FBI is hacked and spam emails about fake cyberattacks are sent out from gov system

hawki · Nov 13, 2021

"THE Federal Bureau of Investigation (FBI) had its email system hacked this morning, sending out fake messages about cyberattacks.

The rogue emails, sent from the FBI’s email infrastructure are said to contain a warning from the Department of Homeland Security (DHS) concerning a cyberattack..."

https://www.the-sun.com/news/4059641/fbi-hacked-spam-email-cyberattack/

zapjb · Nov 13, 2021

No way should this happen. Disgraceful.

Daveski17 · Nov 13, 2021

There's a US version of The Sun?

Thankful · Nov 13, 2021

https://www.cnn.com/2021/11/13/politics/fbi-fake-emails-cyber-threat/index.html

Azure Phoenix · Nov 14, 2021

https://krebsonsecurity.com/2021/11/hoax-email-blast-abused-poor-coding-in-fbi-website/

Pompompurin says the illicit access to the FBI’s email system began with an exploration of its Law Enforcement Enterprise Portal (LEEP), which the bureau describes as “a gateway providing law enforcement agencies, intelligence groups, and criminal justice entities access to beneficial resources.”

“These resources will strengthen case development for investigators, enhance information sharing between agencies, and be accessible in one centralized location!,” the FBI’s site enthuses.

Until sometime this morning, the LEEP portal allowed anyone to apply for an account. Helpfully, step-by-step instructions for registering a new account on the LEEP portal also are available from the DOJ’s website. [It should be noted that “Step 1” in those instructions is to visit the site in Microsoft’s Internet Explorer, an outdated web browser that even Microsoft no longer encourages people to use for security reasons.]

Much of that process involves filling out forms with the applicant’s personal and contact information, and that of their organization. A critical step in that process says applicants will receive an email confirmation from eims@ic.fbi.gov with a one-time passcode — ostensibly to validate that the applicant can receive email at the domain in question.

But according to Pompompurin, the FBI’s own website leaked that one-time passcode in the HTML code of the web page.

Pompompurin said they were able to send themselves an email from eims@ic.fbi.gov by editing the request sent to their browser and changing the text in the message’s “Subject” field and “Text Content” fields.

“Basically, when you requested the confirmation code [it] was generated client-side, then sent to you via a POST Request,” Pompompurin said. “This post request includes the parameters for the email subject and body content.”

Pompompurin said a simple script replaced those parameters with his own message subject and body, and automated the sending of the hoax message to thousands of email addresses.

“Needless to say, this is a horrible thing to be seeing on any website,” Pompompurin said. “I’ve seen it a few times before, but never on a government website, let alone one managed by the FBI.”
Click to expand...

Log in or Sign up

FBI is hacked and spam emails about fake cyberattacks are sent out from gov system

hawki Registered Member

zapjb Registered Member

Daveski17 Registered Member

Thankful Savings Monitor

Azure Phoenix Registered Member

Log in or Sign up

FBI is hacked and spam emails about fake cyberattacks are sent out from gov system

hawki Registered Member

zapjb Registered Member

Daveski17 Registered Member

Thankful Savings Monitor

Azure Phoenix Registered Member

Useful Searches