Trump’s ‘Missing DNC Server’ Is Neither Missing Nor a Server
S E E D E D C O N T E N T
Donald Trump turns to right-wing conspiracy theories when he’s cornered, and he was cornered on Monday. Standing feet away from Vladimir Putin at a press conference following their Helsinki tete-a-tete, a reporter challenged Trump to condemn Putin for Russia’s election interference, “in front of the world.”Instead, the world watched as the President of the United States took Putin’s side against his own Justice Department and his own intelligence agencies , and launched into a rambling discourse about Hillary Clinton’s emails and a supposedly missing DNC server that hides the truth about Putin’s innocence .
“You have groups that are wondering why the FBI never took the server. Why didn’t they take the server? Where is the server, I want to know, and what is the server saying?”
The server is saying shut up.
The “server” Trump is obsessed with is actually 140 servers, most of them cloud-based, which the DNC was forced to decommission in June of 2016 while trying to rid its network of the Russian GRU officers working to help Trump win the election, according to the figures in the DNC’s civil lawsuit against Russia and the Trump campaign. Another 180 desktop and laptop computers were also swapped out as the DNC raced to get the organization back on its feet and free of Putin’s surveillance.
But despite Trump’s repeated feverish claims to the contrary, no machines are actually missing.
“Despite Trump’s repeated feverish claims to the contrary, no machines are actually missing.”
It’s true that the FBI doesn’t have the DNC’s computer hardware. Agents didn’t sweep into DNC headquarters, load up all the equipment and leave Democrats standing stunned beside empty desks and dangling cables. There’s a reason for that, and it has nothing to do with a deep state conspiracy to frame Putin.
Trump and his allies are capitalizing on a basic misapprehension of how computer intrusion investigations work. Investigating a virtual crime isn’t a like investigating a murder. The Russians didn’t leave DNA evidence on the server racks and fingerprints on the keyboards. All the evidence of their comings and goings was on the computer hard drives, and in memory, and in the ephemeral network transmissions to and from the GRU’s command-and-control servers.
Related in Tech
When cyber investigators respond to an incident, they capture that evidence in a process called “imaging.” They make an exact byte-for-byte copy of the hard drives. They do the same for the machine’s memory, capturing evidence that would otherwise be lost at the next reboot, and they monitor and store the traffic passing through the victim’s network. This has been standard procedure in computer intrusion investigations for decades. The images, not the computer’s hardware, provide the evidence.
Both the DNC and the security firm Crowdstrike , hired to respond to the breach, have said repeatedly over the years that they gave the FBI a copy of all the DNC images back in 2016. The DNC reiterated that Monday in a statement to the Daily Beast.
“The FBI was given images of servers, forensic copies, as well as a host of other forensic information we collected from our systems,” said Adrienne Watson, the DNC’s deputy communications director. “We were in close contact and worked cooperatively with the FBI and were always responsive to their requests. Any suggestion that they were denied access to what they wanted for their investigation is completely incorrect.”
The FBI declined comment for this story, but in testimony before the House Intelligence Committee last year, then-director James Comey said that Crowdstrike “ultimately shared with us their forensics.”
At that same hearing, Comey complained that the DNC didn’t give the FBI direct access to the DNC’s servers. It’s unclear why Comey wanted the FBI operating on the DNC’s live network, but if the DNC demurred it wouldn’t be an unusual call, particularly five months before election day.
“The FBI is looking to investigate and prosecute crimes, and we’re looking to return a system to operation as quickly as possible with minimal impact,” said Rendition Infosec’s Jake Williams, one of several incident response professionals interviewed for this story. “I can tell you honestly that had I been part of that incident response, I would not have advocated calling in the FBI. Every minute the FBI spends keeping the actors in play, that’s a minute I don’t get back in prepping for the election. I would absolutely have shared images with them.”
Kenn White, a security expert and former DHS adviser, agreed that the FBI wouldn’t have expected direct access to DNC’s computers, “The FBI had one of the best cyber security firms in the world giving them forensics, and going in depth and reverse engineering to the byte level these implants and turning it over.”
In some versions of the servergate conspiracy theory now espoused by Trump, nothing less than physical possession of the hardware will suffice, because Crowdstrike, a respected security firm helmed by a former senior FBI agent, might be part of the deep state’s efforts to frame Putin. White scoffs at that notion, noting that National Republican Congressional Committee is one of Crowdstrike’s customers .
“I’ve done incident response for defense contractors and healthcare groups, this is all standard practice,” said White. “It’s completely defensible in terms of best practices and what was going on.”
“We were in close contact and worked cooperatively with the FBI. Any suggestion that they were denied access to what they wanted for their investigation is completely incorrect.”
— DNC's Adrienne Watson
It’s also consistent with the Department of Justice’s electronic evidence manual , which recommends capturing images when practical even when the FBI is executing a search warrant against a uncooperative suspect. When the computers belong to a cooperating victim, seizing the machines is pretty much out of the question, said James Harris, a former FBI cybercrime agent who worked on a 2009 breach at Google that’s been linked to the Chinese government.
“In most cases you don’t even ask, you just assume you’re going to make forensic copies,” said Harris, now vice president of engineering at PFP Cyber. “For example when the Google breach happened back in 2009, agents were sent out with express instructions that you image what they allow you to image, because they’re the victim, you don’t have a search warrant, and you don’t want to disrupt their business.”
There’s a final bit of evidence that the FBI got what it wanted from the DNC, and it was filed in the U.S. District Court in Washington DC last Friday: 29-pages of inside details showing exactly how and when the GRU’s hackers moved through the DNC’s network on their mission to help Trump.
If the president really wants to know what the DNC server is saying, it’s all in the indictment against Putin’s hackers. He just has to listen.
Tags
Who is online
115 visitors
To me, the most shocking thing from Trump yesterday was his use of a far right conspiracy theory as a defense for both himself and Putin. I have always known he is a conspiracy nut, which is one of the many reasons he is not qualified to be president, but I didnt think he would blurt out a conspiracy theory with the whole world watching. There are no depths to which this man will not sink.
Actually, cloud computing is offsite storage of applications and storage on SERVERS. Any computer you access remotely is a server. What we are on right now is a server. What we do when we go into Facebook or any site where we have a login is access a server called a login server, which passes us through to another server to access our account(s). If the DNC had IT guys worth their salt, they would have had a RAID 1, RAID 5 or RAID 10 (aka RAID 1+0) set up on the DNC servers to allow them to get back into service quickly. RAID 1 is where you have your storage set up to mirror each other (minimum of 2 hard discs of the same size and type). RAID 5 doesn't mirror but it has parity set up to protect the data, this usually requires 3 discs set up. RAID 1+0 requires 4 discs, as it is essentially two pairs of discs mirrored to create the fault tolerance needed. RAID 0 has no redundancy but just stores data in series as the data stripe continues onto the 2nd disc.
Nope. Cloud computing indicates accessing information from remote server(s) via the internet. If you access those remote servers through your own network, it is not "Cloud" computing. CLOUD = Internet.
Nope. I can and do access my personal computer, at home, from my work computer, tablet, or smartphone. That does not make my home computer a "server".
If the FBI takes ALL their servers, there is no way to get up and going again until they are able to replace the hardware and rebuild the OS and databases. Having their servers configured in a RAID is meaningless when you are talking all hardware being taken.
Basic, if outdated explanation of RAID's. Again though, if the hardware that supports the RAID is removed, it won't matter how it is configured since the supporting hardware is gone. Even if you have off-site backups, they won't do you any good until you are able to replace the hardware, and replacing and rebuilding 140 physical servers will take months.
Additionally, if the DNC's IT guys had done their job, they would have dealt with Password changes and integrity. You know, not allowing people to have passwords like 'password'. I'm still awaiting evidence of how the Russians forced voters to vote for President Trump over others.
Of course, that's not really forthcoming. That assumes that everyone is stupid and allowed FB memes to swing their vote. That should win the DNC more friends-after the whole 'deplorble' thing.
Why are you still waiting? That info has been out for over a year now. Since it doesn't go along with your world view, you are ignoring it.
A "friend" of mine posted the dumbest meme on Face Book during the campaign.
It was 2 photos side by side. One was trump in his military school uniform and the other was Sanders being arrested for protesting. The meme went something..."One is a military hero and the other is a criminal"
One of the "friends" who actually retired from the Air Force bought that meme hook, line, and sinker. The other "friend" who posted it is married to another AF retiree. Since they were dumb enough to actually believe that meme, I unfriended them and let them carry on in their alternate reality fantasy. I thought they were smarter, but they weren't. There are people out there who fall for the dumbest shit and never question it.
What part of OFFSITE storage did you fail to understand? Usually, you don’t have direct connections to offsite computers, so you HAVE to use the internet.
The moment you access a computer from another computer and use a file or application on the computer you just accessed it becomes a client-server relationship where your current device becomes the client and your other computer becomes the server.
If you have disc mirroring enabled, RAID 1 or RAID 1+0 you can keep the mirrored backups while giving them the primary discs. Besides, I am prepping for taking the A+ 901 exam on my way towards an BS in IT from WGU.
No it doesn't, a computer is a server based on its function, not method of access. Any computer running the Chrome browser is accessible through the internet, are you claiming that every single computer running Google's Chrome browser is therefore a server? You can remotely access any Windows based computer through the built-in Remote Desktop Protocol, so by your theory every computer is a server.
You are moving the goalposts now. The question was about the DNC not giving the FBI their servers, NOW you are trying to claim that it was just the hard drives. The truth of the matter is that the FBI would have wanted the entire thing since there are hacking methods that utilize peripherals, and what the FBI got was the images of their servers.
All I can say to that is good luck, been there done that and thoroughly enjoyed it. I started in the computer field back in the good old days(?) of the first Apple desktop, the Apple 1 and the TRS-80.
For Apple, they nearly died due to their proprietary small-mindedness in voiding warranties when the cases were opened by a non-licensed person. I forget the first actual computer I ever used as a kid; but it had Zork on it and ran MS-DOS, forget which version though. That and the Sears version of the Atari 2600 along with the version of Pong that plugged into the TV were among the reasons I became attracted to technology. I, actually, was administrator on a VMS/VAX system for a couple months in the 1990s; but then I got kicked out of school due to bad grades from old bad habits from high school.
I have used RDP in the job that was sent overseas. Had to help people configure Windows 10, Windows 7, Windows 8/8.1, and do port forwarding multiple times during that job.
Yes, I use RDP daily, however there are better options out there now. But since RDP is built-in it is the cheapest choice.
Facts according to Jim Comey:
1. The FBI made multiple requests to access the servers.
2, The DNC refused.
3. The FBI always wants direct access to the original devices involved because its the best evidence.
Thought this was an interesting read...
I love the way right wingers have to resort to lies, misquotes, and other conspiracy theories just to justify their arguments.
Or did you expect a private company to shut themselves down, handing over 140 servers and 180 workstations to the FBI?
Really immaterial as the information was stored in "the cloud" and required more investigation than the physical machines at the DNC.
It's like you can't read.
Nothing you said rebuts what I wrote.
ou expect a private company to shut themselves down, handing over 140 servers and 180 workstations to the FBI?
Well, since this very article reports the servers were decommissioned, yes.
Timeframe???
That act alone is prima facie evidence that they were/are attempting to hide something. The American people have a right to know what that evidence is.
Once again you are ignoring that the RNC also refused after it was shown that they were hacked as well.
You do realize that the DNC was the VICTIM here. They are not being accused of hacking their own emails. If you're looking for prima facie evidence that somebody is attempting to hide something just look at your President coming out of his summit meeting wiping his chin.
We have even MORE of a right to know wtf Trump gave away to Putin in that private meeting. I'm sure you'll want a transcript, once Putin decides what he wants us to know. So glad to know you are now insisting on openness and evidence. Or are you? From where I sit we have nefarious Russian interference with Trump being a docile poodle, while gop is trying to bring our attention to bullshit not relevant to ANYBODY. Why is this even a thing for you? And why don't you care when the gop does the same thing?
The "conspiracy theory" follows a similar pattern as other right wing nonsense. Because the investigation was not done the way we would have wanted it to be done, it must be a coverup . Just like because the police had not caught the person who killed Seth Rich, he must have been killed to shut him up about how he stole the DNC emails.
Whether anyone likes Crowdstrike or not, they presented evidence that satisfied the FBI as to it's validity. Case closed.
A LONG time ago it was reported that a Dutch intelligence agency had seen the Russians hacking into the DNC in real time.
To continue to act as if it is a mystery as to who hacked the DNC is right wing fever dream foolishness, and the president of the United States subscribes to it in his ignoramus way.
Still doesn't answer the question of why the DNC allowed themselves to be hacked, or why they refused to turn over the original DNC computer(s) (server) to the FBI.
I can't explain the obvious to you Greg. You are on your own.
Ask the gop. They were hacked, they didn't turn it over. They just happen to be on Putin's side right now.
The Russians are really good.
They hacked the cloud.
In order to access the cloud you have to have a physical position to start with. That's the computer servers. Let me ask you, how are you going to access the cloud without hardware containing programs used with information vital to access any part of the cloud?
This article is not accurate. Maybe Trump is speaking in layman's terms, but you just can't look up and access the cloud. The FBI according to all the information we are aware of never had actual access of that hardware and the programs contained on it.
Of course the DNC hired the firm to share their findings just like the DNC hired an attorney who hired GPS Fusion who hired Michael Steele who colluded with the Russians to produce phony information to be used in part to obtains FICA warrants and no one knows the names or persons Michael Steele colluded with, except they were supposedly Russians for the DNC who rigged the primary for Hillary against Bernie Sanders and received questions for an upcoming town hall meeting from Donna Brazille.
All will be revealed in due time.
Odd how don't require evidence or proof, nor compliance by the gop (also hacked, also didn't turn over server). Any reason why you keep trying to make old shit relevant again?