3 ms·

Both DNC and also the Clinton Campaign (Campaign Chairman Podesta). Podesta was hacked by pfishing which most users < 30 knows to avoid. Tells me Podesta had

Both DNC and also the Clinton Campaign (Campaign Chairman Podesta). Podesta was hacked by pfishing which most users < 30 knows to avoid. Tells me Podesta had no geek friends.

walrus01 9y ago
worse, podesta actually asked their sysadmin "is this legit" and was told, paraphased "yup, click on it and enter your credentials". https://www.vox.com/policy-and-politics/2016/10/28/13456368/how-john-podesta-email-got-hacked https://www.vox.com/policy-and-politics/2016/10/28/13456368/... "Seemingly skeptical (and rightfully so), Podesta forwarded the email to his chief of staff, who then passed along the email to the campaign’s IT team. This is where things go so painfully wrong: The campaign’s IT team incorrectly identified the email phishing for Podesta’s password as legitimate, instructing him to change his password."
- hackuser 9y ago
  Amazing; I hadn't seen that story. Vox doesn't prove that this particular phishing attack was the way the attackers got access to Podesta's email, but what an unbelievable failure by their IT team. Who would fall for this? The phishing email claims to be from from Google support, and tells the user: > CHANGE PASSWORD: <https://bit.ly/[deleted]> https://bit.ly/[deleted]> That should be enough red flags. Also, the bitly address expands to one in the domain, myaccount.google.com-securitysettingpage.tk
  - Natsu 9y ago
    > Vox doesn't prove that this particular phishing attack was the way the attackers got access to Podesta's email If you visit the stats page for that bitly link by adding a + to the end, you'll find that it was visited exactly twice, both visits at the right time for the hack, and you'll find that the Wikileaks data cuts off soon after the hack, probably when they set up 2FA as suggested. While that doesn't technically prove that they're related, it's better evidence than we have for any other theories. Sources: Bitly stats page: https://bitly.com/1PibSU0+ https://bitly.com/1PibSU0+ Phishing email: https://wikileaks.org/podesta-emails/emailid/34899 https://wikileaks.org/podesta-emails/emailid/34899
- davidf18 9y ago
  That's very helpful information and not something reported in the NYT, WaPo, or other MSM. This is my source: https://motherboard.vice.com/en_us/article/how-hackers-broke-into-john-podesta-and-colin-powells-gmail-accounts https://motherboard.vice.com/en_us/article/how-hackers-broke... Also, I learned recently that Clinton didn't know how to use a personal computer. Nobody on her staff could take the time to teach her the basics.
deleted 9y ago
[deleted]
UncleMeat 9y ago
Gonna need to science to show me that most users under 30 know how to avoid phishing (particularly spearphishing). This goes against all available evidence that I have seen in the industry.
- walrus01 9y ago
  In my experience a huge number of users under age 30 can't even distinguish the difference between a binary that is natively running on their windows10 or osx workstation OS, and something that is presented inside of a web browser window. Thus you get people paying for windows bluescreen ransom javascript webpages (or "FBI has locked your computer") that are presented with scary graphics as fullscreen inside chrome on OSX. People basically treat their laptops as glorified thin clients nowadays.
  - maccard 9y ago
    Considering that many day to day apps (slack, spotify, vscode) are web views, is that really surprising?

Both DNC and also the Clinton Campaign (Campaign Chairman Podesta). Podesta was hacked by pfishing which most users < 30 knows to avoid. Tells me Podesta had no geek friends.

walrus01 9y ago

worse, podesta actually asked their sysadmin "is this legit" and was told, paraphased "yup, click on it and enter your credentials". https://www.vox.com/policy-and-politics/2016/10/28/13456368/how-john-podesta-email-got-hacked https://www.vox.com/policy-and-politics/2016/10/28/13456368/... "Seemingly skeptical (and rightfully so), Podesta forwarded the email to his chief of staff, who then passed along the email to the campaign’s IT team. This is where things go so painfully wrong: The campaign’s IT team incorrectly identified the email phishing for Podesta’s password as legitimate, instructing him to change his password."

hackuser 9y ago
Amazing; I hadn't seen that story. Vox doesn't prove that this particular phishing attack was the way the attackers got access to Podesta's email, but what an unbelievable failure by their IT team. Who would fall for this? The phishing email claims to be from from Google support, and tells the user: > CHANGE PASSWORD: <https://bit.ly/[deleted]> https://bit.ly/[deleted]> That should be enough red flags. Also, the bitly address expands to one in the domain, myaccount.google.com-securitysettingpage.tk
- Natsu 9y ago
  > Vox doesn't prove that this particular phishing attack was the way the attackers got access to Podesta's email If you visit the stats page for that bitly link by adding a + to the end, you'll find that it was visited exactly twice, both visits at the right time for the hack, and you'll find that the Wikileaks data cuts off soon after the hack, probably when they set up 2FA as suggested. While that doesn't technically prove that they're related, it's better evidence than we have for any other theories. Sources: Bitly stats page: https://bitly.com/1PibSU0+ https://bitly.com/1PibSU0+ Phishing email: https://wikileaks.org/podesta-emails/emailid/34899 https://wikileaks.org/podesta-emails/emailid/34899
davidf18 9y ago
That's very helpful information and not something reported in the NYT, WaPo, or other MSM. This is my source: https://motherboard.vice.com/en_us/article/how-hackers-broke-into-john-podesta-and-colin-powells-gmail-accounts https://motherboard.vice.com/en_us/article/how-hackers-broke... Also, I learned recently that Clinton didn't know how to use a personal computer. Nobody on her staff could take the time to teach her the basics.

deleted 9y ago

[deleted]

UncleMeat 9y ago

Gonna need to science to show me that most users under 30 know how to avoid phishing (particularly spearphishing). This goes against all available evidence that I have seen in the industry.

walrus01 9y ago
In my experience a huge number of users under age 30 can't even distinguish the difference between a binary that is natively running on their windows10 or osx workstation OS, and something that is presented inside of a web browser window. Thus you get people paying for windows bluescreen ransom javascript webpages (or "FBI has locked your computer") that are presented with scary graphics as fullscreen inside chrome on OSX. People basically treat their laptops as glorified thin clients nowadays.
- maccard 9y ago
  Considering that many day to day apps (slack, spotify, vscode) are web views, is that really surprising?