Forty Two wrote:No one has actually proven that group is the Russian government (or works for it). This remains the enormous inductive leap that’s not been dealt with.
What would "proof" consist of,
Forty Two? I assume your answer would be "concrete evidence." See below.
Forty Two wrote:So, concrete evidence would be evidence which establishes that the group engaged in phishing or spreading malware is or works for the Russia government. There are a variety of ways, more than I could even speculate on, which would establish that. However, it's not a fact that can be assumed.
You're dodging,
Forty Two. Even though you say that there are more ways than you could even speculate on that you think would establish the conclusion, you appear unable to even describe one or two. I invite you to say what you believe would constitute "concrete evidence" rather than the above hand-waving. The cyber-security professionals in both the private sector and in the government are not just "assuming" that the Russian government is behind this hacking. Put up or shut up: What concrete evidence would you find convincing?
Forty Two wrote:It's unusual for the evidence to be assembled on the victim's dime.
I don't know what context you're applying here, but the fact is that private cyber-security firms are hired by victims of hacking on a regular basis. That's pretty much how they do business. Who the hell do you expect them to be working for?
Your "summary" of the evidence is either based on ignorance or is disingenuous.
We'll begin with the
CrowdStrike piece. They explain that they were familiar with both Russian-based threat actors they describe well before they were hired by the DNC. They are not presenting some spur of the moment account of a recent discovery of these hacking groups. CrowdStrike has been aware of their actions for some time--approximately a decade in one case. They also explain that the fact that there were two Russian intelligence entities that engaged in hacking the DNC, and that is is a known characteristic of how the Russian intelligence agencies operate.
CrowdStrike, having dealt with these groups in the past, is familiar with their techniques, and consider them diagnostic--you could say that these groups have signature modes of operation. There is no hedging in the piece,
Forty Two; CrowdStrike expresses no uncertainty as to who "FANCY BEAR" and "COZY BEAR" are. They do not say the two entities "may have some connection to Russia." That is
your false characterization,
Forty Two.
On to
SecureWorks. This piece starts off stating that they have moderate confidence that the group they're talking about (known to SecureWorks as Threat Group-4127, the group that CrowdStrike calls FANCY BEAR) which hacked into the DNC is operating out of Russia and doing so for the Russian government. Their Counter Threat Unit describes a pattern of behavior by Threat Group-4127 (who it targets) that is the basis for its conclusion. Your characterization would have been justified,
if you had been talking about SecureWorks.
Regarding
Fidelis aka threatgeek: They state that their research supports CrowdStrike's conclusions. This piece also links to a number of reports from other private cyber-security firms that give detailed descriptions of the malware and phishing techniques used by the two threat groups, in which it is noted that some of the exploits are unique to one or the other of the groups (again, a form of signature). Fidelis states unequivocally that, based on their research, they believe the answer to the question of who was responsible for the DNC attack is settled: It was Russian hackers.
On
Motherboard, some of the metadata not mentioned in the above reports is included, as well as very telling details: The fact that IP addresses known to be utilized by the Russian hacking groups were used in the hacking efforts, and that encryption keys that are unique to the groups were used.
What we have is multiple private cyber-security firms that all state (though with varying degrees of confidence) that these hacking efforts originated in Russian intelligence agencies. No other entities have been advanced by these firms as possible suspects. In addition, we have the unanimous agreement of US government intelligence agencies regarding this issue.
You ask if I would take Comey's word for it if this had happened in 2008, and the Russians had been accused of trying to help Obama. No, I doubt that I would. However, if I had spent the time looking at the consilience of evidence and statements from both
all the government intelligence agencies as well as
all the private cyber-security firms who have investigated the issue, I would have no reasonable argument to make that the Russians were not responsible for the hacking. No other suspect has been credibly advanced by anybody, despite the mountebank Trump yapping about "somebody sitting on their bed that weighs 400 pounds." Even Trump publicly admitted yesterday that it was likely the Russians, before almost immediately trying to muddy the water.
