Posted: Aug 12, 2017 10:47 pm
by The_Metatron
crank wrote:
[Reveal] Spoiler:
The_Metatron wrote:
crank wrote:
The_Metatron wrote:Are there any other IT engineers here to look at that stuff?

I have.

First, the author is anonymous. Then, he based all his conclusions on "metadata" to which he alone has access.

I'm curious, how some anonymous dude ends up with actual evidence for forensic analysis.

That article reeks of conspiracy theory.


Sent from my iPad using Tapatalk

What author? This reports on collaboration by a number of folk, including Binney, who I have quite a bit of faith in for obvious reasons to anyone who pays attention to this stuff. These are very serious people with serious reputations, the anonymous contributors have histories of doing quality work. And what they're finding is easily verifiable by others if given the data. It reeks of the [white-hat] hacking community, and I'd trust most of them far more than the 3-letter agencies or any pol.

Forensicator, that's who.

He makes some other bullshit assertions:

    1. Such network speeds were unavailable in 2016.

    2. He "tested" a file transfer from a server 20 miles away.

    3. The transfer was from the east coast, based on time stamps in this mysterious metadata of his.

We can work with those three for now.

1. I know for a positive fact that gigabit speeds existed to any business in downtown Eugene, Oregon with a hundred bucks a month, since at least 2014 when I started working for the City.

2. 20 miles, eh? Through his own, direct path network? If that server wasn't at Forensicator's ISP twenty miles away, that data path could easily go out of state before it reaches his test server. The test claim is bullshit. No network engineer would make it, it has no meaning.

You should at least look at the article if you're going to criticize it, further details:
What is the maximum achievable speed? Forensicator recently ran a test download of a comparable data volume (and using a server speed not available in 2016) 40 miles from his computer via a server 20 miles away and came up with a speed of 11.8 megabytes per second—half what the DNC operation would need were it a hack.


The_Metatron wrote:
3. Time stamps, eh? Timestamps of what, exactly? They're claiming in that article that this was a USB stick file copy. Oh, really? If that's so, exactly what system clock was used to make the fucking timestamps of the magic metadata that only he has? USB drives are passive. They don't have clocks to timestamp anything. If there are any timestamps involved in a USB file copy, they are generated by the host's system clock. You know, the DNC server itself, which was on the east coast. Waddya know?

Let's talk about that metadata. He has metadata that shows transfer speeds, but mysteriously doesn't record the interface that transferred it? Bullshit. Such metadata, if it even exists, would be useless without also recording what network interface the transfer used.

Let's go back to that east coast claim. VPN, anyone? Or, perhaps Comrade Hacker simply used a compromised server anywhere on the east coast from, oh, any fucking place on earth? Jesus. If I can think of these out of hand, there are surely more.


Sent from my iPad using Tapatalk

There are all kinds of time stamps put into file metadata, this is done by the OS, the USB is just a drive, it writes data that it's told to write [I know this is over-simplified, and drives get more and more of the proc workload put on them, and it depends on the file system in question, and mode like IDE vs AHCI, and compression issues and god knows what ZFS can do, and etc etc, but the easiest way to see it is the data source is the PC, not the drive, and that includes what time is the system time that is used for the timestamps]. Why and how would an OS records metadata about the network it sends a file over? You can use timestamps to calculate how fast the file is transferred. Timestamps have timezone data included. And the story being told so adamantly is how they know it was done from a known IP address associated with the Russian government somewhere in Eastern Europe I think, it says Romania in the article, I have no reason to doubt that. And I don't know enough about the gigabit connections available around the world, but I'd trust these guys to. And connection rate and transfer rate are not all that closely related, if you have a gigabit line to your ISP, how fast can you download from a BBS with a 2400 Baud modem? Any proxies used to obfuscate his actual position are going to slow thngs down tremendously.

What it really boils down to is who you gonna trust? The 3-letterers or these guys:
ualified experts working independently of one another began to examine the DNC case immediately after the July 2016 events. Prominent among these is a group comprising former intelligence officers, almost all of whom previously occupied senior positions. Veteran Intelligence Professionals for Sanity (VIPS), founded in 2003, now has 30 members, including a few associates with backgrounds in national-security fields other than intelligence. The chief researchers active on the DNC case are four: William Binney, formerly the NSA’s technical director for world geopolitical and military analysis and designer of many agency programs now in use; Kirk Wiebe, formerly a senior analyst at the NSA’s SIGINT Automation Research Center; Edward Loomis, formerly technical director in the NSA’s Office of Signal Processing; and Ray McGovern, an intelligence analyst for nearly three decades and formerly chief of the CIA’s Soviet Foreign Policy Branch. Most of these men have decades of experience in matters concerning Russian intelligence and the related technologies. This article reflects numerous interviews with all of them conducted in person, via Skype, or by telephone.

Like I said earlier, Binney's presence alone gives great credence to these people. If you don't know his history, I'd recommend looking into, it's highly fascinating and revealing. If they trust Forensicator, then I would also. From the article:
The Forensicator’s July 9 document indicates he lives in the Pacific Time Zone, which puts him on the West Coast. His notes describing his investigative procedures support this. But little else is known of him. Adam Carter, in turn, is located in England, but the name is a coy pseudonym: It derives from a character in a BBC espionage series called Spooks. It is protocol in this community, Elizabeth Vos told me in a telephone conversation this week, to respect this degree of anonymity. Kirk Wiebe, the former SIGINT analyst at the NSA, thinks Forensicator could be “someone very good with the FBI,” but there is no certainty. Unanimously, however, all the analysts and forensics investigators interviewed for this column say Forensicator’s advanced expertise, evident in the work he has done, is unassailable. They hold a similarly high opinion of Adam Carter’s work.

You are welcome to trust whomever you like. For all you know, Adam Carter and Forensicator are nineteen different people. This is my field, and I've told you that there are holes in your hackers' story.

We'll see what the buildings full of analysts in the intel community, along with Mueller's investigation reveal, won't we?

Image

That was when we moved into our house. I had only about 65 Mbps in Cheyenne. For fuck sakes, I was getting 22 Mbps over a goddamned phone line when I lived in Belgium.

Notice that speed was from Seattle. Farther than 20 miles from me. If the hapless forensicator can't match that, he needs a new ISP.

Finally, a well chosen proxy sure as fuck won't slow things down, it will speed them up. Forensicator ignored this, just like you are. If I'm behind a bandwidth limited pipe, I choose a compromised proxy host from which I will do my dirty work. From the hacked machine, that's as far as the trail can go. Unless the investigators can get their hands on the proxy host.

Shit, rootkit a server close to the target, execute the attack from there, then send the payload wherever you want the slow way, at your convenience. Trivial.

Oh, and just for fun, I ran a test from my back yard in Centralia, Washington to Utica, New York.

Image

Poor old forensicator is looking a little shaky. I've got data, man. Right here. No magic metadata.


Sent from my iPad using Tapatalk