11 ms·
How Hackers Broke into John Podesta and Colin Powell’s Gmail Accounts
- drited 10y agoIf email filters can detect that the ultimate long URLs are malicious (hence the use of bitly shortened links), couldn't bitly detect those malicious links using the same techniques to cut down on these types of attack? Their response seemed a little defeatist.
- frandroid 10y agoPeople use bit.ly specifically to shorten long URLs; for example, URLs with long Google analytics parameters (e.g. &utm=...) so that would defeat the purpose of using bit.ly.
- drited 10y agoI should explain what I meant further: I wasn't suggesting that bit.ly prevent people from shortening links, rather I was suggesting that they filter for links like the one mentioned in the article which are clearly intended to trick people into thinking they are clicking a link to a Google domain when in fact it is a link to the nefarious party's server. See the long link in the article for what I mean. It looked like a google.com link but in fact was a link to a.tk domain.
- vonklaus 10y agoReally? Guy got a standard spearfishing email and we assume it was the intelligence dept of a powerful nation state. Edit: ...and they used public bitly links. That is standard Russian Hacker tradecraft right there.
- Natsu 10y agoOn a related note, this also came out recently: https://www.craigmurray.org.uk/archives/2016/10/really-really-upset-foreign-office-security-services/ https://www.craigmurray.org.uk/archives/2016/10/really-reall...
- cypherpunks01 10y agoI'm not completely understanding the story here. Did an actual "hack" occur with a 0-day exploit behind that URL, or did Podesta simply get phished and gave up his password to a 3rd party site? I assumed the latter, but there are statements in the article, such as "That’s the link that opened Podesta’s account to the hackers", that are very confusing. Was there some SPF/DKIM/Gmail exploit or trickery that allowed the phishing email to display as if it were legit coming from Google?
- rfrank 10y agocould have been spoofing the url with some sort of homograph attack. http://www.welivesecurity.com/2015/07/14/spoofed-urls-homograph-attacks-revisited/ http://www.welivesecurity.com/2015/07/14/spoofed-urls-homogr...
- revelation 10y agoIt's deliberately obtuse because how you are going to make mass-sent phishing mail sound like some Russian cyberweapon if the mope turns out to have entered his own password? The actual Google myaccount.google.com/.. site that the phishing URL is modeled after asks for a new password.
- wav-part 10y agohttps://google.com/amp/hackme.com https://google.com/amp/hackme.com redirects to hackme.com. The attacker here used tiny.cc to be more elusive. IIRC we had a popular discussion here about this. How google can still allow this is beyond me.
- sjeanpierre 10y agoWow this is really fucked up. Most people would automatically trust a link from Google.
- acqq 10y agoAnd the link really results in the real connection to the real Google server, which then merily redirects to wherever. Whover allowed that in Google, using the main google.com domain, what was he thinking? For me, that is the major story here.
- frandroid 10y agoTL;DR: Spearphishing. Discovered because the attackers used public bit.ly URLs.
- starik36 10y agoThey keep on saying the Russians did it and that the trail leads to the Russians. What is the actual evidence that it was the Russians that did it? And Bitly links ain't it.
- rfrank 10y ago"The intelligence community declined to explain how they reached their conclusion, and it’s fair to assume they have data no one else can see." My personal favorite part of the article, couple paragraphs after that quote: "We are approaching the point in this case where there are only two reasons for why people say there’s no good evidence,” Rid told me. “The first reason is because they don’t understand the evidence—because the don’t have the necessary technical knowledge. The second reason is they don’t want to understand the evidence.”
- deleted 10y ago[deleted]
- h4nkoslo 10y agoThere is no reason for them to not source the evidence they're using to attribute it to the Russians. If it was them, they already know exactly what they left behind. It's actually not that difficult to disguise sources of attacks (assuming for the sake of argument it was the Russians, it could very well have physically occurred from a Manhattan Starbucks), and based on what we know about the server setup it's not like the hack required particular technical sophistication or traceable 0-days. Conversely, there are ample reasons for the intelligence community to pin it on their historic enemy, rather than the more likely Murder on the Orient Express scenario where absolutely everyone paying attention hacked every grotesquely unsecured setup, or the insider-threat scenario. Hey, whatever happened to Seth Rich? And if the "intelligence community" isn't actively targeting insiders at least as a pure pen-testing contingency, why aren't they?
- jgalt212 10y ago> There is no reason for them to not source the evidence they're using to attribute it to the Russians. Well, what if that evidence was gathered via extra-legal means?
- back_beyond 10y agoBut... but Trump is a Russian puppet! /s
- acqq 10y agoThe screens actually show that Google blocks attempts to log in from other, non-typical addresses: "Google stopped this sign in attempt" So it seems it's even not that Podesta just gave his password to the phishing server but some more interesting story?
- ebcode 10y agoNo, the screen w/ "Google stopped this sign in attempt" is not from Google. Presumably the "Change Password" link pointed to a server controlled by the phishers.
- acqq 10y agoI think you don't know what Google does and make an empty claim, unsupported by the screens displayed. They actually have such kind of protections, I've seen them. Why would the phishers inform the victim that they got his password? It's against their goals. Edit: Fascinatingly, the google.com/amp does the redirection, but the google.com is contacted first. Why would google.com do this? Ah, yes... the Google validated AMP cache. Nice. Edit2: Dude in the reply to this, the fascinating thing is, the google.com is actually contacted from that address first. Mind blown. The phishing using the actual, real google.com. Really, really, nice. That is for me the most fascinating detail from this whole story. It is actually the real www.google.com who made that thing possible. Wow.
- ebcode 10y agoDude. Look at the caption underneath those screenshots. They say, "A screenshot of the phishing email received by ..." The fact that Google actually sends out emails that look like that is what makes the phishing attack so effective. The email looks like it is from Google, and therefore trustworthy. As to why the phishers would inform him that they got his password? The reason is that at the time they sent the phishing email, they didn't actually have his password, and wanted him to click on a link that they controlled so he would give them his password. I'm trying to get through to you. Please tell me it's working.
- 10y ago
- deleted 10y ago[deleted]
- ggambetta 10y agoWait, the account didn't have two-factor auth enabled?!?
- cypherpunks01 10y agoOutdated estimate, but better than nothing: https://duo.com/blog/estimating-googles-two-factor-2sv-adoption https://duo.com/blog/estimating-googles-two-factor-2sv-adopt... Seems to point to likely less than 10% of users having 2FA enabled.
- ggambetta 10y agoSure, but I'd expect high-profile people to have _someone_ telling them to enable it!
- deleted 10y ago[deleted]
- vonzeppelin 10y agoNo one at the DNC or Clinton campaign have heard about encrypting emails either.
- jessaustin 10y agoThey thought they just had to keep the server in the bathroom...
- deleted 10y ago[deleted]
- teekert 10y agoThe one thing I kept looking for in the article was "How Hackers Broke into John Podesta and Colin Powell’s Gmail Accounts", but despite the title, the don't say exactly how and it probably wasn't a hack. They just entered their passwords after clicking a phishing link as far as I can tell now. Also, I think I have the technical knowledge to understand the evidence and I certainly want to understand but it is still unclear to me. What a strange article.
- losvedir 10y agoHuh, so phishing, eh? Underwhelming. I don't understand the Russian connection. Is it because the ultimate "account.google.com-security..." domain is associated with Russia? Also, from the article: > It’s unclear why the hackers used the encoded strings, which effectively reveal their targets to anyone. Kyle Ehmke, a threat intelligence researcher at security firm ThreatConnect, argued that “the strings might help them keep track of or better organize their operations, tailor credential harvesting pages to specific victims, monitor the effectiveness of their operations, or diffuse their operations against various targets across several URLs to facilitate continuity should one of the URLs be discovered.” It seems like because with the email encoded in the URL you can prefill the "someone logged into your Google Account: XYZ", right? That way you could send out millions of these things to harvest email/password combinations. I don't understand how or why they would do it any way but that way.
- deleted 10y ago[deleted]
- MichaelBurge 10y agoIt really sounds like it was some guy who weighs 400 pounds in his bedroom, rather than some elite nation-state-level Russian attack.
- cairo_x 10y ago”They don’t want to understand the evidence.” No evidence has been provided showing these command and control servers are under the control of the FSB. So how the hell can anyone hope to understand the evidence when we don't have access to it? Show us the links between FancyBear and the command and control servers or GTFOOH edit regarding related dnc hack: turns out the command and control thing was debunked:https://medium.com/@jeffreycarr/can-facts-slow-the-dnc-breach-runaway-train-lets-try-14040ac68a55 https://medium.com/@jeffreycarr/can-facts-slow-the-dnc-breac... Under 'Fact Check the Evidence' Now the only other evidence for Russian involvement is the metadata found in the Guccifer files, which, if you are to take as 'evidence' means that that link between Premise and toddandclare.com of pedo-gate fame is irrefutable. Which it is not, because it relies on the same borderline intelligent inductions.
- mutagen 10y agoI find the use of Google's AMP cache notable to avoid having to use a spoofed domain, you can use it to have Google serve up your content themselves, rendering the advice to 'look at the domain name of the link before clicking' even more useless than it was before Compare: http://myaccount.google.com-securitysettingpage.ml/security/signinoptions/password http://myaccount.google.com-securitysettingpage.ml/security/... in the first screenshot to the screenshot from a Bellingcat journalist: https://www.google.com/amp/tiny.cc/.. https://www.google.com/amp/tiny.cc/...
- peternicky 10y agoBoth links are broken.
- mutagen 10y agoSorry, in hindsight my comment is rather opaque. Those links are incomplete links of the phishing links contained in the emails. I wanted to highlight the difference in the screenshots in the vice.com article between seeing a clear www.google.com (due to the AMP cache) and a google.com-user-security.tk or whatever spoofed domain that got used. Point being Google is making it easy for phishers to spoof links with the AMP cache. I'm guessing Google is relying on their existing malware detection and site reporting process to weed out pages that take advantage of this. This approach mostly works for mass spammed links and sites trying to pass on malware but won't work for targetted phishing attacks against all but the savviest of security conscious users.
- tmzt 10y agoIs it possible the article writer got served the AMP page and the redirect was to the .com-* subdomain? Are the bit.ly targets known?
- cwisecarver 10y agoIf they're public bitly accounts and the emails are encoded in the URL can't we just go look at the bitly accounts for all the urls and figure out who else they tried to spearfish? Wouldn't that be useful information about what could be coming next? Maybe this is a better question posed in the reddit thread that I'm sure exists.
- badmadrad 10y agoThis article is saying its irrefutable based on the link's and origin of the attack that it was state sponsored and even suggests that you're either contrarian or just an idiot if you think otherwise. But isn't it within the realm of possibility that traffic is being proxied through a Russian located server to make it appear like Russia? Furthermore, I know that when security researchers look at a group they look beyond just the origin of attack and at behavior patterns but couldn't you spoof those easily too? I guess my point is that there is still a possibility its not the Russian/state sponsored based on evidence I have seen.
- imron 10y agoThe former UK Ambassador to Uzbekistan (who has visited Assange at the Ecuadorian embassy) claims: "I can tell you with 100% certainty that it is not any Russian state actor or proxy that gave the Democratic National Committee and Podesta material to WikiLeaks. The claim is nonsense. Journalists are also publishing that these were obtained by “hacking” with no evidence that this was the method used to obtain them." https://www.craigmurray.org.uk/archives/2016/10/really-really-upset-foreign-office-security-services/ https://www.craigmurray.org.uk/archives/2016/10/really-reall...
- eridius 10y agoThe article isn't talking about tracing traffic through Russia or any of that, so I don't understand how your comment is at all appropriate. The article is talking about how a bunch of attacks against people can all be traced back to the same group Fancy Bear (which is claimed to be a group of Russian hackers) because they all used a single bit.ly account to craft the short URLs that were used in the phishing emails. This account was found by tracking down Fancy Bear's command and control domains (so it was already known to belong to Fancy Bear before they connected it to John Podesta). So are you saying that Fancy Bear isn't actually Russian hackers? Or are you saying you think the article is lying about the fairly strong evidence tying all these attacks together?
- badmadrad 10y agoI'm more pointing out the possibility its not state sponsored by Russia even if the attack originated in Russia. Based on the evidence they have released do we have any idea what Fancy Bear is really comprised of and what their motivations are? For all we know there could be Americans in the group. It could be hackers sharing techniques with eachother and operating under the same flag. I still have questions in my mind and I'm not willing to pass the judgement on what I have seen but its possible the security researchers have more evidence they can't release for various reasons.
- codedokode 10y agoThose are script kiddie level phishing attacks. They use free domains and free link shorteners. Only a user that doesn't look at the address bar could buy that. Is shows how insecure web is: a typical user cannot distinct between real and a fake login page. That is why we should stop using outdated insecure password system and switch to cryptographic USB tokens. But Google usually blocks access to the account when you try to login from a new IP address. Why didn't it work here?
- rdslw 10y agoWrong. Look at the https://google.com/amp/hackme.com https://google.com/amp/hackme.com and pictures from article. TL;DR: google amp does redirect, and you can use bit.ly/xxx instead hackme.com in example above.
- bduerst 10y agoThe website url is still http://www.hackme.com http://www.hackme.com though. These different iterations of myaccount-google.com, support.goog1e.com, etc. are common for many companies - the best thing to do is use 2-step auth.
- codedokode 10y agoThe fake login page still is not on a google domain.
- iask 10y ago"The phishing email that Podesta received on March 19 contained a URL, created with the popular Bitly shortening service, pointing to a longer URL that, to an untrained eye, looked like a Google link." Ha....looked at the link and can conclude...long enough to bypass the average attention span ;)
- roel_v 10y agoIs there a list somewhere of all "known" APT's, i.e. which number is suspected to be who? And is the "APT numbering" something internal to the NSA or is it by now a sort of an informal standard? And are there reports of how the Russians and the Chinese 'label' Western groups?
- jessaustin 10y agoOne would have assumed that Mandiant would act as the IANA for APT? b^)
- mckoss 10y agoWhy doesn't bitly block obvious phishing domains - like ones that contain popular domains as a prefix?