Hello world, the FBI website has been exploited to send thousands of trolling emails. It all
went down last Saturday when people started receiving odd looking emails. These emails
weren’t sent from a lookalike domain or by someone just pretending to be the FBI,
no, the emails were sent from a 100% legit fbi.gov email address. The subject line reads
“Urgent: Threat actor in systems”. And the email body is one masterful troll, it
says things like “Our intelligence monitoring indicates exfiltration of several of your
virtualised clusters”, “We tried to blackhole the transit nodes used by this advanced persistent
threat actor, however there is a huge chance he will modify his attack with fastflux technologies,
which he proxies through multiple global accelerators”.
If this makes no sense to you, well that’s kind of the point. It’s a bit of a meme
to drop a load of tech jargon that makes absolutely no sense to try and make something sound ominous
and spooky. Usually we only see this kind of thing in low rate hacker films and TV shows.
If you’re even slightly technically literate you’ll recognise the sheer cringe. But to
normies it sounds impressive and technical, and I’m sure this email raised the blood
pressure of at least a few of the recipients. Anyhow, the email goes on to say “We have
identified the threat actor to be Vinny Troia, whom is believed to be affiliated with the
extortion gang TheDarkOverlord”.
I’d never heard of “Vinny Troia” before this “event”, it turns out he’s the
founder of cyber security companies “NightLion” and “Shadowbyte” - and just so we’re
on the same page, Vinny has nothing to do with this, it’s just a troll email of course.
Why try to frame the guy? Well, as it happens, he and the hacker behind this troll are arch
nemeses. Vinny has written a whole blog post on his previous encounters with this hacker.
And whilst on the one hand I don’t want to feed the trolls too much, it just encourages
them. I learned that lesson through the dealings with my imposter - I’ll link that video
below. But we really have to examine the perp behind this just a little bit, it’s not
often you come across such a perfect archetypal instantiation of a troll.
The troll/hacker, whatever you want to call them, calls themself: “Pompompurin”, they’re
on twitter which makes our investigation a little easier, and they make it very clear
in their bio that they’re not a whitehat or greyhat - if there was any confusion. I
am also reliably informed that “pompompurin” is a character in hellokitty if you were curious.
Interesting hacker name, it’s also very satisfying to say, pompompurin.
On his website, pompompurin is honest with their bio, claiming to be a “threat actor,
website administrator and proud Canadian”. One of their blog posts is titled “Why ransomware
is good”, in which they essentially argue that ransomware “helps companies be more
inclined to care about their security.” - now I honestly can’t even tell if this
post is a troll or not.
Anyhow, what’s the history behind Vinny and Pompompurin’s entanglement? As Vinny
explains in a blog post “This all started about a year ago when we initially published
our cybercrime report naming Christopher Meunier, 22, of Calgary, Canada, as the alleged mastermind
behind several major hacking groups including The Dark Overlord, Gnostic Players, and Shiny
Hunters.”
Vinny alleges that “Christopher Meunier” is pompompurin, though pompompurin denies
this. Now if you want to read the full backstory behind these two I’ll leave a few links
below, both sides have posted reams of screenshots of them sparring with each other, it’s quite
difficult to dissect, and even make any sense of. But in a nutshell they’re not the best
of friends. So much so that Pompompurin has been on quite the trolling spree the last
year. On one occasion our troll hacked the “national center for missing children”,
publishing a blog post about Vinny being a pedo. On another occasion he DDoSed one of
Vinny’s websites. He also hacked Vinny’s twitter account - tweeting the most bizarre
things. And that’s not even the end of it, Vinny says “he tried to publicly frame me
for the hack on Astoria company; and before that, it was something else.”
And of course the latest installment in this saga, not only hacking the FBI, but opting
to weaponise an FBI email server not to spam phishing emails, and make stacks of cash,
but instead to simply further this spat, this feud between them. The lengths pompompurin
has gone to are really quite remarkable. He even had the audacity to message Vinny on
twitter before the FBI hack to simply say enjoy. Vinny, confused, replied “enjoy what”,
and then a day later it all became obvious.
However the question remains, how did Pompompurin hack the FBI to send reams upon reams of trolling
emails? The FBI has a webpage called the “law enforcement enterprise portal” which various
law enforcement agencies use to access resources. The first mistake the FBI made was that anyone
visiting the web page could hit the “Apply for an account” button. Since the hack,
the FBI have made this button return an error, but the FBI have a handy dandy PDF which explains
how the application process used to work. If we skip right to the bottom step 15 explains
“You will receive an email confirmation from [this FBI email] that your account is
created”. And herein lies the second mistake, this confirmation email is generated client
side. By inspecting the traffic to and from the website you can see the parameters are
all generated on your PC. Of course you can change these variables to whatever you want
and have a single custom email sent from FBI servers.
But Pompompurin took it one step further and injected a malicious script, which automated
sending tens of thousands of these troll emails. In fact about 100,000 emails in total were
sent.
The FBI released a very boring statement, essentially acknowledging the hack but trying
to downplay it by adding that no FBI data was compromised - seemingly completely missing
the point about these
awful web
development practices.