{"id":92087,"date":"2017-12-30T09:03:21","date_gmt":"2017-12-30T13:03:21","guid":{"rendered":"https:\/\/stateofthenation2012.com\/?p=92087"},"modified":"2017-12-30T09:04:16","modified_gmt":"2017-12-30T13:04:16","slug":"crowdstrike-did-the-only-cyber-security-firm-ever-contracted-by-the-dnc-plant-the-bogus-russian-evidence","status":"publish","type":"post","link":"https:\/\/stateofthenation2012.com\/?p=92087","title":{"rendered":"CrowdStrike: Did the only cyber-security firm ever contracted by the DNC plant the bogus Russian evidence?"},"content":{"rendered":"

Fancy Frauds, Bogus Bears & Malware Mimicry?!<\/h1>\n

<\/p>\n

Anomalies Discovered In Malware Found By CrowdStrike Merit Further Inspection<\/h2>\n

\"\"<\/a><\/p>\n

Adam Carter
\nDisobedient Media<\/p>\n

It\u2019s amazing what people retain and how they pick up on conflicts of information and inconsistencies. I\u2019ve been impressed by a lot of people I\u2019ve come to know through Twitter and one great example is Stephen McIntyre\u00a0(of\u00a0Climate Audit<\/a>\u00a0\u2013 a blog that has\u00a0an interesting history of its own<\/a>\u00a0in relation to the\u00a0ClimateGate hack of 2009<\/a>).<\/em><\/p>\n

Over recent months McIntyre has given some attention to the topic of the alleged hacking of the DNC in 2016 and his findings have been particularly interesting, at least, to anyone interested in unraveling digital deception.<\/p>\n

As always, some of the background helps for context, if you\u2019re familiar with CrowdStrike\u2019s activity at the DNC, their background and the dates of their activities, feel free to skip the next couple of paragraphs.<\/p>\n

CrowdStrike and DNC Malware Discoveries<\/h3>\n

End of April 2016 \u2013 Breach Detected
\n<\/strong>Towards the end of April 2016, the DNC (Democratic National Convention) contacted a cyber-security firm called CrowdStrike in relation to a suspected breach.<\/p>\n

Early May 2016 \u2013 CrowdStrike Called In, Falcon Installed
\n<\/strong>CrowdStrike\u00a0visited the DNC early in May and soon discovered malware<\/a>. They\u00a0installed their flagship product \u201cFalcon\u201d\u00a0(a product supposed to prevent both hackers and malware)<\/em>\u00a0across the network<\/a>\u00a0and on or before May 11, 2016, the DNC\u00a0started paying their service subscription fee to CrowdStrike<\/a>.<\/p>\n

Late May 2016 \u2013 Emails Acquired<\/strong>
\nApproximately two weeks after Falcon had been installed, emails were acquired\u00a0(with\u00a0dates going up to 19th-25th of May depending on mailbox<\/a>)<\/em>\u00a0that were subsequently\u00a0leaked to WikiLeaks<\/a>.<\/p>\n

Early-Mid June 2016 \u2013 WikiLeaks Announce Leaks & CrowdStrike Announce Hackers<\/strong>
\nWikiLeaks first gave indication they were in possession of leaked emails\u00a0(relating to Hillary Clinton)<\/em>\u00a0when Julian Assange stated it in an interview with ITV\u2019s \u201cPeston on Sunday\u201d on June 12, 2016<\/a>.<\/p>\n

Within 48 hours of the announcement\u00a0(on June 14, 2016)<\/em>, an\u00a0article appeared in the Washington Post<\/a>, covering a story from CrowdStrike executives Shawn Henry and Dmitri Alperovitch. In the article, they claim to have just been working on eliminating the last of the hackers from the DNC\u2019s network during the past weekend\u00a0(conveniently coinciding with Assange\u2019s statement and being an indirect admission that their Falcon software had\u00a0failed to achieve it\u2019s stated capabilities at that time<\/a>, assuming their statements were accurate)<\/em>.<\/p>\n

The following day, June 15, 2016, they publicized a report in which they share IOCs (Indicators of Compromise) and samples of the malware code.<\/p>\n

To date, CrowdStrike has not been able to show how the malware had relayed any emails or accessed any mailboxes. They have also not responded to inquiries specifically asking for details about this.<\/p>\n

In fact, things have now been discovered that bring some of their malware discoveries into question.<\/p>\n

Fancy Bear Malware & Compile Times<\/h3>\n

It was reported that Cozy Bear\u00a0(aka APT29)<\/em>\u00a0was at the DNC since the Summer 2015 and that Fancy Bear\u00a0(aka APT28)\u00a0<\/em>didn\u2019t start their attacks until Spring 2016.<\/p>\n

While it would seem logical to infer this as meaning that the Fancy Bear activity occurred just before CrowdStrike\u2019s visit, there is a reason to think Fancy Bear didn\u2019t start some of its activity until CrowdStrike had arrived at the DNC.<\/p>\n

CrowdStrike, in the indiciators of compromise they reported, identified three pieces of malware relating to Fancy Bear:<\/p>\n

\n

compilation date (Virus Total) of FancyBear X-Agent and X-Tunnel software in DNC hack compiled AFTER Crowdstrike installed their software pic.twitter.com\/A9bDcNSIrs<\/a><\/p>\n

— Stephen McIntyre (@ClimateAudit) October 25, 2017<\/a><\/p><\/blockquote>\n