Comment by desdiv | Hacker News Reader

Comment by desdiv | Hacker News Reader

Parent Full thread

These links work. Don't ask how I got them.

https://archive.org/download/Pierrpersongmail.com_drive.part...

https://archive.org/download/Pierrpersongmail.com_drive.part...

https://archive.org/download/xls_cedric/xls_cedric_archive.t...

https://archive.org/download/Macron_201705/Macron_201705_arc...

But seriously, using archive.org as a dump? Get your shit together, Ruskies, and use IPFS next time.

EDIT: Here are the magnet links in case the archive.org links go down.

    magnet:?xt=urn:btih:6a9f03af2d552b42a23e69abbbe38737b8906454&dn=Macron%5F201705&tr=http%3A%2F%2Fbt1.archive.org%3A6969%2Fannounce&tr=http%3A%2F%2Fbt2.archive.org%3A6969%2Fannounce&ws=https%3A%2F%2Farchive.org%2Fdownload%2F&ws=http%3A%2F%2Fia601505.us.archive.org%2F27%2Fitems%2F&ws=http%3A%2F%2Fia801505.us.archive.org%2F27%2Fitems%2F

    magnet:?xt=urn:btih:fc36c7e406187d83ec6602ff59183c3c56f3ea9b&dn=xls%5Fcedric&tr=http%3A%2F%2Fbt1.archive.org%3A6969%2Fannounce&tr=http%3A%2F%2Fbt2.archive.org%3A6969%2Fannounce&ws=https%3A%2F%2Farchive.org%2Fdownload%2F&ws=http%3A%2F%2Fia601507.us.archive.org%2F11%2Fitems%2F&ws=http%3A%2F%2Fia801507.us.archive.org%2F11%2Fitems%2F

    magnet:?xt=urn:btih:b8f18fcb16819e34d01ea94d393f256cc540f99e&dn=Pierrpersongmail.com%5Fdrive.part1&tr=http%3A%2F%2Fbt1.archive.org%3A6969%2Fannounce&tr=http%3A%2F%2Fbt2.archive.org%3A6969%2Fannounce&ws=https%3A%2F%2Farchive.org%2Fdownload%2F&ws=http%3A%2F%2Fia601502.us.archive.org%2F34%2Fitems%2F&ws=http%3A%2F%2Fia801502.us.archive.org%2F34%2Fitems%2F

    magnet:?xt=urn:btih:80baae16065f6fbc276e718bda2c5db4a6435f8d&dn=Pierrpersongmail.com%5Fdrive.part2&tr=http%3A%2F%2Fbt1.archive.org%3A6969%2Fannounce&tr=http%3A%2F%2Fbt2.archive.org%3A6969%2Fannounce&ws=https%3A%2F%2Farchive.org%2Fdownload%2F&ws=http%3A%2F%2Fia601503.us.archive.org%2F22%2Fitems%2F&ws=http%3A%2F%2Fia801503.us.archive.org%2F22%2Fitems%2F

What is in them? Rar-files and empty sql-lite databases? What is this supposed to be?

Why do people insist that it is the Russians?

If Russia is so capable in this area then why is every published attack simple low-tech hacks like guessing a password or sending a spoof link?

Same reason Kevin Mitnick used them - they work, incredibly well. Dress up like a Best Buy employee and you can probably hand-cart a dozen big-screen TVs out the door without anyone asking a question (and maybe even helping you).

Humans are almost always the weakest link in the chain.

Nobody's going to even bother examining the theory that Kim Dotcom's crew was behind it, never mind him publicly predicting it years ahead of time on Twitter as revenge for signing off on his extradition.

Security researchers say it's the Russians, based on evidence they have seen. It's not that people are throwing a dart at a map and picking Russia.

https://www.nytimes.com/2017/05/05/world/europe/france-macro...

That article, and its cited sources, say that Trend Micro came to that conclusion, but does not even attempt to present any facts from the report, only the bare conclusions.

The 'Fancy Bear' report was also called into question by people looking over the details. They somehow missed that one of the tools used was an outdated copy of P.A.S., for example. More details can be found in past HN coverage.

There aren't a lot of facts to go on here, just a forest of articles citing the same conclusions without bothering to cover any of the details about the underlying technical facts they're supposed to be based on.

This is incredibly superficial reporting, anyone who bothers to look for details will be continually disappointed.

> There aren't a lot of facts to go on

In fact there is a long history of evidence. The Russia defenders love to try to create uncertainty, using these same talking points every time, regardless of the evidence.

No, there are a lot of articles. There are hardly any facts in any of them, I keep checking for that and getting disappointed. If you can find something with more facts, distill them and point me at them please.

The best we ever got on a technical level was that original report from the DNC consultants where most of the IP addresses in the "signature" were Tor exit nodes and they didn't recognize an old, freeware copy of P.A.S. despite it being publicly available.

We've had a lot of utterly laughable things, like the one where someone was intercepting the DNS traffic for a 3rd party marketing site weakly linked to Trump that was making queries to a Russian bank... because of some Russian spam. I can't help but note that the same people keep falling for nonsense of this level.

However, feel free to link to the actual technicals of the reports if you have any. Despite the prior reports being stuff and nonsense (but mostly the latter), I remain open to changing my mind should anyone offer actual proof of some sort. Please note that I'm looking for logs, IP addresses, code and other things that could qualify as actual evidence, not so-and-so's say-so.

The closest this article got to facts were various bits of speculation about people's motives, claiming that Trend Micro thinks it matches this APT (for reasons they didn't bother to cover) and links to past coverage... that also fails to answer any of the obvious questions about what we know and how we know it, for which the usual answer in the past has been variations on interviews with unnamed people, appeals to classified data not in evidence, or random "experts" giving an opinion without disclosing any of the facts used to form that opinion.

In short, it's a lot of hearsay. I follow more or less this process:

https://www.popehat.com/2017/01/19/how-to-read-news-like-a-s...

Most news currently fails this test. I completely ignore all articles that fail the test as unreliable, even when I happen to agree with the conclusions. This applies to other articles as well, not just controversial things.

Just as a follow-up, I eventually found the Trend Micro report linked from an Ars Technica article. It's justification for labeling this as Fancy Bear was that they saw an email address from a free provider that they believe is linked and some cyrillic text. That's not really very much, given that the original label for this APT is already quite tenuous, given how the 'signature' from the original report consists of things like using Tor exit nodes that are quite common.

Maybe there's more to it, but if so they should really put it in their reports.

Reply on news.ycombinator.com