Major Alfa Bank-Trump Tower Breakthrough!

The funny thing about mysteries is sometime the answer is starin’ you right in the face so intently you can’t see it.  A year ago, Tea Pain saw a signal in the noise that got him lookin’ into the mystery of the Trump Tower/Alfa Bank server scandal.  If you haven’t read about it yet, stop and read it before you continue.  Trump Tower’s “Stealth Russian Data Machine”

When Tea Pain first looked at the publicly available raw data logs he thought he was lookin’ at a buncha gibberish.  It was just scads and scads of DNS lookups, so many they made his eyeballs spin.  There was a bunch of what Tea Pain thought was duplicate entries that made finding a pattern all that much harder.  Tea Pain decided to look at the DNS lookup summaries instead.

Something jumped outta the data and bit him right on his digital hindquarters.  There was never more than 24 DNS lookups, or “connections” in one day.  The connections, on their busiest days averaged just a little over an hour apart.  Tea Pain, no stranger to databases, data transmittin’ and such, immediately recognized a pattern consistent with “Database Replication.”  Tea wrote an article that ended up gettin’ over 250,000 views and caught the attention of media outlets and even a U.S. Senator’s office.

This theory, if true, revealed a data transmission network constantly movin’ data between Russia’s Alfa Bank, Trump Tower and, believe it or not, Spectrum Health in Michigan.   Based on the feasibility and sensibility of this real world explanation, Tea Pain was asked to prepare a list of questions to be used in the Senate Intelligence committee’s investigation.  Tea Pain was mighty honored to oblige!

In the past few months, rumors have emerged that Bob Mueller’s team is lookin’ into the Alfa Bank mystery hot and heavy, promptin’ media outlets to start puttin’ fresh eyes on this year-old scandal.  Four news outlets contacted Tea Pain for explanation of the Database Replication theory that had been favored by many investigatin’ the case.

Newspaper folks ask a lotta questions and Tea Pain quickly realized that his theory needed a little beefin’ up so he decided to go back to square one and revisit the facts.  The reporters admitted that replication made the most sense, but they needed more to feel comfortable about what was goin’ on here. So Tea pulled up the original logs (available here) and went back to square one.  That’s when he saw it!  It wasn’t duplicates like he first thought. It was pairs! Right there in the logs lay the answer.

Above is a snippet of the raw logs.  Now look at it with just a little bit of help.

All the connections were made in sets of two, four, six, eight, etc.  This is the KEY to unlockin’ the whole shootin’ match!

Early database replication was fairly straight forward.  A process on one computer would “wake up” and see if there was any new data that needed to be sent to his digital step-brother.  The process would establish two connections with another computer, one outgoin’ and one incomin’ to broadcast data changes back and forth to the other database until both databases looked exactly alike.  Then it would go back to sleep, usually for an hour, then wake up and check again.

That was cool until databases got really big and the demand to replicate larger amounts of data increased.  Smart folks figured out they could create multiple sets of connections, known also as “threads” to replicate more data in less time.  Most databases spawn these threads in pairs of 2, 4, 6, 8 and so on.

So there it was, starin’ Tea Pain in the face the whole time.  He was clearly witnessin’ “Multi-threaded Database Replication” followin’ it’s predictable and programmed algorithm to a “T”.  Check out this snippet of activity and it’ll get even clearer.

Here’s a few sessions from July 28, durin’ the Stealth Data Machine’s busiest transmission period.  These reflect each time Alfa Bank contacted the Trump Tower server durin’ the wee mornin’ hours.  Notice each time a session starts, multiple threads are spawned in pairs of 2.  The real key thing to notice is the interval.  Just a little over an hour apart!

Typically, Alfa would contact Trump Tower, and exchange data for 4-5 minutes, plenty of time to exchange gigabytes of data on high-speed 1 gigabit commercial lines.  Then Alfa Bank sets a timer for an hour and goes to sleep.  Day in, day out, this stealth data machine labored away, sendin’ its treasonous cargo round the world disguised as everyday business data.

There are 3 tell-tale signs of hourly database replication

1. Never more than 24 sessions a day
2. Never less than an hour apart ( typically an hour and a few minutes apart)
3. Connections made in multi-threaded pairs of 2

There you have it folks.  We can’t see the money the crooks stole, but we can plainly see what kind of getaway car they was drivin’!  Tea Pain has faith that Bob Mueller’s crew has access to way more information than this and that all the naughty boys and girls involved will be brought to justice.