16 ms·

Email from FBI Looks Odd

476 points by jacksoncloud 5y ago

yonaguska 5y ago
Tangentially related, but the FBI needs to be disbanded. At least the DC offices, which are simply a political police force at this point. This is just another example of incompetence on their part.
- Doubtme 5y ago
  Im just going to let you figure out this one for yourself.
  - yonaguska 5y ago
    There was no reform after COINTELPRO. The FBI has known about nearly every mass shooter for the past 20 years, they've leaked numerous investigations and raids to the press for political reasons, they sit on evidence for political reasons, they target domestic journalists for political reasons, they lied to FISA courts for political reasons, and they've been sitting on exculpatory evidence for political reasons, they've been sicced on parents at school boards for political reasons. I'll let you figure this one out for yourself.
    - tata71 5y ago
      No idea what the other commenter was alluding to...
      - twofornone 5y ago
        They did allegedly just raid a politically opposed journalistic outlet and leak confidential reporter's notes to NYT, which is sort of illegal. Can anyone explain why Biden's daughter's stolen diary, which PV obtained and gave back, is grounds for an FBI search warrant? https://news.ycombinator.com/item?id=29210285 https://news.ycombinator.com/item?id=29210285
        astronautjones 5y ago
        calling that guy a journalist is hilariously disingenuous. the guy that has been caught doctoring and falsely editing literally everything that he has produced? He's catering to an audience of hateful people that can't even eat breakfast without it being in bad faith. He is weeks away from an expose telling you that actually the confederacy landed on the moon first. Being a contrarian fool that argues blindly without accepting or understanding reality and context is de rigueur on this website, it's disgusting and telling as to why the industry is so self-serving and fraud-ridden
        twofornone 5y ago
        > the guy that has been caught doctoring and falsely editing literally everything that he has produced? I don't know what to tell you, that's a lie. Even if he had published misleading or false statements in the past, that does not imply that everything out of PV is false, as convenient as such a belief may be for supporters of the establishment. >He's catering to an audience of hateful people that can't even eat breakfast without it being in bad faith. He is weeks away from an expose telling you that actually the confederacy landed on the moon first. Dissent is not hateful. Leaning right is not hateful. You are stereotyping, writing off everyone on the other side based on the beliefs of an extreme minority. The same logic could be applied to the left at large and it would be just as dishonest. >Being a contrarian fool that argues blindly without accepting or understanding reality and context is de rigueur on this website, it's disgusting As opposed to blindly following groupthink because your "authoritative sources" have unquestioningly quoted experts with blatant political and financial conflicts of interest? Please. Tell me, where are the journalists looking into e.g. ties between pfizer and the FDA? Regulatory capture is no secret. The partisan hate that PV gets is totally unwarranted, its a cheap, straw grasping dismissal of opposition. This leaked diary is an excellent example, by the way. Though PV did not leak the contents, someone else did, and there are images of pages detailing Ashley's potential molestation by her father. If our media had a semblance of objectivity that would be a huge story - and apparently if the FBI is raiding PV over the diary (for which there is absolutely no justification, beyond party politics), the diary must be authentic. Hunter Biden's laptop was another example of mass collusion by partisan media - regardless of how you feel about the situation, images of a presidential candidate's son smoking crack with prostitutes is huge news. PV was one of the few outlets willing to touch it. In any case, that you may think O'Keefe is biased does not imply that he is not in fact a journalist; unless you are willing to be consistent and acknowledge that the blatant activism that has replaced journalism in mainstream media also disqualifies them from identifying as journalists. This is what dissent looks like.
      - geofft 5y ago
        I am guessing "Anyone who gets seriously close to threatening the FBI's existence will get extrajudicially prevented from doing so"? For a lawmaker, you don't even have to do anything legally or (particularly) morally questionable like killing them - just entrap them and have them lose their jobs. https://en.wikipedia.org/wiki/Abscam https://en.wikipedia.org/wiki/Abscam
        RNCTX 5y ago
        If you do catch them and it's too public to go after you for retribution, they'll sell a federal judiciary seat to someone willing to erase it. One of Trump's 2017 judicial appointments in the ND of Texas dismissed the civil suit against the FBI, DOJ, and Comey by name for organizing the "ISIS" mass shooting in Garland, TX in 2015. We know they organized it because local cops caught an undercover in the parking lot who was waiting on the shooters to arrive. [1] He had to identify himself as undercover to stop the local cops from shooting him. [2] A security guard who was shot in the incident brought the civil suit against the feds, discovery produced text messages showing the same undercover FBI agent giving the shooters instructions. The FBI also had to remove flags from databases so the shooters could pass background checks for gun purchases. And before anyone falls for the knee-jerk tendency of thinking one political party is different from the other, the judge who dismissed the case on her first day was a stalled Obama appointment to the same seat before she was a Trump appointment confirmed for that seat. And the person who blew the whistle on the FBI paying people to recruit and train domestic "terrorists" said they began doing so when Obama took office in 2009. 1. https://www.azcentral.com/story/news/local/phoenix/2017/02/10/records-undercover-fbi-agent-near-garland-terror-attack/97740354/ https://www.azcentral.com/story/news/local/phoenix/2017/02/1... 2. https://www.cbsnews.com/news/terrorism-in-garland-texas-what-the-fbi-knew-before-the-2015-attack/ https://www.cbsnews.com/news/terrorism-in-garland-texas-what...
        nosefrog 5y ago
        Extraordinary claims require extraordinary evidence, and most of what you've stated are not supported by your links.
  - dang 5y ago
    Please don't take HN threads further into flamewar. We're trying to avoid that here. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- deleted 5y ago
  [deleted]
- _game_of_life 5y ago
  So what would you suggest to replace it? Obviously there needs to be some federal law enforcement agency... And as much as their past has portions that are super fucked up, wasn't that also a reflection of American society at the time? I just think that for as much harm as the FBI historically caused, they've also busted enormous criminal rings and done a lot to reduce organized crime. I genuinely think Americans would be worse of without them, even with my bias as a leftist that typically loathes alphabet soup surviellance agencies.
- dang 5y ago
  "Eschew flamebait. Avoid unrelated controversies and generic tangents." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
killingtime74 5y ago
Would the FBI not establish first contact by mail, in person or at least on the phone? What kind of common sense thinks this is legit.
- pedro2 5y ago
  The news here is the headers look good.
  - sterlind 5y ago
    The hackers have the ability to originate legit emails from ic.fbi.gov and they blow it on a spammy phishing campaign with broken English? what a waste..
    - 3np 5y ago
      It doesn't even seem like phishing; there's no contact info and the sender bounces in a way that seems like it doesn't go to the one who sent it. Is it general FUD (eroding FBI legitimacy) or a smear campaign against Vinny Troia..? EDIT: Or it's a diversion of attention; there's something else going on somewhere else that they want to go unnoticed.
      - jazzyjackson 5y ago
        vinny troia himself washing out the google results for his name?
        not1ofU 5y ago
        never heard of him before, but after a few minutes digging, I tend to agree.
    - madaxe_again 5y ago
      Sounds about right. A blue chip I work with had a successful phish against them - the attacker ended up with access to the email inbox of an HR person. So they tried basic, stupid 419 type scams, with broken English. They could have pried the entire org wide open - she had masses of private data in her inbox, enough to impersonate or social engineer your way to anywhere. But instead, they blew it - and blew it so badly the client spent days investigating what this could have been a distraction for, as they pretty much couldn’t believe their luck at the minimal severity of the attack. It’s like breaking into the federal reserve, thinking it’s a 7/11, and then stealing the ballpoint pens from the cashiers desks. Either way, it was a helpful experience for them - a vaccination against further stupidity, and they all of a sudden started engaging on their ISMS with gusto and panache.
buro9 5y ago
The FBI don't provide information like this in an email and will speak to you first. This is bogus, delete it.
- londons_explore 5y ago
  The dkim header signature is correct. It means it really is from an FBI server.
  - buro9 5y ago
    But still... the FBI don't speak to you like this and wouldn't overprovide information like this. The only time I've seen the FBI talk like this is when they already have a trusted relationship with you and an open channel and they're off the record. Just because a server is coerced into sending an email that is signed, it does not mean it is from the FBI.
    - lordofgibbons 5y ago
      The point here isn't whether this is real or fake. The news is that someone is able to impersonate an email as coming from the FBI with all of the correct email headers with dkim signing. I'm speculating here, but this probably means they might have control of one of the FBI subdomains
  - hericium 5y ago
    How can you tell without all the headers mentioned in DKIM-Signature?
bell-cot 5y ago
First reaction - if $Legit_and_Competent_Group believes that a bunch of my infrastructure is compromised, then why the h*ll would they alert me via e-mail? Especially an e-mail full of sensitive details, which has a fair chance of being read by the attackers first.
tejtm 5y ago
the only vaguely reliable item in an email header is the last ip in the square bracket inserted bt your mailserver saying where it thinks it "Received from" note that in this case it is: Received: from dap00040.str0.eims.cjis (dap00040.str0.eims.cjis [10.66.2.72]) and that 10.X.X.X is an un-routable address (unless you are part of the originating network) Since I'm not part of the FBI I would strongly suspect some one was misrepresenting their address to my mailserver. adding that I really don't know jack about this. sec is not an interest of mine so please, experts, straighten out any misconceptions I am propagating
- ev1 5y ago
  The one inserted by my mailserver is Received: from mx-east.fbi.gov (mx-east-ic.fbi.gov [153.31.119.142]) The 10.* ones were inserted by theirs.
- technion 5y ago
  There's a paste from another recipient's headers: https://pastebin.com/8ES3t1hv https://pastebin.com/8ES3t1hv I believe the very top line is inserted by the victim mailserver and points to an FBI IP in a way that can be considered accurate.
sys32768 5y ago
I received this at 1:07 AM PST to my work sysadmin account. It passed Barracuda and Office 365 spam filters. Initially I felt a surging panic when I realized the source IP was indeed FBI, especially considering one of our close partners recently buckled under a ransomware attack they refused to pay, and thus had to rebuild from backups over a period of two weeks. Smells mostly bogus now with no links to a status page and so many others reporting the exact same sloppy email, but how did they know to email me and other sysadmins, and how did they send from an FBI IP address? Edit: typo
- vhold 5y ago
  If it wasn't whois then another common tactic is to use LinkedIn and guess addresses from the names.
- bell-cot 5y ago
  Did the "one of our close partners [who] recently buckled under a ransomware attack" have contact details for "[you] and other sysadmins", to target the emails?
- ev1 5y ago
  Are you listed on any contacts or WHOIS? One of my friends got it to every single possible ARIN POC - abuse, noc, any named users for their IP space, and any emails that could be found for their domain.
  - sys32768 5y ago
    No, actually. All domains use an alias but this was sent directly to my primary, but not sent to any of our historic or present domain WHOIS contacts.
hericium 5y ago
Lack of full body and some headers mentioned in the DKIM-Signature headers makes it impossible to verify DKIM authenticity. Would (reddit) OP not cut out their Authentication-Results headers, we we would know how their MTA's anti-forgery mechanisms saw this alleged message. But, assuming that what's on reddit is true, this is interesting. It looks like FBI attempting to discredit a researcher (which I doubt because this would be one of dumbest ways to do so) or maybe someone gained enough access to FBI's infra to at least bounce a message by their systems without it looking so (but earlier Received headers do not suggest that the message originated from outside the network). EDIT: Another idea is that OP's systems may be so compromised already that someone simply created FBI-looking message on their system and it never touched network.
trhway 5y ago
"email from FBI", and the Nigerian FBI office at that ... Reminded - a professor of a Moscow University couple months ago received a call from Russian Central Bank advising him that his account in some bank is being actively targeted by scammers/hackers, and that he needs to temporarily transfer the money to the special holding account the Central Bank rep provided, so the professor did. Some time later the scammers started to target the professor's condo - the police agent called him informing about it and asking for help to catch the scammers - when the scammers come with the prepared documents for the condo sale, professor would need to play the part as if he doesn't know what it is a scam and to sign the documents, receive the money and after that to give the money as evidence to the special agents in the car near the condo building. And professor did as he was told. So far - no money, no condo, no bank account with the significant sum of money... Or as our corporate anti-phishing/etc. training - which was forced again upon us last month - instructs "Got a call from John from company A ? Hang up and call the public phone number of the company A and ask for the John."
- tentacleuno 5y ago
  What happened to the scammers?
  - trhway 5y ago
    So far nothing. The victim reported it to police only 3 weeks ago. https://www.google.com/amp/s/m.gazeta.ru/amp/social/news/2021/10/20/n_16721839.shtml https://www.google.com/amp/s/m.gazeta.ru/amp/social/news/202...
    - tentacleuno 5y ago
      Fixed the link: https://www.gazeta.ru/social/news/2021/10/20/n_16721839.shtml https://www.gazeta.ru/social/news/2021/10/20/n_16721839.shtm... For some reason the one you sent redirects me to Google Fonts CSS.
    - tentacleuno 5y ago
      From what I'm reading in that news article and the explanation you wrote above, this seems like a fairly complicated and comprehensive scam. It's interesting to note how, when someone gets caught up in a scam, they don't step back and think "Woah, this doesn't make sense". Giving documents to a police officer? Special agents in another building? This always seems to happen, too. I watch scambaiters on YouTube with refund scams, and you end up with an old lady drawing figures upwards of £10,000 out of the bank, then putting it into a box, mailing it to them... Mind you, they tend to prefer the older people because they're more gullible.
buzer 5y ago
The email address seems to point to EIMS (Enterprise Identification and Management Service according to https://bja.ojp.gov/sites/g/files/xyckuh186/files/media/document/a_a_fed_id_mgt_global_04-8-2010.pdf https://bja.ojp.gov/sites/g/files/xyckuh186/files/media/docu...). The email address is also listed at some guide at https://www.justice.gov/tribal/page/file/1260671/download https://www.justice.gov/tribal/page/file/1260671/download. My guess would be that there is some integration point somewhere to EIMS that allows requesting/granting some access & takes the email template from submitted form.
dsukhin 5y ago
The email domain where the messages originate is from some sort of federated identity management system that was created in 2010 (here is a proposal deck [0] with technical details). Found this program simply by searching Google for the sending domain. Based on the guide for using this system [1] (see step 15) looks like this specific email address is the one that sends automated confirmation emails upon registration. Perhaps someone was able to inject a message instead of the regular canned text through some sort of reflection attack? This explains why replies to the message result in a canned response. The system also now appears to be temporarily down. So it’s getting some sort of attention (internally taken down (most likely) or maybe denial of service from the abuse). The Reddit thread suggests the recipients’ emails are likely ARIN IP range contacts. Those are very available from tools like this [2] so nothing interesting with that, but the real question is WHY someone would do this at all? This was clearly given some thought (on who to send this to who would actually take the time to verify the headers) but given the sloppiness of everything else, is this just a script kiddie flex? Whoever it is pissed off the FBI and gained absolutely nothing. [0] https://bja.ojp.gov/sites/g/files/xyckuh186/files/media/document/a_a_fed_id_mgt_global_04-8-2010.pdf https://bja.ojp.gov/sites/g/files/xyckuh186/files/media/docu... [1] https://www.justice.gov/tribal/page/file/1260671/download https://www.justice.gov/tribal/page/file/1260671/download [2] http://itools.com/tool/arin-whois-domain-search http://itools.com/tool/arin-whois-domain-search
- technion 5y ago
  Awesome. A guide written in 2019 from the FBI that suggests Internet Explorer.
  - fortran77 5y ago
    I would assume they're recommending Edge now. We switched from IE to Edge around that time; and our company is very security conscious because of our clients.
    - RNCTX 5y ago
      I would assume you're wrong. I don't think you appreciate how many government websites run ancient software sold to them by a politician's cousin, who thinks even having a developer on staff is a waste of money.
Kiro 5y ago
Readable link on mobile: https://www.reddit.com/r/sysadmin/comments/qsun7o/email_from_fbi_looks_odd/ https://www.reddit.com/r/sysadmin/comments/qsun7o/email_from...
- mynameismon 5y ago
  A more readable link: https://i.reddit.com/r/sysadmin/comments/qsun7o/email_from_fbi_looks_odd/ https://i.reddit.com/r/sysadmin/comments/qsun7o/email_from_f...
Raed667 5y ago
We have been made aware of "scary" emails sent in the last few hours that purport to come from the FBI/DHS. While the emails are indeed being sent from infrastructure that is owned by the FBI/DHS (the LEEP portal), our research shows that these emails *are* fake. https://twitter.com/spamhaus/status/1459450061696417792 https://twitter.com/spamhaus/status/1459450061696417792
- stevebmark 5y ago
  I continue to see Twitter as an invaluable real time news source. It often seems to have more direct information on breaking topics than other mediums. I often discover news on Twitter well before seeing it on other platforms.
  - camhart 5y ago
    Last summer Twitter alerted me to wild fire evacuations for my area (in Western Washington) hours before traditional channels reached me.
  - systemvoltage 5y ago
    Agree, but also keeps feeding me extreme bias and straight up nonsense. Let’s not forget its destructive aspects as well.
    - gzer0 5y ago
      You can mitigate this, at least partially, if you go into your account settings and deselect “show me personalized content and ads”; this paired with ublock origin can do wonders.
- TheRealNGenius 5y ago
  Why did they feel the need to emphasize are?
  - TheRealNGenius 5y ago
    I'd like to think this is a valid question
deleted 5y ago
[deleted]
tumblewit 5y ago
There is this line from Michael Clayton movie that I basically assume every time I see something like this ‘client:(phone rings) That’s the police isn’t it? MC: No, they don’t call.’ Or in this case, they don’t email.
- capableweb 5y ago
  Not this holds up, in this case they would most likely call you and either tell you over the phone, or setup the meeting over the phone.
hungryforcodes 5y ago
From the Reddit thread: "got it too. i called the FBI helpdesk and they are getting flooded with calls..." I mean as a spammer (or whateveer) do you REALLY want to piss off the FBI like that?
- sennight 5y ago
  What are they gonna do in response, bankroll somebody to say they have a tape of Russian hookers peeing on you? The FBI is famously inept at anything beyond questionably legal political games, so much so that the Secret Service was in charge of enforcing telecommunications related law for the longest time.
  - pangolinplayer 5y ago
    True
- rwbhn 5y ago
  Misdirection? Loud noise here - actual attack somewhere else?
  - jazzyjackson 5y ago
    or shake the machine and see what falls out - watch the access logs to find what individuals have the power to respond, target them for further spearfishing
- LogonType10 5y ago
  If you're in a former USSR state there's nothing they can do to you.
feefree-cc 5y ago
We received and forwarded to various groups at FBI and DHS at the onset. The running theory here is IPv6 to iPv4 routing is the problem with this incident. Generic and trusted config as where any ipv6 arbitrarily “just works” to a trusted IPv4 block with existing rules. Most IPv6 implementations do not have the detail scrutiny in firewall rules to prevent or filter, and IDS this type of thing from happening.
- bink 5y ago
  > Most IPv6 implementations do not have the detail scrutiny in firewall rules to prevent or filter, and IDS this type of thing from happening. This sentence is nonsensical. Any firewall that will pass IPv6 can understand IPv6 enough to block it. And no firewall will default open for IPv6. The same goes for any IDS made in the last 15 years. But regardless, IDS doesn't block anything, it only detects (and likely wouldn't trigger solely on sending an email).
oxymoran 5y ago
I find it fascinating that one can be intelligent enough to be able to do something like this but they just couldn’t put together a coherent enough email to actually fool you, especially because they seem to have a decent enough command of English. The tone is waaaaaay off though.
- ac2u 5y ago
  Perhaps the human effort needed to see their goals through requires that they filter for only the targets that would fall for such a poorly constructed effort.
  - rasz 5y ago
    This could work if recipients were CEOs/CISOs, not actually technical people (ARIN IP range contacts = NOC? as someone above me found out)
  - Zarel 5y ago
    The big unanswered question there is: Why go through the effort of making the headers real, if you want to intentionally filter out the kind of people who would look at them?
    - ac2u 5y ago
      We're talking in hypotheticals of course, but the effort to make headers real isn't just to fool people who would inspect, but also to fool corporate spam filters and email clients that would display big bold warnings over such an email.
- Alex3917 5y ago
  If you can send email from the FBI then you also have a get out of jail free card for any crime. Seems like a bad use of this access.
  - enkid 5y ago
    I don't see how sending an email from the FBI gives you a get out of jail free card.
arvindamirtaa 5y ago
https://twitter.com/GossiTheDog/status/1459451749811593219 https://twitter.com/GossiTheDog/status/1459451749811593219
IAmGraydon 5y ago
Lots of people commenting that the text of the email seems amateurish. Perhaps it’s exactly as it should be, but you don’t understand its purpose. Maybe they wanted this to be discussed on netsec forums everywhere, so that Google searches for “Vinny Troia” always lead back to discussion about this email, framing him as a cyber criminal and outranking legitimate posts about or by him - an online identity assassination. They needed the email to set off some alarm bells so that it would pique enough interest to be widely discussed. They appear to have widely targeted the email addresses of system admins. I’m fairly certain this was their intention. Also, does it strike anyone else as odd that the account that posted this to HN was created hours ago, for the sole purpose of starting this thread?
- chillingeffect 5y ago
  Don't know of Vinny, but if he's a security guy, maybe one of his colleagues is pranking him? My college buddies did this kind of stuff to one another. They would die laughing at finding a way to legit send spam through the fbi.
  - deleted 5y ago
    [deleted]
  - agency 5y ago
    Love to commit high profile cyber crime that could land me in prison, as a prank.
    - bink 5y ago
      If this is (as it appears it might be) simply a reflection attack of some sort, I'm not sure what crime could've been committed. Or at least what computer crime could've been committed. Impersonating a federal official is about the only thing I can think of.
      - deleted 5y ago
        [deleted]
PaulHoule 5y ago
They probably want you to send them money with a gift card, watch out! Real thugs use Bitcoin.
IYasha 5y ago
I still don't quite understand hackers: doing such high-profile hacking and writing lame texts even wihout much fact checking (about agency divisions in this case). Being written in more professional way, this attack could be way more effective. Also, is it a thing among "hackers" to write with tons of mistakes? A part of culture maybe? Or to scare the bricks out of people? )
- tsywke44 5y ago
  The email text to me looks like it was written by some 15-year-old zoomer kid with no clue what they’re really doing.
- kingkawn 5y ago
  Or the purpose is to make the FBI look publicly incompetent, not to successfully carry out a secret operation.
  - vmception 5y ago
    For the lulz, I would be happy to see that culture come back, well somewhat
- vorhemus 5y ago
  I'd have guessed that it should be possible to get a reasonable amount of $ for selling access to FBI email servers but maybe the person(s) behind the attack don't care much about money.
- flatiron 5y ago
  According to the phishing training I was mandated to take at work if you are stupid enough to overlook the mistakes you are the right target. According to them the misspellings filter out the smart enough people they don’t want talking to. But that could also be nonsense.
  - caturopath 5y ago
    Yeah, I buy this theory in general, but I'm not sure that's the highest-leverage way to use this access.
rybosworld 5y ago
Seems like an attempt to embarrass the FBI?
redm 5y ago
This Newsweek article has a pretty good breakdown: "The Federal Bureau of Investigation (FBI) email system had reportedly suffered a hack on Saturday morning amid several reports of messages sent from the agency's email infrastructure purporting to be a warning from the Department of Homeland Security (DHS) about a cyberattack." [1] "The Spamhaus Project, an international nonprofit organization based in Andorra and Switzerland that tracks spam, reported on Twitter that its analysis had shown the unusual emails are being sent from accounts "scraped" from the American Registry for Internet Numbers (ARIN) database." [1] "Our telemetry indicates that there were two 'spam' waves, one shortly before 5 AM (UTC) [12.am. E.T.] and another one shortly after 7 AM (UTC) [2a.m. E.T.]. The FBI has been getting many calls about it. We are therefore refraining from further actions against the sending IP addresses." [1] [1] https://www.newsweek.com/fbi-email-system-reportedly-hacked-fake-dhs-cyberattack-messages-1648966 https://www.newsweek.com/fbi-email-system-reportedly-hacked-...
JKCalhoun 5y ago
Yeah, I would ignore an email like that. If it's so important to the (legitimate) FBI, they can make a house call. They know where I live, right?
spzb 5y ago
> While the emails are indeed being sent from infrastructure that is owned by the FBI/DHS Well, that’s reassuring
fortran77 5y ago
I can think of one very good purpose for this message: To publicly demonstrate that an FBI expert witness's "proof" of an email's authenticity at a criminal trial may not be all that reliable.
L0in 5y ago
FBI e-mail infrastructure got hacked.
deleted 5y ago
[deleted]
Kiro 5y ago
https://twitter.com/vinnytroia/status/1459515619838251010 https://twitter.com/vinnytroia/status/1459515619838251010 https://twitter.com/pompompur_in/status/1459458485154942978 https://twitter.com/pompompur_in/status/1459458485154942978 https://twitter.com/seds https://twitter.com/seds Is this some kind of meme or joke I don't understand?
xhkkffbf 5y ago
I hate to say it, but if I were to get an email from "fbi.gov", I would assume it belongs in the same pile as the great offers from that Nigerian prince. Even if I look at the headers, I wouldn't be convinced. Perhaps we should try harder to create a public key infrastructure for email.
- ClumsyPilot 5y ago
  The fact that we can trust government communication about as much as messages from a Nigerian prince gets us a step closer to the kind of society that produces them.
deleted 5y ago
[deleted]
deleted 5y ago
[deleted]
jacksoncloud 5y ago
Hoax Email Blast Abused Poor Coding in FBI Website https://krebsonsecurity.com/2021/11/hoax-email-blast-abused-poor-coding-in-fbi-website/ https://krebsonsecurity.com/2021/11/hoax-email-blast-abused-...

476 points by jacksoncloud 5y ago

Tangentially related, but the FBI needs to be disbanded. At least the DC offices, which are simply a political police force at this point. This is just another example of incompetence on their part.

Doubtme 5y ago
Im just going to let you figure out this one for yourself.
- yonaguska 5y ago
  There was no reform after COINTELPRO. The FBI has known about nearly every mass shooter for the past 20 years, they've leaked numerous investigations and raids to the press for political reasons, they sit on evidence for political reasons, they target domestic journalists for political reasons, they lied to FISA courts for political reasons, and they've been sitting on exculpatory evidence for political reasons, they've been sicced on parents at school boards for political reasons. I'll let you figure this one out for yourself.
  - tata71 5y ago
    No idea what the other commenter was alluding to...
    - twofornone 5y ago
      They did allegedly just raid a politically opposed journalistic outlet and leak confidential reporter's notes to NYT, which is sort of illegal. Can anyone explain why Biden's daughter's stolen diary, which PV obtained and gave back, is grounds for an FBI search warrant? https://news.ycombinator.com/item?id=29210285 https://news.ycombinator.com/item?id=29210285
      - astronautjones 5y ago
        calling that guy a journalist is hilariously disingenuous. the guy that has been caught doctoring and falsely editing literally everything that he has produced? He's catering to an audience of hateful people that can't even eat breakfast without it being in bad faith. He is weeks away from an expose telling you that actually the confederacy landed on the moon first. Being a contrarian fool that argues blindly without accepting or understanding reality and context is de rigueur on this website, it's disgusting and telling as to why the industry is so self-serving and fraud-ridden
        twofornone 5y ago
        > the guy that has been caught doctoring and falsely editing literally everything that he has produced? I don't know what to tell you, that's a lie. Even if he had published misleading or false statements in the past, that does not imply that everything out of PV is false, as convenient as such a belief may be for supporters of the establishment. >He's catering to an audience of hateful people that can't even eat breakfast without it being in bad faith. He is weeks away from an expose telling you that actually the confederacy landed on the moon first. Dissent is not hateful. Leaning right is not hateful. You are stereotyping, writing off everyone on the other side based on the beliefs of an extreme minority. The same logic could be applied to the left at large and it would be just as dishonest. >Being a contrarian fool that argues blindly without accepting or understanding reality and context is de rigueur on this website, it's disgusting As opposed to blindly following groupthink because your "authoritative sources" have unquestioningly quoted experts with blatant political and financial conflicts of interest? Please. Tell me, where are the journalists looking into e.g. ties between pfizer and the FDA? Regulatory capture is no secret. The partisan hate that PV gets is totally unwarranted, its a cheap, straw grasping dismissal of opposition. This leaked diary is an excellent example, by the way. Though PV did not leak the contents, someone else did, and there are images of pages detailing Ashley's potential molestation by her father. If our media had a semblance of objectivity that would be a huge story - and apparently if the FBI is raiding PV over the diary (for which there is absolutely no justification, beyond party politics), the diary must be authentic. Hunter Biden's laptop was another example of mass collusion by partisan media - regardless of how you feel about the situation, images of a presidential candidate's son smoking crack with prostitutes is huge news. PV was one of the few outlets willing to touch it. In any case, that you may think O'Keefe is biased does not imply that he is not in fact a journalist; unless you are willing to be consistent and acknowledge that the blatant activism that has replaced journalism in mainstream media also disqualifies them from identifying as journalists. This is what dissent looks like.
    - geofft 5y ago
      I am guessing "Anyone who gets seriously close to threatening the FBI's existence will get extrajudicially prevented from doing so"? For a lawmaker, you don't even have to do anything legally or (particularly) morally questionable like killing them - just entrap them and have them lose their jobs. https://en.wikipedia.org/wiki/Abscam https://en.wikipedia.org/wiki/Abscam
      - RNCTX 5y ago
        If you do catch them and it's too public to go after you for retribution, they'll sell a federal judiciary seat to someone willing to erase it. One of Trump's 2017 judicial appointments in the ND of Texas dismissed the civil suit against the FBI, DOJ, and Comey by name for organizing the "ISIS" mass shooting in Garland, TX in 2015. We know they organized it because local cops caught an undercover in the parking lot who was waiting on the shooters to arrive. [1] He had to identify himself as undercover to stop the local cops from shooting him. [2] A security guard who was shot in the incident brought the civil suit against the feds, discovery produced text messages showing the same undercover FBI agent giving the shooters instructions. The FBI also had to remove flags from databases so the shooters could pass background checks for gun purchases. And before anyone falls for the knee-jerk tendency of thinking one political party is different from the other, the judge who dismissed the case on her first day was a stalled Obama appointment to the same seat before she was a Trump appointment confirmed for that seat. And the person who blew the whistle on the FBI paying people to recruit and train domestic "terrorists" said they began doing so when Obama took office in 2009. 1. https://www.azcentral.com/story/news/local/phoenix/2017/02/10/records-undercover-fbi-agent-near-garland-terror-attack/97740354/ https://www.azcentral.com/story/news/local/phoenix/2017/02/1... 2. https://www.cbsnews.com/news/terrorism-in-garland-texas-what-the-fbi-knew-before-the-2015-attack/ https://www.cbsnews.com/news/terrorism-in-garland-texas-what...
        nosefrog 5y ago
        Extraordinary claims require extraordinary evidence, and most of what you've stated are not supported by your links.
- dang 5y ago
  Please don't take HN threads further into flamewar. We're trying to avoid that here. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
deleted 5y ago
[deleted]
_game_of_life 5y ago
So what would you suggest to replace it? Obviously there needs to be some federal law enforcement agency... And as much as their past has portions that are super fucked up, wasn't that also a reflection of American society at the time? I just think that for as much harm as the FBI historically caused, they've also busted enormous criminal rings and done a lot to reduce organized crime. I genuinely think Americans would be worse of without them, even with my bias as a leftist that typically loathes alphabet soup surviellance agencies.
dang 5y ago
"Eschew flamebait. Avoid unrelated controversies and generic tangents." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

killingtime74 5y ago

Would the FBI not establish first contact by mail, in person or at least on the phone? What kind of common sense thinks this is legit.

pedro2 5y ago
The news here is the headers look good.
- sterlind 5y ago
  The hackers have the ability to originate legit emails from ic.fbi.gov and they blow it on a spammy phishing campaign with broken English? what a waste..
  - 3np 5y ago
    It doesn't even seem like phishing; there's no contact info and the sender bounces in a way that seems like it doesn't go to the one who sent it. Is it general FUD (eroding FBI legitimacy) or a smear campaign against Vinny Troia..? EDIT: Or it's a diversion of attention; there's something else going on somewhere else that they want to go unnoticed.
    - jazzyjackson 5y ago
      vinny troia himself washing out the google results for his name?
      - not1ofU 5y ago
        never heard of him before, but after a few minutes digging, I tend to agree.
  - madaxe_again 5y ago
    Sounds about right. A blue chip I work with had a successful phish against them - the attacker ended up with access to the email inbox of an HR person. So they tried basic, stupid 419 type scams, with broken English. They could have pried the entire org wide open - she had masses of private data in her inbox, enough to impersonate or social engineer your way to anywhere. But instead, they blew it - and blew it so badly the client spent days investigating what this could have been a distraction for, as they pretty much couldn’t believe their luck at the minimal severity of the attack. It’s like breaking into the federal reserve, thinking it’s a 7/11, and then stealing the ballpoint pens from the cashiers desks. Either way, it was a helpful experience for them - a vaccination against further stupidity, and they all of a sudden started engaging on their ISMS with gusto and panache.

buro9 5y ago

The FBI don't provide information like this in an email and will speak to you first. This is bogus, delete it.

londons_explore 5y ago
The dkim header signature is correct. It means it really is from an FBI server.
- buro9 5y ago
  But still... the FBI don't speak to you like this and wouldn't overprovide information like this. The only time I've seen the FBI talk like this is when they already have a trusted relationship with you and an open channel and they're off the record. Just because a server is coerced into sending an email that is signed, it does not mean it is from the FBI.
  - lordofgibbons 5y ago
    The point here isn't whether this is real or fake. The news is that someone is able to impersonate an email as coming from the FBI with all of the correct email headers with dkim signing. I'm speculating here, but this probably means they might have control of one of the FBI subdomains
- hericium 5y ago
  How can you tell without all the headers mentioned in DKIM-Signature?

bell-cot 5y ago

First reaction - if $Legit_and_Competent_Group believes that a bunch of my infrastructure is compromised, then why the h*ll would they alert me via e-mail? Especially an e-mail full of sensitive details, which has a fair chance of being read by the attackers first.

tejtm 5y ago

the only vaguely reliable item in an email header is the last ip in the square bracket inserted bt your mailserver saying where it thinks it "Received from" note that in this case it is: Received: from dap00040.str0.eims.cjis (dap00040.str0.eims.cjis [10.66.2.72]) and that 10.X.X.X is an un-routable address (unless you are part of the originating network) Since I'm not part of the FBI I would strongly suspect some one was misrepresenting their address to my mailserver. adding that I really don't know jack about this. sec is not an interest of mine so please, experts, straighten out any misconceptions I am propagating

ev1 5y ago
The one inserted by my mailserver is Received: from mx-east.fbi.gov (mx-east-ic.fbi.gov [153.31.119.142]) The 10.* ones were inserted by theirs.
technion 5y ago
There's a paste from another recipient's headers: https://pastebin.com/8ES3t1hv https://pastebin.com/8ES3t1hv I believe the very top line is inserted by the victim mailserver and points to an FBI IP in a way that can be considered accurate.

sys32768 5y ago

I received this at 1:07 AM PST to my work sysadmin account. It passed Barracuda and Office 365 spam filters. Initially I felt a surging panic when I realized the source IP was indeed FBI, especially considering one of our close partners recently buckled under a ransomware attack they refused to pay, and thus had to rebuild from backups over a period of two weeks. Smells mostly bogus now with no links to a status page and so many others reporting the exact same sloppy email, but how did they know to email me and other sysadmins, and how did they send from an FBI IP address? Edit: typo

vhold 5y ago
If it wasn't whois then another common tactic is to use LinkedIn and guess addresses from the names.
bell-cot 5y ago
Did the "one of our close partners [who] recently buckled under a ransomware attack" have contact details for "[you] and other sysadmins", to target the emails?
ev1 5y ago
Are you listed on any contacts or WHOIS? One of my friends got it to every single possible ARIN POC - abuse, noc, any named users for their IP space, and any emails that could be found for their domain.
- sys32768 5y ago
  No, actually. All domains use an alias but this was sent directly to my primary, but not sent to any of our historic or present domain WHOIS contacts.

hericium 5y ago

Lack of full body and some headers mentioned in the DKIM-Signature headers makes it impossible to verify DKIM authenticity. Would (reddit) OP not cut out their Authentication-Results headers, we we would know how their MTA's anti-forgery mechanisms saw this alleged message. But, assuming that what's on reddit is true, this is interesting. It looks like FBI attempting to discredit a researcher (which I doubt because this would be one of dumbest ways to do so) or maybe someone gained enough access to FBI's infra to at least bounce a message by their systems without it looking so (but earlier Received headers do not suggest that the message originated from outside the network). EDIT: Another idea is that OP's systems may be so compromised already that someone simply created FBI-looking message on their system and it never touched network.

trhway 5y ago

"email from FBI", and the Nigerian FBI office at that ... Reminded - a professor of a Moscow University couple months ago received a call from Russian Central Bank advising him that his account in some bank is being actively targeted by scammers/hackers, and that he needs to temporarily transfer the money to the special holding account the Central Bank rep provided, so the professor did. Some time later the scammers started to target the professor's condo - the police agent called him informing about it and asking for help to catch the scammers - when the scammers come with the prepared documents for the condo sale, professor would need to play the part as if he doesn't know what it is a scam and to sign the documents, receive the money and after that to give the money as evidence to the special agents in the car near the condo building. And professor did as he was told. So far - no money, no condo, no bank account with the significant sum of money... Or as our corporate anti-phishing/etc. training - which was forced again upon us last month - instructs "Got a call from John from company A ? Hang up and call the public phone number of the company A and ask for the John."

tentacleuno 5y ago
What happened to the scammers?
- trhway 5y ago
  So far nothing. The victim reported it to police only 3 weeks ago. https://www.google.com/amp/s/m.gazeta.ru/amp/social/news/2021/10/20/n_16721839.shtml https://www.google.com/amp/s/m.gazeta.ru/amp/social/news/202...
  - tentacleuno 5y ago
    Fixed the link: https://www.gazeta.ru/social/news/2021/10/20/n_16721839.shtml https://www.gazeta.ru/social/news/2021/10/20/n_16721839.shtm... For some reason the one you sent redirects me to Google Fonts CSS.
  - tentacleuno 5y ago
    From what I'm reading in that news article and the explanation you wrote above, this seems like a fairly complicated and comprehensive scam. It's interesting to note how, when someone gets caught up in a scam, they don't step back and think "Woah, this doesn't make sense". Giving documents to a police officer? Special agents in another building? This always seems to happen, too. I watch scambaiters on YouTube with refund scams, and you end up with an old lady drawing figures upwards of £10,000 out of the bank, then putting it into a box, mailing it to them... Mind you, they tend to prefer the older people because they're more gullible.

buzer 5y ago

The email address seems to point to EIMS (Enterprise Identification and Management Service according to https://bja.ojp.gov/sites/g/files/xyckuh186/files/media/document/a_a_fed_id_mgt_global_04-8-2010.pdf https://bja.ojp.gov/sites/g/files/xyckuh186/files/media/docu...). The email address is also listed at some guide at https://www.justice.gov/tribal/page/file/1260671/download https://www.justice.gov/tribal/page/file/1260671/download. My guess would be that there is some integration point somewhere to EIMS that allows requesting/granting some access & takes the email template from submitted form.

dsukhin 5y ago

The email domain where the messages originate is from some sort of federated identity management system that was created in 2010 (here is a proposal deck [0] with technical details). Found this program simply by searching Google for the sending domain. Based on the guide for using this system [1] (see step 15) looks like this specific email address is the one that sends automated confirmation emails upon registration. Perhaps someone was able to inject a message instead of the regular canned text through some sort of reflection attack? This explains why replies to the message result in a canned response. The system also now appears to be temporarily down. So it’s getting some sort of attention (internally taken down (most likely) or maybe denial of service from the abuse). The Reddit thread suggests the recipients’ emails are likely ARIN IP range contacts. Those are very available from tools like this [2] so nothing interesting with that, but the real question is WHY someone would do this at all? This was clearly given some thought (on who to send this to who would actually take the time to verify the headers) but given the sloppiness of everything else, is this just a script kiddie flex? Whoever it is pissed off the FBI and gained absolutely nothing. [0] https://bja.ojp.gov/sites/g/files/xyckuh186/files/media/document/a_a_fed_id_mgt_global_04-8-2010.pdf https://bja.ojp.gov/sites/g/files/xyckuh186/files/media/docu... [1] https://www.justice.gov/tribal/page/file/1260671/download https://www.justice.gov/tribal/page/file/1260671/download [2] http://itools.com/tool/arin-whois-domain-search http://itools.com/tool/arin-whois-domain-search

technion 5y ago
Awesome. A guide written in 2019 from the FBI that suggests Internet Explorer.
- fortran77 5y ago
  I would assume they're recommending Edge now. We switched from IE to Edge around that time; and our company is very security conscious because of our clients.
  - RNCTX 5y ago
    I would assume you're wrong. I don't think you appreciate how many government websites run ancient software sold to them by a politician's cousin, who thinks even having a developer on staff is a waste of money.

Kiro 5y ago

Readable link on mobile: https://www.reddit.com/r/sysadmin/comments/qsun7o/email_from_fbi_looks_odd/ https://www.reddit.com/r/sysadmin/comments/qsun7o/email_from...

mynameismon 5y ago
A more readable link: https://i.reddit.com/r/sysadmin/comments/qsun7o/email_from_fbi_looks_odd/ https://i.reddit.com/r/sysadmin/comments/qsun7o/email_from_f...

Raed667 5y ago

We have been made aware of "scary" emails sent in the last few hours that purport to come from the FBI/DHS. While the emails are indeed being sent from infrastructure that is owned by the FBI/DHS (the LEEP portal), our research shows that these emails *are* fake. https://twitter.com/spamhaus/status/1459450061696417792 https://twitter.com/spamhaus/status/1459450061696417792

stevebmark 5y ago
I continue to see Twitter as an invaluable real time news source. It often seems to have more direct information on breaking topics than other mediums. I often discover news on Twitter well before seeing it on other platforms.
- camhart 5y ago
  Last summer Twitter alerted me to wild fire evacuations for my area (in Western Washington) hours before traditional channels reached me.
- systemvoltage 5y ago
  Agree, but also keeps feeding me extreme bias and straight up nonsense. Let’s not forget its destructive aspects as well.
  - gzer0 5y ago
    You can mitigate this, at least partially, if you go into your account settings and deselect “show me personalized content and ads”; this paired with ublock origin can do wonders.
TheRealNGenius 5y ago
Why did they feel the need to emphasize are?
- TheRealNGenius 5y ago
  I'd like to think this is a valid question

deleted 5y ago

[deleted]

tumblewit 5y ago

There is this line from Michael Clayton movie that I basically assume every time I see something like this ‘client:(phone rings) That’s the police isn’t it? MC: No, they don’t call.’ Or in this case, they don’t email.

capableweb 5y ago
Not this holds up, in this case they would most likely call you and either tell you over the phone, or setup the meeting over the phone.

hungryforcodes 5y ago

From the Reddit thread: "got it too. i called the FBI helpdesk and they are getting flooded with calls..." I mean as a spammer (or whateveer) do you REALLY want to piss off the FBI like that?

sennight 5y ago
What are they gonna do in response, bankroll somebody to say they have a tape of Russian hookers peeing on you? The FBI is famously inept at anything beyond questionably legal political games, so much so that the Secret Service was in charge of enforcing telecommunications related law for the longest time.
- pangolinplayer 5y ago
  True
rwbhn 5y ago
Misdirection? Loud noise here - actual attack somewhere else?
- jazzyjackson 5y ago
  or shake the machine and see what falls out - watch the access logs to find what individuals have the power to respond, target them for further spearfishing
LogonType10 5y ago
If you're in a former USSR state there's nothing they can do to you.

feefree-cc 5y ago

We received and forwarded to various groups at FBI and DHS at the onset. The running theory here is IPv6 to iPv4 routing is the problem with this incident. Generic and trusted config as where any ipv6 arbitrarily “just works” to a trusted IPv4 block with existing rules. Most IPv6 implementations do not have the detail scrutiny in firewall rules to prevent or filter, and IDS this type of thing from happening.

bink 5y ago
> Most IPv6 implementations do not have the detail scrutiny in firewall rules to prevent or filter, and IDS this type of thing from happening. This sentence is nonsensical. Any firewall that will pass IPv6 can understand IPv6 enough to block it. And no firewall will default open for IPv6. The same goes for any IDS made in the last 15 years. But regardless, IDS doesn't block anything, it only detects (and likely wouldn't trigger solely on sending an email).

oxymoran 5y ago

I find it fascinating that one can be intelligent enough to be able to do something like this but they just couldn’t put together a coherent enough email to actually fool you, especially because they seem to have a decent enough command of English. The tone is waaaaaay off though.

ac2u 5y ago
Perhaps the human effort needed to see their goals through requires that they filter for only the targets that would fall for such a poorly constructed effort.
- rasz 5y ago
  This could work if recipients were CEOs/CISOs, not actually technical people (ARIN IP range contacts = NOC? as someone above me found out)
- Zarel 5y ago
  The big unanswered question there is: Why go through the effort of making the headers real, if you want to intentionally filter out the kind of people who would look at them?
  - ac2u 5y ago
    We're talking in hypotheticals of course, but the effort to make headers real isn't just to fool people who would inspect, but also to fool corporate spam filters and email clients that would display big bold warnings over such an email.
Alex3917 5y ago
If you can send email from the FBI then you also have a get out of jail free card for any crime. Seems like a bad use of this access.
- enkid 5y ago
  I don't see how sending an email from the FBI gives you a get out of jail free card.

arvindamirtaa 5y ago

https://twitter.com/GossiTheDog/status/1459451749811593219 https://twitter.com/GossiTheDog/status/1459451749811593219

IAmGraydon 5y ago

Lots of people commenting that the text of the email seems amateurish. Perhaps it’s exactly as it should be, but you don’t understand its purpose. Maybe they wanted this to be discussed on netsec forums everywhere, so that Google searches for “Vinny Troia” always lead back to discussion about this email, framing him as a cyber criminal and outranking legitimate posts about or by him - an online identity assassination. They needed the email to set off some alarm bells so that it would pique enough interest to be widely discussed. They appear to have widely targeted the email addresses of system admins. I’m fairly certain this was their intention. Also, does it strike anyone else as odd that the account that posted this to HN was created hours ago, for the sole purpose of starting this thread?

chillingeffect 5y ago
Don't know of Vinny, but if he's a security guy, maybe one of his colleagues is pranking him? My college buddies did this kind of stuff to one another. They would die laughing at finding a way to legit send spam through the fbi.
- deleted 5y ago
  [deleted]
- agency 5y ago
  Love to commit high profile cyber crime that could land me in prison, as a prank.
  - bink 5y ago
    If this is (as it appears it might be) simply a reflection attack of some sort, I'm not sure what crime could've been committed. Or at least what computer crime could've been committed. Impersonating a federal official is about the only thing I can think of.
    - deleted 5y ago
      [deleted]

PaulHoule 5y ago

They probably want you to send them money with a gift card, watch out! Real thugs use Bitcoin.

IYasha 5y ago

I still don't quite understand hackers: doing such high-profile hacking and writing lame texts even wihout much fact checking (about agency divisions in this case). Being written in more professional way, this attack could be way more effective. Also, is it a thing among "hackers" to write with tons of mistakes? A part of culture maybe? Or to scare the bricks out of people? )

tsywke44 5y ago
The email text to me looks like it was written by some 15-year-old zoomer kid with no clue what they’re really doing.
kingkawn 5y ago
Or the purpose is to make the FBI look publicly incompetent, not to successfully carry out a secret operation.
- vmception 5y ago
  For the lulz, I would be happy to see that culture come back, well somewhat
vorhemus 5y ago
I'd have guessed that it should be possible to get a reasonable amount of $ for selling access to FBI email servers but maybe the person(s) behind the attack don't care much about money.
flatiron 5y ago
According to the phishing training I was mandated to take at work if you are stupid enough to overlook the mistakes you are the right target. According to them the misspellings filter out the smart enough people they don’t want talking to. But that could also be nonsense.
- caturopath 5y ago
  Yeah, I buy this theory in general, but I'm not sure that's the highest-leverage way to use this access.

rybosworld 5y ago

Seems like an attempt to embarrass the FBI?

redm 5y ago

This Newsweek article has a pretty good breakdown: "The Federal Bureau of Investigation (FBI) email system had reportedly suffered a hack on Saturday morning amid several reports of messages sent from the agency's email infrastructure purporting to be a warning from the Department of Homeland Security (DHS) about a cyberattack." [1] "The Spamhaus Project, an international nonprofit organization based in Andorra and Switzerland that tracks spam, reported on Twitter that its analysis had shown the unusual emails are being sent from accounts "scraped" from the American Registry for Internet Numbers (ARIN) database." [1] "Our telemetry indicates that there were two 'spam' waves, one shortly before 5 AM (UTC) [12.am. E.T.] and another one shortly after 7 AM (UTC) [2a.m. E.T.]. The FBI has been getting many calls about it. We are therefore refraining from further actions against the sending IP addresses." [1] [1] https://www.newsweek.com/fbi-email-system-reportedly-hacked-fake-dhs-cyberattack-messages-1648966 https://www.newsweek.com/fbi-email-system-reportedly-hacked-...

JKCalhoun 5y ago

Yeah, I would ignore an email like that. If it's so important to the (legitimate) FBI, they can make a house call. They know where I live, right?

spzb 5y ago

> While the emails are indeed being sent from infrastructure that is owned by the FBI/DHS Well, that’s reassuring

fortran77 5y ago

I can think of one very good purpose for this message: To publicly demonstrate that an FBI expert witness's "proof" of an email's authenticity at a criminal trial may not be all that reliable.

L0in 5y ago

FBI e-mail infrastructure got hacked.

deleted 5y ago

[deleted]

Kiro 5y ago

https://twitter.com/vinnytroia/status/1459515619838251010 https://twitter.com/vinnytroia/status/1459515619838251010 https://twitter.com/pompompur_in/status/1459458485154942978 https://twitter.com/pompompur_in/status/1459458485154942978 https://twitter.com/seds https://twitter.com/seds Is this some kind of meme or joke I don't understand?

xhkkffbf 5y ago

I hate to say it, but if I were to get an email from "fbi.gov", I would assume it belongs in the same pile as the great offers from that Nigerian prince. Even if I look at the headers, I wouldn't be convinced. Perhaps we should try harder to create a public key infrastructure for email.

ClumsyPilot 5y ago
The fact that we can trust government communication about as much as messages from a Nigerian prince gets us a step closer to the kind of society that produces them.

deleted 5y ago

[deleted]

deleted 5y ago

[deleted]

jacksoncloud 5y ago

Hoax Email Blast Abused Poor Coding in FBI Website https://krebsonsecurity.com/2021/11/hoax-email-blast-abused-poor-coding-in-fbi-website/ https://krebsonsecurity.com/2021/11/hoax-email-blast-abused-...