Russian Hacks: is Alisa Shevchenko the culprit, a scape-goat or a little of both?

[peterdavidcarter]

https://www.theguardian.com/world/2017/jan/06/russian-hacker-putin-election-alisa-shevchenko

She suggested that the US authorities were guilty either of “a technically incompetent misinterpretation of the facts” or had been fooled by a “counterfeit in order to frame my company”. Those who could have had an interest in framing her could include competitors, US intelligence or Russian intelligence, with the goal of screening the real culprits, Shevchenko said.

“A young female hacker and her helpless company seems like a perfect pick for that goal. I don’t try to hide, I travel a lot, and am a friendly communicative person. And most importantly, I don’t have any big money, power or connections behind me to shrug off the blame. So really, it could be anyone.”

I'm sure the fact she happens to be extremely attractive doesn't hurt her media profile, but was she selected to draw attention, or maybe she chose to draw attention to herself??

[Thesh]

It sounds to me like she wasn't personally mentioned, just her company included in the sanctions. That she finds zero days means that it's entirely possible that the Russian government, directly or through another company, bought zero days from them that were specifically for the DNC hack, without their knowledge. In that case, she is neither a culprit nor a scapegoat.

[peterdavidcarter]

So you think she might have provided software to a third-party company who then used it to hack? It's a plausibly theory. But surely it's one the CIA would have considered themselves. By outing her in this way, in addition to closing off most of the 'white market' they've opened up a lot more other avenues, I would assume. Surely that must have been considered before the decision was made to name her company.

[Thesh]

So you think she might have provided software to a third-party company who then used it to hack? It's a plausibly theory. But surely it's one the CIA would have considered themselves. By outing her in this way, in addition to closing off most of the 'white market' they've opened up a lot more other avenues, I would assume. Surely that must have been considered before the decision was made to name her company.

Sanctions are a political decision; it's likely they just went through the report and sanctioned anyone involved.

[peterdavidcarter]

So you think she might have provided software to a third-party company who then used it to hack? It's a plausibly theory. But surely it's one the CIA would have considered themselves. By outing her in this way, in addition to closing off most of the 'white market' they've opened up a lot more other avenues, I would assume. Surely that must have been considered before the decision was made to name her company.

Sanctions are a political decision; it's likely they just went through the report and sanctioned anyone involved.

Interesting. I assume to be effective the sanctions list must be public domain? Would you have an idea where I might be able to find it?

[peterdavidcarter]

Nevermind, it appears the full list is here:

https://www.treasury.gov/resource-center/sanctions/OFAC-Enforcement/Pages/20161229.aspx

So if anyone's struggling to find a hacker for hire, now there's a public directory.

[cphite]

It sounds to me like she wasn't personally mentioned, just her company included in the sanctions. That she finds zero days means that it's entirely possible that the Russian government, directly or through another company, bought zero days from them that were specifically for the DNC hack, without their knowledge. In that case, she is neither a culprit nor a scapegoat.

The evidence points more towards a spearphishing attack... basically Podesta was sent an email asking him to change his credentials and the link took him to a fake website - presumably on a machine owned by Russian intelligence.

Which really doesn't require much in terms of sophistication; it's a fairly routine attack used by identity thieves.

My guess is that it's one of two things... one, the IC has information about a hack (or hacks) that is completely different than anything they've hinted at publicly, and they don't want to talk about it for reasons; or two, they have nothing at all in terms of evidence, and think that blaming a company like hers helps make their case from a public perception angle.

[Thesh]

The evidence points more towards a spearphishing attack... basically Podesta was sent an email asking him to change his credentials and the link took him to a fake website - presumably on a machine owned by Russian intelligence.

Which really doesn't require much in terms of sophistication; it's a fairly routine attack used by identity thieves.

My guess is that it's one of two things... one, the IC has information about a hack (or hacks) that is completely different than anything they've hinted at publicly, and they don't want to talk about it for reasons; or two, they have nothing at all in terms of evidence, and think that blaming a company like hers helps make their case from a public perception angle.

This is about the DNC hack. The Podesta hack was against the Clinton Foundation.

[cphite]

The evidence points more towards a spearphishing attack... basically Podesta was sent an email asking him to change his credentials and the link took him to a fake website - presumably on a machine owned by Russian intelligence.

Which really doesn't require much in terms of sophistication; it's a fairly routine attack used by identity thieves.

My guess is that it's one of two things... one, the IC has information about a hack (or hacks) that is completely different than anything they've hinted at publicly, and they don't want to talk about it for reasons; or two, they have nothing at all in terms of evidence, and think that blaming a company like hers helps make their case from a public perception angle.

This is about the DNC hack. The Podesta hack was against the Clinton Foundation.

The two hacks are are related according to the CIA report... and the fact that the phishing attack sent Podesta to a server tied to Russian intelligence is one of the only pieces of actual evidence that's been made public, and that (presumably) points to Russia being involved.

[peterdavidcarter]

The evidence points more towards a spearphishing attack... basically Podesta was sent an email asking him to change his credentials and the link took him to a fake website - presumably on a machine owned by Russian intelligence.

Which really doesn't require much in terms of sophistication; it's a fairly routine attack used by identity thieves.

My guess is that it's one of two things... one, the IC has information about a hack (or hacks) that is completely different than anything they've hinted at publicly, and they don't want to talk about it for reasons; or two, they have nothing at all in terms of evidence, and think that blaming a company like hers helps make their case from a public perception angle.

This is about the DNC hack. The Podesta hack was against the Clinton Foundation.

The two hacks are are related according to the CIA report... and the fact that the phishing attack sent Podesta to a server tied to Russian intelligence is one of the only pieces of actual evidence that's been made public, and that (presumably) points to Russia being involved.

Yet all the sanctions on Shevchenko state is that she 'provided materials'. Given a large proportion of her articles are public or semi-public domain, and are completely legal, it seems odd to include her in sanctions on that basis, unless there is a hidden agenda of some sort.