Attacks/Breaches

6/17/2016
11:00 AM
50%
50%

Lone Hacker Taking Credit For DNC Breach Is Likely Russian, Says Researcher

'Guccifer 2.0' claimed responsibility for the breach at the Democratic National Committee, then leaked stolen documents about Donald Trump to prove it.

Investigators pinned this week's Democratic National Committee data breach on two Russian state-sponsored advanced threat groups, Cozy Bear and Fancy Bear. Yet, shortly thereafter, an anonymous actor, going by the name "Guccifer 2.0," claimed individual responsibility for the DNC attack, and supported their claim by releasing what appeared to be documents stolen from the DNC, reported Ars Technica.  

Much is unknown about Guccifer's involvement or relationships with the advanced threat actors or the Kremlin; but what does seem clear is Guccifer's Russian heritage. Private security researcher PwnAllTheThings highlighted evidence, reports Ars Technica.

The researcher says the first clue is in the computer name Феликс Эдмундович obtained from the metadata inside the hacker’s Word document. This indicates the computer was configured to use Russian language. Translated, this name is Felix Dzerzhinsky who was founder of the Soviet secret police.

The second suggestion, says PwnAllTheThings, comes from the leaked Donald Trump Word document which carries a break in a link displaying the message “Error! Hyperlink reference not valid.” This document, when converted to a PDF file by Guccifer 2.0 and posted on Gawker, carries this same message, but in Russian. 

The third hint is the use of ))) in Guccifer 2.0’s blog post, which, says PwnAllTheThings, is a smiley used by people in Eastern Europe and Russia.

PwnAllTheThings adds clues suggest the hacker may not be native English speaking and also thinks the culprit is unlikely to be a nation-state.

For more details, read here.

 

 

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
6/20/2016 | 2:19:19 PM
Data Lost?
Has a report been generated yet to detail/catalog what precisely has been lost during the DNC breach?
What We Talk About When We Talk About Risk
Jack Jones, Chairman, FAIR Institute,  7/11/2018
Major International Airport System Access Sold for $10 on Dark Web
Kelly Sheridan, Staff Editor, Dark Reading,  7/11/2018
Mueller Probe Yields Hacking Indictments for 12 Russian Military Officers
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/13/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Cyberspace is much less secure than my old lamp.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-14363
PUBLISHED: 2018-07-17
An issue was discovered in NeoMutt before 2018-07-16. newsrc.c does not properly restrict '/' characters that may have unsafe interaction with cache pathnames.
CVE-2018-14349
PUBLISHED: 2018-07-17
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/command.c mishandles a NO response without a message.
CVE-2018-14350
PUBLISHED: 2018-07-17
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/message.c has a stack-based buffer overflow for a FETCH response with a long INTERNALDATE field.
CVE-2018-14351
PUBLISHED: 2018-07-17
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/command.c mishandles a long IMAP status mailbox literal count size.
CVE-2018-14352
PUBLISHED: 2018-07-17
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap_quote_string in imap/util.c does not leave room for quote characters, leading to a stack-based buffer overflow.