Russian Hackers Kept DNC Backdoor Longer Than Anyone Knew

Daily Beast ^ | 7/13/18 | KEVIN POULSEN

[Libloather]

**SNIP**

Today’s indictment confirms every aspect of the DNC’s and Crowdstrike’s account, with one exception. Both the DNC and Crowdstrike have said repeatedly that they went public only after expelling all the Russian hackers.

But buried in the new indictment is language suggesting that Crowdstrike missed a spot, and one computer infected with the GRU’s malware “remained on the DNC network until in or around October 2016.”

If Mueller’s right, it raises the possibility that the Russians gathered months and months of additional intelligence on the DNC—right as the campaign was in its final, most important stretch. The hackers may have even had a front row seat on the DNC’s network that July, when Wikileaks published the hacked emails and the DNC was thrown into upheaval.

[rolling_stone]

why didn’t the fbi get search warrants if the”election’was being endagered?

[advance_copy]

VIPS showed the data rate to be about 181 Mbps, which is doable using an OC-12 line (very expensive). Their calculations is solid using timestamps and file size. VIPS also describes transit latency that imposes a session limit to about 80 Mbps, and that is true. So, even with an OC-12 connection equivalent from DC to Chicago, the data rate limit wouldn’t be enough on a single file transfer session.

But I believe there’s a flaw in VIPS theory. Peer-to-peer systems could blast through the session limit because they employ multi-session file transfers. While P2P systems aren’t built for a single computer to single computer (they’re built for multi-computer to single computer), it would be possible to modify open source P2P code so that uses TCP ports instead of IP addresses. That could allow multi-thread processes on a single system to emulate more than one source computer.

Also, the indictment indicates that many computers at the DNC were infected with the malware “X-agent” that was apparently the process that ex-filtrated the data. This could also bypass the single session data rate limit.