О переписке Игоря Процика / The E-mails of Igor Protsyk: Translation

The e-mails of Igor Protsyk//
We are being aggressively offered to believe another sensation from an allegedly hacked mailbox. This time the "data leak" has been presented as follows:

dcn2005 15.03.14 в 15:06

"We have hacked e-mail correspondence of US Army Attache Assistant in Kiev Jason Gresh and a high ranking official from Ukrainian General Staff Igor Protsyk".

dcn2005 15.03.14 в 15:06

An archive of messages, allegedly from the igor.protsyk@gmail.com mailbox, was published. The package contains two folders – "most interesting" with three scandalous e-mails, which have been spread all over the Internet, and "all" with the complete archive of 86 messages.

dcn2005 15.03.14 в 15:10

We've analyzed the "all" folder and would like to make the following statements on the three "most interesting" messages:

dcn2005 15.03.14 в 15:11

E-mail #1: from GreshJP@state.gov to igor.protsyk@gmail.com, delivered on 9 Mar 2014 08:57:15 -0700.

dcn2005 15.03.14 в 15:12

It looks very different from the rest five messages between the same users (GreshJP@state.gov to igor.protsyk@gmail.com) in the "all" folder (an obvious difference in English skills is just one of them). For example, all the content of this message belongs to the "text/plain" data type (the other ones are multipart/related, with HTML part). Besides that, this message does not end with the notice "SBU This email is UNCLASSIFIED" (SBU, Sensitive But Unclassified – a designation of information in the United States government).

dcn2005 15.03.14 в 15:24

E-mail #2: from igor.protsyk@gmail.com to krivonis.te@gmail.com, delivered on 11 Mar 2014 05:50:36 -0700.

dcn2005 15.03.14 в 15:25

This message, unlike all the other archived ones sent by igor.protsyk@gmail.com, has a valid DKIM-signature and headers confirming its delivery to krivonis.te@gmail.com. The presence of those headers makes it clear that the message was extracted from the krivonis.te@gmail.com mailbox, not from igor.protsyk@gmail.com (that is from the recipient mailbox, though the archive has nothing to do with it).

dcn2005 15.03.14 в 15:32

That means that the hackers had access not only to the mailbox of igor.protsyk at gmail.com, but also to krivonis.te@gmail.com; that's true for E-mail #3 as well.

dcn2005 15.03.14 в 15:36

E-mail #3: from krivonis.te@gmail.com to kolyarny@gmail.com (by the way, the latter mailbox can be found on the Web only in the context of the "data leak" in question) and to igor.protsyk@gmail.com, delivered on 11 Mar 2014 09:20:47 -0700.

dcn2005 15.03.14 в 15:39

Besides that the archive contains a message from no-reply@accounts.google.com to protsyk@ukr.net with password recovery information, delivered on 11 Mar 2014 05:47:11 -0700 (before sending of E-mails #2 and #3). Judging by the fact that there are 21 more e-mails to protsyk@ukr.net in the archive, the messages from that address are being forwarded to igor.protsyk@gmail.com.

dcn2005 15.03.14 в 15:43

You are free to make your own conclusions, but here are some hints from us:

dcn2005 15.03.14 в 15:44

The hackers declared that they had access to the GreshJP@state.gov and igor.protsyk@gmail.com mailboxes. But all the published messages between these two addresses are obviously not trustworthy, as they could have been written by the hackers themselves. The hackers most likely had no access to GreshJP@state.gov, because E-mail #1 was clumsily forged on the basis of the rest five "legitimate" messages from GreshJP@state.gov found in the igor.protsyk@gmail.com mailbox.

dcn2005 15.03.14 в 16:04

The message from no-reply@accounts.google.com gives us reasons to suppose that E-mails #2 and #3 have been sent after the igor.protsyk@gmail.com mailbox was compromised; that means that those e-mails could have been sent by the hackers themselves.

dcn2005 15.03.14 в 16:09

E-mail #2 proves that the hackers had access to krivonis.te@gmail.com, so why couldn't E-mail #3 have been created by the hackers?

dcn2005 15.03.14 в 16:11

This time the Anonymous Ukraine authors of the mail hacking scandal concerning the Crimea provocations made a far less clumsy try. The DKIM-signatures are doubtlessly proving the hacking of the igor.protsyk@gmail.com and krivonis.te@gmail.com mailboxes. But the results of the comparison between the "alarming" and all the other archived messages suggest with a high probability that the e-mails, which have so providently been placed in a separate directory under the meaningful name "most interesting", have been forged or sent by the hackers themselves.

dcn2005 15.03.14 в 16:28