Hack Everything…

All of the available evidence however does in our opinion suggest that the group operates
on behalf of the Russian Federation. Kaspersky noted that based on the compilation
timestamps, the authors of the Duke malware appear to primarily work from Monday to
Friday between the times of 6am and 4pm UTC+0 [11] . This corresponds to working
hours between 9am and 7pm in the UTC+3 time zone, also known as Moscow Standard
Time, which covers, among others, much of western Russia, including Moscow and St.
Petersburg.”
However, since we know the NSA has altered the time stamps on previous programs, it
would be a simple matter for them to also alter the time stamps on Cozy Duke. Here is a
quote from Kaspersky about why they never attribute any cyber weapon to any nation:
“Cyber-spies can stage false-flag operations: the evidence we use to attempt to identify
attackers includes timestamps, words in particular languages in the malware code,
names or nicknames, and the geographical locations of the command-and-control
servers used. But such evidence is always circumstantial and can easily be forged.”
http://media.kaspersky.com/en/Duqu-2-0-Frequently-Asked-Questions.pdf
It is therefore possible to imagine that the time stamps on the Cozy Duke code are valid
and that it was therefore written by Russians. However, such a naive claim ignores all of
the other evidence – especially the fact that all the Cozy Duke “call home” server IP
addresses are in the US or in countries friendly to the US - which leads to the conclusion
that it was the NSA that wrote Cozy Duke. If we conclude that the NSA wrote Cozy Duke,
then we must also conclude that it was the NSA and not Russia that hacked the DNC
servers. Since the NSA motto is to hack everything, it should not surprise anyone that the
NSA was hacking DNC servers – because the NSA hacks all servers.
All of the above was reported and known prior to the DNC hacker attacks. Now that
we have a better understanding of how Cozy Bear and Fancy Bear work, and the
fact that both are far more likely to be NSA cyber weapons than Russian cyber
weapons, let’s get back to the DNC hack.
Hack Everything… A Detailed Timeline of the DNC Hack Page 29