DNC Hack Movie Release Date

J.J. Thompson
SECOPS
Published in
5 min readJan 6, 2017

Its inevitable that there will be a movie about the DNC hack and the ripple effects it will have for years to come. After all is said and done, what will the script look like? Here’s one rendition that may just leave you thinking “its possible”.

SH33PD0GS Monitor the 2016 Elections from the Rook Security Operations Center in Indianapolis

Sarah Volkov stared cautiously around the room as the intensity increased. Back in January Hillary, a shoe in for the Presidency, requested that her team prepare a “plan B” in case the unlikely event that citizens began to lean toward electing her opponent. It was now June. Months before the election and news just broke that was surely to put Trump’s poll numbers into a tailspin. The DNC had been hacked and the hired cyber-sleuths had concluded that the attackers were from not only Russia, but were part of a state-sponsored hacking group. The media began to speculate that the hackers were acting on behalf of business associates trying to gain favor with Manafort, one of Trump’s top advisors. There was no hiding the palpable optimism around the table as jubilant staffers began to envision themselves in their new offices in the White House. Fortunately, “plan B” would never go into action as there is no way Trump could recover from this devastating blow. Sarah glanced at the Chief of Staff, Myriam Khaled, and was surprised to see that her boss seemed distant, almost distracted and unaware of the jubilant atmosphere around her.

The pounding in her ears was intensifying. Myriam could barely breathe as the realization that it was going to happen battled with her fear of being discovered. So far, all had gone as planned. The investigation was headed exactly where it was intended to as the forensics team found the trace evidence — remnants of IP addresses and malware left precisely where they would look for it. They had taken the bait. When their preliminary findings came back the team was thrilled. Not only had FlockSwipe identified the malware but they traced it back to eastern european IP addresses. Instead of using IP ranges known to send spam messages, therefore showing up in cyber security block-lists, these IPs were clean. This created a false flag that led the analysts to think that the IP addresses were utilized by more advanced adversaries instead of script kiddies. The malware was grabbed from a paste site where it had been placed right after it was used in an un-related attack. AdobeARM was chosen as the dropper as FireEye and other cyber groups had previously identified them as being of Russian state-sponsored origin. This had been reported on in a german site in 2015.

Articles like this were everywhere and it linked directly to the source intelligence report. And while its easy to obtain the malware online, the industry doesn’t question the analyst reports from analysts working at these giant companies.

All we had to do was find a cyber nerd who could find the malware, re-purpose it, but maintain the majority of indicators so it would appear to be nearly identical in style, methods, and authorship to code previously attributed to Cozy Bear and Fancy Bear.

It was a bit more difficult to figure out what to do once that attribution link was made as no one knows who exactly are the members of those two groups. Except for intelligence agencies. Fortunately, I still had that card from Geneva, where I met Minister Paplov. A few quick conversations later and we were all set. I needed to take pressure off of #emailgate, and with Trump climbing in the polls, needed to decrease his appeal. This move would do both.

And we wouldn’t even have to make the claim publicly. All I needed was for the Minister’s friends at the GRU to cooperate with the Kremlin and make a few comments here and there that would lead the public and the media to Manafort and his business relations with Russia. Of course they were more than happy to, as this would give increased status to Putin on the national stage and assist his defiance of the UN. The rest will happen on its own. In Schindler’s own words,

Covert action by itself cannot create political conditions, it can only exploit what already exists.

Eagerly jumping to support CrowdStrike’s attribution.

The news coverage that inspired the post.

DNC leaders were tipped to the hack in late April. Chief executive Amy Dacey got a call from her operations chief saying that their information technology team had noticed some unusual network activity.

That evening, she spoke with Michael Sussmann, a DNC lawyer who is a partner with Perkins Coie in Washington. Soon after, Sussmann, a former federal prosecutor who handled computer crime cases, called Henry, whom he has known for many years.

Within 24 hours, CrowdStrike had installed software on the DNC’s computers so that it could analyze data that could indicate who had gained access, when and how.

The computers contained research going back years on Trump. “It’s a huge job” to dig into the dealings of somebody who has never run for office before, Dacey said.

CrowdStrike is not sure how the hackers got in. The firm suspects they may have targeted DNC employees with “spearphishing” emails. These are communications that appear legitimate — often made to look like they came from a colleague or someone trusted — but that contain links or attachments that when clicked on deploy malicious software that enables a hacker to gain access to a computer. “But we don’t have hard evidence,” Alperovitch said.

While I believe this story is the one that will sell the most tickets, there were other great plots that could be adapted:

--

--

J.J. Thompson
SECOPS
Editor for

Founder at Spektrum Labs, equipping cyber resilience innovators in the cyber insurance ecosystem. #cyberresilience #blockchain #insurtech #tokenization