Russian Info, Cyber and Disinformation (Jan-June 2017).

[OUTLAW 09]

I have been drumbeating the use of Russian bot networks to amplify proTrump social media support....

And again I am not alone in seeing this Russian activity.....

Forbes
✔
@Forbes
Only 3 million of Trump's 20 million Twitter followers are active domestic users
http://on.forbes.com/60148r68O

So who is driving the remaining 17M Twitter followers....actually computer servers and humans in the pay of Russian companies and or the Russian Intelligence Services...simple actually...

Just many Trump voters do not want to really accept that small fact of life...

[OUTLAW 09]

Over SIX MILLION of Trump's followers are fake. Paid-for Russian bots, perhaps?
https://www.twitteraudit.com/Realdonaldtrump


So again no Russian connections...

[OUTLAW 09]

NCI Agency @NCIAgency
.@NATO SecGen @jensstoltenberg: "In 2016, NATO dealt with an average of 500 cyber incidents per month, a 60% increase on 2015."

[OUTLAW 09]

This is the story that's got @RussianEmbassy so afraid. Unmaking Peter Chayanov, Russian hacker and @Wikileaks host
https://patribotics.wordpress.com/20...-their-claims/


Wikileaks is Connected to Russia – Despite Their Claims
March 12, 2017 ~ patribotics

By Laurelai Bailey

Wikileaks has time and time again denied any connections to Russia or the Russian state, but – like Donald Trump – they are lying. This weekend, it was exposed on Twitter that they acquired major Russian servers – from a known hacker – one week before the Podesta emails were released.

I will walk you through the proof, since its a little complex for non computer experts. So let’s start with a primer.

All websites on the internet have an address, much like houses in the real world. This address are usually names and things you recognize, like google.com or amazon.com. But behind that address there are a series of numbers, unique to each server known as internet protocol addresses. If you have ever had to log in to your wireless router, you wound up typing a number into your browser like 192.168.1.1, this is an IP address.

Now IP addresses have physical locations, in the real world, and tools exist to discover where those addresses are.

Wikileaks -like every other website – has servers and IP addresses behind the domain name “wikileaks.org”. When we do a command on a linux machine called “dig” we find out all of the IP addresses behind the domain name. Here is the output of the dig command. Don’t worry if you can’t understand this part – just scroll down to the rest of the article. The writing in the middle explains it, but for those that want proof, we need to list how we get from a to b.

dig wikileaks.org

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.47.rc1.el6_8.4 <<>> wikileaks.org

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4839

;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 4, ADDITIONAL: 8

;; QUESTION SECTION:

;wikileaks.org. IN A

;; ANSWER SECTION:

wikileaks.org. 600 IN A 95.211.113.154

wikileaks.org. 600 IN A 141.105.65.113

wikileaks.org. 600 IN A 141.105.69.239

wikileaks.org. 600 IN A 195.35.109.44

wikileaks.org. 600 IN A 195.35.109.53

wikileaks.org. 600 IN A 95.211.113.131

; ; AUTHORITY SECTION:

wikileaks.org. 1470 IN NS ns2.wikileaks.org.

wikileaks.org. 1470 IN NS ns1.wikileaks.org.

wikileaks.org. 1470 IN NS ns4.wikileaks.org.

wikileaks.org. 1470 IN NS ns3.wikileaks.org.

;; ADDITIONAL SECTION:

ns1.wikileaks.org. 80774 IN A 46.28.206.81

ns2.wikileaks.org. 83083 IN A 46.28.206.82

ns3.wikileaks.org. 80774 IN A 95.211.113.131

ns3.wikileaks.org. 80774 IN A 195.35.109.54

ns3.wikileaks.org. 80774 IN A 31.192.105.18

ns4.wikileaks.org. 80774 IN A 195.35.109.44

ns4.wikileaks.org. 80774 IN A 95.211.113.154

ns4.wikileaks.org. 80774 IN A 141.105.65.114

;; Query time: 20 msec

;; SERVER: 213.186.33.99#53(213.186.33.99)

;; WHEN: Fri Mar 10 16:21:37 2017

;; MSG SIZE rcvd: 327

Now the above might mostly seem like junk to you, if you don’t speak computer, so we’ll cut out everything not that’s not relevant and focus on what is relevant, namely, these two addresses:

wikileaks.org. 600 IN A 141.105.65.113

wikileaks.org. 600 IN A 141.105.69.239

When you look up these addresses, listed above, via a command known as “whois”, you can find their physical location in the real world.

organisation: ORG-MTL21-RIPE

org-name: Mir Telematiki Ltd

org-type: LIR

address: Barabannii pereulok 4/4

address: 107023

address: Moscow

address: RUSSIAN FEDERATION

phone: +7 495 369 9796

fax-no: +7 495 369 9796

mnt-ref: MTLM-MNT

mnt-ref: RIPE-NCC-HM-MNT

mnt-by: RIPE-NCC-HM-MNT

mnt-by: MTLM-MNT

abuse-mailbox: abuse@hostkey.ru

abuse-c: HA2800-RIPE

created: 2010-10-06T10:46:46Z

last-modified: 2016-09-30T12:14:19Z

source: RIPE # Filtered

This information is the same for both IP addresses, and if you notice the last modified date as “2016-09-30” that is when the IP address’s pointing to a server was changed. So we can safely bet that this is when wikileaks added these addresses to their systems.

In turn, this proves Wikileaks gained Russian hosting on September 30th 2016, one week before the Podesta emails were made public. Wikileaks got Russian Federation virtual addresses one week before the Podesta emails. Let that sink in.

Now the actual owner of the IP addresses is a man by the name of Peter Chayanov, whose IP addresses have hosted spammers and hackers, according to my sources, who work in internet backbone companies.

Chayanov’s IP space is a virtual equivalent of a bad neighborhood that makes you lock your car doors when you drive through it. So this further implies a connection to Wikileaks and Russian hackers. That sort of stuff is Chayanov’s day job. And, further, it’s important to remember, this web host also stays around at the consent of the Russian government despite (or because of?) being known cyber criminal hosts.

The other addresses I told you to ignore before? When you do a whois on wikileaks itself you get shown IP’s in Amsterdam and Zurich, ones that make much more sense to have since they are in countries with strong freedom of speech and transparency laws. Places you would want an organization like that in, but the Russian IP spaces, to be visible to you have to be dug for carefully to find them. They did a fairly good job obfuscating it, but the records will always be able to be found.

Mr. Chayanov did not disguise his hosting carefully enough. And when he was exposed this weekend on Twitter, he made matters worse by deleting his account at once.

So why would Wikileaks, a “transparency” org acquire hosting in a country thats known to assassinate whistleblowers? Especially ones that challenge Trumps presidency? It makes no sense for people who claim to be for transparency to take up virtual residence in an autocratic nation that might try to kill them. So why would they do it? Well, it’s pretty simple; they would only be there with the consent of the Russian government, ieVladimir Putin. He wants them to be there and allows them to be there.

Why would he do that? Sounds an awful lot like putting a rattlesnake in your own bed to keep the neighbors away. That is if wikileaks was as neutral and would leak against anyone like they claim. Putin might be an autocrat, but he isn’t an idiot.

He would not allow them there unless he got something out of it for himself, like immunity to being leaked against or by having influence over what gets leaked and when. Putin like all politicians is a self interested lout and acts in ways that keep him in power. Much like many other world leaders. So wikileaks dropping info on the US alone isn’t enough to allow them to stay, he knows he would be next on the leaking list.

So that strongly suggests Russia is getting some kind of favorable or special treatment. Its also likely that the CIA was already aware of this and that this is part of the information they base their claims of Russian interference on. When you see this alone its enough to strongly suggests collusion with the Russian government either directly or indirectly.

So it seems fairly sure to me that Wikileaks is now in bed with the Russian government in some form or fashion.

Will we shortly discover that Mr. Chayanov is also connected to Guccifer2?

[OUTLAW 09]

Here's what Rand Paul said on Face the Nation. He isn't making some broader point about warrants, he's leveling a very specific accusation.

Paul's defenders now want to shift the conversation to their general critique of 702 in order to divert from Paul's very specific falsehood.

That accusation is that NSA targets foreigners "purposefully" in order to "get to Americans," i.e. they do what's know as reverse targeting.

[OUTLAW 09]

Over SIX MILLION of Trump's followers are fake. Paid-for Russian bots, perhaps?
https://www.twitteraudit.com/Realdonaldtrump

So again no Russian connections...

I keep going back to the idea tha national security has two elements....

1. internal and
2. external

Right now on the interna side we have seen a strong tendency of the Trump WH to draw in adviors from the White nationalist side with Miller and Bannon...Bannon sits in the NSC....and white nationalism is the vehicle used to project white supremacy......

This is a long read but well worth reading as it is well researched and goes to a serious question I have....

Just how is it possible that these large amounts of Russian controlled bots on the social media side WERE absolutely not detected by US tech giants??

WHY did it take European social media open source analysts and IT researchers to find what Twitter or FB or Instrgram should have seen first??

AND why has Twitter been so resistent in understanding the significance of these developments and downplays it at every opportunity....

http://www.motherjones.com/politics/...-tech-alt-righ...

Meet Silicon Valley's Secretive Alt-Right Followers
I investigated the role of "alt-techies" in the extremist movement emboldened by Trump.

Josh HarkinsonMar. 10, 2017 7:00 AM

Mother Jones Illustration; Marco Rullkoetter/Getty

Readers of The Right Stuff long knew that founder "Mike Enoch" had two main interests: technology and white supremacy. Posts on the neo-Nazi site have included discussion of "a new blogging platform built on node.js," while other less techie content has alluded to the "chimpout" in Ferguson, putting Jews in ovens, and Trump's "top-tier troll" of Jews on Holocaust Remembrance Day.

In January, Enoch was outed as Mike Peinovich, a Manhattan-based software engineer. His unmasking highlighted a lingering question about the racist far-right movement that rose to prominence with Donald Trump's election: What support might the so-called alt-right have among techies?

Ever since I began investigating the extremist groups lining up behind Trump last spring, several of their leaders have made big claims to me about an alt-right following in Silicon Valley and across the broader tech industry. "The average alt-right-ist is probably a 28-year-old tech-savvy guy working in IT," white nationalist Richard Spencer insisted when I interviewed him a few weeks before the election. "I have seen so many people like that." Andrew Anglin, the publisher of the neo-Nazi Daily Stormer, told me he gets donations from Silicon Valley, and that Santa Clara County, home to Apple and Intel, is his site's largest traffic source.

Chuck Johnson, the publisher of the conspiracy-mongering site Got News, said he gets lots of page views from the San Francisco Bay Area.
"If you even try to posit that racism and sexism aren't why women and minorities aren't making it, that it's some combination of talent and values, people's heads just explode."

After Peinovich was outed, he also insisted to me that many techies secretly identify with the alt-right, which he attributed to a backlash against the "corporate feminist and diversity agenda" of tech companies. "The fact that speaking up about this virtually guarantees career and social suicide, as in my case, shows why so many white males in tech would be attracted to the alt-right."

None of these alt-right figures would provide any data to support their claims. As I've reported, some alt-right sites have wildly overstated their reach. Moreover, the tech industry is renowned for its globalist outlook: Public-opinion surveys conducted by a Stanford political economist have found that rank-and-file workers in Silicon Valley exhibit less racial resentment and more favorable views toward most forms of immigration than average Americans.

Nonetheless, "alt-techies," as Spencer and others call them, do appear to play a role in a movement that first incubated in the backwaters of the internet and eventually spread online with the rise of Trump. Some heroes of the far right are associated with tech: They include former Breitbart News "tech editor" Milo Yiannopoulos; the infamous neo-Nazi hacker Andrew Auernheimer (a.k.a. Weev); and the video gaming vlogger Felix Arvid Ulf Kjellberg, whose "Pewdiepie" YouTube channel featuring Nazi-themed jokes has 54 million subscribers. (Last month Kjellberg apologized for the jokes and said he is not a Nazi.)

There are also successful figures in the tech industry who appeal to and have commingled with the alt-right: The DeploraBall, a gathering of far-right activists and conspiracy theorists during Trump's inauguration, was co-organized by software investor Jeff Giesea and attended by tech billionaire and Trump backer Peter Thiel.

San Francisco-based tech entrepreneur Curtis Yarvin is known for launching the pro-authoritarian "neoreactionary" movement and reportedly has been in contact with Trump's chief strategist, Steve Bannon. (Yarvin denies this.) Giesea and Yarvin, both of whom I interviewed, reject the "alt-right" label for its associations with white nationalism, yet they share the movement's disdain for the race and gender politics of the left. (Thiel's media representative did not respond to a request for comment from him.)

Continued...a long read.....

[OUTLAW 09]

Ukraine’s fight against fake news goes global

Countering Kremlin disinformation is one area where Kiev has the upper hand.

By Vijai Maheshwari
3/12/17, 10:30 PM CET

http://www.politico.eu/article/on-th...9d93-189575777

[OUTLAW 09]

Reference the Trump statement that the CIA and "others" have been spying on him via microwaves......

[OUTLAW 09]

Reference Russian info warfare...

Russia Today, InfoWars, Sputnik, and Fox are now virtually identical.

[OUTLAW 09]

While everyone was in a panic over the CIA hacking tools AND the Trump surrogate claims of spying microwave ovens....I have been constantly ringing the alarm bells over the "Internet of Things IoT" that are far more dangerous than anything the CIA can come up with...

NOW if Trump and his merry band of surrogates wanted to be truly helpful on internet security then they need to point to the IoT problem and not some microwave oven thingy....

NOTICE a bulk of the affected devices come from China and why is that????

https://krebsonsecurity.com/2017/03/...ge/#more-38363

Dahua, Hikvision IoT Devices Under Siege

Dahua, the world’s second-largest maker of “Internet of Things” devices like security cameras and digital video recorders (DVRs), has shipped a software update that closes a gaping security hole in a broad swath of its products. The vulnerability allows anyone to bypass the login process for these devices and gain remote, direct control over vulnerable systems. Adding urgency to the situation, there is now code available online that allows anyone to exploit this bug and commandeer a large number of#IoT devices.
On March 5, a security researcher named Bashis posted to the Full Disclosure security mailing list exploit code for an embarrassingly simple flaw in the way many Dahua security cameras and DVRs handle authentication. These devices are designed to be controlled by a local Web server that#is accessible via a Web browser.
That server requires the user to enter a username and password, but Bashis found he could force all affected devices to cough up their usernames and a simple hashed value of the password. Armed with this information, he could effectively “pass the hash” and the corresponding username right back to the Web server and be admitted access to the device settings page. From there, he could add users and install or modify the device’s software. From Full Disclosure:
“This is so simple as:
1. Remotely download the full user database with all credentials and permissions
2. Choose whatever admin user, copy the login names and password hashes
3. Use them as source to remotely login to the Dahua devices
“This is like a damn Hollywood hack, click on one button and you are in…”
Bashis said he was so appalled at the discovery that he labeled it an#apparent “backdoor” — an undocumented means of accessing an electronic device that often only the vendor#knows about. Enraged, Bashis decided to publish his exploit code without first notifying Dahua. Later, Bashis said he changed his mind after being contacted by the company and agreed#to remove his code from the online posting.
Unfortunately, that ship may have already sailed. Bashis’s exploit code already has been copied in several other places online as of this publication.
Asked why he took down his exploit code, Bashis said in an interview with KrebsOnSecurity that “The hack is too simple, way too simple, and now I want Dahua’s users to get patched firmware’s before they will be victims to some botnet.”
In an advisory published March 6, Dahua said it has identified nearly a dozen of its products that are vulnerable, and that further review may reveal additional models also have this flaw. The company is urging users to download and install the newest firmware updates as soon as possible. Here are the models known to be affected so far:
DH-IPC-HDW23A0RN-ZS
DH-IPC-HDBW23A0RN-ZS
DH-IPC-HDBW13A0SN
DH-IPC-HDW13A0SN
DH-IPC-HFW13A0SN-W
DH-IPC-HDBW13A0SN
DH-IPC-HDW13A0SN
DH-IPC-HFW13A0SN-W
DHI-HCVR51A04HE-S3
DHI-HCVR51A08HE-S3
DHI-HCVR58A32S-S2
It’s not clear exactly how many devices worldwide may be vulnerable. Bashis says that’s a difficult question to answer, but that he “wouldn’t be surprised if 95 percent of Dahua’s product line has the same problem,” he said. “And also possible their OEM clones.”
Dahua has not yet responded to my questions or request for comment. I’ll update this post#if things change on that front.
This is the second time in a week that a major Chinese IoT firm has urgently warned its#customers to update the firmware on their devices. For weeks, experts have been warning that there are signs of attackers exploiting an unknown backdoor or equally serious vulnerability in cameras and DVR devices made by IoT giant Hikvision.
Writing for video surveillance publication IPVM, Brian Karas reported on March 2 that he was hearing from multiple Hikvision security camera and DVR users who suddenly were locked out of their devices and had new “system” user accounts added without their permission.
Karas said the devices in question all were set up to be remotely accessible over the Internet, and were running with the default credentials (12345). Karas noted that there don’t appear to be any Hikvision devices sought out by the Mirai worm — the now open-source malware#that is being used to enslave IoT devices in a botnet for launching crippling online attacks (in contrast, Dahua’s products are hugely represented in the list of systems being sought out by the Mirai worm.)
In addition, a#programmer who has long written and distributed custom firmware for Hikvision devices claims he’s found a backdoor#in “many popular Hikvision products that makes it possible to gain full admin access to the device,” wrote the user “Montecrypto” on the IoT forum IPcamtalk on Mar. 5. “Hikvision gets two weeks to come forward, acknowledge, and explain why the backdoor is there and when it is going to be removed. I sent them an email. If nothing changes, I will publish all details on March 20th, along with the firmware that disables the backdoor.”
According to IPVM’s Karas, Hikvision has not acknowledged an unpatched backdoor or any other equivalent weakness in its product. But on Mar. 2, the company issued a reminder to its integrator partners about the need to be updated to the latest firmware.

A special bulletin issued Mar. 2, 2017 by Hikvision. Image: IPVM
“Hikvision has determined that there is a scripted application specifically targeting Hikvision NVRs and DVRs that meet the following conditions: they have not been updated to the latest firmware; they are set to the default port, default user name, and default password,” the company’s statement reads. “Hikvision has required secure activation since May of 2015, making it impossible for our integrator partners to install equipment with default settings. However, it was possible, before that date, for integrators to install NVRs and DVRs with default settings. Hikvision strongly recommends that our dealer base review the security levels of equipment installed prior to June 2015 to ensure the use of complex passwords and upgraded firmware to best protect their customers.”
ANALYSIS
I don’t agree with Bashis’s conclusion that the Dahua flaw was intentional; It appears that the makers of these products simply did not invest much energy, time or money in building security into the software. Rather, security is clearly an afterthought that is bolted on afterwards with these devices, which is why nobody should trust them.
The truth is that the software that runs on a whole mess of these security cameras and DVRs is very poorly written, and probably full of more security holes just like the flaw Dahua users are dealing with right now. To hope or wish otherwise given what we know about the history of these cheap electronic devices seems sheer folly.
In December, KrebsOnSecurity warned that many Sony security cameras contained a backdoor that can only be erased by updating the firmware on the devices.
Some security experts maintain that these types of flaws can’t be easily exploited when the IoT device in question is behind a firewall. But that advice just doesn’t hold water for today’s IoT cameras and DVRs. For one thing, a great many security cameras and other IoT devices will punch a hole in your firewall straight away without your permission, using a technology called Universal Plug-and-Play (UPnP).
In other cases, IoT products are incorporating peer-to-peer (P2P) technology that cannot be turned off and exposes users to even greater threats. #In that same December 2016 story referenced above, I cited research from security firm Cybereason, which found at least two previously unknown security flaws in dozens of IP camera families that are white-labeled under a number of different brands (and some without brands at all).
“Cybereason’s team found that they could easily exploit these devices even if they were set up behind a firewall,” that story noted. “That’s because all of these cameras ship with a factory-default peer-to-peer (P2P) communications capability that enables remote ‘cloud’ access to the devices via the manufacturer’s Web site — provided a customer visits the site and provides the unique camera ID stamped on the bottom of the devices.”
The story continued:
“Although it may seem that attackers would need physical access to the vulnerable devices in order to derive those unique camera IDs, Cybereason’s principal security researcher Amit Serper said the company figured out a simple way to enumerate all possible camera IDs using the manufacturer’s Web site.”
My advice? Avoid the P2P models like the plague. If you have security cameras or DVR devices that are connected to the Internet, make sure they are up to date with the latest firmware. Beyond that, consider completely blocking external network access to the devices and enabling a VPN if you truly need remote access to them.
Howtogeek.com has a decent tutorial on setting up your own VPN to enable remote access to your home or business network; on picking a decent router that supports VPNs; and installing custom firmware like DD-WRT on the router if available (because, as we can see, stock firmware usually is some horribly insecure and shoddy stuff).

Continued.....