US Intelligence Veterans Believe Russian Hack Inside Job

[seemslikeadream]

This can be true and so can the fact that trump is owned by the Russian mobs

Both can be true at the same time and I would definitely want the truth about this to come out just as I want the truth about who trump is

My focus has always been on trump and his connections to the Russian mobs, not the hacks ...so here it is and again this does not relieve trump of his criminality

I definitely want to know who the insiders were

Why isn't trump all over this ..why isn't he shouting this from the mountain top?

U.S. Intelligence Veterans Believe the ‘Russian Hack’ of DNC Computers May Have Been an Inside Job

Posted on Jul 24, 2017

By VIPS / Consortiumnews



Forensic analysis of metadata from the “Guccifer 2.0” July 5, 2016, intrusion into the Democratic National Committee server. (The Forensicator)

MEMORANDUM FOR: The President

FROM: Veteran Intelligence Professionals for Sanity (VIPS)

SUBJECT: Was the “Russian Hack” an Inside Job?

Executive Summary
Forensic studies of “Russian hacking” into Democratic National Committee computers last year reveal that on July 5, 2016, data was leaked (not hacked) by a person with physical access to DNC computers, and then doctored to incriminate Russia.

After examining metadata from the “Guccifer 2.0” July 5, 2016, intrusion into the DNC server, independent cyber investigators have concluded that an insider copied DNC data onto an external storage device, and that “telltale signs” implicating Russia were then inserted.

Key among the findings of the independent forensic investigations is the conclusion that the DNC data was copied onto a storage device at a speed that far exceeds an Internet capability for a remote hack. Of equal importance, the forensics show that the copying and doctoring were performed on the East Coast of the U.S. Thus far, mainstream media have ignored the findings of these independent studies [see here and here].

Independent analyst Skip Folden, a retired IBM Program Manager for Information Technology U.S., who examined the recent forensic findings, is a co-author of this Memorandum. He has drafted a more detailed technical report titled “Cyber-Forensic Investigation of ‘Russian Hack’ and Missing Intelligence Community Disclaimers,” and sent it to the offices of the Special Counsel and the Attorney General. VIPS member William Binney, a former Technical Director at the National Security Agency, and other senior NSA “alumni” in VIPS attest to the professionalism of the independent forensic findings.

The recent forensic studies fill in a critical gap. Why the FBI neglected to perform any independent forensics on the original “Guccifer 2.0” material remains a mystery—as does the lack of any sign that the “hand-picked analysts” from the FBI, CIA, and NSA, who wrote the “Intelligence Community Assessment” dated January 6, 2017, gave any attention to forensics.

NOTE: There has been so much conflation of charges about hacking that we wish to make very clear the primary focus of this Memorandum. We focus specifically on the July 5, 2016, alleged Guccifer 2.0 “hack” of the DNC server. In earlier VIPS memoranda, we addressed the lack of any evidence connecting the Guccifer 2.0 alleged hacks and WikiLeaks, and we asked President Obama specifically to disclose any evidence that WikiLeaks received DNC data from the Russians [see here and here].

Addressing this point at his last press conference (January 18), he described “the conclusions of the intelligence community” as “not conclusive,” even though the Intelligence Community Assessment of January 6 expressed “high confidence” that Russian intelligence “relayed material it acquired from the DNC … to WikiLeaks.”

Obama’s admission came as no surprise to us. It has long been clear to us that the reason the U.S. government lacks conclusive evidence of a transfer of a “Russian hack” to WikiLeaks is because there was no such transfer. Based mostly on the cumulatively unique technical experience of our ex-NSA colleagues, we have been saying for almost a year that the DNC data reached WikiLeaks via a copy/leak by a DNC insider (but almost certainly not the same person who copied DNC data on July 5, 2016).

From the information available, we conclude that the same inside-DNC, copy/leak process was used at two different times, by two different entities, for two distinctly different purposes:

-(1) an inside leak to WikiLeaks before Julian Assange announced on June 12, 2016, that he had DNC documents and planned to publish them (which he did on July 22)—the presumed objective being to expose strong DNC bias toward the Clinton candidacy; and

-(2) a separate leak on July 5, 2016, to pre-emptively taint anything WikiLeaks might later publish by “showing” it came from a “Russian hack.”

* * *

Mr. President:

This is our first VIPS Memorandum for you, but we have a history of letting U.S. Presidents know when we think our former intelligence colleagues have gotten something important wrong, and why. For example, our first such memorandum, a same-day commentary for President George W. Bush on Colin Powell’s U.N. speech on March 5, 2003, warned that the “unintended consequences were likely to be catastrophic,” should the U.S. attack Iraq and “justfy” the war on intelligence that we retired intelligence officers could readily see as fraudulent and driven by a war agenda.

The January 6 “Intelligence Community Assessment” by “hand-picked” analysts from the FBI, CIA, and NSA seems to fit into the same agenda-driven category. It is largely based on an “assessment,” not supported by any apparent evidence, that a shadowy entity with the moniker “Guccifer 2.0” hacked the DNC on behalf of Russian intelligence and gave DNC emails to WikiLeaks.

The recent forensic findings mentioned above have put a huge dent in that assessment and cast serious doubt on the underpinnings of the extraordinarily successful campaign to blame the Russian government for hacking. The pundits and politicians who have led the charge against Russian “meddling” in the U.S. election can be expected to try to cast doubt on the forensic findings, if they ever do bubble up into the mainstream media. But the principles of physics don’t lie; and the technical limitations of today’s Internet are widely understood. We are prepared to answer any substantive challenges on their merits.

You may wish to ask CIA Director Mike Pompeo what he knows about this. Our own lengthy intelligence community experience suggests that it is possible that neither former CIA Director John Brennan, nor the cyber-warriors who worked for him, have been completely candid with their new director regarding how this all went down.

Copied, Not Hacked

As indicated above, the independent forensic work just completed focused on data copied (not hacked) by a shadowy persona named “Guccifer 2.0.” The forensics reflect what seems to have been a desperate effort to “blame the Russians” for publishing highly embarrassing DNC emails three days before the Democratic convention last July. Since the content of the DNC emails reeked of pro-Clinton bias, her campaign saw an overriding need to divert attention from content to provenance—as in, who “hacked” those DNC emails? The campaign was enthusiastically supported by a compliant “mainstream” media; they are still on a roll.

“The Russians” were the ideal culprit. And, after WikiLeaks editor Julian Assange announced on June 12, 2016, “We have emails related to Hillary Clinton which are pending publication,” her campaign had more than a month before the convention to insert its own “forensic facts” and prime the media pump to put the blame on “Russian meddling.” Mrs. Clinton’s PR chief Jennifer Palmieri has explained how she used golf carts to make the rounds at the convention. She wrote that her “mission was to get the press to focus on something even we found difficult to process: the prospect that Russia had not only hacked and stolen emails from the DNC, but that it had done so to help Donald Trump and hurt Hillary Clinton.”

Independent cyber-investigators have now completed the kind of forensic work that the intelligence assessment did not do. Oddly, the “hand-picked” intelligence analysts contented themselves with “assessing” this and “assessing” that. In contrast, the investigators dug deep and came up with verifiable evidence from metadata found in the record of the alleged Russian hack.

They found that the purported “hack” of the DNC by Guccifer 2.0 was not a hack, by Russia or anyone else. Rather it originated with a copy (onto an external storage device—a thumb drive, for example) by an insider. The data was leaked after being doctored with a cut-and-paste job to implicate Russia. We do not know who or what the murky Guccifer 2.0 is. You may wish to ask the FBI.

The Time Sequence

June 12, 2016: Assange announces WikiLeaks is about to publish “emails related to Hillary Clinton.”

June 15, 2016: DNC contractor Crowdstrike, (with a dubious professional record and multiple conflicts of interest) announces that malware has been found on the DNC server and claims there is evidence it was injected by Russians.

June 15, 2016: On the same day, “Guccifer 2.0” affirms the DNC statement; claims responsibility for the “hack;” claims to be a WikiLeaks source; and posts a document that the forensics show was synthetically tainted with “Russian fingerprints.”

We do not think that the June 12 & 15 timing was pure coincidence. Rather, it suggests the start of a pre-emptive move to associate Russia with anything WikiLeaks might have been about to publish and to “show” that it came from a Russian hack.

The Key Event

July 5, 2016: In the early evening, Eastern Daylight Time, someone working in the EDT time zone with a computer directly connected to the DNC server or DNC Local Area Network, copied 1,976 MegaBytes of data in 87 seconds onto an external storage device. That speed is many times faster than what is physically possible with a hack.

It thus appears that the purported “hack” of the DNC by Guccifer 2.0 (the self-proclaimed WikiLeaks source) was not a hack by Russia or anyone else, but was rather a copy of DNC data onto an external storage device. Moreover, the forensics performed on the metadata reveal there was a subsequent synthetic insertion—a cut-and-paste job using a Russian template, with the clear aim of attributing the data to a “Russian hack.” This was all performed in the East Coast time zone.

“Obfuscation & De-obfuscation”

Mr. President, the disclosure described below may be related. Even if it is not, it is something we think you should be made aware of in this general connection. On March 7, 2017, WikiLeaks began to publish a trove of original CIA documents that WikiLeaks labeled “Vault 7.” WikiLeaks said it got the trove from a current or former CIA contractor and described it as comparable in scale and significance to the information Edward Snowden gave to reporters in 2013.

No one has challenged the authenticity of the original documents of Vault 7, which disclosed a vast array of cyber warfare tools developed, probably with help from NSA, by CIA’s Engineering Development Group. That Group was part of the sprawling CIA Directorate of Digital Innovation—a growth industry established by John Brennan in 2015.

Scarcely imaginable digital tools—that can take control of your car and make it race over 100 mph, for example, or can enable remote spying through a TV—were described and duly reported in The New York Times and other media throughout March. But the Vault 7, part 3 release on March 31 that exposed the “Marble Framework” program apparently was judged too delicate to qualify as “news fit to print” and was kept out of the Times.

The Washington Post’s Ellen Nakashima, it seems, “did not get the memo” in time. Her March 31 article bore the catching (and accurate) headline: “WikiLeaks’ latest release of CIA cyber-tools could blow the cover on agency hacking operations.”

The WikiLeaks release indicated that Marble was designed for flexible and easy-to-use “obfuscation,” and that Marble source code includes a “deobfuscator” to reverse CIA text obfuscation.

More important, the CIA reportedly used Marble during 2016. In her Washington Post report, Nakashima left that out, but did include another significant point made by WikiLeaks; namely, that the obfuscation tool could be used to conduct a “forensic attribution double game” or false-flag operation because it included test samples in Chinese, Russian, Korean, Arabic and Farsi.

The CIA’s reaction was neuralgic. Director Mike Pompeo lashed out two weeks later, calling Assange and his associates “demons,” and insisting, “It’s time to call out WikiLeaks for what it really is, a non-state hostile intelligence service, often abetted by state actors like Russia.”

Mr. President, we do not know if CIA’s Marble Framework, or tools like it, played some kind of role in the campaign to blame Russia for hacking the DNC. Nor do we know how candid the denizens of CIA’s Digital Innovation Directorate have been with you and with Director Pompeo. These are areas that might profit from early White House review.

Putin and the Technology

We also do not know if you have discussed cyber issues in any detail with President Putin. In his interview with NBC’s Megyn Kelly, he seemed quite willing—perhaps even eager—to address issues related to the kind of cyber tools revealed in the Vault 7 disclosures, if only to indicate he has been briefed on them. Putin pointed out that today’s technology enables hacking to be “masked and camouflaged to an extent that no one can understand the origin” [of the hack] … And, vice versa, it is possible to set up any entity or any individual that everyone will think that they are the exact source of that attack.”

“Hackers may be anywhere,” he said. “There may be hackers, by the way, in the United States who very craftily and professionally passed the buck to Russia. Can’t you imagine such a scenario? … I can.”

Full Disclosure: Over recent decades the ethos of our intelligence profession has eroded in the public mind to the point that agenda-free analysis is deemed well nigh impossible. Thus, we add this disclaimer, which applies to everything we in VIPS say and do: We have no political agenda; our sole purpose is to spread truth around and, when necessary, hold to account our former intelligence colleagues.

We speak and write without fear or favor. Consequently, any resemblance between what we say and what presidents, politicians and pundits say is purely coincidental. The fact we find it is necessary to include that reminder speaks volumes about these highly politicized times. This is our 50th VIPS Memorandum since the afternoon of Powell’s speech at the U.N. Live links to the 49 past memos can be found at https://consortiumnews.com/vips-memos/.

FOR THE STEERING GROUP, VETERAN INTELLIGENCE PROFESSIONALS FOR SANITY

William Binney, former NSA Technical Director for World Geopolitical & Military Analysis; Co-founder of NSA’s Signals Intelligence Automation Research Center

Skip Folden, independent analyst, retired IBM Program Manager for Information Technology US (Associate VIPS)

Matthew Hoh, former Capt., USMC, Iraq & Foreign Service Officer, Afghanistan (associate VIPS)

Michael S. Kearns, Air Force Intelligence Officer (Ret.), Master SERE Resistance to Interrogation Instructor

John Kiriakou, Former CIA Counterterrorism Officer and former Senior Investigator, Senate Foreign Relations Committee

Linda Lewis, WMD preparedness policy analyst, USDA (ret.)

Lisa Ling, TSgt USAF (ret.) (associate VIPS)

Edward Loomis, Jr., former NSA Technical Director for the Office of Signals Processing

David MacMichael, National Intelligence Council (ret.)

Ray McGovern, former U.S. Army Infantry/Intelligence officer and CIA analyst

Elizabeth Murray, former Deputy National Intelligence Officer for Middle East, CIA

Coleen Rowley, FBI Special Agent and former Minneapolis Division Legal Counsel (ret.)

Cian Westmoreland, former USAF Radio Frequency Transmission Systems Technician and Unmanned Aircraft Systems whistleblower (Associate VIPS)

Kirk Wiebe, former Senior Analyst, SIGINT Automation Research Center, NSA

Sarah G. Wilton, Intelligence Officer, DIA (ret.); Commander, US Naval Reserve (ret.)

Ann Wright, U.S. Army Reserve Colonel (ret) and former U.S. Diplomat

[liminalOyster]

This storyline makes a great deal more sense to me.

From the information available, we conclude that the same inside-DNC, copy/leak process was used at two different times, by two different entities, for two distinctly different purposes:

-(1) an inside leak to WikiLeaks before Julian Assange announced on June 12, 2016, that he had DNC documents and planned to publish them (which he did on July 22)—the presumed objective being to expose strong DNC bias toward the Clinton candidacy; and

-(2) a separate leak on July 5, 2016, to pre-emptively taint anything WikiLeaks might later publish by “showing” it came from a “Russian hack.”

Thanks, SLAD.

[Elvis]

Most interesting! Thanks.

[seemslikeadream]

Why the latest theory about the DNC not being hacked is probably wrong
BY JOE UCHILL - 08/14/17 12:08 PM EDT 288
110

Why the latest theory about the DNC not being hacked is probably wrong
© Getty Images
A forensic report claiming to show that a Democratic National Committee insider, not Russia, stole files from the DNC is full of holes, say cybersecurity experts.

“In short, the theory is flawed,” said FireEye’s John Hultquist, director of intelligence analysis at FireEye, a firm that provides forensic analysis and other cybersecurity services.

“The author of the report didn’t consider a number of scenarios and breezed right past others. It completely ignores all the evidence that contradicts its claims.”

The theory behind the report is that it would have been impossible for information from the DNC to have been hacked due to upload and download speeds.
The claims have slowly trickled through the media, finding backers at the right -wing site Breitbart in early June. Last week, the left-wing magazine The Nation published a 4,500-word story on the allegations.

The claims are based on metadata from the leaked files, which were published on WikiLeaks during the 2016 presidential election.

Metadata is information recorded in a file for archiving purposes and is not displayed when a file is open. It can include the last date a file is modified and note what software and devices were involved in creating the file, among other information.

When files are copied to a new device, the metadata can record the time each file finishes being duplicated as the time it was “last modified.”

A blogger named “The Forensicator” analyzed the "last modified" times in one set of documents released by Guccifer 2.0. Based on the size of the documents and the times they were downloaded, Forensicator calculated that a hacker was able to copy the files at a speed of more than 20 megabytes per second.

That is faster than consumer internet services in the United States can upload documents.

As a result, Forensicator concluded that the documents could not have been copied over the internet. Instead, someone with physical access to the network must have copied them in person to a USB drive, the blogger concluded.

“This theory assumes that the hacker downloaded the files to a computer and then leaked it from that computer,” said Rich Barger, director of security research at Splunk.

But, said Barger and other experts, that overlooks the possibility the files were copied multiple times before being released, something that may be more probable than not in a bureaucracy like Russian intelligence.

“A hacker might have downloaded it to one computer, then shared it by USB to an air gapped [off the internet] network for translation, then copied by a different person for analysis, then brought a new USB to an entirely different air gapped computer to determine a strategy all before it was packaged for Guccifer 2.0 to leak,” said Barger.

Every time the files were copied, depending on the method they were transmitted, there would be a new chance for the metadata to be changed.

Hultquist said the date that Forensicator believes that the files were downloaded, based on the metadata, is almost definitely not the date the files were removed from the DNC.

That date, July 5, 2016, was far later than the April dates when the DNC hackers registered “electionleaks.com” and “DCLeaks.com.” Hulquist noted that the DNC hackers likely had stolen files by the time they began determining their strategy to post them.

The July date is also months after the DNC brought in FireEye competitor CrowdStrike to remove the hackers from their network and well after Crowdstrike first attributed the attack to Russia.

With increased scrutiny on the network, it would be a high-risk way to remove files. And if an insider removed files from the DNC on July 5, it could just as likely be a second, unrelated attack to the Russian one.

Even if there were no other scenarios that would create the same metadata, experts note that metadata is among the easiest pieces of forensic evidence to falsify. It would be far more difficult to fabricate other evidence pointing to Russia, including the malware only known to be used by the suspected Russian hackers, and internet and email addresses seen in previous attacks by that group.

Forensicator’s claim that 20 to 25 megabyte per second downloads would be impossible over the internet also raised eyebrows.

John Bambenek, threat systems manager at the security firm Fidelis, noted that while home internet, where uploads are much slower than downloads, would not allow that speed, corporate and cloud networks could do so.

The DNC would not provide details about its upload speeds in July of 2016.

Proponents of the Forensicator theory have accused CrowdStrike co-founder Dmitri Alperovitch of being biased against Russia, negating his firm’s analysis.

But CrowdStrke was not the only firm to conclude Russia was behind the attack.

Other companies independently discovered evidence that linked the attacks to the same culprit. SecureWorks found an improperly secured URL shortening account used by Fancy Bear while investigating other attacks by the group. That account contained evidence of nearly 4,000 phishing attacks Fancy Bear waged against Gmail addresses — the attack that ensnared Hillary Clinton campaign chairman John Podesta’s email account among them.

In the end, Fidelis, FireEye, SecureWorks, Threat Connect and other CrowdStrike competitors all confirmed Crowdstike’s results.

The intelligence community, including the CIA, FBI and NSA, also claims to have evidence the attacks were coordinated by Moscow, though they have not released their evidence to the public.

“I find it interesting that people are so eager to believe that Dmitri Alperovitch is biased, but willing to accept the forensics of an anonymous blogger, with no reputation, that no one knows anything about,” said Hultquist.

The cybersecurity industry is not shy about shaming competitors for spurious research. Companies have gone out of business after high-profile reports were disproven.

“This industry loves to eat itself up. If you get something wrong, your peers will tell you,” said Barger.

“When this many brands agree on something, come together to provide several different aspects of the attack, sometimes it’s true.”
http://thehill.com/policy/cybersecurity ... ably-wrong

[seemslikeadream]

In Ukraine, a Malware Expert Who Could Blow the Whistle on Russian Hacking
By ANDREW E. KRAMER and ANDREW HIGGINSAUG. 16, 2017

KIEV, Ukraine — The hacker, known only by his online alias “Profexer,” kept a low profile. He wrote computer code alone in an apartment and quietly sold his handiwork on the anonymous portion of the internet known as the Dark Web. Last winter, he suddenly went dark entirely.

Profexer’s posts, already accessible only to a small band of fellow hackers and cybercriminals looking for software tips, blinked out in January — just days after American intelligence agencies publicly identified a program he had written as one tool used in the hacking of the Democratic National Committee.

But while Profexer’s online persona vanished, a flesh-and-blood person has emerged: a fearful man who the Ukrainian police said turned himself in early this year, and has now become a witness for the F.B.I.

“I don’t know what will happen,” he wrote in one of his last messages posted on a restricted-access website before going to the police. “It won’t be pleasant. But I’m still alive.”

It is the first known instance of a living witness emerging from the arid mass of technical detail that has so far shaped the investigation into the D.N.C. hack and the heated debate it has stirred. The Ukrainian police declined to divulge the man’s name or other details, other than that he is living in Ukraine and has not been arrested.

There is no evidence that Profexer worked, at least knowingly, for Russia’s intelligence services, but his malware apparently did.

That a hacking operation that Washington is convinced was orchestrated by Moscow would obtain malware from a source in Ukraine — perhaps the Kremlin’s most bitter enemy — sheds considerable light on the Russian security services’ modus operandi in what Western intelligence agencies say is their clandestine cyberwar against the United States and Europe.

It does not suggest a compact team of government employees who write all their own code and carry out attacks during office hours in Moscow or St. Petersburg, but rather a far looser enterprise that draws on talent and hacking tools wherever they can be found.

Also emerging from Ukraine is a sharper picture of what the United States believes is a Russian government hacking group known as Advanced Persistent Threat 28 or Fancy Bear. It is this group, which American intelligence agencies believe is operated by Russian military intelligence, that has been blamed, along with a second Russian outfit known as Cozy Bear, for the D.N.C. intrusion.

Rather than training, arming and deploying hackers to carry out a specific mission like just another military unit, Fancy Bear and its twin Cozy Bear have operated more as centers for organization and financing; much of the hard work like coding is outsourced to private and often crime-tainted vendors.

Photo

Kiev’s main thoroughfare. Ukraine has been used for years by Russia as a testing ground for politicized cyberoperations that later cropped up in other countries. Credit Brendan Hoffman for The New York Times
Russia’s Testing Ground

In more than a decade of tracking suspected Russian-directed cyberattacks against a host of targets in the West and in former Soviet territories — NATO, electrical grids, research groups, journalists critical of Russia and political parties, to name a few — security services around the world have identified only a handful of people who are directly involved in either carrying out such attacks or providing the cyberweapons that were used.

This absence of reliable witnesses has left ample room for President Trump and others to raise doubts about whether Russia really was involved in the D.N.C. hack.

“There is not now and never has been a single piece of technical evidence produced that connects the malware used in the D.N.C. attack to the G.R.U., F.S.B. or any agency of the Russian government,” said Jeffrey Carr, the author of a book on cyberwarfare. The G.R.U. is Russia’s military intelligence agency, and the F.S.B. its federal security service.

United States intelligence agencies, however, have been unequivocal in pointing a finger at Russia.

Seeking a path out of this fog, cybersecurity researchers and Western law enforcement officers have turned to Ukraine, a country that Russia has used for years as a laboratory for a range of politicized operations that later cropped up elsewhere, including electoral hacking in the United States.

In several instances, certain types of computer intrusions, like the use of malware to knock out crucial infrastructure or to pilfer email messages later released to tilt public opinion, occurred in Ukraine first. Only later were the same techniques used in Western Europe and the United States.

So, not surprisingly, those studying cyberwar in Ukraine are now turning up clues in the investigation of the D.N.C. hack, including the discovery of a rare witness.

Security experts were initially left scratching their heads when the Department of Homeland Security on Dec. 29 released technical evidence of Russian hacking that seemed to point not to Russia, but rather to Ukraine.

In this initial report, the department released only one sample of malware said to be an indicator of Russian state-sponsored hacking, though outside experts said a variety of malicious programs were used in Russian electoral hacking.

The sample pointed to a malware program, called the P.A.S. web shell, a hacking tool advertised on Russian-language Dark Web forums and used by cybercriminals throughout the former Soviet Union. The author, Profexer, is a well-regarded technical expert among hackers, spoken about with awe and respect in Kiev.

He had made it available to download, free, from a website that asked only for donations, ranging from $3 to $250. The real money was made by selling customized versions and by guiding his hacker clients in its effective use. It remains unclear how extensively he interacted with the Russian hacking team.

After the Department of Homeland Security identified his creation, he quickly shut down his website and posted on a closed forum for hackers, called Exploit, that “I’m not interested in excessive attention to me personally.”

Soon, a hint of panic appeared, and he posted a note saying that, six days on, he was still alive.

Another hacker, with the nickname Zloi Santa, or Bad Santa, suggested the Americans would certainly find him, and place him under arrest, perhaps during a layover at an airport.

“It could be, or it could not be, it depends only on politics,” Profexer responded. “If U.S. law enforcement wants to take me down, they will not wait for me in some country’s airport. Relations between our countries are so tight I would be arrested in my kitchen, at the first request.”

In fact, Serhiy Demediuk, chief of the Ukrainian Cyber Police, said in an interview that Profexer went to the authorities himself. As the cooperation began, Profexer went dark on hacker forums. He last posted online on Jan. 9. Mr. Demediuk said he had made the witness available to the F.B.I., which has posted a full-time cybersecurity expert in Kiev as one of four bureau agents stationed at the United States Embassy there. The F.B.I. declined to comment.

Profexer was not arrested because his activities fell in a legal gray zone, as an author but not a user of malware, the Ukrainian police say. But he did know the users, at least by their online handles. “He told us he didn’t create it to be used in the way it was,” Mr. Demediuk said.

A member of Ukraine’s Parliament with close ties to the security services, Anton Gerashchenko, said that the interaction was online or by phone and that the Ukrainian programmer had been paid to write customized malware without knowing its purpose, only later learning it was used in the D.N.C. hack.

Mr. Gerashchenko described the author only in broad strokes, to protect his safety, as a young man from a provincial Ukrainian city. He confirmed that the author turned himself in to the police and was cooperating as a witness in the D.N.C. investigation. “He was a freelancer and now he is a valuable witness,” Mr. Gerashchenko said.

Photo

The headquarters of the F.S.B. in Moscow. The Americans believe Russian military intelligence operates Advanced Persistent Threat 28, or Fancy Bear. Credit Pavel Golovkin/Associated Press
A Bear’s Lair

While it is not known what Profexer has told Ukrainian investigators and the F.B.I. about Russia’s hacking efforts, evidence emanating from Ukraine has again provided some of the clearest pictures yet about Fancy Bear, or Advanced Persistent Threat 28, which is run by the G.R.U.

Fancy Bear has been identified mostly by what it does, not by who does it. One of its recurring features has been the theft of emails and its close collaboration with the Russian state news media.


Tracking the bear to its lair, however, has so far proved impossible, not least because many experts believe that no such single place exists.

Even for a sophisticated tech company like Microsoft, singling out individuals in the digital miasma has proved just about impossible. To curtail the damage to clients’ operating systems, the company filed a complaint against Fancy Bear last year with the United States District Court for eastern Virginia but found itself boxing with shadows.

As Microsoft lawyers reported to the court, “because defendants used fake contact information, anonymous Bitcoin and prepaid credit cards and false identities, and sophisticated technical means to conceal their identities, when setting up and using the relevant internet domains, defendants’ true identities remain unknown.”

Nevertheless, Ukrainian officials, though wary of upsetting the Trump administration, have been quietly cooperating with American investigators to try to figure out who stands behind all the disguises.

Included in this sharing of information were copies of the server hard drives of Ukraine’s Central Election Commission, which were targeted during a presidential election in May 2014. That the F.B.I. had obtained evidence of this earlier, Russian-linked electoral hack has not been previously reported.

Photo

A polling station outside Kiev during the 2014 Ukrainian election. The server hard drives of Ukraine’s Central Election Commission were targeted by a cyberattack. Credit Sergey Ponomarev for The New York Times
Traces of the same malicious code, this time a program called Sofacy, were seen in the 2014 attack in Ukraine and later in the D.N.C. intrusion in the United States.

Intriguingly, in the cyberattack during the Ukrainian election, what appears to have been a bungle by Channel 1, a Russian state television station, inadvertently implicated the government authorities in Moscow.

Hackers had loaded onto a Ukrainian election commission server a graphic mimicking the page for displaying results. This phony page showed a shocker of an outcome: an election win for a fiercely anti-Russian, ultraright candidate, Dmytro Yarosh. Mr. Yarosh in reality received less than 1 percent of the vote.

The false result would have played into a Russian propaganda narrative that Ukraine today is ruled by hard-right, even fascist, figures.

The fake image was programmed to display when polls closed, at 8 p.m., but a Ukrainian cybersecurity company, InfoSafe, discovered it just minutes earlier and unplugged the server.

State television in Russia nevertheless reported that Mr. Yarosh had won and broadcast the fake graphic, citing the election commission’s website, even though the image had never appeared there. The hacker had clearly provided Channel 1 with the same image in advance, but the reporters had failed to check that the hack actually worked.

“For me, this is an obvious link between the hackers and Russian officials,” said Victor Zhora, director of InfoSafe, the cybersecurity company that first found the fake graphic.

A Ukrainian government researcher who studied the hack, Nikolai Koval, published his findings in a 2015 book, “Cyberwar in Perspective,” and identified the Sofacy malware on the server.

The mirror of the hard drive went to the F.B.I., which had this forensic sample when the cybersecurity company CrowdStrike identified the same malware two years later, on the D.N.C. servers.

“It was the first strike,” Mr. Zhora said of the earlier hack of Ukraine’s electoral computers. Ukraine’s Cyber Police have also provided the F.B.I. with copies of server hard drives showing the possible origins of some phishing emails targeting the Democratic Party during the election.

In 2016, two years after the election hack in Ukraine, hackers using some of the same techniques plundered the email system of the World Anti-Doping Agency, or WADA, which had accused Russian athletes of systematic drug use.

Photo

A website announced that WADA had been hacked by a group calling itself the “Fancy Bears’ Hack Team.” Credit Alexander Zemlianichenko/Associated Press
That raid, too, seems to have been closely coordinated with Russian state television, which began airing well-prepared reports about WADA’s hacked emails just minutes after they were made public. The emails appeared on a website that announced that WADA had been hacked by a group calling itself the “Fancy Bears’ Hack Team.”

It was the first time Fancy Bear had broken cover.

Fancy Bear remains extraordinarily elusive, however. To throw investigators off its scent, the group has undergone various makeovers, restocking its arsenal of malware and sometimes hiding under different guises. One of its alter egos, cyberexperts believe, is Cyber Berkut, an outfit supposedly set up in Ukraine by supporters of the country’s pro-Russian president, Viktor F. Yanukovych, who was ousted in 2014.

After lying dormant for many months, Cyber Berkut jumped back into action this summer just as multiple investigations in Washington into whether the Trump campaign colluded with Moscow shifted into high gear. Cyber Berkut released stolen emails that it and Russian state news media said had exposed the real story: Hillary Clinton had colluded with Ukraine.
https://www.nytimes.com/2017/08/16/worl ... tness.html