Breaking It All Down: An Overview of What Occurred<\/h2>\n\n\n\n
In a nutshell, on Nov. 12, an attacker capitalized on a basic vulnerability within the FBI\u2019s IT infrastructure to send out phony emails to recipients that warned of fake cyber attacks. But what makes the situation particularly scary is that the messages were sent via an email address \u201ceims@ic.fbi.gov\u201d \u2014 this is a legitimate email domain that hails from servers controlled by the Bureau. This means that the attacker was able to use their IT infrastructure against them to send out emails from their legitimate domain.<\/p>\n\n\n\n
The next day, the FBI released a brief official statement<\/a> on the matter, saying that they were aware of the incident regarding the FBI email account and had taken the affected hardware offline. Of course, there\u2019s a certain level of irony considering that in the same breath, they also warned people to \u201cbe cautious of unknown senders\u201d and to report suspicious activity to either ic3.gov or cisa.gov. Since the emails were sent using an official email address by exploiting a webmail form vulnerability, that point is quasi moot in this case.<\/p>\n\n\n\n Two days after the initial faux emails went out, the FBI posted an update, stating that a threat actor gained temporary access to their law enforcement portal to send the hoax warning emails due to a \u201csoftware misconfiguration.\u201d (Brownie points if you remember this later.) The Law Enforcement Enterprise Portal, or LEEP, is part of the IT infrastructure that the Bureau uses to communicate with local and state law enforcement partner agencies. According to the Bureau:<\/p>\n\n\n\n \u201cWhile the illegitimate email originated from an FBI operated server, that server was dedicated to pushing notifications for LEEP and was not part of the FBI\u2019s corporate email service. No actor was able to access or compromise any data or PII on the FBI\u2019s network.<\/em> Once we learned of the incident, we quickly remediated the software vulnerability, warned partners to disregard the fake emails, and confirmed the integrity of our networks.\u201d<\/em><\/p>\n<\/blockquote>\n\n\n\n The statement is a mix of bad and good news: Sure, the server in question was operated by the FBI. But it wasn\u2019t used to house sensitive information. Rather, it was used to push messages to law enforcement partners.<\/p>\n\n\n\n The big takeaway in all of this is that the email messages were sent by a legitimate application on the FBI server. Since the FBI didn\u2019t secure the API access, it allowed an unauthorized user to send out the hoax emails in their name.<\/p>\n\n\n<\/span><\/span>\n\n\n Okay, now that you have an idea of what this situation entails, it\u2019s time to actually take a look at the message. The Spamhaus Project<\/a>, an international threat intelligence organization, posted screenshots of one of these warning emails on its Twitter page:<\/p>\n\n\n\n It says the following:<\/p>\n\n\n\n \u201cOur intelligence monitoring indicates exfiltration of several of your virtualized clusters in a sophisticated chain attack. We tricked to blackhole the transit nodes used by this advanced persistent threat actor, however there is a huge chance he will modify his attack with fastflux technologies, which he proxies trough multiple global accelerators. We identified the threat actor to be Vinny Troia, whom is believed to be affiliated with the extortion gang TheDarkOverlord, We highly recommend you to check your systems and IDS monitoring.<\/em><\/p>\n\n\n\n Beware this threat actor is currently working under inspection of the NCCIC, as we are dependent on some of his intelligence research we can not interfere physically within 4 hours, which could be enough time to cause severe damage to your infrastructure.<\/em><\/p>\n\n\n\n Stay safe.<\/em><\/p>\n\n\n\n US Department of Homeland Security | Cyber Threat Detection and Analysis | Network Analysis Group\u201d<\/em><\/p>\n<\/blockquote>\n\n\n\n \u2026 Uh huh. Okay. The spelling, grammar, and punctuation issues aside, this confused warning email seems to take an unusual left turn by ragging on cybersecurity researcher Vinny Troia. In an article in The Washington Post<\/a>, Troia says he believes it was a smear campaign in response to research he\u2019d published that exposed a young hacker and their involvement in several hacking groups. <\/p>\n\n\n\n The Spamhaus Project also tweeted another screenshot of the email\u2019s sanitized header information as well for people to see:<\/p>\n\n\n\n In the screenshot above, note the CJIS references in the \u201cReceived: from\u201d fields \u2014 those stand for the Criminal Justice Information Services, which is a division of the FBI. <\/p>\n\n\n\n In an article on his blog krebsonsecurity.com<\/a>, Krebs said he interviewed the alleged attacker who goes by the username \u201cpompompurin.\u201d (Be sure to check out that article if you want a more in-depth look at how it occurred.) Pompompurin shared how he or she used the FBI\u2019s own email system against them.<\/p>\n\n\n\n It all started with the LEEP web portal, which is intended to be used for government-authorized uses only by law enforcement and other related agencies.<\/p>\n\n\n\n Until shortly after this incident, virtually anyone previously could set up an account on the law enforcement portal website. This process involved the FBI\u2019s email system automatically sending a confirmation to a new user\u2019s email account to confirm the new account.<\/p>\n\n\n\n Now when you hit the Apply for an Account<\/strong> button, it results in the following error message:<\/p>\n\n\n\n Oops.<\/p>\n\n\n\n Remember how the FBI\u2019s statement pointed to a software misconfiguration as the cause of the security incident? Well, that not-so-little misconfiguration involved the system generating a client-side one-time code that it sent via an HTML POST request. (The POST request allows you to specify what information to include in an email and where to send it.) What this means is that the email gets generated in the browser where someone could \u2014 and apparently did \u2014 tamper with it and then the server would send the message.<\/p>\n\n\n\n Using client-side code to send emails like this is really<\/em> insecure and there\u2019s no reason why any site should use it \u2014 especially not a federal government website! To say it\u2019s insecure and dangerous is an understatement. <\/p>\n\n\n\n There are plenty of reasons why<\/em> the attack might have occurred \u2014 perhaps the attacker was just bored. Maybe they wanted to have a little fun at the expense of the FBI and Troia. Or, maybe, they\u2019re a grey hat hacker<\/a> who did something bad to do something that\u2019s ultimately good\u2026<\/p>\n\n\n\n According to Krebs, Pompompurin said the reason why they decided to hack the FBI\u2019s email is that they wanted to call attention to a problem before someone else decided to exploit it for malicious reasons.<\/p>\n\n\n\n All of this goes to show that anyone \u2014 no matter whether you\u2019re a small business, a large corporation, or even the federal government \u2014 can become the target or victim of a cybercriminal. Your technological weaknesses can be discovered and will be exploited if they fall into the wrong hands. Unfortunately for you and your business, if a bad guy finds one of those vulnerabilities to exploit, they may not have good intentions and will use it to cause significant harm to your business and customers.<\/p>\n\n\n\n Symantec reports<\/a> that as of Q1 2020, one in every 4,200 emails were phishing messages. Now, imagine how much that number has likely skyrocketed considering all of the COVID-19-related scams, riots, and other ongoing world events that cybercriminals can use to their advantage.<\/p>\n\n\n\n At least, in this case, it doesn\u2019t appear that the threat actor (Pompompurin) was trying to cause harm to the email recipients since they could have but didn\u2019t. The emails weren’t sent out with any phishing links or attach malicious files. However, it\u2019s no secret that email communications are a major target for cybercriminals. Email is the way that organizations stay in touch with their employees, customers, vendors, partners, and other key entities. <\/p>\n\n\n\n If someone can impersonate a legitimate organization or authority by hijacking their systems, who\u2019s to say that they won\u2019t use those systems to do significantly worse harm than sending an obviously fake email?<\/p>\n\n\n<\/span><\/span>\n\n\n This particular cyber security situation for the FBI is one that was easily avoidable by following coding best practices and securing API access. But what other steps can you take to make your email communications more secure?<\/p>\n\n\n\n When it comes to exploiting web and email vulnerabilities, no one \u2014 including the U.S. federal government \u2014 is impervious to cybercriminals\u2019 attacks\u2026 Earlier this month, the U.S. Federal Bureau…<\/p>\n","protected":false},"author":17,"featured_media":15228,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":"","tve_updated_post":"","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{},"tcb2_ready":0,"tcb_editor_enabled":0,"tve_landing_page":"","_tve_header":"","_tve_footer":""},"categories":[13107,16],"tags":[7970,7387],"class_list":["post-15220","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-beyond-hashed-out","category-hashing-out-cyber-security","tag-email-security","tag-fbi","post-with-tags"],"views":10606,"jetpack_featured_media_url":"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2021\/11\/fbi-hoax-email.jpg","_links":{"self":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/15220","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/users\/17"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/comments?post=15220"}],"version-history":[{"count":0,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/15220\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media\/15228"}],"wp:attachment":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media?parent=15220"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/categories?post=15220"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/tags?post=15220"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}\n
What Did the Emails Say? Here\u2019s a Look at the Hoax Messages<\/h2>\n\n\n\n
![\"A](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2021\/11\/spamhaus-project-email-example.png\")
\n
![\"A](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2021\/11\/spamhaus-project-email-header-example.png\")
How the Form Mail Exploit Attack Occurred<\/h2>\n\n\n\n
![\"A](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2021\/11\/leep-login-page-screenshot.png\")
![\"A](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2021\/11\/leep-new-account-error.png\")
\n
Why the Email Attack Occurred<\/h2>\n\n\n\n
Why You Should Care<\/h2>\n\n\n\n
Final Takeaways: How to Make Email Communications More Secure<\/h2>\n\n\n\n
\n