3 ms·

I'm not completely understanding the story here. Did an actual "hack" occur with a 0-day exploit behind that URL, or did Podesta simply get phished and gave up

I'm not completely understanding the story here. Did an actual "hack" occur with a 0-day exploit behind that URL, or did Podesta simply get phished and gave up his password to a 3rd party site? I assumed the latter, but there are statements in the article, such as "That’s the link that opened Podesta’s account to the hackers", that are very confusing. Was there some SPF/DKIM/Gmail exploit or trickery that allowed the phishing email to display as if it were legit coming from Google?

rfrank 10y ago
could have been spoofing the url with some sort of homograph attack. http://www.welivesecurity.com/2015/07/14/spoofed-urls-homograph-attacks-revisited/ http://www.welivesecurity.com/2015/07/14/spoofed-urls-homogr...
revelation 10y ago
It's deliberately obtuse because how you are going to make mass-sent phishing mail sound like some Russian cyberweapon if the mope turns out to have entered his own password? The actual Google myaccount.google.com/.. site that the phishing URL is modeled after asks for a new password.
wav-part 10y ago
https://google.com/amp/hackme.com https://google.com/amp/hackme.com redirects to hackme.com. The attacker here used tiny.cc to be more elusive. IIRC we had a popular discussion here about this. How google can still allow this is beyond me.
- sjeanpierre 10y ago
  Wow this is really fucked up. Most people would automatically trust a link from Google.
  - acqq 10y ago
    And the link really results in the real connection to the real Google server, which then merily redirects to wherever. Whover allowed that in Google, using the main google.com domain, what was he thinking? For me, that is the major story here.
    - tmzt 10y ago
      Wow, this should at least be googleusercontent.com or the like. It seems amp started as a whitelist of well-known publishers and morphed into somthing like an open proxy.
      - acqq 10y ago
        Ended as the www.google.com becoming the redirector, by default, to anything, without having any query in the URL syntax. It broke what people knew how www.google.com behaved for more than a decade. But if I understood correctly it started from the idea "Google hosts your pages (if I understand correctly, even the scripts!) now with Google's TLS certificate and on Google's www.google.com domain" which is also quite fracked up for what can be expected of www.google.com?

rfrank 10y ago

could have been spoofing the url with some sort of homograph attack. http://www.welivesecurity.com/2015/07/14/spoofed-urls-homograph-attacks-revisited/ http://www.welivesecurity.com/2015/07/14/spoofed-urls-homogr...

revelation 10y ago

It's deliberately obtuse because how you are going to make mass-sent phishing mail sound like some Russian cyberweapon if the mope turns out to have entered his own password? The actual Google myaccount.google.com/.. site that the phishing URL is modeled after asks for a new password.

wav-part 10y ago

https://google.com/amp/hackme.com https://google.com/amp/hackme.com redirects to hackme.com. The attacker here used tiny.cc to be more elusive. IIRC we had a popular discussion here about this. How google can still allow this is beyond me.

sjeanpierre 10y ago
Wow this is really fucked up. Most people would automatically trust a link from Google.
- acqq 10y ago
  And the link really results in the real connection to the real Google server, which then merily redirects to wherever. Whover allowed that in Google, using the main google.com domain, what was he thinking? For me, that is the major story here.
  - tmzt 10y ago
    Wow, this should at least be googleusercontent.com or the like. It seems amp started as a whitelist of well-known publishers and morphed into somthing like an open proxy.
    - acqq 10y ago
      Ended as the www.google.com becoming the redirector, by default, to anything, without having any query in the URL syntax. It broke what people knew how www.google.com behaved for more than a decade. But if I understood correctly it started from the idea "Google hosts your pages (if I understand correctly, even the scripts!) now with Google's TLS certificate and on Google's www.google.com domain" which is also quite fracked up for what can be expected of www.google.com?