4 ms·
Bellingcat journalists targeted by failed phishing attempt
- panarky 7y agoStatement from ProtonMail: https://protonmail.com/blog/bellingcat-cyberattack-phishing/ https://protonmail.com/blog/bellingcat-cyberattack-phishing/
- hannob 7y agoThere is this interesting part: > Furthermore, the attackers attempted to exploit an unpatched vulnerability in an open source software that is widely used by email providers in an effort to bypass spam and abuse filters. We were previously aware of this vulnerability and have already been watching it for some time, but we will not disclose it here because the software in question is not developed by ProtonMail, and it has not yet been patched by the software maintainers. This vulnerability, however, is not widely known and indicates a higher level of sophistication on the part of the attackers. So there's a yet unfixed vulnerability, but some email provider knows about it and also probably some russian spies. Yet protonmail doesn't want to disclose it. Why do they know about it in the first place? Who else knows about it?
- panarky 7y agoThe phishing mail spoofed support@protonmail.ch, which should have been caught by SPF and DMARC. And protonmail-to-protonmail should be E2E encrypted and authenticated. Many unanswered questions here about how this got past ProtonMail to users.
- stebann 7y agoNice observation. Maybe the vulnerability might be related to spoofing SPF and other security mechanism? They should be fixing this by now.
- roywiggins 7y ago"The researchers use open-source intelligence and information gathering where police, law enforcement and intelligence agencies often fail." intel agencies may succeed but they certainly are not shouting their success to the skies except in rare cases. Open source intelligence gathering isn't always about one-upping the intelligence agencies! It's about retrieving information that can inform the public and isn't locked away by intelligence and political actors.
- londons_explore 7y agoBellingcat to me looks like a way for intelligence agencies to announce their results to the world without saying how they figured this stuff out. It's very easy to do this 'open source journalism' if you already have the answers via an NSA tipoff.
- JetSpiegel 7y agoNot sure why the NSA would squander all the positive publicity of identifying those GRU officers that killed Skripal. OTOH, you could also argue that not stopping them at the border was a failure.
- manjana 7y agoThe language in the phishing mail comes off as awkward and ingenuine.
- TheOtherHobbes 7y agoIt's very poor English. I find it hard to believe that a state actor couldn't put together a spoof email written in good idiomatic English if it really wanted to. But from my limited experience of Russian troll farms they seem to be staffed by younger people who don't respect Westerners and think any action is a bit of a joke, so attention to detail may not be their main interest. They're effectively a kind of weaponised Russian version of 4chan, not a professional intelligence department or PR machine.
- solarkraft 7y agoThis is interesting. Do you have more information to share about this topic?
- curiousph 7y agoCan you tell why? I spend a day by trying to make fluent but you are telling me it looks awkward...
- fibers 7y agos/Bellingcat/SomethingAwful Posters/g
- ga-vu 7y agoThreatConnect source: https://threatconnect.com/blog/building-out-protonmail-spoofed-infrastructure/ https://threatconnect.com/blog/building-out-protonmail-spoof... The article glosses over attack details and mumbles about 'Russia is bad' for three-quarters of the text
- nkozyra 7y agoI don't understand why you take onus with the Russian state/Fancy Bear aspect of the story. They seem to be addressed in the same spirit in both articles.
- vuln 7y agoIt you look at the indicators of compromise that law enforcement shared on Fancy Bear and Grizzly Steppe you would notice that a large portion of the IP address are tied to VPN providers like Hide My Ass. Attribution is very very very hard. https://krebsonsecurity.com/2017/08/blowing-the-whistle-on-bad-attribution/ https://krebsonsecurity.com/2017/08/blowing-the-whistle-on-b...
- curiousph 7y agoGuys, can somebody show me my mistakes in spoof email, please? Otherwise I'll be fired Thanks!