Did the Clinton Email Server Have an Internet-Based Printer?

[amborin]

http://krebsonsecurity.com/2016/05/did-the-clinton-email-server-have-an-internet-based-printer/

The Associated Press today points to a remarkable footnote in a recent State Department inspector general report on the Hillary Clinton email scandal: The mail was managed from the vanity domain “clintonemail.com.” But here’s a potentially more explosive finding: A review of the historic domain registration records for that domain indicates that whoever built the private email server for the Clintons also had the not-so-bright idea of connecting it to an Internet-based printer.

According to historic Internet address maps stored by San Mateo, Calif. based Farsight Security, among the handful of Internet addresses historically assigned to the domain “clintonemail.com” was the numeric address 24.187.234.188. The subdomain attached to that Internet address was….wait for it…. “printer.clintonemail.com“.

Interestingly, that domain was first noticed by Farsight in March 2015, the same month the scandal broke that during her tenure as United States Secretary of State Mrs. Clinton exclusively used her family’s private email server for official communications.

I should emphasize here that it’s unclear whether an Internet-capable printer was ever connected to printer.clintonemail.com. Nevertheless, it appears someone set it up to work that way.

Ronald Guilmette, a private security researcher in California who prompted me to look up this information, said printing things to an Internet-based printer set up this way might have made the printer data vulnerable to eavesdropping.

“Whoever set up their home network like that was a security idiot, and it’s a dumb thing to do,” Guilmette said. “Not just because any idiot on the Internet can just waste all your toner. Some of these printers have simple vulnerabilities that leave them easy to be hacked into.”

More importantly, any emails or other documents that the Clintons decided to print would be sent out over the Internet — however briefly — before going back to the printer. And that data may have been sniffable by other customers of the same ISP, Guilmette said.

[Barack_America]

1. Yep. Read that. Very interesting.

Another thing I'll have to quiz the IT guy at work about tomorrow.

[Waiting For Everyman]

2. Remote Desktop was enabled at some point too.

On at least one device on the system, for how long wasn't stated. When I read that I was gobsmacked.

I'm not super savvy, but even I know that's a wide open door security risk, even for private individuals with nothing special to secure.

[dreamnightwind]

4. Thanks for that tip

I knew about this (not to enable it), but checked my settings just in case. To my surprise, it was enabled! Disabled now.

[amborin]

18. didn't realize that!

[TheBlackAdder]

3. Printer data my ass, even with WPA-2 networks, you can hack into a wireless printer and go upstream.

.


Internet connected printers are a severe network exposure. But, let's not forget the wireless home networks too.


If a person sets up a cantana, or other directional wireless antenna, you greatly extend the range someone can hack. Those WPA-2 encryptions create a false sense of security, since cracking software on a linux laptop will probably break that network within hours. Some neighborhood kid could tap into that easily. The only secure way is dedicated cable connections. Printers and other embedded devices pose risks for networks.


People even think that their home cordless phones are secure. While many use spread spectrum and other technologies, several of the phones will also send unencrypted side signals to keep the phone from cutting out or dropping the call. Many of these can be hacked too.


A 3-foot boom mast, on any scanner or interceptor, can receive home cordless signals from over 1 mile away. That's a 1 mile radius that people can work on cracking the calls.


.

[nadinbrzezinski]

6. This is why we have nothing sensitive

Like financials, in the computer. Old fashioned pen and notebook log.

[DisgustipatedinCA]

8. cert-based 802.1x is a good way to do wireless if you need to, but obviously her setup

was appalling, based on what we know so far.

[TheBlackAdder]

12. Even these networks are insecure. Proper enterprise EAP and 802.1x are still vulnerable.

.


The best wireless network is about secure as an Internet cloud network.

The question isn't if your data gets hacked, but when.


.

[nadinbrzezinski]

13. That is what I assume.

Convenient yes...but there is a price

[nadinbrzezinski]

5. Let me guess...it was not part of a secured network

[jeff47]

7. At this point, it looks like nothing at clintonemail.com was part of a secured network. (nt)

[nadinbrzezinski]

9. I know my home network has holes

That is why we have the financials off the network. No quicken fir me

[Arazi]

10. Oh ffs, worse and worser

[silvershadow]

11. bookmarked.

[grasswire]

14. kick nt

[JudyM]

15. The Clinton's probably would like to strangle Pagliano.

I guess when you're doing some unsavory things you can't take the risk of hiring a top tier IT firm.

[Arazi]

16. Pagliano's a young guy. Wonder who he works for now

Have the Clintons protected him or is he out in the cold with a very public hole blown in his resume a mile deep

[Paulie]

17. Likely they did have a printer Internet accessible

looking up the historical records, the authoritative DNS servers haven't changed since 2009 for the clintonemail.com domain. So printer would have had to be manually added as an A record on Network Solutions dns (they are also the registrar). You wouldn't do that unless you specifically wanted that name to resolve.

24.187.234.186 rosencrans.dyndns.ws
24.187.234.187 wjcoffice.com
24.187.234.187 mail.clintonemail.com
24.187.234.187 mail.presidentclinton.com
24.187.234.188 printer.clintonemail.com
24.187.234.188 printer.presidentclinton.com
24.187.234.190 sslvpn.clintonemail.com

Wonder if there are any historical nmap scans from say late 2009, what actually enumerated on that ip prefix...

[Cheese Sandwich]

19. that's a very interesting question