Posted on 12/31/2016 5:05:38 PM PST by Eddie01
On Thursday, as part of the White House response to alleged Russian hacking, the FBI and DHS released a Joint Analysis Report (JAR) called “Grizzly Steppe.” While this report was meant to prove, or at least provide evidence, that the Russian government was involved in hacks of the Democratic Party, experts have stated that it “adds nothing.”
Jeffrey Carr, a cybersecurity consultant, author, and founder of the Suits and Spooks conference, wrote in an analysis that the report merely lists every threat group ever reported on by a commercial cybersecurity company suspected of having ties to Russia, labeling them “Russian Intelligence Services,” without evidence that any such connection exists.
“Unlike Crowdstrike, ESET doesn’t assign APT28/Fancy Bear/Sednit to a Russian Intelligence Service or anyone else for a very simple reason. Once malware is deployed, it is no longer under the control of the hacker who deployed it or the developer who created it,” Carr wrote, adding, “It can be reverse-engineered, copied, modified, shared and redeployed again and again by anyone. In other words, malware deployed is malware enjoyed!”
Carr added that if the White House had unclassified evidence tying Russia to the DNC hack, the evidence would have been made public by now. Since they have not made evidence public, he, like many other members of the intelligence community, believes that it is either classified or it simply does not exist.
“If it’s classified, an independent commission should review it because this entire assignment of blame against the Russian government is looking more and more like a domestic political operation run by the White House that relied heavily on questionable intelligence generated by a for-profit cybersecurity firm with a vested interest in selling ‘attribution-as-a-service,’” Carr stated.
Likewise, Robert M. Lee, a National Cybersecurity Fellow at New America and CEO and founder of cybersecurity company Dragos, published a thorough critique of the JAR, saying it “reads like a poorly done vendor intelligence report stringing together various aspects of attribution without evidence.”
“The list of reported RIS [Russian intelligence services] names includes relevant and specific names such as campaign names, more general and often unrelated malware family names, and extremely broad and non-descriptive classification of capabilities,” Lee wrote. “It was a mixing of data types that didn’t meet any objective in the report and only added confusion as to whether the DHS/FBI knows what they are doing or if they are instead just telling teams in the government ‘contribute anything you have that has been affiliated with Russian activity.’”
Lee explained that it is extremely difficult to identify whether data was sourced from the private sector or from declassified government data.
“It is useful to know what is government data from previously classified sources and what is data from the private sector and more importantly who in the private sector. Organizations will have different trust or confidence levels of the different types of data and where it came from,” Lee said. “Unfortunately, this is entirely missing. The report does not source its data at all. It’s a random collection of information and in that way, is mostly useless.”
Lee, in his critique, detailed that it is important for government reports to detail where data came from, and to separate private-sector information from their own data, which is seen to have a higher confidence level. Further, Lee stated that some of the samples were already known to the public, so if they were classified, “it is a perfect example of over classification by government bureaucracy.”
“The DHS/FBI GRIZZLY STEPPE report does not meet its stated intent of helping network defenders and instead choose to focus on a confusing assortment of attribution, non-descriptive indicators, and re-hashed tradecraft,” Lee said. “Additionally, the bulk of the report (8 of the 13 pages) is general high level recommendations not descriptive of the RIS threats mentioned and with no linking to what activity would help with what aspect of the technical data covered. It simply serves as an advertisement of documents and programs the DHS is trying to support. One recommendation for Whitelisting Applications might as well read ‘whitelisting is good mm’kay?’”
Lee summed up that JAR appears to be very rushed, and put together by multiple teams working with different data sets and motivations, resulting in a very confusing non-explanation that tried to cover too much, while saying too little.
Default position on #FakeNews networks and fed agencies is to treat it all as bovine feces and have a good laugh.
Barky is ‘using’ this Russian ‘hacking’ to cover something else up, he has something more left to do and wants this ‘shiny object’ to take our attention away from what he’s planning...
NO, Russia didn’t hack our files or anything else...if anyone ‘hacked’ anything it was either Hillary, Barky or the CIA...
Sheer speculation based on spite and personal agenda. To liberals, that’s as good as proof.
I’m sure the government has SOME really smart IT guys and gals.
But from my professional experience (which is pretty wide) and from reports about the IRS software upgrade debacle, and Hillary’s email debacle, and this “Russian hacking” debacle, I say it’s pretty darn depressing how poorly the US government handles technology. We no longer have the government expertise that built the A Bomb, won WWII, and put a man on the moon.
It’s mostly back-slapping good ol’ boys talking about their golf game, their retirement portfolio and — oh by the way — is that cyber security watchamacallit thing almost done??
However, a group of retired senior U.S. intelligence officials—among them NSA whistleblower William Binney—claim a system is in place to monitor remote data removal that would have detected Russian hacking. Its failure to do so could only lead to one conclusion—a fiber network was never used but, rather, a thumb drive was to download DNC emails. In other words, it was an inside job.
I am convinced it was a Bernie supporter who thought that this scandal would result in Hillary stepping down and Sanders becoming the DNC nominee. The culprit is probably horrified at how it all turned out and hiding in his parents basement in Georgetown.
This story is unraveling as Obama can’t prove squat and it is going to be another embarrassment.
Or he had 2 gunshots to the back of the head.
ping
You seemed to be saying something similar on an earlier thread...
Yes. There’s also the ongoing theory that Eric Braverman, CEO of the Clinton Foundation, is either under FBI protection, or dead, possibly for similar reasons.
Hadn’t seen the Zumwalt story - thanks!
sputnniknews?
check it out
Bookmark
More than likely proof that it was an inside job and that it WASN’T the Russians after all.
C'mon man! We're working under a lot of pressure here!
Only 20 more days to figure out how to keep Trump out of the WH.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.