this server except Crowdstrike.
Bonney is quoting Crowdstrike's assessment of the download speed....16GB in 87 seconds.
Him and his team could not replicate the speed they claim.
Crowdstrike was paid.....most likely by multiple sources.

originally posted by: visitedbythem

Twenty to life???

originally posted by: jadedANDcynical
a reply to: Dudemo5

See this thread for details:

BOMBSHELL: New Report Shows Guccifer 2.0-DNC Files Were Copied Locally—Not Hacked

Salient excerpt

A mysterious IT specialist, who goes by the name The Forensicator, published a detailed report that appears to disprove the theory that the DNC was hacked by Russia.

The documents were copied on July 5th, five days before Seth Rich was murdered.

The Forensicator summarized the complex report into 10 bullet points.

The report as laid out by The Forensicator:

Based on the analysis that is detailed below, the following key findings are presented:

On 7/5/2016 at approximately 6:45 PM Eastern time, someone copied the data that eventually appears on the “NGP VAN” 7zip file (the subject of this analysis). This 7zip file was published by a persona named Guccifer 2, two months later on September 13, 2016.

So, no, not Crowdstrike but rather an independent examination of the files themselves.

So all of this comes from direct analysis of a zip file uploaded to the internet by a hacker? Nice.

No wonder this doesn't include any of the relevant server analysis.

a reply to: jadedANDcynical

Thanks for that jaded! Great information there, glad to see an independent analysis was also conducted.

originally posted by: JBurns
a reply to: Dudemo5

Is it possible there is an error? Sure. I am sure Binney, with his many years of NSA experience thought of that precise thing.

Since he didn't mention any such concern, however, he is confident in his statements as he always is. Binney has never been shown to "just say things" for the sake of saying them. He is a man of integrity, and has a history of honest and unbiased analysis (no doubt from his NSA experience).

How are you so certain he is wrong? You speak almost as though you've seen some actual evidence linking this to Russia. There has been no such evidence released. Crowdstrike's investigation is not classified, there is no reason not to release the evidence and prove their claim definitively.

There are no sources/methods to protect with system logs - every sysadmin/enthusiast knows how to do that. Heck, anyone running MS [popular pentesting application] can even clear those logs in difficult-to-detect ways. This whole thing feels sloppy, especially its conclusion.

If there is evidence to prove this connection, we deserve to see it. I say deserve specifically because after all of the rumors and innuendo driven narrative they put out there, they owe it to the people to prove the basis of these claims.

No one should accept others at their word on important matters, always take the time to verify things yourself and demand facts. We are all intelligent adults capable of making our own informed analysis of facts.

There is evidence that the hack came from Russia. Others have done a decent job of collating that evidence right here on this very forum. Ante put a decent write-up together which I am sure you can find.

You're never going to get detailed forensics, however, as doing so would jeopardize national security.

a reply to: Dudemo5

What you're not getting is the analysis done by the Forensicator is confirmed by Binny's statements.

There are two separate and unconnected entities (the Forensicator and Binny) that have come to the same conclusion.

a reply to: RazorV66

Crowdstrike is also part of the Fusion GPS team which is part of the Ukrainian coup team which is part of the neo-con team which is part of the SA team which is part of the ISIS team ... with a team like that what could go wrong ...Oh and uncle John McCain in the middle of it all to boot

originally posted by: Dudemo5

originally posted by: underwerks
So a NSA whistleblower said the Russians didn't hack the DNC in a story on Russia Today, the main propaganda arm of the Russian government.

Seems legit.

Good lord it's like a non-stop fake-news fest around this place.

The source isn't RT. The source is Binney, a well respected NSA whistle-blower. But great tactic though, when you can't attack the information attack the source - classic logical fallacy actually

More Russia conspiracy talk I see

originally posted by: jadedANDcynical
a reply to: Dudemo5

What you're not getting is the analysis done by the Forensicator confirm is confirmed by Binny's statements.

There are two separate and unconnected entities (the Forensicator and Binny) that have come to the same conclusion.

The Forensicator got his I/O numbers by examining a zip file uploaded to the internet by a hacker.

Where did Binny get his numbers again?

originally posted by: JBurns

originally posted by: Dudemo5

originally posted by: underwerks
So a NSA whistleblower said the Russians didn't hack the DNC in a story on Russia Today, the main propaganda arm of the Russian government.

Seems legit.

Good lord it's like a non-stop fake-news fest around this place.

The source isn't RT. The source is Binney, a well respected NSA whistle-blower. But great tactic though, when you can't attack the information attack the source - classic logical fallacy actually

More Russia conspiracy talk I see

Oh, I'm sure "Muh Hillary" is to blame.

P.S.

I have been debating the info.

I think it was an inside job. Maybe the Russians bought the info, but I don't think the Russians initiated the hack.

Look at the leakers in the FBI. We are getting stuff twice a week, there are so many leeks in that place, mostly supporting Democrats interests, that I feel that the DNC may have had some leeks going on. Not many people have allegence to groups anymore, so many people just look at what they can get out of it. Our country has gone down the drain.

a reply to: Dudemo5

There is evidence that the hack came from Russia.

Are you unfamiliar with Vault 7?

What about Crowdstrike's flawed analysis?

originally posted by: jadedANDcynical
a reply to: Dudemo5

There is evidence that the hack came from Russia.

Are you unfamiliar with Vault 7?

What about Crowdstrike's flawed analysis?

Are you unfamiliar with ATS?

a reply to: RazorV66

Actually, I think you can tell, at least in Windows environments. When you stick a thumb drive into a pc, the device is logged every time by the operating system. That's required for it to operate correctly. Data transfers are also separately logged, obviously, or how else would they know how much data transferred in what amount of time? It seems to me that an electronic forensics expert could correlate the various logs and come to reasonable conclusions.

The question is has anyone really done that?

It's certainly hinky that the FBI never had the actual servers for investigation.