Breaking News: Clinton email server secure - never hacked.

[kstewart33]

New York Times:

WASHINGTON — A former aide to Hillary Clinton has turned over to the F.B.I. computer security logs from Mrs. Clinton’s private server, records that showed no evidence of foreign hacking, according to people close to a federal investigation into Mrs. Clinton’s emails.

The security logs bolster Mrs. Clinton’s assertion that her use of a personal email account to conduct State Department business while she was the secretary of state did not put American secrets into the hands of hackers or foreign governments.

[link:http://www.nytimes.com/2016/03/04/us/politics/security-logs-of-hillary-clintons-email-server-are-said-to-show-no-evidence-of-hacking.html?hp&action=click&pgtype=Homepage&clickSource=story-heading&module=a-lede-package-region&region=top-news&WT.nav=top-news&_r=0|

[jeff47]

1. Because malware writes to the syslog.

"Installing malware"
"Copying all data to China"

[BlueStateLib]

8. malware on a enterprise grade Fortinet firewall, I don't think so

[jeff47]

9. Read the story. They're talking about the mailserver's logs.

As for enterprise grade firewall, how'd that work for OMB, DoD, IRS, Blue Cross/Blue Shield, Target........

[BlueStateLib]

19. article says "he provided agents the security logs"

Enable logging to capture the details of the network traffic
http://cookbook.fortinet.com/logging-fortigate-traffic/

[AgerolanAmerican]

34. Doesn't say which security logs

"Security logs" can refer to many different things. Could be the Windows security log for the OS, or could be the mail server's security log.

They should assign a reporter who knows enough about IT security to relay all the relevant information in a story.

The exact phrase used was "computer security logs from Mrs. Clinton’s private server". Might be reporter ignorance but my guess is that that is a different log than one made by a network security appliance.

[BlueStateLib]

39. Wouldn't the FBI have recovered any security log files on the Server HDD

Last edited Fri Mar 4, 2016, 05:09 AM - Edit history (1)

[jeff47]

49. Security logs from the potentially compromised system tells you nothing.

Step 1 of your attack is to gain access to the system.

Step 2 of your attack is to erase all evidence of your attack from the system.

If Clinton's server was successfully compromised, there would be no record in any logs on her server.

[Lizzie Poppet]

63. Exactly: compromised systems' logs are useless.

No one competent enough to do the hack in the first place is likely to leave the logs intact. Basic shit...

[MaggieD]

10. Maybe on your home computer

Not in business. At least not my server.

[jeff47]

11. Reading. Try it this time.

Or are you going to claim nation-state-level attacks would write to your log files?

[MaggieD]

12. I read it

It shows a stunning lack of knowledge about business level security. We aren't running servers in our basements.

[jeff47]

13. Again, do you think nation-state-level attacks would write to log files?

If you do, I really hope you're not storing anything important. 'Cause I assure you it does not leave anything you can grep.

Btw, "Business-level-security" has leaked my identity 4 times in the last 2 years. That I know about. "Government-level security" has leaked my identity once.

[MaggieD]

14. I think they wouldn't have a chance to....

When business level security is in place. The government and the server in mom's basement are not in the same league has business level security, and I am sure that is exactly what the Clinton's employed.

[jeff47]

16. Of course they have a choice.

When they take complete control of your servers and network, they get to decide what you see.

The government and the server in mom's basement are not in the same league has business level security

So...skipped over the part where my information has been stolen from "business level security" far more frequently?

I'm well aware of what you think is so super secure. It isn't when you're facing nation-state-grade attacks. Just as you claim business security is in a league beyond home security, nation-state-grade is a league beyond business.

and I am sure that is exactly what the Clinton's employed.

Then you haven't read any coverage of the security problems on her server.

Would you spend the first 4 months with all communications unencrypted? Clinton did.
Would you leave the default VPN keys on your VPN appliance? Clinton did.
Would you use self-signed certificates? Clinton did.
Would you use an easy-to-typosquat address when a .gov could be made available? Clinton did.
Does your ISP have a history of being repeatedly hacked by China? Clinton's did.

About the only good thing they did in regards to the server was not announce its existence on 4chan.

[MaggieD]

22. No, not with the proper security

There is a reason the state department server was hacked and hers was not. Do you not think WikiLeaks would have gotten in if they could have?

The fact is her server was never hacked.

[AgerolanAmerican]

35. There's no way that can be said for sure

It's like proving a negative. With evidence one can prove a hack occurred, but a conclusion of not being hacked can only be based on the lack of evidence of a hack. There is no positive direct evidence that can be produced that a machine hasn't been hacked, although one can present evidence that proper security measures were taken.

Businesses do get hacked all the time, even big ones with nominally secure infrastructure. Off the top of my head, Target and SONY both experienced hacks that got 100 million+ customer records each. The IRS has been hacked in a big way at least twice recently, and of course OPM got its whole database stolen in an insider job. All these businesses use industry standard information security doctrine, but implementing them in detail is a whole different animal. A whole IT infrastructure can be penetrated through something as simple as a failure to protect a web application from an SQL injection attack in one input on one screen (as happened in the SONY case).

Then there's the infamous Ashley Madison hack which was not so long ago, either. Smaller organizations are even less likely to be properly secured than large ones.

[jeff47]

42. The state department server was never hacked either.

FFS, if you're going to claim to be an expert on security, you should at least know that an authorized user copying information they were authorized to access onto a CD is not a "hack".

[Recursion]

71. State was hacked pretty severely about 18 months ago (nt)

[BlueStateLib]

38. Digital certificate analysis for clintonemail.com

These certificates were obtained validly and enabled web-based encryption for applications. Based on TrustNet analyst, Venafi can conclude clintonemail.com was enabled for browser, smartphone, and tablet encryption since 2009 and can operate using encryption through at least 2018. However, for the first 3 months of Secretary Clinton’s term, access to the server was not encrypted or authenticated with a digital certificate.
https://www.venafi.com/blog/post/what-venafi-trustnet-tells-us-about-the-clinton-email-server

All FortiMail units have a self-signed certificate installed on them by default
https://www.venafi.com/blog/post/what-venafi-trustnet-tells-us-about-the-clinton-email-server

Self-signed certificate are just as a secure as a TrustNet issued digital certificate. The only
difference is that you would see this warning when accessing https:// login page.


Hillary accessed her email server from her Blackberry through VPN not https login and clintonemail.com had an userbase of 1 (herself), so nobody had a need or reason to login through https

[Recursion]

43. That's a wonderful thing, not a flaw, as far as that goes

The US Government doesn't use and never will use stock commercial CA's. That would be a horrible idea.

That page is exactly what you want to see.

Central CA's are a horrible, horrible idea, and I'm glad the government is avoiding them. Self-signed certificates are significantly more secure.

[jeff47]

47. Then you can't authenticate the remote server.

You've got no idea if the server you're connecting to is the "real" server, or a man-in-the-middle or similar hijacking.

All they do is present a self-signed cert and say "trust me". That's why you get the big giant warning in Chrome.

Pre-shared self-signed certs give some security, but only as long as that certificate has not been stolen. The third-party authentication via root CAs give more security, because you have to steal more certificates from multiple sources in order to set up your man-in-the-middle attack.

[Recursion]

48. Of course you can. What a ridiculous claim. You *manage key exchange*

You've got no idea if the server you're connecting to is the "real" server, or a man-in-the-middle or similar hijacking.


That's simply absurd. Your administrators *install known good keys*.

That's the entire point. The government can do that. Joe Schmoe can't, which is why the rest of us are stuck with the inferior PKI system.

[jeff47]

51. That would be the pre-shared keys I talked about.

Again, that's only good as long as the certificates have not been stolen. You've got a single point of failure with a giant target on it.

Root CAs (assuming a competent root CA company) require hacking both the target server and a root CA server to exploit. That's significantly harder.

[Recursion]

53. You're half right

Root CAs (assuming a competent root CA company)

Stop.

The root CA for a government server is a government server.

Government IT admins distribute that key, and only that key, to secure systems.

There are zero third party corporate/foreign servers involved, unlike for the rest of us.

That is more secure, and you know that.

[jeff47]

56. Not quite.

The certificate on a government server is not a root CA. The government has its own root CA servers that are separate from, say, a government web server.

The browser in this scenario still contacts a root CA to authenticate the remote server. It just contacts a government-only root CA instead of Verisign, et al.

[Recursion]

58. You're nearly understanding it

You still seem to be missing the fundamental point:

Replace Verisign and 170 other entities with USG. It's the same infrastructure, but 1 and only 1 certificate authority is trusted.

That's more secure.

[jeff47]

66. Nope, you're still missing a certificate.

The web server has a certificate. It is not a root CA, and the public key from that certificate is not installed on the client.

Instead, that certificate chains to a government root CA. The client has that government root CA's public key to authenticate the web server's certificate.

There's (at least) 2 certificates involved.

[Recursion]

68. And the government root CA cert is installed by the government IT admins on the client computers

We actually agreed on this downthread.

I'm still curious why we started on this from the results of an HTTPS request when to my knowledge a WWW site was never involved.

[jeff47]

72. We started it because Clinton's server used a self-signed certificate

No root CA at all.

[Recursion]

74. We have absolutely zero evidence of that

None.

A web server located at that same IP address seems to have, but that's a very different question, isn't it?

[jeff47]

75. We don't have any evidence of a non-self-signed certificate either.

And what would a web server be doing at that address other than providing access to email?

[Recursion]

77. Well, my web server and mail server are at the same IP address and use different certificates

I agree, we also have no evidence of a non-self-signed cert.

We have literally no evidence about the certificates that were used by this mail server whatsoever.

If the web server was used only as a webmail gateway for Clinton and only Clinton, that's actually kind of the textbook use-case for a self-signed certificate because it removes literally any compromise pathways except her own admin.

For that matter, her email server like nearly every government mail server out there could well have just been taking SMTP connections unencrypted over port 25, in which case this entire point is completely moot.

[jeff47]

80. Yeah, but you're actually serving web pages.

What's the point of Clinton even having a web server on the box if not to provide web-based access to email?

If the web server was used only as a webmail gateway for Clinton and only Clinton, that's actually kind of the textbook use-case for a self-signed certificate because it removes literally any compromise pathways except her own admin.

We know Bill, Hillary and several of Hillary's aides had accounts. I vaguely remember Chelsea having one, but I'm not sure about that and don't care to look it up.

For that matter, her email server like nearly every government web server out there could well have just been taking SMTP connections unencrypted over port 25, in which case this entire point is completely moot.

The claim from camp Clinton is that she only accessed the server via VPN on her Blackberry (And that VPN appliance had the default certificates still installed, so it was insecure).

No one has said how the other account holders accessed the server.

[Recursion]

81. And just to be clear, that was supposed to be "nearly every government mail server"

What's the point of Clinton even having a web server on the box if not to provide web-based access to email?


That's fine, and if she was the only client, that's a perfect use case for a self-signed certificate. Literally no pathway for compromise except her admin (who is a pathway in any other circumstance too). Ditto if it was here and some finite number of friends like Bill and Chelsea.

[jeff47]

44. Nope.

Self-signed certificate are just as a secure as a TrustNet issued digital certificate.

Nope.

A self-signed certificate only encrypts the communication. It does not authenticate the remote server. So a self-signed certificate allows man-in-the-middle or similar connection hijacking attacks.

Hillary accessed her email server from her Blackberry through VPN

And the VPN appliance had the default, widely-known keys installed. Meaning anyone could connect to that VPN.

and clintonemail.com had an userbase of 1 (herself)

Nope. Hillary Clinton, Bill Clinton and at least 3 of Hillary Clinton's aides had accounts.

[Recursion]

50. And a CA-signed certificate only authenticates to the extent you trust the CA. And some of those CAs

are the Chinese government.

You're just wrong here. PKI is exactly the wrong solution for true security.

[jeff47]

55. Again, pre-shared keys only protect you as long as the cert is not stolen.

There's a reason even the DoD uses a root CA system - they just have their own root CAs. It requires stealing more certificates from multiple places.

[Recursion]

57. Well, first off, you are confusing pre-shared keys with public/private key pairs

A public key is very different from a shared key.

In a secure government system, one and only one public key is trusted, and that is the key whose private key is owned by a government server (again, this is not a shared-key cryptosystem; I suspect you'll realize this if you think about it for a second). This is the exact same cryptosystem that we use, except that the only trusted root certificate is from the US government.

In contrast, my browser (on OpenBSD, which is fairly paranoid) trusts by default 171 different public keys.

The government's way is more secure.

[jeff47]

62. Yes, I used 'pre-shared key' when I should have used 'pre-shared certificate'.

In a secure government system, one and only one public key is trusted, and that is the key whose private key is owned by a government server

Not quite.

Let's say you're setting up a web server. You'll be given a certificate for that server's secure connections. That certificate is authenticated via a government root CA, and not Verisign's root CA (or any other root CA). Depending on what the client is used for, it will only have that government root CA, or it will have a stripped-down list of root CAs.

You seemed to be espousing generating a self-signed certificate for that web server, and then sharing that with the client in order to authenticate the connection. Which is secure as long as that one certificate is not stolen.

[Recursion]

65. It would look self-signed to an outside observer

You seemed to be espousing generating a self-signed certificate for that web server, and then sharing that with the client in order to authenticate the connection.

Nope. I'm espousing not even sharing the CA's public key with anybody outside of the network. Which looks the same as a self-signed key.

As a separate issue, I think it's absurd that browsers treat a self-signed certificate as less secure than plaintext, when it's strictly better, but that's a completely different question (and I'd imagine you agree with that...)

(And at any rate it's odd that what started this was the results of an HTTPS request, when nobody yet has claimed there was a problem with her website.)

[jeff47]

70. It would be chained to a root CA that the outside observer does not trust.

That typically triggers self-signed behavior, but it's technically not self-signed - the same server is not authenticating the certificate, so it's technically not self-signed.

As a separate issue, I think it's absurd that browsers treat a self-signed certificate as less secure than plaintext, when it's strictly better, but that's a completely different question (and I'd imagine you agree with that...)

IMO, it's based on what the user is more likely to see. Plaintext is "normal" to a typical user. Authenticated via a root CA is also "normal" to a typical user.

Self-signed is not what you'd expect when going to your bank or similar. So the browser says 'Holy shit this is weird! Do you REALLY want to do this?"

[Recursion]

73. Right, but a self-signed certificate is still strictly better

In that it prevents all passive attacks (you might be being phished by the Russian mob, but at least you know the NSA can't listen in).

I still stand by my main point: the results of an HTTPS request don't actually tell me much about the cert an email server was using.

[Recursion]

69. Why would you access an email server through HTTP? (nt)

[TheBlackAdder]

20. Business-level security would be a 3-tier minimum server layer, Bus Architecture to the back-end.

[MaggieD]

23. Not necessarily - you don't seem up to date on the latest tech

[TheBlackAdder]

25. There's new and there's secure. Play in your world, I have responsibilities to secure billions.

.


And Windows is one of the last places to do it!


.

[MaggieD]

26. That's nice

State Department server was hacked. Hers was not. And lots of companies with "billions" don't seem to know about or deploy the proper security. If you think it depends on "bus architecture" you are severely behind the times.

[TheBlackAdder]

27. Let me get this straight! You think a stand-alone server is secure in any configuration?

.


Are you freakin' kidding me?


.

[AgerolanAmerican]

36. A stand-alone Windows server no less

I can tell you have first hand experience from both the content of your comments and the level of exasperation.

I can only imagine the nightmare of trying to secure that machine. I doubt it was really tried, anyone competent would have raised bloody murder over the configuration.

[Bob41213]

64. I agree

From what I read about that server it set up so many red flags in my mind. I'd never run anything like this on a server like that. I can't imagine any foreign government who wanted to get in wouldn't have a handful of zero day hacks they could use to get real time access to that server. This assumes of course that they knew about her use of the server, which seems reasonably likely but I can't say for sure. I can't imagine the Russians or Chinese wouldn't have waltzed right into this server if they tried.

Secondly, the claim that there was only 1 person using the server is ridiculous. In my mind it's quite obvious the whole point of this server was to avoid freedom of information requests. In order to effectively do that is to get all your aids on the server. When it leaks out onto other servers is when you no longer control the records (like the Sidney Blumenthal emails).

I also wonder why the server admin was in possession of the logs and required an immunity agreement to turn them over. If I own that server, I should be the one in possession of the logs. One of my employees doesn't keep a copy of the server logs at home and require immunity to turn them over, those should be owned by the employer since she paid him.

[jeff47]

45. Apparently magic gnomes can detect the attack from the compromised server itself.

Surely the compromise won't involve disabling the ability to detect the compromise!!!

[LittleBlue]

37. Sounds like more Hillary tales

Concocted by some flack who doesn't understand or care about cybersecurity.

[DesertRat]

2. k&r

[tularetom]

3. That sort of misses the point of the investigation

But then, you knew that.

[jillan]

30. Thank you - I was scratching my head when I read this. What does this have to do with anything?

It's about classified info.

[HereSince1628]

41. Defense by non sequitur is mostly for show

In this particular case the absence of evidence that the server was hacked is akin to a drunk driver stopped for speeding in the wrong direction in a school zone who says 'But I didn't have an accident.'

[Press Virginia]

4. Gosh, if only they had the logs 8 months ago this security review

would be over and there wouldn't be a need to grant anyone immunity from prosecution.

[nichomachus]

5. Your headline is misleading

The computer guy said "there were no signs of foreign hacking in the security logs."

No signs of it. Doesn't mean it didn't happen. Any hacker worth his or her salt knows how to erase his footprints amd fingerprints from the server logs. That's what they do.

Any time they do leave a trail is when they want a quick in and out and don't care if the victim knows. Mossad, the KGB, the Chinese, and the Iranians know exactly how to hack a server and not leave any trail behind. Give them some credit.

[kstewart33]

21. Our guys are as good as their guys.

You can bet that the best experts we have examined and concluded that no breaks occurred. That's what the FBI does.

[JonLeibowitz]

33. How do you know our guys are as good?

If they're even slightly better, there would be no evidence.

And the advantage typically goes to the person who has control over the syslog files, so they can clean their tracks of anything the FBI wants to find.

[morningfog]

6. Well if Hillary's aide said it, case closed!

[NWCorona]

7. This!

[DemocratSinceBirth]

59. Actually the FBI said it..

I have been told that her private server was some Rube Goldberg home brew device but the evidence suggests this Brian Pagliano guy built an impenetrable system.

[morningfog]

61. Great news, if true. Link to FBI confirmation? The article in the OP and what I have read only

cite to Pagliano or "aide" for the never-hacked statement.

[DemocratSinceBirth]

67. Not an official confirmation

WASHINGTON — A former aide to Hillary Clinton has turned over to the F.B.I. computer security logs from Mrs. Clinton’s private server, records that showed no evidence of foreign hacking, according to people close to a federal investigation into Mrs. Clinton’s emails.

Brian Pagliano= former aide
FBI officials = people close to the investigation, speaking anonymously of course.

[morningfog]

79. Okay, I see what you are saying.

[LP2K12]

15. When I was enlisted...

and working in intelligence as an analyst, I would never have gotten away with this excuse. It's really disheartening.

[renate]

17. I'm glad

As much as I would rather have Bernie be our nominee, I'm not so unrealistic as to pretend that there isn't a good-to-excellent chance that it'll be Hillary. And I realize there's more to the issue than just whether it was hacked, but I'm glad that her server having been vulnerable won't be an issue.

[TheBlackAdder]

18. Log files are just like any other, subject to edit with tools, including its timestamps!

[Darb]

54. MMWWAAAAAA, MMWWWAAAAAA MMWWAAAAAA

"The fools, don't they know I control EVERYTHING!!!!!

MMWWAAAAAA, MMWWWAAAAAA MMWWAAAAAA

Hillary is Dr. Evil.

[oasis]

24. Unsinkable HRC.

[silenttigersong]

28. Great

Maybe some of the Clinton supporters will stop berating Sanders supporters as RWers.Nice break for awhile.

[calguy]

31. Bernie supporters are not RWers

But many of them are real BSers.

[mindwalker_i]

29. This story is being grasped at all over the place

Thing is, it's a steaming pile of bullshit. The logs don't show it? Which logs? How often were the logs rotated? Who compiled the logs and sent them? Who read them?

"My ass doesn't hurt right now, so I've nobody's ever seen me naked."

[lovuian]

32. from the article

Mr. Pagliano told the agents that nothing in his security logs suggested that any intrusion occurred. Security logs keep track of, among other things, who accessed the network and when. They are not definitive, and forensic experts can sometimes spot sophisticated hacking that is not apparent in the logs, but computer security experts view logs as key documents when detecting hackers.

time will tell

[Nuclear Unicorn]

40. Why would we have to worry about hackers?

The server was just used for yoga routines and discussions of Chelsea's wedding. Hillary said so herself.

[MoonRiver]

46. Great news, but no surprise.

[Chemisse]

52. So if a top secret email isn't hacked, is it still a crime?

They can accuse her of being careless, or using bad judgement, but they can hardly indict her if nobody ever got hold of the classified emails.

[lapfog_1]

60. what OS was the private email server using?

I would ONLY trust it (and only a slight amount, BTW) if it was running the most up to date version of SELinux from Redhat and Tresys Technology (validation). And then only if the most secure policies offered were actually used.

And... even with all that (SELinux is used/from the NSA), you still can't PROVE that it wasn't hacked. Snowden was an admin using SELinux for the NSA... and he only mistake was going public with his information (the easiest way to hack into any system is to be one of the trusted people that administer that system).

[Kip Humphrey]

76. no evidence of foreign hacking does not equal "never hacked", but then you might not know that.

[lynne]

78. Same staffer who pleaded the 5th and got immunity

from the Justice Department, I believe.

Well, golly-gee, I'm sure his word is just oakely-dokely with the FBI! All that pleading and immunity wasn't needed at all because he had his logs. Sheesh . . . everybody back on the bus 'cause there's nothing to see here!