Forensicator’s first decisive findings, made public in the paper dated July 9, concerned the volume of the supposedly hacked material and what is called the transfer rate—the time a remote hack would require. The metadata established several facts in this regard with granular precision: On the evening of July 5, 2016, 1,976 megabytes of data were downloaded from the DNC’s server. The operation took 87 seconds. This yields a transfer rate of 22.7 megabytes per second....
Time stamps in the metadata provide further evidence of what happened on July 5. The stamps recording the download indicate that it occurred in the Eastern Daylight Time Zone at approximately 6:45 pm. This confirms that the person entering the DNC system was working somewhere on the East Coast of the United States. In theory the operation could have been conducted from Bangor or Miami or anywhere in between—but not Russia, Romania, or anywhere else outside the EDT zone....
August 12, 2017
"A New Report Raises Big Questions About Last Year’s DNC Hack/Former NSA experts say it wasn’t a hack at all, but a leak—an inside job by someone with access to the DNC’s system."
Writes Patrick Lawrence in The Nation. Excerpt:
Subscribe to:
Post Comments (Atom)
Posts
159 comments:
the nation finds some fake news?
"The Nation Article About the DNC Hack Is Too Incoherent to Even Debunk"
http://nymag.com/selectall/2017/08/the-nation-article-about-the-dnc-hack-is-incoherent.html
Disenfranchised Democrat. Now deceased?
I think Wikileaks more or less hinted at that last year when the story broke. Even at this late date the feds have not examined the DNC servers that were "hacked". This is all coming from a 3rd party vendor that the DNC hired. But don't expect our media to bother to ask or pry why this is still the case a year. Nope its all RUSSIA, RUSSIA, RUSSIA!!!!
Yeah, that was some "investigation" the FBI did on this "hack"
http://thehill.com/policy/national-security/312767-fbi-never-examined-hacked-dnc-servers-report
The note at the end is, shall we say, predictable; Editor’s note: After publication, the Democratic National Committee contacted The Nation with a response, writing, “U.S. intelligence agencies have concluded the Russian government hacked the DNC in an attempt to interfere in the election. Any suggestion otherwise is false and is just another conspiracy theory like those pushed by Trump and his administration. It’s unfortunate that The Nation has decided to join the conspiracy theorists to push this narrative.”
Maybe the next variation is that the insider was a Russian mole.
PS: This story a couple of weeks old. Maybe it's reached a level of ferment to make the Sunday morning shows.
I thought Julian Assange flat stated their man got it on a CD from a disgruntled DNC employee?
Too Incoherent to Even Debunk
Despite saying that, the New York Magazine article does attempt to debunk it, by saying that you can too copy data across the Internet that fast.
Forensicator is not connected to DNC.
Professor you should require minimum reading comprehension before allowing commenters to post.
It is no Wonder Nation is picking this up. Weren't They for Uncle Bernie!!!
The Left is built upon lies. They won't give up the narrative because they knew it was a lie from the start. And it gave them a lot of mileage.
Chuck quoted NYMag which said...
The Nation Article About the DNC Hack Is Too Incoherent to Even Debunk
The Nation article might be, but the readily available analysis from Forensicator is not.
Can our Congress critters grasp techsplaning? When even Google could not!!
What a wonderful country.
The DNC, RNC, Hillary campaign, and Trump campaign would have been high value targets for any foreign intelligence service -- the Israelis, Chinese, and Pakistanis every bit as much as the Russians. The evidence available suggests that DNC and Hillary campaigns were unusually weak as regards security, which is their lookout and no one else's.
What is impossible to believe is that any of the intelligence services shared their collected information with Wikileaks. Assange has always said that he got the Emails he released from an insider. There is not now and has never been any reason to doubt him.
Where have you gone, Seth Rich?
The Nation turns its lonely eyes to you, wo wo wo
DNC must be emulating Hillary - trying a Benghazi like deflection to Russia. Media were enablers for that also.
Aaaaaaand its back to more comfortable ground - right wing conspiracy theories.
It is rare in life that someone gets what they deserve but Rupert Murdoch may miss out again on buying Sky News thanks to FOX creating the Seth Rich conspiracy our of whole cloth.
"Though the mills of God grind slowly, yet they grind exceeding small."
22.7 megabytes per second is fast. As I understand the way hackers operate, if they are interested in hiding their activities, it slows transmission speeds.
Can anybody confirm that?
Birkel said...
Can anybody confirm that?
No.
We are now down to 2 real news vendors ..the Nation and the National Enquirer . Indeed.
The Nation and Katrina can den Heuvel have been promoted into the right wing by ARM.
No thank you. You keep those nutters on your team. They are not welcome.
Despite saying that, the New York Magazine article does attempt to debunk it, by saying that you can too copy data across the Internet that fast.
In the abstract, yes. In the particular, it depends on how many gateways the DNC had and their respective throughput. Only one gateway would be used (technically it's possible to use more, but not without calling attention to what you are doing) and if their best gateway could not manage that download rate, then no, it's impossible.
One thing to keep in mind is that network performance is measured in megabits per second, and there are 8 bits per byte. Also transmission overheads, such as parity bits, TPC and IP headers, etc. At a rough guess, the actual network performance required in megabits would be roughly ten times the megabytes transmitted (i.e., 224 to 230 megabits per second (mpbs)).
The FBI could easily have done the same analysis as what Forensicator did. But their mindset under Comey clearly not up to it.
What a wonderful country.
Sorry Chuck - it is the NY Mag article that is incoherent. The Nation article pointed out that the 22 mbyte transfer rate is possible for short distances. And, yes, the DNC and Russian intelligence have enterprise level connections. BUT - not between the US and Europe. 10 miles - sure. That was their entire argument - that theoretically (ignoring the thousands of miles and multiple networks between them) it was theoretically possible that the two supposed ends of the connection could transfer at that speed (if they were 10 miles apart on the same network). And the DNC said that they hadn't been hacked (and we should believe them because they have, apparently no reason to harm the Trump Presidency, or something like that). That is their argument. They didn't even bother to argue against these being closer to flash drive speeds, or the use of Office templates that had embedded Russian fingerprints in them, or that the CIA was shown to have tools with those fingerprints, etc. those points were in the Nation article, and ignored by the NY Mag rebuttal, presumably as inconvenient.
"right wing conspiracy theories. "
In The Nation. Sure.
This from a person who cuts and pastes the ravings of Andrew Sullivan. Alternet beckons, ARM. You'll be safe there.
@Birkel,
22.7 megabytes per second is fast.
The point is that there are very few WAN link speeds that are that fast. A WAN link of that speed would cost quite a bit of money per month, & the DNC doesn't have a link of that speed.
Also, that speed is simply not possible when trying to copy data from even a high-speed WAN link to a system in a foreign country. There's simply too much IP overhead traffic to permit that sort of data throughput on a multi-route connection. Remember, even both ends of a data transfer have high-speed lines, the transfer speed's theoretical maximum is that of the slowest "pipe" along the way. And, TCP/IP traffic never attains anything like its theoretical maximum in any situation other than on well-designed & maintained Local Area Networks. It never occurs in traffic across the internet.
As i recall someone called Althouse had questions bout the russian line the day it was said.
Next up, the SPLC lists The Nation as a hate group.
Always keep in mind ... Enemy of my enemy can always be useful to fuck with the enemy. I Regard the Nation as such.
Undercover Russian spy Seth Rich downloaded to a flash drive. Everybody happy now?
Bruce Hayden
You mention the direct transfer speeds but those would not be preferred by hackers because of the ease of trace. Multiple networks in between makes a hack harder to follow. Is that so?
"22.7 megabytes per second is fast. As I understand the way hackers operate, if they are interested in hiding their activities, it slows transmission"
Which is to say that there almost assuredly wasn't a direct connection between the DNC serve and Russian intelligence -because that would not hide the source of the (alleged) hack. Those enterprise level enterprises have at least semipermanent IP addresses, making backtracking of transactions extremely simple. So, if the Russians had hacked the DNC, they very certainly would have run their hack through one or more anonamyzers, probably including the use of virtual circuits. And, there is very likely no way that they could have gotten anywhere near the required 200+ megabit transfer rate through even one level of anonamyzer, and definitely not through the several that they likely would have used.
"Next up, the SPLC lists The Nation as a hate group."
Thread winner!
I thought the "Russia Hacked!" theory was a bit conspiracy-minded. This transfer rate looks like someone plugged a machine directly into the server and downloaded the files.
I suspect FullMoon was joking, but if it's true that Russian intelligence is behind the breach, then there is the possibility that they turned someone inside the DNC.
Oh, & by the way, a few days ago I checked the DNS records for the DNC, & they've moved from an internal Microsoft Exchange server to using Gmail**.
Now, if you're worried about external hackers, would you move your email onto a company that tells you upfront they mine your data? That is one big target for every hacker on the planet?
But, you know what moving your email to gmail does? It makes it much more difficult for an internal leaker to gather up every account & transport them out on an external storage device.
I think the DNC just told us what they really think happened by what they did with their email services.
** Nslookup listing: (some listings changed to preserve my anonymity)
mail.dnc.org
server: percival.rubbarubba.local
address: 192.168.1.251
n-authoritative answer:
Name: ghs.l.google.com
Addresses: 2607:f8b0:4004:805::2013
172.217.7.147
Aliases: mail.dnc.org
ghs.google.com
Traceroute:
Tracing route to ghs.l.google.com [172.217.7.147]
over a maximum of 30 hops:
1 26 ms 32 ms 32 ms Rubbarubba [2XX.1XX.204.129]
2 81 ms 49 ms 66 ms 2XX.1XX.2XX.61
3 32 ms 32 ms 32 ms irb.32.dr1.eqix.ash.va.atlantech.net [76.76.210.130]
4 31 ms 32 ms 32 ms xe-1-1-0.cr2.eqix.ash.va.atlantech.net [76.76.209.125]
5 31 ms 32 ms 32 ms xe-0-0-1.ber1.eqix.ash.va.atlantech.net [76.76.211.178]
6 31 ms 32 ms 32 ms eqixva-google-gige.google.com [206.126.236.21]
7 31 ms 32 ms 32 ms 108.170.246.1
8 30 ms 49 ms 33 ms 216.239.54.205
9 32 ms 32 ms 32 ms iad30s08-in-f147.1e100.net [172.217.7.147]
Trace complete.
Narayanan Subramanian: We are now down to 2 real news vendors ..the Nation and the National Enquirer . Indeed.
Well, those and the UK Daily Mail, if you want to include the foreign press...
Mike Sylvestor pointed this out here two weeks ago.
It is obvious that it was an insider job.
And Seth rich paid with his llfe.
Like that prosecutor in Florida who shot himself in the head with no gun.
The "Nation" article is not a bit incoherent. Its quite clear.
It alleges three technical points which should be easy enough for an official forensic investigator to evaluate.
If the hacker required physical access to the server, or to a workstation on the same LAN, it should be easy enough to figure out who did have access.
"I think the DNC just told us what they really think happened by what they did with their email services."
Another original thought at Althouse Blog. And an interesting one. Keep them coming.
One wonders what time zone Imran Awan was in at the time.
The "Russian-Collusion" hoax, I mean, story was a ploy concocted by John Brenan (Obama's leftist CIA Director) to blunt the pain of Hillary''s epic loss. These assholes are traitors.
This confirms that the person entering the DNC system was working somewhere on the East Coast of the United States. In theory the operation could have been conducted from Bangor or Miami or anywhere in between—but not Russia, Romania, or anywhere else outside the EDT zone....
So we are to eliminate the possibility that a Russian, located in the Eastern Time Zone (but unlikely from the Russian Embassy because of constant NSA monitoring), downloaded the files from the DNC computer? We now know very little more than we did when we considered the stealing a "hack."
Chuck said...
"The Nation Article About the DNC Hack Is Too Incoherent to Even Debunk"
http://nymag.com/selectall/2017/08/the-nation-article-about-the-dnc-hack-is-incoherent.html
That is just stupid. The Nation Article buries the lead but if you read the article it is crystal clear:
"There was no hack of the Democratic National Committee’s system on July 5 last year—not by the Russians, not by anyone else. Hard science now demonstrates it was a leak—a download executed locally with a memory key or a similarly portable data-storage device. In short, it was an inside job by someone with access to the DNC’s system. This casts serious doubt on the initial “hack,” as alleged, that led to the very consequential publication of a large store of documents on WikiLeaks last summer."
Go cry in your corner Chuck. You and your traitorous friends failed. The coup is over. Get used to saying President Trump. You have 7.5 more years of it.
@David,
Another original thought at Althouse Blog. And an interesting one. Keep them coming.
Communally speaking, us Althouse hillbillies done larnt usselves a thang or two along the way.
gadfly said...
So we are to eliminate the possibility that a Russian, located in the Eastern Time Zone (but unlikely from the Russian Embassy because of constant NSA monitoring), downloaded the files from the DNC computer? We now know very little more than we did when we considered the stealing a "hack."
Yes. We eliminate the story(bald faced lie) the DNC has been pedaling since the election they lost.
Also this makes those 17 err... 4... or whatever number of intel agencies the deep state pulled out of their ass liars. Big. Fat. Liars.
Comey is a liar. Brennan is a liar. Hillary was always a liar. Everyone in the DNC except Seth Rich is a liar. The whole russian collusion story is a lie.
The people who designed this coup attempt based it on a lie. Anyone still running with the Russian Collusion crap is a traitor.
Somebody more cynical than I might start to thing "The IC" (eye roll) is its own power center playing its own game. "Trust us, it was the Russians," they said, without providing a shred of evidence.
It's late and I haven't yet read the whole piece, but the summary is certainly more than weak if the goal is to impeach the Russia connection. First of all, parts of Canada and South America are also in the eastern time zone, so even if that time stamp is meaningful we're certainly not limited to the east coast of the US. People/mercenaries hacking for Russia could be literally anywhere in the world. Four people were charged in the Yahoo hack - two Russian spies, a Russian kid and a Khazak-Canadian in Hamilton, Ontario - which is firmly in the Eastern time zone.
Snark,
The data was transferred at a speed that makes overseas hacking so unlikely as to be impossible. That is why the U.S. East Coast is the only option.
Next up: aliens and Russians did it. Superior Soviet and alien technology made the rates of transmission possible.
The article points out that any remote transmission, outside of the local LAN, is unlikely, even in the US and even in the same city, even if theoretically possible.
The apparent facts best fit a copy to a locally attached USB device.
buwaya:
My alien theory fits all the known facts too. But my theory is provided completely tongue in cheek.
Look for Leftists and LLRs to forward similarly ludicrous explanations with a hint of seriousness.
@Snark,
And there's an anonymizer server located in the eastern time zone that the hackers could use? Or, did they just leave behind a trail of IP addresses to be used to track them down?
Even between servers in the same time zone such data transfer rates would be almost impossible to attain. Too many hops, too much overhead. Look at my traceroute example at 10:07 above. I'm in ET & tracing a route to Google server, & look at all the hops.
Birkel asked...
22.7 megabytes per second is fast. As I understand the way hackers operate, if they are interested in hiding their activities, it slows transmission speeds.
Can anybody confirm that?
Yes. Hackers do not connect to servers directly from their own machines, but will always hop across a number of previously compromised intermediary hosts. If they connected directly, their IP address would show up in some server or firewall logs and they would be compromised. These hops decrease download speed in two ways:
1. Maximum bandwidth is reduced to the slowest upload or download link speed of any of those hosts. The intermediary hosts hackers use are usually old unpatched servers, often ancient by current technology standards, and unlikely to be directly on any IP (Internet Protocol) backbone, thus much slower than local area network (LAN) speeds.
2. Each hop imposes a latency, and, because of the technical nature of file transfer, will significantly slows down any transfer rates further.
(For example, if anyone has ever used or heard of TOR, the anonymizing technology that Silk Road used, it uses a minimum of three intermediary hops to avoid exposing one side of a connection to the other.)
This particular "hack" has always smelled funny to anyone with the technical know-how. Hard to tell if it is stupidity or maleficence, however. Hard to imagine that the FBI would normally ever accept conclusions provided by a normal private party as truth like this, however.
"The data was transferred at a speed that makes overseas hacking so unlikely as to be impossible. That is why the U.S. East Coast is the only option."
This makes no sense. We have LAN speeds, and we have internet speeds.
It's bytes. Not even KB or mb. Don't be silly.
Podesta could transmit as much data by waving his underwear outside his bedroom window.
Snark,
Your willful blindness is endearing. Hit snooze one more time.
I should clarify on the stupidity or malificence part: The FBI should have never allowed the DNC to wipe the server, its logs, etc., without a full forensic analysis. Unless a hack compromises the administrative or root account, there are a number of fingerprints that get left behind in logs, etc. (Even with root/administrative access, it's hard to fully wipe evidence of a breach, unless a very long time passes between the breach and its discovery. At least without raising errors all over the place.)
Unfortunately, any direct evidence that might lead us to the truth was destroyed when that happened. As a result, we have little but guesswork to go on.
@Rigelsen,
The FBI should have never allowed the DNC to wipe the server, its logs, etc., without a full forensic analysis
Prevent the DNC from wiping their server on what grounds? It's private property. The DNC is not a federal government agency, & unless the DNC wishes to make their server available, they are under no legal mandate to assist in the investigation. Essentially, it's like the DNC decided not to press charges, so as to speak.
I think the DNC made a stupid move in not turning over their server to the FBI (there might have been things they didn't want them to see..), but stupidity isn't illegal.
"Your willful blindness is endearing. Hit snooze one more time."
What are you even talking about. I don't even know what the report says beyond the posted summary, so it's pretty hard to be blind to something I haven't seen.
Precious!
Best to read the report then, before commenting.
Its quite clear. I only know enough networking to be dangerous (hey, we HAVE networks and networked systems) but anybody in a technical profession these days has to know enough to understand it.
Snark said...
"Your willful blindness is endearing. Hit snooze one more time."
What are you even talking about. I don't even know what the report says beyond the posted summary, so it's pretty hard to be blind to something I haven't seen.
---------------
Preserved in all its self-refuting glory.
The same article was published also on Consortium News on August 10.
https://consortiumnews.com/2017/08/10/new-cracks-in-russia-gate-foundation/
Some corrections:
What are you even talking about. (sic) I don't even know what the report says beyond the posted summary, so it's pretty hard to be blind to something I haven't seen (and won't see and will avoid seeing no matter how dispositive an alternate explanation might be when it challenges my pre-conceived notions. Also, you are a doody head for saying I am willfully ignorant just because I will not read information at the hyperlink. It is my choice to remain ignorant and my choice is not willful. Because REASONS!!!!!!!!!!)
"Prevent the DNC from wiping their server on what grounds? It's private property."
Perhaps you should ask Manafort about that. Surely the FBI can seize private property as evidence in a criminal investigation. Of course that presumes the FBI was actually interested in determining what happened, as opposed to promoting the "Russia!!!" nonsense, which they likely knew would not hold up under actual scrutiny.
@James,
Surely the FBI can seize private property as evidence in a criminal investigation.
There was no criminal investigation opened at the time. Manafort's search was part of an open federal investigation, involving matters of national security.
The DNC is a private organization. Its servers, by definition, have nothing on them of national security importance. No one knows if it was Russian intelligence or just some private schmuck at the beginning. And once CrowdStrike is given the server, it's forensically useless in court.
It's basically like me hacking into a bank's systems. If the bank declines to press charges or refuses to assist law enforcement in the investigation, that's it. It goes no further.
Snark said...
What are you even talking about. I don't even know what the report says beyond the posted summary, so it's pretty hard to be blind to something I haven't seen.
I will summarize for you.
The DNC lied about being hacked.
The Russian collusion story has been a known lie from the start.
The DNC, the 17 or 4 or whatever intelligence agencies, the obama administration, the clinton campaign, James Comey, Fusion GPS, and most of the MSM are Big. Fat. Liars.
Traitors who attempted to pull off a coup and failed is actually more accurate.
"Best to read the report then, before commenting.
Its quite clear. I only know enough networking to be dangerous (hey, we HAVE networks and networked systems) but anybody in a technical profession these days has to know enough to understand it."
I will, I'm just super tired right now and beyond the sort of focus that would be neceassary. That summary as posted is weak though, that is a fact. I do find it interesting that the original Guccifer has opined that Guccifer 2.0 is an entity of the US government. It's all possible of course. We've seen glimpses in the past of what is done in secret through and by empowered agencies. Either way, it's one more mirror in the already crowded hall, and soon enough it's possible that few will feel truth on any matter is knowable. I do believe that if there is something to this it will show up in the NYT etc. Not because it requires that to be valid, but because the story would be too fascinating to pass up.
YoungHegelian said...
There was no criminal investigation opened at the time. Manafort's search was part of an open federal investigation, involving matters of national security.
Actually since the reason for the Special Counsel is bullshit that would make the raid on Manafort the result of a lie. An early morning No Knock Raid.
I was a part of many a No Knock Raid. They are no joke and there really is no reason outside of a hostage situation they should be used domestically.
"What are you even talking about. (sic) I don't even know what the report says beyond the posted summary, so it's pretty hard to be blind to something I haven't seen (and won't see and will avoid seeing no matter how dispositive an alternate explanation might be when it challenges my pre-conceived notions. Also, you are a doody head for saying I am willfully ignorant just because I will not read information at the hyperlink. It is my choice to remain ignorant and my choice is not willful. Because REASONS!!!!!!!!!!)"
You sure did wring a lot out of me musing that EST is not limited to the US east coast and that hackers for hire can work from anywhere..
Even without the technical details, the overwhelmingly simplest explanation was that the e-mails were an internal leak. The technical details simply make it almost beyond reasonable doubt at this point.
I have the New Improved Occam's Razor. It has five blades and a strip of aloe vera.
I am Laslo.
And remember- this lie was buttressed by the IC under Obama at a time when it was still believed that Trump's election could be stopped by the Electoral College. If you go over the evidence that has made it to the public realm, literally none of it supports the idea that the DNC e-mails came from an overseas hack- literally not a single verifiable fact has been published supporting the Russian hack story- literally all of is of the form "anonymous sources claim".
Let's be blunt - there was no outside hack, because if there had been, the DNC would have turned over it's server and records to the FBI. They didn't.
Some disgruntled Bernie-Bro copies a bunch of stuff to a USB drive and gave it to Assange.
Director Brennan or some other Dem shill decided to make lemonade out of lemons by turing their embarrassing data leak into an attack by those dastardly "Trump connected Russkies".
unless the DNC wishes to make their server available, they are under no legal mandate to assist in the investigation. Essentially, it's like the DNC decided not to press charges, so as to speak.
Funny, I thought evidence of a crime may be seized from anyone and held even though it is rightfully his and was not used illegally, much as a material witness may be arrested for the purpose of offering testimony even though he has committed no crime.
That there was no criminal investigation was a choice of the FBI.
One thing I haven't seen is that the DNC claiming their email was hacked makes Hillary's private server look even worse.
Russian hackers are the new "Bushy-Haired Stranger."
I am Laslo.
@Earnest Prole,
The DNC became fully aware that they had been hacked when they let their server be forensically analyzed by CrowdStrike. The analysis by CrowdStrike destroyed any chance of law enforcement of any sort claiming unbroken custody of evidence.
No evidence, no possible charges, thus no investigation.
Am I the only one here who remembers Trump being mocked for saying the election wasn't hacked?
Once again, Trump is right and the rest of the MSM are fools.
Funny how no one is challenging the veracity of the emails. It's almost as the crime is exposing the Democrats as criminals.
DWS did it to prove that her successor would be an even bigger idiot than she was.
Everyone is lying here, with purposes that are unrevealed.
"Despite saying that, the New York Magazine article does attempt to debunk it, by saying that you can too copy data across the Internet that fast."
They may be trying to say that, but what they actually are saying is that both the DNC and Russian intelligence very likely have enterprise level access to the Internet, which operates at significantly higher speeds. And then assumes (IMHO naively) that that means that someone could have copied the DNC emails to Russian intelligence at that speed. But that ignores that Internet traffic doesn't travel as if there were wires, or even Ethernet, between the two locations. It travels in hops, with the hopping being a little random in places. Every hop costs a little in time, and typically, the further away you are, the more hops. And here, the two locations are 1/3 or so around the world from each other, separated by an ocean.
Another problem with that assumption is the assumption that just because the DNC theoretically had enterprise level access to the Internet, that this means that it could support this level of hacking. The problem here is that there are really multiple components to bandwidth. Sure, there is raw bandwidth between an organization and their ISP (etc). But that is not really relevant, except as a gross limit. But that is the aggregate over multiple sessions multiplexed to/from over that link to their ISP. Think of it this way, for 200mbs, you can have 10 sessions at 20mbs, 100 sessions at 2mbs, or one session at 200mbs. Etc. Except that you typically can't have the latter, because bandwidth rates typically assume multiple sessions running simultaneously multiplexed over low level links. Which is usually fine, because what you usually want are the multiple sessions running in parallel. When you are downloading pages over the Internet, modern web browsers typically are downloading different parts of a page in parallel. More to the point here, email servers are designed to transmit email to multiple users at the same time. Hundreds, if not thousands (hundreds of thousands or more for big servers like Gmail) at the same time. And keep in mind here that for the most part, you get throughput in the case of email servers by just that - having a lot of sessions operating at the same time. Part of this is because Internet traffic is automatically throttled at various levels. Think of it this way - you have a window of X messages or bytes, which means that you can transmit X before getting an acknowledgment. Let's assume we are counting messages. Maybe X is 5, so you send 5 (1-5) and then wait for an acknowledgment. You get an ack for msgs 1&2, which lets you send two more (6&7). Another ack of 2 (3&4) lets you send 2.more (8&9). Some of this is node to node, hop to hop, but some is end to end. Cited bandwidth is between a computer or modem and their ISP, and not end to end, and assumes multiple sessions multiplexed over lower level connections. Which is why it is much harder to get one session at 200mbs than 100@2mbs.
Now the complexity of hacking added to my previous point. As I pointed out above, email servers are typically designed to support large numbers of simultaneous sessions between them and other email servers or end users, all multiplexed over high speed, lower level links. The enterprise level bandwidtha refers to the speed over those lower level links, and not end-to-end, which is, by necessity, much lower. This is fine, because single email messages typically don't use up a lot of bandwidth. We are typically talking several hundred bytes, probably less than a thousand, even including headers, over low level links running at millions of bytes per second. Email technology hasn't really advanced all that far since the first email programs were running over ARPAnet between IMPs, before TCP/IP had been ported to run over Ethernet. It mostly consists of the text you see, maybe a little HTML for formatting, and the headers, mostly in plain ASCII text.
To get decent throughput out of an email server, you need a lot of parallelism. But that gets difficult when you are hacking because you need multiple sessions, but having a bunch of Admin signons at the same time is highly suspicious- probably even to the DNC. Esp when they all try to upload large amounts of data at the same time. You can maybe hide one such at a time. Not 10, or more likely 100. And you need the throughput of a large number of simultaneous sessions to get the 200+ mbs required for the time stamps found in the metadata.
I can see that it will be probably impossible to get any comment thread on this off the technical speed questions, and I doubt that debate will never be resolved to a point where a non-expert can confidently feel that there is a consensus.
But I am intrigued by this issue raised near the end of the article.
"It does not require too much thought to read into this sequence. With his June 12 announcement, Assange effectively put the DNC on notice that it had a little time, probably not much, to act preemptively against the imminent publication of damaging documents. Did the DNC quickly conjure Guccifer from thin air to create a cyber-saboteur whose fingers point to Russia? There is no evidence of this one way or the other, but emphatically it is legitimate to pose the question in the context of the VIPS chronology. WikiLeaks began publishing on July 22. By that time, the case alleging Russian interference in the 2016 elections process was taking firm root. In short order Assange would be written down as a “Russian agent.”"
So (if I'm understanding this):
1. Assange announces that he has some damaging emails from DNC (and perhaps he doesn't really have any such emails -- I think there was another Assange threat that failed to pan out) or perhaps Assange or one of his non-Russian associates actually did hack the DNC).
2. Someone in the DNC or Clinton campaign thinks: "We could turn this to our advantage, by leaking it (what is "it"? leaking some fairly exhaustive set of DNC emails perhaps) ourselves, after first wrapping it up in a Russian cover, so that computer experts who look at the emails will "discover" that they came from Russian sources. Then we could raise a ruckus about how the Russians are interfering in our election, and the GOP (was Trump the candidate by this time?) is the party the Russians favor."
3. And I will reiterate that the articles author admits there is no evidence for this, only that this explanation is consistent with the facts as we know them. And it certainly is true that Democrats and their allies have been pushing this Russia interfered story mightily.
So heartening to see some information based on forensics to come out, finally. Thank you, Bruce Hayden, for the basics on data transfers.
I, too, am curious as to the DNC cover up and possible complicity in all of this. Also curious still about the flow of the Podesta emails from the phishing exercise.
Come on people! 17 US intelligence agencies have confirmed the Russian narrative.
What are these people who say otherwise - anti-intelligence?
Honestly, the idea of someone walking in, sticking in a flashdrive and walking out with the data makes a lot more sense than the Russians hacking them and releasing the data. The Russians gained nothing by the release of the data, except losing the left, who have been reliably neutral to allies of the more authoritarian/communist Russian old guard for decades.
Even if the Russians *got* the data, it doesn't make sense to ruin their relationship with the Democrats so fantastically.
The first catechism question asked by every Media Prpopagandist about the Great Russian Crime is," You do agree that the Russians meddled in our elections, don't you." And there is only one answer to that question permitted. You could say that inquiring minds are forbidden.
But this thumb drive transfer by Seth Rich being an inside job has been known for more than a year. Why else arrange the obvious hit on Seth designed to send the Deep State's message to traitors.
As to whether the DNC had the right to not hand over the servers or not.
They may indeed have that right. But, much like if I claim an assault happened on my person, but refuse to allow doctors or police to review my injuries, and instead, release the report of a hired gun investigator, who later materially changes their statement, walking back the claim significantly, you would be right in wondering why I did not cooperate with the investigation.
In addition, let's say it *was* a foreign government hack.
Why would you NOT give that to the FBI? Rubio's office was apparently the target of a hack, and provided the data, as was the RNC. So... why doesn't the DNC want the FBI to have had a chance to figure out what really happened?
It doesn't add up; I don't like it.
traditionalguy said...
But this thumb drive transfer by Seth Rich being an inside job has been known for more than a year. Why else arrange the obvious hit on Seth designed to send the Deep State's message to traitors.
So much crazy compacted into so few words. Well done.
@YH ...
In your example - what about bank customers who could be injured? Can they seek law enforcement to act?
"We've traced the hacks. The hacks are coming from inside the party."
With Carol Kane as Debbie Wasserman Shultz.
Occam's Razor: if it's highly unlikely that the data could be transferred at those rates externally over an Internet connection, the most likely scenario is that it was transferred over a direct internal connection.
MICHAEL BRENDAN DOUGHERTY said ...
Just as Spencer took Trump’s “I disavow” without a direct object to be a kind of wink in his direction, surely he’ll take today’s statement about “all sides” as another form of non-condemnation. With his performance today, Trump confirms the worst that has been said about him. He’s done damage to the peace of his country. What a revolting day in America.
ARM:
Your 9:34 PM above was wrong. Others responded. Care to correct the record?
No. There is no consensus in the real world, or even here for that matter. And you are a moron.
Random internet person said an anti-Trump thing. Who could believe it?
And ARM, dog that he is, heard the whistle.
I don't know why I'd listen to Dougherty, especially if he's close enough to Spencer to know what he thinks.
No evidence, no possible charges, thus no investigation.
I think you have that inverted. The usual sequence is investigate, gather all evidence, eliminate evidence that doesn't have a chain of custody, and place charges if the remaining evidence suffices. And just because some evidence lacks a chain of custody doesn't mean you can't use it in the investigation, only at trial.
Thanks AReasonableman. Compacting helps the transfer rate.
traditionalguy said...
Thanks
No problem. The work of a superior craftsman should always be acknowledged.
Shows how massive the conspiracy is. There's absolutely no evidence for it. Call me Louise Mensch.
Q: can you compact while hacking and transferring at the same time?
Is such software/virus available?
Won't the compacting process lengthen hack duration?
More likely to compact on site and transfer to external media also on site.
If not a hacker, compact process could be run during regular business process - archiving emails for example.
A number of people believe that if it is true that there was not a Russian hack, that it then follows that the whole Mueller investigation is illegitimate and therefore that investigation should be halted.
Can we get our legal commenters to chime in on this?
I recall the Fitzmas investigation which started as an investigation to see if a crime was committed by Scooter Libby or Karl Rove -- that crime being the illegal public unmasking of a CIA agent. And, in retrospect we know that the leaker was Richard Armitage, and that Prosecuter Fitzgerald knew that from almost the start of his investigation. But the investigation went on for a long time and ended with an indictment and conviction of Scooter LIbby, not for identifying an agent, but for perjury.
So based on this, I conclude that the Mueller investigation can go on even if it is proven that the initiating allegations are false.
traditionalguy said...
But this thumb drive transfer by Seth Rich being an inside job has been known for more than a year. Why else arrange the obvious hit on Seth designed to send the Deep State's message to traitors.
AReasonableMan said...
So much crazy compacted into so few words. Well done.
Call it a tarball.
What meaning 'fishing expedition"
For compliments?
For information?
For feet to fit 'cement boots'
What is your pick?
FBI gets points/future budget for cement boots.
Congress critters pretend the second.
Media dole out the first.
If it was Russians, they could fake the transfer speeds. Or copy it to another place on the network and then move it.
USB is probably what happened.
@Narayanan Subramanian --
On the evening of July 5, 2016, 1,976 megabytes of data were downloaded from the DNC’s server. The operation took 87 seconds. This yields a transfer rate of 22.7 megabytes per second.
The metadata analysis compared quantity to time. It doesn't matter whether the data was compacted or not. A certain amount of data was transferred at a certain time. What that data was -- a zip file / an email archive / a million individual files -- is a separate question.
This does not say that the DNC was not hacked by "the Russians" and others of the usual suspects - only that the version released by Wikileaks did not come from a hack.
For what it's worth, the Forensicator analysis has this to say about file types:
The .rar files and plain files that eventually end up in the “NGP VAN” 7zip file disclosed by Guccifer 2.0 on 9/13/2016 were likely first copied to a USB flash drive, which served as the source data for the final 7zip file. There is no information to determine when or where the final 7zip file was built.
Henry said...
Call it a tarball.
:)
I've had a chance to read the whole report and better understand the allegations. They appear to be entirely based on July 5 time stamps, from which the analyst draws various conclusions about transfer speeds and location. This is not particularly sophisticated metadata. If I understand the arguments correctly, the entire pattern he relies on can be explained by a hacker copying his original data to a local source on July 5. Given that the Assange statements came out in June, it is certainly possible and perhaps even likely that the July 5, 2016 timestamps reflected subsequent file operations, and not the original hacking date. In addition, the EST settings he relies on are easily manually set by anybody regardless of where they actually are. Overall, this seems to be pretty thin gruel.
No, Snark. It was outer space aliens.I
Occam's hairbrush.
Razor's airbrush.
As I said, a moron.
@Snark -- If you're interested, there's a lot of back-and-forth commentary on the technical findings on Forensicator's web site.
I admit, despite a decent high-level understanding of the technology, that most of this is beyond me.
@henry ... All we have then is data transfer analysis for the zip files which are obviously compacted and bundled. This transfer event is totally independent from what may have transpired at DNCs computer set up. Only that the source data was on USB drive to initiate the transfer.
Q? Could the USB files have been built-up after a slow speed hack over the Internet?
ARM:
You say Russians with nearly no substantial evidence. This report indicates it is unlikely that the Russians could have transferred the files in the timeframe available.
My alien explanation is as likely as yours. No evidence and impossible to disprove.
Occam's Razor suggests an internal download from within the DNC. You don't want a close shave. Fine.
"The Russians gained nothing by the release of the data, except losing the left, who have been reliably neutral to allies of the more authoritarian/communist Russian old guard for decades."
While this may have been true in the past, the Russian government and the allies of the DNC have been at loggerheads since fairly early in the Obama administration, as far as I can tell. Supporting the Ukraine coup pissed the Russians off mightily.
"the entire pattern he relies on can be explained by a hacker copying his original data to a local source"
Isn't that the whole point? Copy to USB stick vs. copy across the Internet.
Snark said at 8:48AM...
Agree. Based on how hackers work, it would not be surprising that they would manipulate time stamps and other file meta-data quite readily. Quite obviously the content of the files can be made up, too.
I'm still mystified by the fact that there's no contention of the content of the documents (perhaps there was but it's been lost in the noise). As if the evidence of a crime isn't important, just the method of obtaining said evidence.
Honestly, I keep going back to the official statement: there's no hard evidence of who obtained the data but the what information is available demonstrates a pattern attributable to the Russians.
Let's flip things around then - what is the actual evidence that the DNC server was actually hacked, and not leaked? As far as I can tell, it is that there were Russian "fingerprints" in the metadata after the emails were released. And that the DNC contractor Cloudstrike stated that it was an outside job. The exact same metadata that has those time stamps. DNC contractor Cludstrike is the only party to have seen the actual logs, or the raw server data, and no doubt, that information has very likely not been available for much of the last year (with normal retention policies).
If the facts here had been reversed, a big thing would have been made of Cloudstrike's obvious biases, being essentially an agent here if the DNC, whose members have used the supposed Russian hack heavily for the last year to damage their opponents (the Republicans), Trump, and his Administration. Do the Democrats have an incentive to lie here? Of course they do. With that - did/does Cloudstrike? I think likely, given their relationship. Note - I am not claiming right here that they did lie, but merely that they had an incentive to do so.
Which leads to the question about the IC evaluation, led apparently by the CIA, that looked at that metadata and said "the Russians did it". The highly politicized CIA that has been shown (by Wikileaks) to use hacking tools that leave those exact same Russian fingerprints. The Wikileaks dump of the CIA hacking tools was almost assuredly in response to the CIA's claim that the Russians did it because of the Russian signatures. Etc. They apparently routinely hid their own hacking by pretending that the Russians did it, then turned around and claimed that the very same type of signatures that they routinely faked proved that it was the Russians.
Keep that in mind - the entirety, as far as we know, of the hard evidence used by the intelligence community (led by the CIA) to determine that the Russians hacked the DNC is the metadata released with the email by Wikileaks. We have heard of nothing more. Nothing in over a year. Just analysis of the metadata. (And then a Wikileaks dump shortly thereafter that showed that the exact same CIA could just as easily have been the hacker).
With regard to Hillary!'s "missing" e-mails, I have twice heard Mike Morell, former assistant director and acting director of the CIA, state on national TV news that her operation was so sloppy that he assumed "every competent intelligence service" in the world had hacked her server and copied it all, and General Hayden of the NSA when asked about this agreed that that was probably so.
(This would presumably include the "17 national intelligence agencies" of the United States, no?)
Almost every nation in the world - friend, foe, or in between - is strongly affected by developments in the United States and will do their best to try to keep up with whatever those crazy Americans may do next.
Thank you for that link Henry. The analyst himself acknowledges both points I made:
"Some reviewers have noted that the July 5, 2016 dates present in the metadata overwrote any previously recorded dates/times, which of course is true. They further note that prior intermediate copy operations may have been performed, which is also true. Some have opined that if Guccifer 2 pulled data from his previously claimed hack and simply copied that data to say his local hard drive on July 5, 2016 that the pattern present in the metadata might result; also true.
We should also keep in mind that the study concludes that Eastern time zone settings were in force on both the first (initial) and second copy operations. Some reviewers have noted that Guccifer 2 could have manually set his timezone to Eastern time – also true."
Many other great points made there by people challenging the basis for the conclusions, but I think this one is the simplest to grasp for the average person. The report assumes that the July 5th date represents the date of the hack rather than a random date on which somebody with possession of the files simply copied them somewhere else (to a USB stick, hard drive etc.) Everything points to the hack happening prior to June 2016 when reports first appeared, so Occam's razor suggests that the July 5 operations just reflected local moving around of files that were acquired at an earlier time.
I conclude that the Mueller investigation can go on even if it is proven that the initiating allegations are false.
Oh, it will go on and on until Mueller gets one scalp, probably from a perjury trap, and then says he was right all the time and the money and effort was worth it.
Fitzgerald is the model.
I see that Forensicator concedes my Q.
They are dubbing themselves as top NSA analysts (ex).
Thin gruel indeed. Nerdy but ineffectual for real life issues. Or devious and obfuscating. Seems to be the pattern for our intelligence community and Congress critters.
What a wonderful country.
Isn't there other materials to analyze? Other than Guccifer 2.0
I also found it interesting that the analysis turned up evidence of the files being moved though both Linux and Windows-typical file systems. That is certainly consistent with what you would expect in a hacking situation where the hacker originally breached the DNC server over the internet (using Linux tools) and then later copied to a local device, such as a USB.
Snark thinks we don't now.
Snark thinks it was Russians.
Circle. Square. Some assembly required.
Willful ignorance.
So know-it-all ARM - who did kill Seth Rich?
and why?
The easiest check on the date and time is the contents - when was the latest email in the data?
It should be easy to pin down just when the data was taken.
We want an answer, know-it-all ARM.
Why no answers in the Seth Rich case? Why no media interest in the case at all?
Rich worked for the DNC and he wasn't robbed of any valuables. Why was he murdered?
ARM - would you cover for the Democrats or the Clintons if you knew they killed Seth Rich?
My guess - since you are a loyal democrat progressive, you would.
The bottom line is that there is literally nothing in the metadata or theories he presents that proves that the files came directly from DNC servers on July 5. They could have been acquired at any date before that and simply copied on July 5, and that is incredibly important when one weighs the soundness of these conclusions.
So then, Snark, with no evidence presented it must be the Russians, right?
Earn your handle.
stlcdr said...
Snark said at 8:48AM...
Agree. Based on how hackers work, it would not be surprising that they would manipulate time stamps and other file meta-data quite readily. Quite obviously the content of the files can be made up, too.
As can all the "Russian fingerprints" evidence. You do understand that, right?
The fact that DNC spurned the FBI and then destroyed the evidence, demonstates quite clearly that the DNC has no interest in "discovering the truth."
I don't know who it was Birkel. I do know that it seems to be a strange leap to assume that July 5 was the date of the hack and that those files are the original transfer from DNC servers. As far as I can tell that is literally baseless.
This is how WaPo recently summarized the public evidence.
This is how WaPo recently summarized the public evidence.
You are welcome.
Don't know = Democrat party operatives must be right about the Russians
Snark remains willfully ignorant.
Speaking of timestamps and willful ignorance...
You can see it from where you are. Turn around. The willfulness is the problem, not the ignorance.
Forget which side you support and admit the Russia angle has no support. Dare.
Did Seth Riche's laptop run Linux?
I guess we'll never know.
But that ignores that Internet traffic doesn't travel as if there were wires
I think you mean "a series of tubes".
Very old school, Mary Beth. You earn points, LOL.
:-)
New York Magazine's readership is women. The assumption behind offering the imprecise "debunking" is that women have little interest in technology. Dissent is mansplainin'.
Gut feeling Mueler will ignore the hacking angle.
And the investigation will stop once Comey is exonerated.
I wish it was different, sigh.
Be nice to have a real investigation of the hacking.
"New York Magazine's readership is women."
The Nation Article About the DNC Hack Is Sooo Incoherent We Can't Even.
Wait I thought that DNC staffer was killed by a random mugging gone bad or something.
Can the media make up it's mind?
I was getting Mark Rich and Seth Rich confused in my mind just now because that last name just so happened to be connected to the Clintons, one going back to when Bill was president and the other one more recent from the time Hillary was attempting to become president...
That was a mouthfull.
As per Wikileaks the last emails they released from the DNC are from May 25. If the mail database was copied on May 25th anything could have been done with the file subsequently.
So nobody has investigated the Seth Rich murder beyond calling it a robbery where nothing was taken, even though there was valuable stuff on Rich to take, and nobody was allowed to look at the DNC computers, but the Democrats and their sock puppets in the press have firmly averred that there is nothing to see here. Circulez!
I don't know what happened, but I know that there seems to be zero official interest in finding out either, and zero cooperation from the DNC. It is not surprising that 'conspiracy theories' are popping up.
If you want the honest lowdown on anything political, the WaPo is the unbiased source.
Following things down a bit, one of the interesting things that I ran into is that the Russian hacking meme seems to have come mostly from Guccifer 2.0, who claimed to be Romanian or Russian, but very likely is not. Rather, he is very likely American. Some have wondered if he worked for Cloudstrike, and that the whole purpose of his claim of being the Wikileaks hacker was to discredit the Wikileaks dump of DNC emails. His use of definite articles and prepositions appears to be that of a Native English speaker who occasionally mangles things in an Eastern European/Slavic language/Russian way roughly 96% correct and 4% mangled for definite articles.
Interestingly, some of the Russian "evidence" seems to come from a Word document turned into a template that seems to have come from Joe Biden's office in the White House (Warren Flood, Biden's technical director at one time, is listed as the original author ("Created By") in the metadata). It appears that multiple other documents were pasted into this template, before being saved as .Doc files. "Last Updated" was set to someone with a Cryllic name (hence, the Russian connection).
Notably, Julian Assange, who runs Wikileaks has denied from the first, both that Guccifer 2.0 provided the documents to Wikileaks, and that they were hacked, and not leaked. He has claimed, almost from the first, that the Wikileaks dump was an inside job. Which gets to the obvious question of who Guccifer 2.0 really is, whether he has any connection to the DNC (such as through Cloudstrike), Crooked Hillary, et al., what were his motives, etc.
All of these people
are Dirty. Dirty. Dirty.
We need a congaline
of show trials, we are So overdue.
Start with Lois Lerner,
Lotsa ladies on the list. Susan Rice, unmasker Samantha Power, tarmac'd Loretta Lynch
And who ordered the murder of Seth Rich? Whoever she is, her, too.
Chop their hair off, March them to the edge of town, and throw them in a ditch. No fat pensions for you, bitches.
<<(A girl can dream, can't she?)>>
Somewhere out there there is a flowchart a mile wide and ten deep. This whole thing stinks to high heaven. There is something very deep and very rotten in the DC power structure. It is going to take a long time to root it out, or a lot of dead bodies to cover it up. I don't think even a world champion cynic/paranoid/conspiracy theorist could imagine the depth of this. Even the Clintons (crooks par excellance) aren't at the bottom of this.
Well if Mueller does try to pull a Fitzmas and take down a scapegoat ala Scooter Libby I am pretty certain Trump will kick him him the balls right off and pledge to pardon anyone who is not involved with the original scurrilous charge of Russian "collusion". Mueller and the entire DNC, MSM nexus are going to have to deliver the goods. After throwing chum in the water for close to a year they can't reel in a minnow for their efforts.
Funny note on that article: Starts out by dinging the US intelligence community for relying too heavily on anonymity, goes on to cite analysis by "Forensicator" and "Adam Carter", who are not named and the latter of which's name is based on a British TV show. I guess anonymity's really going around, isn't it?
Post a Comment