I have no idea - I am only commenting on the logic of the excerpt that Decatur provided. It explains why the images of live data is better (for some purposes) than examining hard drive contents after the fact.

Of course it is possible Crowdsrike manufactured the 'evidence' - but that is a different issue.

IS there a way to ID the hackers after the fact? after the hacker has come and gone? Is there a way to cipher all this from the hard drive data? I just dont have any idea of how sleuths these internet sleuths are. Envious of those who do.

2 ...

Report Post

Posted by tigerinDC09

Washington, DC

Member since Nov 2011

4741 posts

Posted on 7/17/18 at 9:46 am to ChineseBandit58

quote:
I have no idea - I am only commenting on the logic of the excerpt that Decatur provided. It explains why the images of live data is better (for some purposes) than examining hard drive contents after the fact. Of course it is possible Crowdsrike manufactured the 'evidence' - but that is a different issue. IS there a way to ID the hackers after the fact? after the hacker has come and gone? Is there a way to cipher all this from the hard drive data? I just dont have any idea of how sleuths these internet sleuths are. Envious of those who do.

I can understand the confusion from those who aren't cyber experts.... With that said, what's the point of having cyber experts explain it if some in here won't even believe/trust what they say?

Even aside from the cyber forensics, you have intercepts of the GRU discussing the hack and their actions to clean up after themselves.

1 ...

Report Post

Posted by Decatur

Member since Mar 2007

28719 posts

Posted on 7/17/18 at 9:58 am to ChineseBandit58

quote:
IS there a way to ID the hackers after the fact? after the hacker has come and gone?

You can when they reuse command and control servers and malware.

quote:
But some of the most compelling evidence linking the DNC breach to Russia was found at the beginning of July by Thomas Rid, a professor at King’s College in London, who discovered an identical command-and-control address hardcoded into the DNC malware that was also found on malware used to hack the German Parliament in 2015. According to German security officials, the malware originated from Russian military intelligence. An identical SSL certificate was also found in both breaches.

LINK

Edit: not sure I answered your question but I hope you find the info helpful.

This post was edited on 7/17/18 at 10:01 am

1 ...

Report Post

Political Talk - Replies to Post

Return To Board

Page 1

Return To Board