"Guccifer 2.0" publishes hundreds of pages of purported DNC docs.
In an intriguing follow-up to Tuesday's report that Russian hackers gained access to Democratic National Committee servers, an anonymous blogger has claimed he alone was responsible for the breach and backed up the claim by publishing what purport to be authentic DNC documents taken during the online heist.

In a blog post published Wednesday, someone with the handle Guccifer 2.0 published hundreds of pages of documents that the author claimed were taken during a lone-wolf hack of the DNC servers. One 231-page document purports to be opposition research into Donald Trump, the presumptive Republican nominee. Other files purport to be spreadsheets that include the names and dollar amounts of large DNC donors. Yet another document purportedly came from the computer of presumptive Democratic nominee Hillary Clinton while she was secretary of state.
"Worldwide known cyber security company CrowdStrike announced that the Democratic National Committee (DNC) servers had been hacked by 'sophisticated hacker groups," Wednesday's blog post stated. "I’m very pleased the company appreciated my skills so highly))) But in fact, it was easy, very easy."

The documents are either authentic copies of the files they purport to be, or they're elaborate hoaxes that required time and skill and were rushed out less than 24 hours after Tuesday's report of the DNC hack.

"They all seem reasonable," Rob Graham, a researcher and CEO of security firm Errata Security, told Ars of the documents he has examined so far. "If they are fake, someone has done a lot of research. They would have to be a really smart hoaxer."

If the documents are authentic, they would appear to contradict the claim by CrowdStrike, the security firm the DNC brought in to investigate suspicions its servers had been hacked, that the attackers didn't access financial or donor information. They would also cast doubt on other aspects of the report. For instance, they would suggest that either CrowdStrike misattributed the breach to the wrong groups or failed to detect that one or more additional actors had also gained high-level access and made off with a trove of confidential information.

"It's certainly possible that CrowdStrike could have misattributed one or both of these attacks," said Justin Harvey, chief security officer of Fidelis Cybersecurity, a firm that competes with CrowdStrike in investigating large-scale hacking operations. "Without forensic evidence, it's really difficult to drive down to the truth of this attack."

At this point, there's no way to rule out that the documents are fakes. There's also no way to rule out that they're authentic files that were leaked by either by a DNC insider or by one of the hacking groups named by CrowdStrike in an attempt to sow doubt or confusion after their cover was blown. For its part, CrowdStrike is standing by its findings. In a statement, company officials wrote:

CrowdStrike stands fully by its analysis and findings identifying two separate Russian intelligence-affiliated adversaries present in the DNC network in May 2016. On June 15, 2016 a blog post to a WordPress site authored by an individual using the moniker Guccifer 2.0 claiming credit for breaching the Democratic National Committee. This blog post presents documents alleged to have originated from the DNC. Whether or not this posting is part of a Russian Intelligence disinformation campaign, we are exploring the documents¹ authenticity and origin. Regardless, these claims do nothing to lessen our findings relating to the Russian government¹s involvement, portions of which we have documented for the public and the greater security community.

Guccifer 2.0 is an allusion to the Romanian man who in 2013 shattered the privacy of the family of former presidents George H. W. Bush and George W. Bush after breaking into private e-mail accounts that contained personal communications and pictures. Guccifer also exposed e-mails sent to former Secretary of State Colin Powell, a former member of the US joint chiefs of staff and a former presidential advisor. A cab driver whose real name is Marcel Lehel, Guccifer is now in US custody and faces federal charges.

The incidents over the past 24 hours are a powerful reminder of the perils of using incomplete or circumstantial evidence to attribute breaches to specific groups or individuals. It's possible that hacking tools known to belong to a group can be stolen or otherwise appropriated and that IP addresses and other signs of origin can be faked by attackers attempting to cover their tracks. Ars should have included this oft-repeated disclaimer in Tuesday's report, but didn't. Ars also should have made clear that given the potentially high value of information stored by major presidential candidates, it would be surprising if the DNC, its Republican counterpart, and both major candidates weren't regularly targeted and on occasion successfully breached by hackers motivated by political espionage, financial gain, or both.

In the spirit of those disclaimers, a reminder that it's far too early to say anything definitive about the new documents that have come forward other than to say they're worth close scrutiny for clues about exactly who has hacked the DNC and how they did it. Until then, people should resist the urge to jump to unfounded conclusions.