I shouldn't, but I couldn't resist a couple of comments on the issue of those darn Ruskies hacking the election.
Please be aware that my goal is to be completely non-political. I just think that from the technical, security perspective, there are some interesting things going on here worth looking at.
The first comment is simply to point to what is far and away the best overviews I've seen on the Grizzle Steppe release by DHS.
Before you read it though, let me point out that the author does steer into what might be considered politics every now and then. I encourage you to just avert your eyes, and focus on the discussion of the Grizzly Steppe IOCs.
http://www.thedailybeast.com/articles/2017/01/06/how-the-u-s-enabled-russian-hack-truthers.html
The comments in the article by Robert Lee and Robert Graham are, I think, spot on.
If you're interested in diving into this report in more detail, here's a much more in-depth critique of the report by Robert Lee:
http://www.robertmlee.org/critiques-of-the-dhsfbis-grizzly-steppe-report/
In my opinion, irrespective of your politics, DHS did not endear themselves to the security community with this one. It comes off as a huge bureaucratic CYA exercise because somebody in authority said very loudly, "DO SOMETHING!!". It only succeeded in generating a lot of work for folks defending stuff, and I doubt much good came of it.
Here's the other thing I thought was interesting. While we don't have access to the technical data underlying the assessment of the DNC hack, it turns out we have very good insight into the hacking of John Podesta's gmail account - which was a different compromise but was related due to Podesta's involvement with the election.
The paper below describes in detail how, due to an opsec mistake by the attackers, researchers at SecureWorks were able to compromise some phishing campaigns which they believe were run by APT28. The compromise allowed them to directly identify the targets of these phishing campaigns, and to develop an estimate of which targets were successfully compromised.
https://www.secureworks.com/research/threat-group-4127-targets-google-accounts
It's a good read if you want to understand how one mistake can lay bare an entire cyber attack program. It also describes the mechanics of how the attackers led their victims to a fake Google password change page.
In a related display of cosmic irony - included in the leak of John Podesta's email to Wikileaks, is the phishing email which appears to have resulted in the compromise of his email and therefore the leak his emails to Wikileaks. :-)
After reading the SecureWorks paper, let's see why the Podesta hack could be part of that campaign...
We know from the email dump in Wikileaks, that Podesta received a phishing email purporting to be from Google, encouraging him to change his password, and conveniently providing a URL he could use to change it. The URL he was provided was:
https://bit.ly/1PibSU0
(Note: as a rule, I don't go to Wikileaks, but if you want to see the source email thread, it's available at: https://wikileaks.org/podesta-emails/emailid/36355)
Some URL shortners, including bit.ly, have a feature where if you append a '+' sign to the shortened URL, they take you to a page which shows where the shortened URL redirects you to. Using that feature, we can examine the URL from the phishing email (notice the appended '+'):
https://bit.ly/1PibSU0+
which shows us that Podesta was ultimately sent to:
http://myaccount.google.com-securitysettingpage.tk/security/signinoptions/password?e=am9obi5wb2Rlc3RhQGdtYWlsLmNvbQ%3D%3D&fn=Sm9obiBQb2Rlc3Rh&n=Sm9obg%3D%3D&img=Ly9saDQuZ29vZ2xldXNlcmNvbnRlbnQuY29tLy1RZVlPbHJkVGp2WS9BQUFBQUFBQUFBSS9BQUFBQUFBQUFCTS9CQldVOVQ0bUZUWS9waG90by5qcGc%3D&id=1sutlodlwe
Based on what we learned in the SecureWorks paper, we can decode the components of that URL to see that:
am9obi5wb2Rlc3RhQGdtYWlsLmNvbQ== --> john.podesta@gmail.com
Sm9obiBQb2Rlc3Rh --> John Podesta
Sm9obg== --> John
Ly9saDQuZ29vZ2xldXNlcmNvbnRlbnQuY29tLy1RZVlPbHJkVGp2WS9BQUFBQUFBQUFBSS9BQUFBQUFBQUFCTS9CQldVOVQ0bUZUWS9waG90by5qcGc= --> //lh4.googleusercontent.com/-QeYOlrdTjvY/AAAAAAAAAAI/AAAAAAAAABM/BBWU9T4mFTY/photo.jpg
That was the information which was used to construct the web page used to trick him into providing his Google password. BTW, that last URL brings up the publicly available picture that Google uses for Podesta's Google applications.
The actual web site which displayed the fake Google password change page is no longer up, but we can see in the SecureWorks paper what it looked like.
Based on this research, it seems pretty clear that Podesta had been phished by the group documented by SecurityWorks. Based on the contents of the email thread, it's very likely that the attack succeeded and that this attack resulted in his email being compromised.
Here are some screen shots showing these steps:
Here's email thread showing the URL in the phishing email.
In the same email thread, Podesta's IT support team mistakenly decides that the email is legitimate and they need to change the password for his email account. This is why I think it's likely the phishing attack was successful.
Here's the bit.ly page showing where the URL in the phishing email redirects him to (notice the URL in my browser's address box):
BTW, the frozen "2 Clicks" statement in the above suggests that the bit.ly URL was used twice before they locked it down. This may be further evidence that the phishing attack was successful.
The next screen shot just shows me using the base64 utility to decode the portions of the URL which show this attack was directed at Podesta, and that a customized bit.ly redirection had been established for him (Note: I translated the '%3D' in the URL to the '=' that it represents.)
And finally, here's the publicly available Google page which is pointed to by the last argument in the phishing URL. This is used to make the fake password change page more believable.
I would just finish by observing that while the "big guys" in the industry sometimes have access to data that the rest of us never see, often we can peek under the hood and see a lot of the same stuff they see.
As security folks, I think it's fair to say that we live in interesting times! :-)
