The Insider and The IRA Data That’s Been On Auction For Over A Year

Today a tweet was directed at me concerning some new information posted on a Russian news site back on February 21st that no one in the US media seems to have noticed nor the NATSEC community. In fact, I had not seen this and I kinda have chided myself for not paying better attention to the Joker Buzz site that the data was for sale on, for a year! I had actually been on their site(s) in the clearnet and darknet and thought I had posted a blog about the notion of the site and what they sell but I can’t seem to locate it. I guess maybe I just tweeted about it and moved on …My bad.

Anyway, the post on The Insider has the skinny on how a user there named “AlexDA” had ALL of the IRA’s internal documents on the active measures campaign for sale for over a year and no one really took notice. This means that we could have bought the data and had all of the actors, their data, and their METADATA if we had only seen or purchased them back in January/February 2017. What’s more is that had we had this intelligence in the open much more could have been easily available for the general public to be aware of how this was all working and what to look for. Of course now after the Indictment by Mueller of the 13 entities the op has been completely blown and the infrastructure is likely not to be operational, but, we could see operational details and OPSEC mistakes that the players made and extend that to the upcoming years election cycle and Russian influence and active measures campaigns to come right?

Even so, big things are in the small details even within the offering itself that AlexDA is making on JokerBuzz. I have been going through the images from the auction site that Alex put up to entice and prove that they are legit and here is what I have found by doing my thing as usual mining:

Proxy IP Space Used:

In the offering images you can see that AlexDA tried to obfuscate the last couple octets but if you look real hard you can see the numbers pop up. Of course if you just take the first two or three octets and you put that into Google you can see what pops right up. So, the first thing to see is that the service mentioned in the indictment is actually Total Server Solutions LLC out of Plano Texas. I would like to call your attention to how much “Texas” was involved in many of the Twitter and facebook accounts that were super patriotic. It was mentioned in the indictment that they rented the server space to appear that they were in the US. Well, there you have it kids. The data fits and it makes sense that they would try to do this to appear as if they were in the US to fool first pass looking right? I ran an Nmap of the /24 and as you can see if you look, there are some proxies, port 80 and 22 open but none are available to access at this time, so maybe they went back to being just space owned by Total server… I would hope though that those there servers had been, ya know, collected on by subpoena by the FBI right?

Wink wink nudge nudge.

 

Meanwhile, there’s a bunch of servers/IP’s listed in the images as well that are in Russia using port 8888. I haven’t looked at those with Nmap but they are VPS as well so maybe they are still in play. Suffice to say though, it is interesting data and could lead to more things coming to light if you look into them a little further. If you want to play the home game please feel free. I will be circling back over this stuff in the near future and enlightenment will be posted here when I have it for you all.

Alias and Users To Search:

Gee, look at all those aliases man! I have yet to dig into these and I am sure some are already known but you now too can play the home game! Take a look and see what histories you can find on these accounts/nicks. I am willing to bet we can put together quite the timeline and then use that as data to look at future attacks as well. All those Blacktivist accounts though were the appetizer to what I saw next in the screen shots. Alex gives us a whole thing to work with in the image below and if you start digging on that you can get some good stuff.

 

http://aktivnyye.com/t/20171013-blackmattersus.html

Nolan Hack, a name that I believe others have seen in the press accounts, has a Facebook page, a phone number, and a site blackmattersus.com that is in fact still live but not updated since 2017 it seems. His Facebook is live still as well (Why no take down Facecult?) I looked up his details on there and the blackmatersus site and what I came back with was a cell phone out of california marked as a bad number and a site that has been around since 2015 that was registered anonymously and kept so throughout the time it has been up.

http://aktivnyye.com/t/20171013-blackmattersus.html

I am sure with more digging on the name (Nolan Hack *amusing*) I can put together more of the breadcrumb trail to show the cutout’s actions. Maybe in a post to come, but suffice to say that this data also is legit and tracks with everything we have been told by the IC and the news up to today on the active measures by the IRA.

Passwords:

Amazingly enough in the screen shots given on the jokerbuzz site you can also see where Alex tried to remove at least half the passwords in a couple posts. I immediately knew what the password was because, I mean, come on! The phrase “Greed is good” is a classic line from Wall Street and Gordon Gekko. If you look close enough at these images though you can make out the lower part of the G so you know it is that. Now we have to work backwords on those accounts and get the full data in order to attempt top maybe log into them and see what intel we can gather from them (see below for lower part of the g) It also amusing to see that these guys were sloppy and re-using passwords in various accounts. If we get the accounts right I am betting we could own them all and gather much more insight.

Greedisgood…. You guys amuse me.

Illegals Names and drop sites:

In amongst all the stuff is also an address and name where drops were made in NV used by the IRA and more likely the illegals who were in country. The address comes back to a known bad drop/company in NV that has a history of being used for Ebay scams. The cutout name of Gneeda Harris has zero history on first pass but I will look again and dig a little more. Maybe I can turn up something more on this ID but at the very least we have something more to work with than what the special counsel decided to drop on us.

Maybe the FBI can check this place out and see if they have had DVR’d video surveillance? Maybe this dead drop is still live? Are there still illegals in country that have been told to sleep? I wonder…

Metadata:

Lastly, or near the last thing I will cover here on this is the metadata. I used wget to pull down the jokerbuzz site and in the folder for the page of the auction are the screen caps used. Pulling those down and then running them through the old EXIF scan you can see that these captures were done September 28th and 29th 2016. The time stamp says +3hrs and that as of today they were done 1 year 4 months 28 days ago. So, back in September 2016, this data was in the hands of AlexDA and ostensibly about to be put up on Jokerbuzz. This means that either someone on the INSIDE decided to sell out the operation because they knew they were blown and wanted some cash, OR, someone hacked them and downloaded all this shit making the screen shots in September for the jokerbuzz auction. This in tandem with all the backstopping I just did shows that this data is legit and it has been on sale for at least a year and no one knew or was clued in enough to say anything about it.

Who is AlexDA?

Lastly, who is AlexDA? How did they get this data and what is the motive here other than money? Money mind you that they did not get in over a year as the auction timed out and NO ONE bought it. Now, I have been looking at who this may be and there is a case to be made that this dump came from Shaltai Boltai (humpty dumpty) a group that is now broken up due to arrests but has one last player on the loose. That player is in fact a guy named Alexander Glazastikov who has not been caught and may in fact be AlexDA. I will also point to the fact that if you look at the Jokerbuzz auctions there are a number of them from Shaltai Boltai offering all kinds of interesting data leaked from Russian operations. So, it is my guess that this is the case but just an educated one. I for one would like to have a conversation with AlexDA and see just how much he wants for the dump now that it has not sold in over a year. Maybe we all can crowdsource it?

Summing Up:

Anywho, this is what I found just by looking at the details here in the auction post. Imagine what we could have if we actually had all the documents? Hell, I would love to get my hands on them, prize out all the details and then pass it along to the feds. The data is legit, it has been around for a year online, and we all missed it man!

Hey AlexDA, you wanna just gimme that data for free feel free to reach out to my protonmail acct!

More stuff when I have it kids.

K.

Russian Meddling: Indictments and Troll Farms

The indictment by the Mueller special counsel investigation into the meddling by Russia into the election cycle last year is just another nail in the coffin on the conclusion that there was no action by the Russians to affect the election cycle in favor of Trump. Though many still have their cognitive dissonance helmets on full, the reality even struck into the White House with Trump tweeting out that there was actually meddling, no collusion, but meddling. So this indictment has shown it’s potential power on the whole case but I wanted to dig a bit deeper into the Troll farm and it’s KGB ties before we ever heard about it as a general populace post 2016.

Point of fact is that in 2015 Adrian Chen wrote about the Troll farm as it was still carrying out attacks on Russia’s other pressing enemy, Ukraine. People seem to have forgotten with all of the talk about the farm in 2016, that the Russian propaganda and PSYOPS machine was actively working for Putin in support of his agenda against Ukraine and it is this fact and how they operated then that should be addressed and shown how they evolved to today’s hybrid warfare tip of the spear.

Back in 2015 the nascent troll farm was active in trying to spin stories about Ukrainian ologarchs and their activities as counter to Russia. One particular story line took place after the assassination of Boris Nemtsov, an opposition candidate to Putin and a progressive in Russia. A reporter for a Russian news service did a story on the Troll Farm and actually managed to gather their documentation including opposition research (internet research) which later would be the name they would take up as IRA right? Anyway, within that cache of documents you have papers with links on things like the Middle East and other areas with ideas on how you could attack them politically with posts like the above on Nemtsov’s being killed not by Putin, but instead by those nasty Ukrainians.

It is informative to look at the postings and the nick names that were being used by the early IRA as opposed to what they have used in 2016 and still use today. In early days they did not really try to insert themselves so well into the public space as being citizens of the areas they were talking about, in fact, most of the names have English connotations  and not Russian at all. So by looking at the users and their posts (livejournal for instance) show’s you what it was like in 2015 spinning up and learning. There may have been just as many Twitter accounts but for the most part they were using Livejournal, which makes sense because at the point this was going on, Russia had bought Livejournal…(I left LJ when they did)

No. П / П	THE CHANGE OF KAZAKABBAEV TATYANA	CHANGE OF LEBEDYANTSEVA OLGA
1 2	mazurov_89 braille_teeth	vehofunzi qitsen
3	koka-kola23	raphahunthig
4	lipyf837	panebcaj
5	vince-crane	tergparriotio
6th	ya_karnavalova	lihohor
7th	nannik-dr	sojaan884
8	Rezites	cypetcompbis
9	konorlaoo04	destforkowoo
10	qkempek	nouglysv
eleven	caradoxee5	petraffilya
12	ynuka	Backlashealthma
13	natalex84	amenem
14	anna_02051990	paintbellu
15	mrokiralex	iugegeizh
16	annetjohnson	pexirgarnez
17th	rghkride	chicocali
18	gkohio	pexirub
19	karber861	kmfemovmpxxx
20	innyla92	lojtautome
21	cotedo	inkiptiruc
22	Smurfetka-24	palecefaz
23	raikbowee1	hhlayz
24	ohvis134	ningcotedin
25	demouu1	olginarkew
26th	nofk452	renfidebun
27th	alexander7171	portlandam
28	vadro	olga_lebedyan
29	makgxiewua	andriudruz
thirty	mofan926	unmolarlay
31	smspudilj	repaw968
32	varkhotel	stepalexos
33	shtots	prasingyy55
34	rijbc	steltertheeness
35	wylwurwolv	spinrarata
36	workroman	ddesesexla
37	pheyeroo57	antaauu4
38	tritonst	wihhie917
39	milka_e20	pagkagezmeat
40	codirips814	werhellvolkfu
41	lorislaley	tiopretytcur
42	eekim81	aladorzam
43	oftibar	nyntynuriu
44	elegmhehov	begtotenlu
45	aple_at_the_tab	abezhiu
46	Nikolaabil	oxyitt
47	hey_son1c	rabrukywiz
48	firyupa	snowdidsmomuds
49	asus	paradana
50	Symatvei	durenhuntpi
51	xamit251	sixfeevae
52	farpodmuu07	nebozuanrou
53	oloviit	procomdn
54	diuu085	kovikotuss
55	alenkujl	urigcon211
56	rcrims	peosaytranos
57	snoop83	borgperwensgod
58	vynal	rhealaltrades
59	sportto	nishihatu
60	danybody	asafasngut
61	alexmosyan	cophetycoo
62	poragpalkhe	merzasarsgepf
63	sergalyev839	promvogtsigold
64	vadim_spx	pesina20k
65	rus-policy	vuhyzowi
66	wafyy248	skewerilgraph
67	katerina2703	wladmancornnes
68	dragon_uz	feedpecosleft
69	Winter-kinder	prosorouqu
70	Pjobynrutri	frantirigesch
71	green_margo	cirgadisla
72	ptirenw	precalacov
73	pastogross	zlavaq037
74	igerenbart	hrilepswia
75	mskilys	szehdes
76	pantyyy08	bestthecalpa
77	thepicard	lasorpprogso
78	igtego	classatopos
79	paqurni	zipkingfilci
80	emory6townsend	preaphoubowo
81	aspera76	geoversive
82	zymecs	gingsenpirem
83	001usa	tes40uvir
84	ca119idia	judj747
85	fadaqpm	throwenelan
86	pybden	sfouninmire
87	Protsyon	diotradconpe
88	phidiwp507	llanpaclaive
89	makabu	neytilmigers
90	osobroim	glyzitneko
91	yuliya_korshyn	metcentlighrou
92	Parabellum50	bentakiffo
93	policyrus	pqalongese
94	tuyqer898	chaicoffskaya
95	aljin	cenhoufimou
96	rammathets	siohuntired
97	overtimorouq	feascoacoca
98	overtimorouq	prozaet
99	ntnwoc	inga
100	stranamasterov	glycmamortga
101	ktoroj14	imclasfulte
102	Yohohoguy	izorylie646
103	pbijipsfem	lighwinsbrachig
104	wyazfunovv	mafomeri
105	ariol921	oryanhuazo
106	mariya-789	kfuu0
107	roavrumper	daytrolchildcha
108	kyxapka	odassaflot
109	ryypaulinm	tamred1
110	jang033	paca979
111	wwwevgemie	vollatasklu
112	p01t11	legahedddis
113	pohezvitie	othoee111
114	zhakim755	trugleyscorun
115	Asswalker	ybdocegesch
116	vvp2014	rpmuntar
117	to12scorta	nahezuu91
118	Spicemachine	socompdanfi
119	nastia642	beadeadsdentfi
120	nungsorivat	pia986
121	homyr657e	pzsg
122	orlenrenosr	pdachee
123	kalininkhu	paschig
124	parydaq070	plimtintaza
125	enot_kot	ptimenalhook
126	abfyr890	Ladushki2014
127	vamiqyy63	photographereye
128	evgenyashm	balyk2014
129	palfemine	polza1985
130	tay-zakulisnay1	polina_i_liza
131	radbec	gymbreaker
132	revivaldude	strelach
133	cykularj	tolstunovich
134	ageev013	demosfen-en
135	porkimes	Ikehujaik
136	owwaxde082	nersis
137	andrei-kovrin	IvanichKem
138	pasioda	BVDfan
139	fooqbal951	bookworm-war
140	nugotvapi	nina_zlova
141	swull786
142	nina_istomina
143	gig180
144	raokabea
145	synbmulty
146	beloham848
147	lissa-marioko
148	kater971
149	peflirz
150	hikonozauu00
151	hikonozauu00
152	michael_jd
153	uglycoyotespb
154	urajr
155	bobzan
156	peulgieness
157	scavamerzl
158	levyshkinr
159	pavetbrer
160	ddanii33
161	goodrus
162	supersonicwall
163	mannaliobrit
164	pierii01
165	panbiran
166	georgi-grusha
167	pashka208
168	vmoffee179
169	etopiterdetka99
170	jenyamelika
171	anya_rocket
172	snowy_trail
173	malkovich_i
174	samiyymniy
175	chadimi
176	kvazarion
177	Nestero85
178	nika_anisina
179	savoiyar
180	oksadoxa
181	mercymt

Most of these you have to look up with the Wayback Machine and you will notice that a lot of them were one off posts and that was it. Just sowing the ground for the infowar and then linking that post around. For Ukraine and anyone who has been paying attention, the PSYOPS and Hybrid War has been ongoing for many years so this is nothing new. For the US, well, the general populace that is, they hadn’t a clue I guess but I wanted to get across to you that what they pulled off in the US wasn’t new, it was just the next evolution of what they have been doing all along elsewhere. It was the magic of ubiquitous social media and a really polarized political landscape that made it work so well in 2016.

So with this indictment we can peek further under the hood of the hybrid information war against the US election process. It seems that this all kind of was being at least thought about in 2013 when Putin was pissed off with Clinton about his own elections and some of what later came out in the cables that were dumped by Wikileaks. By 2014 the notion of hybrid warfare had been put out by the Gerasimov and Russia was starting to plan. The creation of the Troll Farm I personally think was a part of the Gerasimov doctrine’s modus operandi that the SVR/GRU and Putin decided to create for this purpose and furthermore that the first fledgling attacks were the prelude to what would come in 2016. Certainly by 2015 they were spinning up and already had assets in place in the US gathering intel and creating the baselines for the attacks.

Truly this was a hybrid form of warfare using human assets and technical ones to carry off the plan. This wasn’t just some one off fly by night operation, they invested a lot of time and money getting assets in country (US) to collect data and to add to the planning stages. They then went as far to hire out servers in the US and create VPN’s to make it look as though their troll armies were actually here in the states. Add to this the fact that they also used carding sites to create users and bank accounts to fund the operations also speaks to the sophistication of the operation.

This wasn’t dedushka’s propaganda operation!

So what does all this mean other than it is an entertaining diversion for those who want to go down the rabbit hole OSINT wise? Well, it shows that the Russian plan was larger than one might have thought, more effective than some still think, and was but one component of a larger operation. That last bit is key for me to get across to you all. Of late I have been seeing reports online since the indictments came out that said the campaign really did not affect the election and this is poppycock. This was just a part of the larger whole and to take this module of the whole plan and separate it out to say nothing happened, is idiotic.

Though the President and the Russian operations still ongoing would like you to believe this is the case, it is a falsehood. In tandem with the hacking and the leaks, the Russians most definitely affected the voting by the populace. In fact, when information starts to come out about how Analytica data targeting very specific groups and regions comes to light you will see just how much the whole is the sum of the parts and the synergy was leveraged. This was no simple hack and dump of data, there were psychologists and social scientists involved as well as technicians and hackers.

This indictment just sets the stage for more to come my friends… And seeing Donny squirm and rage has been amusing.

More will come. For now though, do read the aricle and look at all the docs in the Google docs dump there.

Dos va donya

K.

UPDATE: I am going through the metadata of the files from the Google drive and I have found a document that comes from a .mil address (function.mil.ru) and this document (Nightly TK of 06.01) gives direction on post keywords and writing direction for content.

Ночное ТЗ от 06.01

It was created 1/26/2015 by “user”

You can now see a military connection to the Troll farm.

Create NEW Ransomware: Darknet Site Ransomware Scheme

Surfing the darknet as I do, I came across this little gem of a site today. The idea here is that you can share in the bitcoin ransom by entering your wallet address and then getting a download of the malware to deploy wherever you like. This seems like a ponzi scheme to me where you offer a great reward for a little action and in the end you get ripped off but ok, let’s run with it. The site is in the darknet and I am not sure if or how they are publishing this site elsewhere so people can find it and use it. I must say though that the site is more complete than I thought it would be once you start to dig and the ransomware is new to me as well as it seems to be to VT and Hybrid.

So yeah, I decided to play along and I used someone’s wallet to start the process here. Who’s wallet you ask? Well this guy’s wallet will do since he has never had anything in it. So it’s fairly simple, you put in the wallet address then solve the captcha and lo and behold you download the ransomware. I also decided to see if I put in an alternate wallet address would I get another hashed file, and yes, yes I did. I only changed the wallet address by one letter (a) and got a new file that I uploaded to VT after the first one.

 

Upon upload to VT and Hybrid I get hits on the major players and the designation of the malware is of course ransomware but you choose the name you like because there are too many per the AV firms (please stop this)…

So yeah, the ransomware is not so stealth and likely anyone with current AV will have some intervention one hopes …But how many really keep their AV up to date and working?

*sigh*

Anyway, I uploaded it to Hybrid and got the following report and the second with the second sample here …

 

The malware reaches out to the darknet via .casa online bridge to the darknets. Once you plug in that address you get the Qrypter site frontend. This site is your C&C ostensibly to track your malware and your bitcoin “donations” from the poor sods who get the malware. The unfortunate bit is that when you go to the url that is in the malware you get the following sad news:

OH NOES! Are you smelling a scam? Cuz I am kinda smelling a scam here now…

Anywho, the interesting bit for the site itself is that it has a display on how many AV vendors are seeing the malware and as of today it’s… Wrong?

Mmmmmmyeaahhhh no, I see 14 vendors seeing this as malware and I have just added to the hash pile by uploading my samples here so that is likely to get even more detected as the day passes on. So, this is an interesting turn in malware as a service, or in this case Ransomware As A Service (RAAS) as I have seen out there on the net. I have captured the whole site in the darknet and I will be spending some more cycles on the malware later on so updates will likely follow on this post. For now though, just enjoy the novelty and the derp.

Cheers,

K.

UPDATE: This is evidently a new replay of something seen in 2017

Useful Idiots, Russians, and FISA Warrants

Now that the Nunes memo is out and all the news cycles have been spent ad nauseum on point-counterpoint of the cherry picked facts ol’ “recused” Devin put to paper, I thought I would add my two cents here. The fact of the matter is that Nunes seems to have been in the pocket of the Trump admin from the get and this memo was just crafted as part of a propaganda operation to give Trump shelter to possibly plead the fifth in interviews with Bob Mueller. The idea goes like this;

• The FBI is bias

• The DOJ is bias

• The Steele Dossier is bias and false… Oh and it was paid for by the opposition!

• The Steele Dossier was used as the predicate to eavesdrop on poor innocent Carter Page!

• By proxy of use of the Steele dossier to obtain a FISA warrant and continued approvals it was BAD! and ILLEGAL!

• I, Donald J. Trump cannot get a fair hearing out of the BIAS FBI/DOJ/Mueller! So I will plead the fifth or not talk to him at all!

I would like to set aside all the cognitive dissonance that Trump and his quislings would like you all to suffer and show you some facts about good ol’ Carter Page that make the introduction of the Steele dossier a trigger to legally get a FISC court to approve of extensions on surveillance. Pay no mind to the general argument that the surveillance was illegal at all or that the FBI lied their way into getting approval to do so because that is just wholly untrue. The warrants were warranted and the data that enabled the FBI to listen to his conversations and watch his texts and emails wasn’t just this “dossier” (notes really) that came from the opposition investigations started by the GOP in 2016. You see, Carter had already been on the radar of the FBI since 2013 and this is an important fact to all of this.

You see, back in 2010 the FBI popped “The Illegals” in NYC, remember? The 10 NOC operatives in the US looking to gather intelligence and connections that the SVR (Directorate S) could pass to Directorate E at Moscow Center. You might all remember the most spectacular of the reporting concerning Anna Chapman, the ersatz NOC who managed to get pretty close to a number of important people within the constellation of the US president. Well anyway, those guys were popped by the FBI, which in turn left another group of NOC agents for the FBI to start working on with renewed vigor and FISA warrants. In 2012 the FBI began to intercept communications and tail one NOC agent and two official cover agents in the NYC area (where Anna and others in the 2010 ring were) who were out there working to gather intelligence and recruit assets.

The three, revealed in 2015 via affidavit in NYC, were Evgeny Buryakov, (NOC working for Vnesheconombank), Igor Sporyshev, and Victor Pdobnyy. Buryakov was the contact man and the two others (Igor and Victor) were his bag men and controllers passing information to and from Moscow Center. During the time that the FBI was surveilling and carrying out intercepts on them, the handlers (Igor and Victor) were heard through the intercepts talking about various other things like how they thought being a spy would be a bit more Bond like and other routine things. Until that is, one day they were caught talking about a certain individual that the Affidavit names as “Male-1” which was later confirmed to be none other than Carter William Page, the boy wonder.

Igor and Victor really didn’t have that much nice to say about Carter, basically calling him what the Russians in the trade call a “полезный идиот” or useful idiot. In reading the text of the intercept you can see that Carter was eager to have connections with potential Russians who could garner him access in the Russian government and or business environment such as Rosneft. He emailed Victor who had given him his card with two email addresses on it that the FBI was most likely monitoring as well, though the affidavit here does not outline this. In any case, all of these conversations were captured in the SVR offices that the two were working in and had been compromised if not by SSG at the very least by FISA intercepts of the infrastructure used to send messages. In this case though, the conversation was caught on a bug in their offices *wink SSG*

So it seems the plan here concerning Carter Page was that they planned on grooming him, using him for intel with the lure of getting him hooked up to make a lot of money and or, to get him to do something for money and then use that as kompromat for more later. It seemed that Carter was interested but the FBI stepped in and interviewed Carter in 2013 and nothing much more is said about him by the FBI nor the two SVR agents that we the public have been made aware of. The affidavit in 2015 relates the tradecraft and the operations the Russians undertook up to and including an interesting interlude where the FBI sent in an agent of their own ostensibly making overtures about making a deal on a casino in Moscow. Suffice to say it is interesting reading and in the end the three were rolled up with Evgeny (Zhenya as he was referred to) arrested by the feds and the other two returned home to Russia having been blown.

If you read the whole affidavit you get a pretty good picture of what they were up to and a lot of the espionage they were carrying out centered on financial information and, wait for it, wait for it, “sanctions” against Russia. Gee, now where have we heard a lot about sanctions lately say since like 2016? Right, these guys were working on the same types of information gathering and asset recruitment that the previous ten illegals had been doing for the same SVR division. So, are you all seeing the pattern here? In the case of Carter, he happened into their sights because he wanted, needed, was hungry for those connections to the Russian oligarchs within the energy sector that he was working in himself. He showed the two SVR officers that in the MICE or RASCALS list of reasons to spy, money was his biggest motive according to Victor in the bugged conversation in 2013.

Right, so Carter has already come into contact with the Russian SVR in 2013 and has been admonished/interviewed by the FBI. You might think that he would maybe back off a bit but not our Carter! He goes on to only ingratiate himself with the Russians and as time goes by, either is put in the way of Trump by the SVR by way of Paul Manafort, or, by just blind luck he ends up not only in the Trump orbit but also inside the inner circle as an expert in foreign relations. How might have Manafort been directed possibly to use Carter Page? Well, if the SVR kept it’s records it may have nudged him in that direction because they KNEW they could possibly use Page because he was so eager in the past with Victor and Igor as well as his multiple trips to Russia to “make friends” there.

So when Carter suddenly turned up in the Trump inner circle, and the Steele dossier mentions overtly that there was intelligence given by a source that Manafort was using Page as a proxy as well, then the FBI just had to go back to it’s records on Page and the 2013 incident. Honestly, this is not that hard people! So, when the FBI went to the FISC to get a new warrant as well as to extend them, they had a history already that likely contained even more information on Page and his interlude in 2013 with the SVR to use as just cause to get a warrant signed and intercepts started.

But once again, it was not Carter Page and his FISA warrants or intercepts that started the Mueller investigation kids, like the memo said, that was Papadopolous!

But I digress…

Back to Carter and his Russian pals. You see in the Dossier by Steele you also have direct intelligence product that claims that Carter met with Igor Sechin who offered him tasty tasty things for some sanctions quid pro quo in 2016. Notice that this guy is involved in Rosneft, a name you have heard before and within the space that Carter claims to be expert in. If I were the FBI then I would be looking rather closely at ol’ Carter and getting all the information I could out of him. Obviously just having another nice little chat would do no good.

Well, all of this just refutes any claim of “poor me” by Page in my book and I am sure the IC as well. The whole #releasethememo crap was just another propaganda/hybrid warfare program by Russia and the Trump administration with the help of the GOP in my book. It’s all a little like playing Clue, and it certainly does look like it was Professor Page, in the library, with the candle stick if you ask me. Much of the Steele Dossier information has been backstopped by information that has come since it’s creation. We have seen a president and his minions all act guiltily and extremely stupidly in trying to cover up their connections and it is just all the worse that this group of people has been aided and abetted by the GOP. The memo release was just the cherry on top of the shit sandwich but it should not distract all of you from the truth of the matter when you do the research and pay attention.

Whether or not Trump actively has been an asset of the Russian SVR, or an unwitting полезный идиот, I for one believe now he knows the scope of things and is trying with all his wiles to get away with the biggest con he has pulled to date; that of taking the presidency with the help of the SVR and GRU. Certainly Manafort seems to have been a bit more directed and in a bind because he owed so much money to a Putin aligned oligarch, but Page is clearly an idiot, just watch any of his TV appearances to see for yourselves. Alas though, you needn’t be a super genius to be used by the SVR and effective enough to damage the country targeted.

There you have it kids.

K.

Ethics In Hacking and Dropping Code

With the release of Autosploit, a tool for automatically scanning and exploiting hosts located via Shodan.io, a shit storm erupted on the ethics of releasing a tool like this. The problem has become just how easy it may now be to automate the attacks on vulnerable systems en masse that this tool could potentially provide. In an age where IoT devices as well as SCADA and ICS are sitting online in vulnerable states makes the possiblity of great damage to large networks more probable with such a tool. It also brings to the table the idea that the barrier to success on such attacks has been lowered to a new class of individuals with a limited knowledge base and creates an asymmetric threat model of a single individual able to wield greater attack capabilities with one tool.

Many arguments have been made on Twitter about the efficacy of releasing code like this but most have not focused on tools per se but instead on malcode or 0day’s. Now that there are bug bounty programs and companies that sell vulnerabilities we are living in a more dangerous time where the few with the money could buy exploits and do mass damage or commit mass surveillance and espionage. This also applies to countries willing to pay for 0day exploits to be in control of the attacks and have the upper hand. Think about that, our politics and our lives are at the mercy of code being sold to the highest bidder. We have weaponized code and tools made from it on a medium that was supposed to enlighten and bring us all together. Instead our baser nature has made the internet and everyone’s devices a tool for repression or subversion.

After the release of Autosploit, the hue and cry went up, and rightly it did. In a time where we have people releasing code and remarking “Let the world burn” I think it is time that we began to talk about the ethics of doing these things. Ethics kids is a philosophical discipline where you consider the moral responsibilities of what you do and the effects your actions could have. I think that too many people of a certain age group have had little to no training on ethics and this has helped to lead us to where we are today. In this specific case let’s talk about the ethics of releasing any code or tool that would lead to potential disastrous effect.

Many tools over the years have been dropped for free by hackers out there that could and were abused by others who downloaded and used them for their own desires. I have been exhorted to mention things like BackOrifice or L0phtcrack in the past and, well, there you go. Both tools were used for bad purposes as well as ostensibly good in the hands of penetration testers. Of course these were just placed on the net for free for anyone to have at first and this is where the quandary starts right? Did L0pht or CDC consider the potential damage that could be done with their tools? Did they put them out there with some self awareness that they may in fact be complicit in crimes because the tools that they created and distributed, for good or for ill, could be misused?

I point you all to Alfred Nobel, the inventor of Dynamite. He created a tool that would help in mining but in the end that tools devastating effects were used in other ways to hurt people and wage war. In an obituary that was accidentally run about him instead of his brother, he learned what the world perhaps thought of him regarding his invention. This bothered him so much that to atone for his actions he created the Nobel Prize to further science and other pursuits that do not further the harm of others. The idea that his inventions use for ill and how he would be perceived by history prompted his ethical response.

Today, we have people creating tools that could be misused and in some cases are for the sole purpose of misuse. The Autosploit tool may be a boon for some penetration testers, but the reality is that it is just another mass scan tool that seeks out vulnerable systems throughout the whole of the internet and loads the exploit potential to just break into them. This is not a refined tool for a scoped penetration test, this is a tool for mayhem. This is why I think others have made comments about the way it was released and the dangers in doing it so. The ethics though seem to have been glossed over concerning this release. What are the ethics of Autosploit’s creation and release on a Git repo? What is the morality behind doing so? Are there arguments for either of those or is it just another hacker saying; “Let the world burn” with no thought or accountability because it is the internet?

The problem we have today is that there are no ethical demands being placed on these coders and hackers. In fact, the whole notion of hacking has a very troubled side where illegal activities are the norm because the ethical and moral question of “should I do this” has not even been contemplated over the desire to know things. Sometimes I personally think that there is a fair bit of sociopathic behaviour in this community to begin with so that actually kind of aligns with the argument that ethics have not even been contemplated in some of these works. So as we move forward into a world of cyber warfare we have to care for the ethics and morality of what we do just as we have in all other forms of warfare in the civilized world.

While people like Katie Moussouris advocates for penetration testing tools being classified in ways that they are not declared illegal, we too have to look at the ethical concerns of the tools and how they are released to the world at large. Wassenar is a great idea but I feel that it is a myopic approach to larger issues in our ever more connected world. If you look at the actions of the Balkanization of the internet, you can see the actions of China and Russia joining together in a pact to repel the US hegemony in the internet you have to follow that all the way back to the tools that make such issues possible. The tools that you all create for hacking and exploitation that you should have some ethical concerns over when they are used perhaps in ways you did not intend.

Thus, take the ethical pause before you just dump them online …Unless all you care about is watching the world burn.

K.