FBI spams thousands with fake infosec advice after 'software misconfiguration' The FBI has admitted that a software misconfiguration let parties unknown send legit-looking email from its servers. A statement from the bureau, dated November 14, states the agency "is aware of a software misconfiguration that temporarily allowed an actor to leverage the Law Enforcement Enterprise Portal (LEEP) to send fake …
The most chilling comment, which I totally believe, is:
"I could've 1000% used this to send more legit looking emails, trick companies into handing over data etc. And this would've never been found by anyone who would responsibly disclose, due to the [nondisclosure] notice the feds have on their website."
The LEEP server is used by law enforcement and intelligence agencies. A request from the FBI for information will likely be acted upon without question.
And all because of yet another "misconfiguration" (assuming the FBI is being honest about that).
Krebs's article explains. It sounds weird. Weird as in "what were they on?". The sign-up process resulted in a one-time code emailed to the new user's email address. So far so 2FA. But the email seems to have been generated client-side and sent to the server with a POST request which included as parameters not just the email address, but also the subject and body so by feeding POST requests to the server the server would send out whatever emails were requested.
No weak passwords required: no passwords required at all. Apparently IE was required, however. I suppose it stopped those wicked Linux users getting access.
Casting aspersions. :-) ....... Robert Carnegie
And random secret field beta testing for Aspergeans too, Robert C
A rare breed indeed that do trade in raw information free from foreign embellishment and flash fiat money market influence chasing rapidly disappearing paper wealth negatively impacting the automatic continuity of great atomic affluence ......... so whenever the truth be told with all said and alreadily done, certainly most definitely extremely disruptive and Greater IntelAIgent Game Changing.
And there’s not many able to confess to being able to Host and Provide Succour and Nectar to those sorts of COSMIC Programs.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
