Experts Destroy White House ‘Proof’ of Russian Hacking

On Thursday, as part of the White House response to alleged Russian hacking, the FBI and DHS released a Joint Analysis Report (JAR) called “Grizzly Steppe.” While this report was meant to prove, or at least provide evidence, that the Russian government was involved in hacks of the Democratic Party, experts have stated that it “adds nothing.”

Jeffrey Carr, a cybersecurity consultant, author, and founder of the Suits and Spooks conference, wrote in an analysis that the report merely lists every threat group ever reported on by a commercial cybersecurity company suspected of having ties to Russia, labeling them “Russian Intelligence Services,” without evidence that any such connection exists.

“Unlike Crowdstrike, ESET doesn’t assign APT28/Fancy Bear/Sednit to a Russian Intelligence Service or anyone else for a very simple reason. Once malware is deployed, it is no longer under the control of the hacker who deployed it or the developer who created it,” Carr wrote, adding, “It can be reverse-engineered, copied, modified, shared and redeployed again and again by anyone. In other words, malware deployed is malware enjoyed!”

Carr added that if the White House had unclassified evidence tying Russia to the DNC hack, the evidence would have been made public by now. Since they have not made evidence public, he, like many other members of the intelligence community, believes that it is either classified or it simply does not exist.

“If it’s classified, an independent commission should review it because this entire assignment of blame against the Russian government is looking more and more like a domestic political operation run by the White House that relied heavily on questionable intelligence generated by a for-profit cybersecurity firm with a vested interest in selling ‘attribution-as-a-service,’” Carr stated.

Likewise, Robert M. Lee, a National Cybersecurity Fellow at New America and CEO and founder of cybersecurity company Dragos, published a thorough critique of the JAR, saying it “reads like a poorly done vendor intelligence report stringing together various aspects of attribution without evidence.”

“The list of reported RIS [Russian intelligence services] names includes relevant and specific names such as campaign names, more general and often unrelated malware family names, and extremely broad and non-descriptive classification of capabilities,” Lee wrote. “It was a mixing of data types that didn’t meet any objective in the report and only added confusion as to whether the DHS/FBI knows what they are doing or if they are instead just telling teams in the government ‘contribute anything you have that has been affiliated with Russian activity.’”

Lee explained that it is extremely difficult to identify whether data was sourced from the private sector or from declassified government data.

“It is useful to know what is government data from previously classified sources and what is data from the private sector and more importantly who in the private sector. Organizations will have different trust or confidence levels of the different types of data and where it came from,” Lee said. “Unfortunately, this is entirely missing. The report does not source its data at all. It’s a random collection of information and in that way, is mostly useless.”

Lee, in his critique, detailed that it is important for government reports to detail where data came from, and to separate private-sector information from their own data, which is seen to have a higher confidence level. Further, Lee stated that some of the samples were already known to the public, so if they were classified, “it is a perfect example of over classification by government bureaucracy.”

“The DHS/FBI GRIZZLY STEPPE report does not meet its stated intent of helping network defenders and instead choose to focus on a confusing assortment of attribution, non-descriptive indicators, and re-hashed tradecraft,” Lee said. “Additionally, the bulk of the report (8 of the 13 pages) is general high level recommendations not descriptive of the RIS threats mentioned and with no linking to what activity would help with what aspect of the technical data covered. It simply serves as an advertisement of documents and programs the DHS is trying to support. One recommendation for Whitelisting Applications might as well read ‘whitelisting is good mm’kay?’”

Lee summed up that JAR appears to be very rushed, and put together by multiple teams working with different data sets and motivations, resulting in a very confusing non-explanation that tried to cover too much, while saying too little.

“If you want to have your mind blown, Freepers REALLY need to take a look at the referenced JAR report that statement of “Russian Malicious Cyber Activity” is based on (https://www.us-cert.gov/sites/default/files/publications/JAR_16-20296.pdf).

This report (https://www.us-cert.gov/sites/default/files/publications/JAR_16-20296.pdf) is a sick joke! There is NOTHING in that report that justifies what was stated in that press release! NOTHING!

That report consists of nothing but a bunch of generalizations except for blathering on about TWO hackers (with flowcharts even) who each sent out a 1,000 phishing emails and tricked a couple of idiots like Podesta into giving them their passwords. Also, note that the “RIS” group the report mentions consists of both civilian and military hackers and the report never says whether the TWO identified hackers are civilians or military.

Literally millions of these kind of phishing emails are sent out every day by thousands of sources around the world, and yet this report mentions TWO guys sending out a couple thousand of these phishing emails. And apparently that justifies kicking trying to start a war with Russia!

The report casually mentions “elections” in a generic list of WORLDWIDE targets but never says anything else about “election” “hacking”.

The final 8 pages of the 13 consist of nothing more than outlines of basic IT security procedures that small businesses like daycare centers and the like should be using; it’s astonishing just how low-level, and basic these security recommendations are, like something copied off of a Security 101 web page. Either our government IT is woefully and pathetically insecure, or this report is utter nonsense.

I seriously doubt this “report” was written by anyone who actually knows anything in our intelligence communities, either that or our intelligence communities have sunk to unimaginable depths of patheticness.

The whole thing looks like some kind of political hackjob whose sole purpose is to look and sound official enough that NYT, WaPo, and the rest of the fake stream media can pretend it’s proof that “Russian hackers got Donald Trump elected as President”.

If/when we see the fake stream media trumpeting this report as some kind of gospel, we’ll know for a fact that the fake stream media really is simply faking the “news”.

Nonetheless, it’s terrifying that Obama would try to start a war with Russia three weeks before leaving office if this is all he’s really got in terms of “proof”. It’s even more terrifying that this kind of complete disinformation is being willingly released against us by the very organizations that are SUPPOSED to be protecting us. And perhaps most terrifying of all is the pathetically amateurish level of this disinformation.

President Trump is truly inheriting government dysfunction of Biblical proportions.”

Meanwhile, NYT, WaPo and all the rest tout this ridiculous report as proof positive that “the Russians hacked the election to get Donald Trump elected”, naturally without ever having read it, even though it was written at about a 11th grade level and contained only 5 relevant pages, which distill down to: “two maybe Russian ‘hackers’ sent out a thousand phishing emails each, and they might be private ‘hackers’ or they might work for the Russian government”.

Curiously this “report” fails to mention that ten thousand other ‘hackers” send out millions of phishing emails every day and only people as stupid as John Podesta give away their passwords. It also fails to mention that someone hacked the Federal personnel office a year ago and stole ALL of their data, including ALL personal on file for ALL Federal employees!

Even though the report goes on for eight more pages about basic IT security measures copied from some Internet Security 101 website, they fail to mention things like not using private email servers in you bathroom to conduct sensitive government business, and the extremely high likelihood said servers, being less secure even than gmail, were hacked by multiple foreign players.

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.