Clinton Campaign Chair John Podesta’s Email Was Hacked Via Simple Phishing Attack
There are many different ways of hacking into a person's email account. Some are rather sophisticated and involve a lot of effort, while on the end of the spectrum a scheme known as phishing is one of the easiest methods—all you need is a cooperative victim with limited technical savvy. Hackers found both in John Podesta, Chairman of the Hillary Clinton presidential campaign.
What is even more startling is that hackers found the same in Clinton's IT staff. It now appears that it was not some complex hacking that compromised the security of Podesta's email account, it was the inability to recognize a phishing attempt despite multiple telltale signs.
WikiLeaks has been making public hacked emails from Podesta's compromised account. The information contained in those emails sometimes shine a less than bright light on Clinton's campaign trail and if she loses the presidential election to Republican nominee Donald Trump, the emails will be looked back upon as part of her undoing.
It all started on March 19. That is when Podesta received an email from a spoofed address (no-reply@accounts.googlemail.com) claiming that someone in Ukraine tried to sign into his account. The spoofed account then went on to advise Podesta to change his password immediately using a provided Bit.ly link.
Yes, Bit.ly. To Podesta's credit, he was suspicious of the email so he forwarded it to his chief of staff, who then sent it to the campaign's IT department. That is where it should have ended—the IT team should have immediately recognized it as a phishing attempt, but instead determined the email was legitimate.
"This is a legitimate email. John needs to change his password immediately, and ensure that two-factor authentication is turned on his account. He can go to this link: https://myaccount.google.com/security to do both. It is absolutely imperative that this is done ASAP.," an email leaked by WikiLeaks reads.
The IT team did Podesta a solid by providing an accurate link, but it screwed up both by determining the phishing email was legitimate and failing to warn Podesta against clicking the Bit.ly link. Whether the IT team knew the link was harmful isn't entirely clear. They should have. For one, Google has its own URL shortening service, so why would it use Bit.ly? But if the team did know, they failed Podesta by not making it clear.
What is even more startling is that hackers found the same in Clinton's IT staff. It now appears that it was not some complex hacking that compromised the security of Podesta's email account, it was the inability to recognize a phishing attempt despite multiple telltale signs.
WikiLeaks has been making public hacked emails from Podesta's compromised account. The information contained in those emails sometimes shine a less than bright light on Clinton's campaign trail and if she loses the presidential election to Republican nominee Donald Trump, the emails will be looked back upon as part of her undoing.
It all started on March 19. That is when Podesta received an email from a spoofed address (no-reply@accounts.googlemail.com) claiming that someone in Ukraine tried to sign into his account. The spoofed account then went on to advise Podesta to change his password immediately using a provided Bit.ly link.
Yes, Bit.ly. To Podesta's credit, he was suspicious of the email so he forwarded it to his chief of staff, who then sent it to the campaign's IT department. That is where it should have ended—the IT team should have immediately recognized it as a phishing attempt, but instead determined the email was legitimate.
"This is a legitimate email. John needs to change his password immediately, and ensure that two-factor authentication is turned on his account. He can go to this link: https://myaccount.google.com/security to do both. It is absolutely imperative that this is done ASAP.," an email leaked by WikiLeaks reads.
The IT team did Podesta a solid by providing an accurate link, but it screwed up both by determining the phishing email was legitimate and failing to warn Podesta against clicking the Bit.ly link. Whether the IT team knew the link was harmful isn't entirely clear. They should have. For one, Google has its own URL shortening service, so why would it use Bit.ly? But if the team did know, they failed Podesta by not making it clear.
