6 ms·

The news here is the headers look good.

by pedro2 5y ago

sterlind 5y ago
The hackers have the ability to originate legit emails from ic.fbi.gov and they blow it on a spammy phishing campaign with broken English? what a waste..
- 3np 5y ago
  It doesn't even seem like phishing; there's no contact info and the sender bounces in a way that seems like it doesn't go to the one who sent it. Is it general FUD (eroding FBI legitimacy) or a smear campaign against Vinny Troia..? EDIT: Or it's a diversion of attention; there's something else going on somewhere else that they want to go unnoticed.
  - jazzyjackson 5y ago
    vinny troia himself washing out the google results for his name?
    - not1ofU 5y ago
      never heard of him before, but after a few minutes digging, I tend to agree.
- madaxe_again 5y ago
  Sounds about right. A blue chip I work with had a successful phish against them - the attacker ended up with access to the email inbox of an HR person. So they tried basic, stupid 419 type scams, with broken English. They could have pried the entire org wide open - she had masses of private data in her inbox, enough to impersonate or social engineer your way to anywhere. But instead, they blew it - and blew it so badly the client spent days investigating what this could have been a distraction for, as they pretty much couldn’t believe their luck at the minimal severity of the attack. It’s like breaking into the federal reserve, thinking it’s a 7/11, and then stealing the ballpoint pens from the cashiers desks. Either way, it was a helpful experience for them - a vaccination against further stupidity, and they all of a sudden started engaging on their ISMS with gusto and panache.
  - notahacker 5y ago
    The other episode that springs to mind is the hackers who managed to compromise the Twitter accounts of the likes of Obama and Elon Musk, but used it to promote a shitty Bitcoin gifting scam, which netted them an easily traced $100k and a prison sentence. Probably the scammers promoting the same sort of scheme in the comments with legal fake accounts make more money
    - jazzyjackson 5y ago
      i’ve heard it said, “if criminals were any smarter they wouldn’t be criminals” - but of course its a selection bias because smart criminals don’t get caught, you only hear about the dumb ones
      - mark-r 5y ago
        If you work with police, you'll hear no end of dumb criminal stories. My favorite was the guy who coated his fingers with glue so he wouldn't leave fingerprints at the scene - then peeled off the glue and dropped the peelings in the trash on his way out. Leaving perfect fingerprints.
LeonM 5y ago
Except that the OP did not post all the information to verify. The IP address does belong to the fbi.gov (both forward and reverse DNS lookups check out). The DKIM public key does exist at the given selector [0], but without the complete raw message, it is not possible to verify the signature. He also excluded the authentication-result header from his post. [0] https://www.mailhardener.com/tools/dkim-validator?domain=cjis._domainkey.fbi.gov https://www.mailhardener.com/tools/dkim-validator?domain=cji...
- deleted 5y ago
  [deleted]
- londons_explore 5y ago
  > Except that the OP did not post all the information to verify. A few other people on that thread got the same mail and did verify it. Either they're all sockpuppets or it verifies.

The news here is the headers look good.

by pedro2 5y ago

The news here is the headers look good.

The hackers have the ability to originate legit emails from ic.fbi.gov and they blow it on a spammy phishing campaign with broken English? what a waste..

3np 5y ago
It doesn't even seem like phishing; there's no contact info and the sender bounces in a way that seems like it doesn't go to the one who sent it. Is it general FUD (eroding FBI legitimacy) or a smear campaign against Vinny Troia..? EDIT: Or it's a diversion of attention; there's something else going on somewhere else that they want to go unnoticed.
- jazzyjackson 5y ago
  vinny troia himself washing out the google results for his name?
  - not1ofU 5y ago
    never heard of him before, but after a few minutes digging, I tend to agree.
madaxe_again 5y ago
Sounds about right. A blue chip I work with had a successful phish against them - the attacker ended up with access to the email inbox of an HR person. So they tried basic, stupid 419 type scams, with broken English. They could have pried the entire org wide open - she had masses of private data in her inbox, enough to impersonate or social engineer your way to anywhere. But instead, they blew it - and blew it so badly the client spent days investigating what this could have been a distraction for, as they pretty much couldn’t believe their luck at the minimal severity of the attack. It’s like breaking into the federal reserve, thinking it’s a 7/11, and then stealing the ballpoint pens from the cashiers desks. Either way, it was a helpful experience for them - a vaccination against further stupidity, and they all of a sudden started engaging on their ISMS with gusto and panache.
- notahacker 5y ago
  The other episode that springs to mind is the hackers who managed to compromise the Twitter accounts of the likes of Obama and Elon Musk, but used it to promote a shitty Bitcoin gifting scam, which netted them an easily traced $100k and a prison sentence. Probably the scammers promoting the same sort of scheme in the comments with legal fake accounts make more money
  - jazzyjackson 5y ago
    i’ve heard it said, “if criminals were any smarter they wouldn’t be criminals” - but of course its a selection bias because smart criminals don’t get caught, you only hear about the dumb ones
    - mark-r 5y ago
      If you work with police, you'll hear no end of dumb criminal stories. My favorite was the guy who coated his fingers with glue so he wouldn't leave fingerprints at the scene - then peeled off the glue and dropped the peelings in the trash on his way out. Leaving perfect fingerprints.

LeonM 5y ago

Except that the OP did not post all the information to verify. The IP address does belong to the fbi.gov (both forward and reverse DNS lookups check out). The DKIM public key does exist at the given selector [0], but without the complete raw message, it is not possible to verify the signature. He also excluded the authentication-result header from his post. [0] https://www.mailhardener.com/tools/dkim-validator?domain=cjis._domainkey.fbi.gov https://www.mailhardener.com/tools/dkim-validator?domain=cji...

deleted 5y ago
[deleted]
londons_explore 5y ago
> Except that the OP did not post all the information to verify. A few other people on that thread got the same mail and did verify it. Either they're all sockpuppets or it verifies.