Proof that, contrary to Trump, it's unlikely a random "14-year-old" phished Podesta's email

[Denzil_DC]

Trump cited his BFF Julian Assange's words in the Hannity interview to support his insistence that Russia wasn't responsible for the Podesta hack (and by extension, the DNC hack):

Donald J. Trump @realDonaldTrump

Julian Assange said "a 14 year old could have hacked Podesta" - why was DNC so careless? Also said Russians did not give him the info!

Here's a condensed version of some recent tweets from Pwn All The Things, who's done what the media seem incapable of and pulled together information from various sources:

Pwn All The Things @pwnallthethings

Could have hacked? Sure. Did hack? No. Let me go through why not.

So the actual email used to phish John Podesta ended up in the WIkileaks dump. It's here

https://t.co/H6ACVvnOXH
This is a reconstruction of that phishing email. (All of the information is bogus - the mention of Ukraine isn't relevant here)



You can't tell just by looking, but that "Change Password" link doesn't take you to Google. It takes you to Bit.ly.

This link expands to a fake login page (note URL is for a .tk site). This is what Podesta saw when he accidentally gave creds to hackers.



But the hackers screwed up. The hackers weren't hacking one-by-one; so URL contraction wasn't done manually. It was done via the Bitly API.

Using the Bitly API requires you create an account. So the hackers had to create an account. And they forgot to make their account private.

It's no longer possible - the hackers have changed their settings - but before you could simple enumerate ALL of the contracted links.

The Bitly link in John Podesta's email is visible in the Wikileaks dump here https://wikileaks.org/podesta-emails/emailid/36355 …



We can ask Bitly to expand it. This is what it says https://bitly.com/1PibSU0+



Those gobble-de-gook strings aren't encrypted. They're Base64 encoded. In this case, it tells us the link was for [e-mail]



Why did the hackers include this info? Same reason they contracted links via API. Because they're not hacking 1-by-1. Are hacking at scale.

This information lets their attack server populate fields to look more authentic (it's why it's able to pre-fill Podesta's name and picture)

But it also means this opsec screw up is bad. Bc we can see the links contracted by the account, we can see all of the spearphishing URLs

And the spearphishing URLs tells us the accounts that were targeted.

How many accounts did this "14 year old" hack? About 1800. In 2015.

Who were these accounts? Mil, govt personnel in the West, defence cos, journos critical of govt in Russia etc



Here's a pie chart of some of the accounts the 14 year old hacker hacked outside of Russian sphere of influence



This 14 year old is apparently an avid reader, given how many authors they're hacking. What are their interests? Another pie chart.



(These pie charts by @SecureWorks I should add, from here: https://www.secureworks.com/research/threat-group-4127-targets-google-accounts …)

And which countries is our friendly 14 year old hacker interested in? These ones. Remember. This is 1800 gmail accounts *in 2015 alone*.



Is it possible this was all a 14 year old? Sure. Also possible I'm a bridge salesman, and boy have I got a great deal for you today.

When hackers hack at scale, they reuse infrastructure. They make mistakes. This isn't unusual. You can piece the bits together.

And this isn't even the DNC hack. It's just the Podesta one. And it's only one of many different strands in just the public attribution case

Full tweet thread here: https://twitter.com/pwnallthethings/status/816629673820114944

[dhol82]

1. Impressive how this can be tracked back

Glad somebody knows how to do it.

[Denzil_DC]

7. It's an illustration of how Trump's insistence that

"unless you catch hackers in the act, you can't prove what's going on" is unbelievably thick bullshit.

Pwn All The Things is tech-savvy, but he's just an individual working with publicly available resources.

Imagine the other avenues and databases of earlier hack patterns the security services have access to.

[DemocratSinceBirth]

2. K and R

I take this mean the hack was relatively sophisticated, beyond what your average fourteen year old is capable of.

[Denzil_DC]

4. It's fairly sophisticated (I wouldn't have fallen for the phishing attempt), but

the main point is the pattern of targets revealed by the bit.ly account research above - a weird bunch of interests and a heck of a lot of effort over an extended period for even a hardened teen geek.

[DemocratSinceBirth]

5. He received a request that looked like it was from google to change his password.

I wonder how many other relatively unsophisticated users would have been tricked.

[Denzil_DC]

6. Well, there's a lesson here for us all

(and one I repeatedly impress on my partner): If you ever get a seemingly account security-related email like the one Podesta received (we had a thoroughly legit one from Hotmail a few weeks ago that was similar in its message), among a series of other checks, hover over any links in the message to see where they lead. If I'd seen a bit.ly link there, I'd have figured there's no way Google/Gmail would be using that system.

[eppur_se_muova]

15. NEVER respond to any such notice by clicking on the link. Go directly to the supposed sender.

Open a new window and login to gmail.com, hotmail.com etc. -- a cold login, preferably after closing your browser or even changing computers. If they really sent you such a notice, they should notify you again when you attempt to login. Or you could even change your password to be safe, just so long as you initiate the transaction through a direct login.

It's the same as giving out confidential info over the phone -- never give such info to someone who called you. Ask for the name of the company, dept, individual etc. and cold-call the company. Do not use a number given to you by the caller, unless you have Googled it first and are satisfied it is genuine.

[Denzil_DC]

17. All good advice! n/t

[dhol82]

8. I received several of those notifications.

Thought they were fishy.
Had some friends who also reported receiving them.
Fortunately, none of us fell for it.

[Denzil_DC]

11. Any time I receive a message like that,

among other things (e.g. checking out the sender address, though that can be spoofed), I'll Google some chunks of the text. Often they'll include typos or un-English-sounding expressions, but not always, as in this case. If they're related to a scam, there's a good chance others have been discussing the messages and figured out whether they're legit or not.

Then as I said above, I'll always investigate any links in the message thoroughly before even entertaining the idea of clicking on them. No legit organization is going to mask a password reset link using a URL-shortening service like Bitly, so that's a dead giveaway.

In my experience, these phishing attempts are usually less sophisticated and the true URL will appear in full if you hover over the link, and it'll be pretty obvious it has nothing to do with organization that's supposedly emailed you.

[dhol82]

13. Thanks for the info.

[eppur_se_muova]

16. See my reply #15 nt

[Lucinda]

3. KNR

[Mc Mike]

9. Great info, thanks Denzil.

Last edited Wed Jan 4, 2017, 05:46 PM - Edit history (1)

Makes the case easier to understand for non-tech-savvy people like me.

Everything dRumpf says about the hacks is projective. When he talks about a 400 lb guy on a bed somewhere, tt's because that's how HE always does the cyber, when he tweets, and he's feeling fat that day.

When he talks about a 14 year old doing it, that's because some respectable newssource just said he has the maturity of a grade school kid.

[progressoid]

10. Trump doesn't understand any of this.

And even if he was smart enough to understand it, he wouldn't change his stance.

[baldguy]

12. Even if he was strapped to a chair & had it explained to him bit by bit

he would refuse to understand & wouldn't change his stance.

[Starry Messenger]

14. K&R

[muriel_volestrangler]

18. Wikileaks can't keep its story straight

Now they're claiming it was an 'easy' hack; last month they were claiming it was a Democratic insider with legal access to it, who 'leaked' it: http://www.dailymail.co.uk/news/article-4034038/Ex-British-ambassador-WikiLeaks-operative-claims-Russia-did-NOT-provide-Clinton-emails-handed-D-C-park-intermediary-disgusted-Democratic-insiders.html

I really am disgusted by Craig Murray's role in this bullshit. He appeared to have some integrity before he became an Assange supporter.

[Denzil_DC]

19. Good point.

I'm actually appalled at Murray. I'd long had him down as a loose cannon (the SNP rejected him as a UK election candidate, and not without reason), but he's gone off the deep end, and last time I looked, the comments section on his blog had been taken over by hideously RW frothers and counter-counter conspiracy theorists.

I loved the appeal to authority he made in support of his claims on his blog, to the effect: "Have you ever known Julian or I to lie?" Well, Assange is a well-documented stranger to the truth, and now I'm seriously wondering about you, Craig ...

[Denzil_DC]

20. Shameless kick for the later crowd! n/t

[Denzil_DC]

22. Final kick for those who missed this earlier n/t

[JHan]

23. K & R!

[Initech]

24. Trumpenfuror has *ZERO* clue what he's talking about here.