How can intelligence services be so sure that Russia is the culprit?

Question

Recently, US and non-US media has been publishing many articles regarding Russia being involved in the "Podesta-hack" or even accusing Putin of being directly responsible. For example:

• "Putin directly involved in US election hacking" (MSNBC)
• "White House accuses Putin of personally authorizing US hacks, aiding Trump victory" (DW)

However, none of these articles give any proof for such a claim, they are just referring to secret CIA information. Furthermore, in my country, Germany, media outlets are jumping on the accusation-bandwagon and start accusing Russia/Putin of hacking the NSA investigation committee.

Again, no evidence can be provided.

Now to my question:
I think that it's possible to act almost totally anonymously online, especially when you're backed/funded by a government. Also, I am aware that the CIA and german intelligence probably have their sources which cannot be made public.

But how can we be sure that this is not entirely propaganda against the russian government? Wouldn't one expect that Russia would be able to cover their tracks, if they'd want to?

What I have seen a couple of times now is the point that the attacker's active-time is coherent with the timezone of Moscow? Is this already enough evidence? What other possibilities are there to identify an attacker, when he knows his business and is hiding his IP/Info and not making stupid mistakes?

Answer 1

This is nearly a dupe of How do organizations check what has been hacked? While that question deals with unraveling what, you're asking about unraveling how and by whom.

What other possibilities are there to identify an attacker, when he knows his business and is hiding his IP/Info and not making stupid mistakes?

There are a lot of possibilities. There's a lot more to remaining un-attributed than "not making stupid mistakes"! it's fair to say, any APT (nation-state) actor is going to be attributed, eventually, by any nation-state level defender. National Defense gets hella more resources than, say, you trying to figure out who took advantage of your Yahoo! credentials.

If you read the list of forensic steps that can be taken, the methods of backtracking rely on all the bits of data, each of which is a small piece of the puzzle.

Data you'll start with:

• IP addresses used in the attack
• Attack tools used in the attack and left on the target servers
• Times of activity (as you say, not conclusive, but a piece of the puzzle)

To quote the bible, "By their fruit you will recognize them." The advanced hacking groups build their own specialized tools, sometimes use the same IPs to route themselves through, and show enough consistency in times of activity to offset them from other advanced groups.

Some of this stuff can get really nitty-gritty. Individual actors have been identified personally because their username was embedded in a directory that was embedded in a file compiled from source that referenced that directory. Small strings found in one set of files have been enough to tie together that attack with another that also happened to have the same signature strings.

At the national level, the people who are working to defend and investigate have access to an awful lot of puzzle pieces, and can use them to attribute actions. They may know that attack XYZ, for example, was blatantly tied to Russia, and that attack QRS has a significant overlap of indicators. Enough overlap? They conclude that QRS was also tied to Russia.

If you're interested in seeing more about how this is done, I strongly recommend reading Mandiant's "APT1: Exposing One of China's Cyber-Espionage Units"

Answer 2

This is like any exercise in forensic investigation. Attackers leave trails. These can sometimes be correlated to evidence left behind in other attacks. Time of day may not seem like much, but if its from the same block of time every day, that may not be coincidence. Hacking tools left behind may have native language artifacts, custom directory path names, or timestamps consistent with other recognizable attacks featuring similar time zones. Often, the tools are customized, and leave unique fingerprints.

If you're an organization like NSA, you probably also don't obey the rules against counter-hacking.

The more resources you have, the better evidence you'll get from the forensic analysis. The NSA is pretty good at it.