Slashdot Mirror
A Typo Led To Podesta's Email Hack, Says Report (thehill.com)
tomhath quotes a report from The Hill: Last March, Podesta received an email purportedly from Google saying hackers had tried to infiltrate his Gmail account. When an aide emailed the campaign's IT staff to ask if the notice was real, Clinton campaign aide Charles Delavan replied that it was "a legitimate email" and that Podesta should "change his password immediately." Instead of telling the aide that the email was a threat and that a good response would be to change his password directly through Google's website, he had inadvertently told the aide to click on the fraudulent email and give the attackers access to the account. Delavan told The New York Times he had intended to type "illegitimate," a typo he still has not forgiven himself for making. The email was a phishing scam that ultimately revealed Podesta's password to hackers. Soon after, WikiLeaks began releasing 10 years of his emails.
Clinton campaign aide Charles Delavan replied that it was "a legitimate email"............he had intended to type "illegitimate,"
If that's true, shouldn't they have used "an" instead of "a". These are college graduates after all, right?
That sounds like a really sophisticated Russian hacking effort! I'm glad the CIA is on it!
https://www.youtube.com/watch?...
Apparently, there were thousands of typos in the emails themselves. All those racial slurs. All those admissions of collusion with the press and super PACS. All those derogatory things the Clinton campaign was saying about Obama. All the campaign's dirty tricks. All the gaffes in Hillary's paid speeches....They were just all TYPOS!
To hack complete idiots.
Apparently he wasn't tipped off by the start of the email
Comrade Podesta,
Filthy imperialist pigs have hacked into you email. To change your password please click http://www.ussrlives.com/mail/
And furthermore, if the IT guy believed the email saying Posesta's account was hacked is illegitimate then why would he instruct Podesta to change his email password?
https://wikileaks.org/podesta-emails/emailid/36355
[Edited to remove blank lines and phone numbers]
Re: Someone has your passwrd
From:mfisher@hillaryclinton.com
To: slatham@hillaryclinton.com
CC: john.podesta@gmail.com
Date: 2016-03-19 12:14
Subject: Re: Someone has your passwrd
Hi- yes I will call John right away and work on new passwords. He will need
to use my two step verification codes to sign in.
Milia Fisher
[phone number]
On Mar 19, 2016, at 10:07 AM, Sara Latham
wrote:
The gmail one is REAL
Milia, can you change - does JDP have the 2 step verification or do we need
to do with him on the phone? Don't want to lock him out of his in box!
Sent from my iPhone
Begin forwarded message:
*From:* Charles Delavan
*Date:* March 19, 2016 at 9:54:05 AM EDT
*To:* Sara Latham , Shane Hable
*Subject:* *Re: Someone has your passwrd*
Sara,
This is a legitimate email. John needs to change his password immediately,
and ensure that two-factor authentication is turned on his account.
He can go to this link: https://myaccount.google.com/security [Stupid assistant ignored the correct way to chg pass]
to do both. It is absolutely imperative that this is done ASAP.
If you or he has any questions, please reach out to me at [phone number[
On Sat, Mar 19, 2016 at 9:29 AM, Sara Latham
wrote:
> Sent from my iPhone
>
> Begin forwarded message:
>
[Forwarded Phishing Email from Delavan here]
> *From:* Google
> *Date:* March 19, 2016 at 4:34:30 AM EDT
> *To:* john.podesta@gmail.com
> *Subject:* *Someone has your passwrd*
>
> Someone has your passwrd
> Hi John
>
> Someone just used your password to try to sign in to your Google Account
> john.podesta@gmail.com.
>
> Details:
> Saturday, 19 March, 8:34:30 UTC
> IP Address: 134.249.139.239
> Location: Ukraine
>
> Google stopped this sign-in attempt. You should change your password
> immediately.
>
> CHANGE PASSWORD
>
> Best,
> The Gmail Team
> You received this mandatory email service announcement to update you about
> important changes to your Google product or account.
>
--
-Charles Delavan
HFA Help Desk
The HFA Operations Team is here to support you. Let us know how we’re doing .
by filling out a brief survey
So the help desk actually provided the correct URL to change the password, but the assistant went on click the phishing bit.ly link. Funnily enough, the HelpDesk monkey's sig contains a link to a survey using A BIT.LY LINK! LOL>
You mean he didn't check the url where he was giving his new password, he didn't log into Google directly, he didn't to make sure that the email was really sent from someone at Google.
He blindly clicked on a link in an email and gave up his password.
And this proves that Russia hacked is account.
All this proves is that John Podesta is an idiot.
The Russian psychic warfare department strikes again! We really need to stop those evil Russians meddling with our democracy! Who knows in what other nefarious ways they use their psychic superpowers!
Who uses the word "illegitimate" to describe a phishing email?
When you're talking to non-techies you do, if you said phishing email to Podesta he would start looking for his tackle box.
I have never in my life referred to an email as "illegitimate". Not talking to bumpkins, not to construction workers, not to tradesmen, not to policemen, not to soldiers, not to doctors, not to lawyers, not to elected officials. Not to my employees, not to my bosses, not to CEOs, not to directors. Not to teenagers, not to millennials, not to adults, not to boomers, not to octogenarians.
However, I use the phrases "That's spam, delete it." and "Fake, trash it." damn near every day.
I haven't been around the world and seen everything, but I've seen a lot, and I've never met or heard of a group or demographic that would consider that phrasing normal.
There are times when spinning a tall tail to cover your ego is appropriate, and times when it is not. There are also good lies and bad lies. This one was pretty bad, and at a time when he's got a sizable fraction of the world looking in his direction. A better lie, and one that every single IT professional and talented amateur in the world would have believed completely, would have been: "I'm sorry, I was about to check the headers and I got distracted by a phone call / person walking into my office. When I got back to it, I had lost my place and mistakenly thought that I had checked when I hadn't."
See that "Preview" button?
...we continue to talk about the HACK and who did it, not what the emails showed.
-Styopa
General pactice when someoe is being tageted is t asume other attaks fromm other vectors are in pogress som of which may be crack-basd.
I can titaly see this happening what wit today's autocorect, IT people not bein traned in gramar and always rushin, an the godamn suck ass chiclet keybords in us today.
Someone had to do it.
Eight years ago these people mocked McCain as "out of touch" for his reluctance to use a computer...
Turns out, they need two layers of aides themselves to be able to tell an e-mail scam... Hypocrite scum.
In Soviet Washington the swamp drains you.
Exactly. Having done this for a few years, CLEAR LANGUAGE is very important. There are english courses dedicated to that concept, but its pretty simple to grasp.
"Yes, that's probably a virus. Delete it."
While not exactly technically accurate, leaves absolutely no ambiguity. You would never tell the user to change their password, because obviously, they are being told that already by a third party so you telling them that would be an explicit validation of the problem and cause them to immediately act on it.
That he says a typo is to blame is icing on the cake really. Like someone who went over reading bad correspondences they made and desperately searching for any reason that it is not their fault.
Language of course, can only help if your direction is sound. And with that many screw ups in a tiny email, it was clearly not. This guy does seem like a bad admin at this point and perhaps, clueless. lor knows there are plenty of them
-