It's looking like NBC sat on the Guccifer story for over a month.

[RichVRichV]

17. Most communication to a server is logged somewhere.

Servers keep logs of all direct access attempts (successful or failed) with IP addresses of connections. It's a simple matter to parse the log files down to only successful connections. From there it's just a matter of determining if the connection was legitimate or a hack such as brute forcing a password on the root account (always turn off the root and admin accounts on servers, everyone attacks them). That's going through the front door with something like an ssh connection.


There's also other means of hacking a server. One of our email servers was hacked by a buffer overflow attack. In a buffer overflow attack someone sends data in a corrupted manner that pushes a portion of the data outside the memory block allocated for storing that data. By pushing the correct data into the correct memory block they can use it to compromise security. There are lots of other types of attacks who's effectiveness depends on how well a server has been setup and what is running on it.


Most attacks leave fingerprints of the activity on the server for people that know where to look.