So we got some interesting news you don't hear every day,
which is the FBI got hacked.
Specifically one of their email servers got compromised and was used to send
out some interesting spam emails, and the email address it came from was
real, so it was not a spoofed email.
It legitimately came from the FBI servers.
However, the email itself was not real.
However, this is not any kind of typical scam or phishing email or anything
you see usually getting sent out.
So explain what I mean by all that.
It's kind of interesting.
So what's the deal?
What even happened?
Well, according to SpamHaus Project, which is an international
organization that tracks spam activity.
On Friday night between about 9:00 p.m.
and Midnight Pacific Time, which is 5:00 a.m.
and 8:00 a.m.
UTC time, the following email was sent out in two different waves
or at two different times to a
whole bunch of people and companies.
So pretend you are a company receiving this email.
It is from eims@ic.fbi.gov.
The subject is "Urgent: Threat actor in systems".
And the content is...
our intelligence monitoring indicates exfiltration of several of our virtualized
clusters in a sophisticated chain attack.
We tried to blackhole the transit nodes used by this
advanced persistent threat actor.
However, there is a huge chance he will modify his attack with
fastflux technologies, which he proxies [through] that's supposed
to say multiple global accelerators.
We identified the threat actor to be Vinny Troia.
Who, by the way, I had to look him up.
He's a security researcher.
He's not actually a malicious hacker or anything.
They just used his name anyway it continues....
whom is believed to be affiliated with the extortion gang TheDarkOverlord.
We highly recommend you check your systems and IDS monitoring.
Beware this threat actor is currently working under inspection of the
NCCIC as we are dependent on some of his intelligence research.
We cannot interfere physically within four hours, which could be enough time to cause
severe damage to your infrastructure.
Stay safe!
U.S.
Department of Homeland Security Cyber Threat Detection and
Analysis Network Analysis Group.
So one thing you noticed is it doesn't include any kind of demand or
outrageous claims or offers or anything.
It basically just contains a whole bunch of technical jargon nonsense.
So what exactly is their goal here, then?
Well, let's hold off on that for a second and go over some
more details about the email.
So as SpamHaus mentions, apparently the email list that this email was
sent to was just scraped from the ARIN database and that stands for
American Registry for Internet Numbers.
And basically it's a database of 'whois' information.
So when you buy a website domain, you have to publish some kind of contact
information like an email address.
So what someone could theoretically do is just go and do searches on a
whole bunch of popular websites and get a whole bunch of email addresses.
Unless you use a proxy service that fowards emails
to you, something like that.
So they got just a list of public email addresses, basically.
The important thing they point out though, is that the headers are real.
They really are coming from FBI infrastructure.
They have no name or contact information in the .sig, or the signature.
Now as for what the headers are, if you're not familiar it's basically
information that's sent along with the email for the server side of things,
not for you, and it contains things like the sending server's IP address.
The sending email address also some security signature
information to verify the sender, if that set up, stuff like that.
And depending on whether the sending domain has certain security protocols
set up, such as things called SPF and DKIM, are two examples.
Then it will be sent along with a signature to prove that it
really came from that server.
And by the way, I did make a video talking about this kind of stuff in my
ultimate guide to spotting spoofed emails.
I go over headers and stuff and generally how to tell if an email was spoofed.
But I also mentioned that occasionally a email server may actually just get
hacked and sent out a legitimate, not spoofed email that actually came from the
address, but the email itself is fake.
An example I gave was there was a scam email that came from
an Erie.Gov government email address, and it was really from
that address, but it was a scam.
But in this case, there was no kind of scam or demand or anything like that.
So what is their goal?
Well, SpamHaus did give three possible speculative reasons.
The first could be just to cause chaos, make companies scared
enough to shut things down.
Mess stuff up.
Or just cause the FBI to get flooded with phone calls, which they did by the way.
Another reason could be character assassination of Vinny Troia, the guy
mentioned in the email, basically just to make him look bad or troll him.
Or as they say, it could just be for the lulz you know, just to see if you could or
show off, or maybe even all of the above.
Now, as for how this was accomplished, there is some speculation that perhaps it
was done through the web portal of the FBI that they use maybe a weakness in there.
Or it's also possible that a user at the FBI was personally hacked and then they
used their device to send out emails.
One Twitter user, who says they are a former FBI agent, also
gave a fun fact for context.
He says for context, the FBI used to use ic.fbi.gov for our non-classified email.
Around the time I left 2015, they dropped the ic.fbi.gov and moved to fbi.gov.
Someone may have gained access to the abandoned email infrastructure.
So that could be a possibility, if they never properly shut down the
old one and it was still set up, and maybe they weren't doing updates
to it because it was old, then that would have had more weaknesses.
Now the talk about this hack seems to mostly still be within the cyber security
industry in industry circles and not exactly out in the mainstream yet.
And it's still not really clear how serious this is.
And that would depend on the real reasoning behind it.
So depending on how this pans out, it might not get picked
up by too much mainstream.
Although I do think that "FBI gets hacked" is too juicy of a headline
for most news outlets to pass up.
Also, I did find a thread on the sysadmin subreddit on Reddit, which was before
everyone knew what the heck was going
on.
And basically the guy saying, 'this is kind of a weird email from the FBI'.
And then some other users were saying, 'Hey, we got that too'.
And presumably these are mostly sysadmins or IT people from different companies.
One user said that they had called the FBI helpdesk to figure out what
the deal is with this and that they were just being flooded and they
didn't really know any information.
Probably because this happened so late at the night local time, that there was no
one really on staff they could handle it.
And one funny and interesting comment I read is the one that said "the FBI email
you need to be concerned with is the one that simply asks you call Special
Agent X at your earliest convenience."
And that's just for future reference if you ever get contacted by the FBI.
So that's really all we know about this at the moment.
There's not really anything for the average person to worry about.
But if you did happen to get one of these emails, or someone at your company
mentions it and they're kinda frantically figuring out what's going on, you can
let them know that it was indeed fake.
Now if you guys want to keep watching, the next video I'd recommend is
that one I was talking about the ultimate guide for how to spot
spoofed and scam emails, definitely recommend it, you'll learn a lot.
If you want to subscribe,
also click the bell next the subscribe button to enable all notifications
because I only post about twice we tops, so you don't want those to get
lost in the rest of your subscriptions.
And by the way, if you want to become a channel member, I
always forget to mention this.
You can click the Join button and get a special badge next
to your name and be able to use some cool emojis in the comments.
So anyway, thanks so much for watching, guys.
And I'll see you in the next video.