Hack Everything…

It sounds like an open and shut case, doesn’t it? There is only one problem. Almost every
sentence in the above paragraph is false (kind of like the Vermont Power Grid story was
false). But don’t take it from me. Here is a quote from security consultant Jeffrey Carr:
“Problem #1: The IP address 176.31.112[.]10 used in the Bundestag breach as a
Command and Control server has never been connected to the Russian intelligence
services. In fact, Claudio Guarnieri, a highly regarded security researcher, whose
technical analysis was referenced by Rid, stated that “no evidence allows to tie the
attacks to governments of any particular country.”
Problem #2: The Command & Control server (176.31.112.10) was using an outdated
version of OpenSSL vulnerable to Heartbleed attacks. Heartbleed allows attackers to
steal data including private keys, usernames, passwords and other sensitive information.
The existence of a known security vulnerability that’s trivial to exploit opens the door to
the possibility that the systems were used by one rogue group, and then infiltrated by a
second rogue group, making attribution even more complicated.
Problem #3: The BfV published a newsletter in January 2016 which assumes that the
GRU and FSB are responsible because of technical indicators, not because of any
classified finding; to wit: “It is assumed that both the Russian domestic intelligence
service FSB and the military foreign intelligence service GRU run cyber operations.”
https://medium.com/@jeffreycarr/can-facts-slow-the-dnc-breach-runaway-train-lets-try-
14040ac68a55#.9o758bkf5
But don’t take Jeffrey’s word for it. Let’s go to the source. This is the source document for
the May 20 2015 German hack that was reported on June 19 2015 which thankfully was
printed in English as my German is a little rusty. .
https://netzpolitik.org/2015/digital-attack-on-german-parliament-investigative-report-onthe-hack-of-the-left-party-infrastructure-in-bundestag/
Here is a quote from the report: “Attributes of one of the artifacts and intelligence
gathered on the infrastructure operated by the attackers suggest that the attack was
perpetrated by a state-sponsored group known as APT28. Previous work published by
security vendor FireEye in October 2014 suggests the group might be of Russian origin.”
So the author relies on the Fire Eye conclusion that APT 28 is Russian which in turn was
based on the F Secure Report which in turn was based on easily changed time stamps.
But it may be that the hacker of the German server was not Russian or American
because the hacker made a very basic mistake. Here is the quote:
“The Command & Control server (176.31.112.10) appears to be using an outdated
version of OpenSSL and be vulnerable to Heartbleed attacks. The same C&C server
might have been the subject of 3rd-party attacks due to this vulnerability.”
Here is one more quote from the German report:
“(German hack) Artifact #2 was compiled by the authors on April 22nd 2015, which
suggests that the compromise may only have lasted a couple of weeks...Previous work
by security vendor FireEye suggests the group might be of Russian origin, however no
evidence allows us to tie the attacks to governments of any particular country.”
Hack Everything… A Detailed Timeline of the DNC Hack Page 44