The person claiming responsibility for the FBI email server hack says they were able to send spam messages by abusing insecure code in the FBI's LEEP portal
even with how silly it was written AND not following protocol — was NOT the weird juju I wanted going into this weekend. https://krebsonsecurity.com/ ... https://twitter.com/... @embryoresist : 1) Breach FBILEEP system. 2) Use it to email security specialist Brian Krebs. 3) Tell Krebs he is hosting a botnet “on his forehead”. 4) Carry one's large balls home in a wheelbarrow. https://twitter.com/... John Scott-Railton / @jsrailton : The ever-timely @briankrebs already has an interview with the person who claimed responsibility. https://krebsonsecurity.com/ ... https://twitter.com/... @rayredacted : Brian's article should clarify pretty much everything about the FBI LEEP incident of the past 12 hours. https://twitter.com/...
Krebs on SecurityBrian Krebs
Context & Ripple Effects
The LEEP account follows parallel reporting that the FBI’s email infrastructure was used to distribute warnings of a “sophisticated chain attack,” apparently aimed at discrediting security researcher Vinny Troia. The claimant’s account narrows the alleged entry point to insecure code in the portal, while Brian Krebs’ interview makes the claim part of the public incident record.
The episode turns an FBI-branded communications channel into the vehicle for the alleged abuse, rather than merely a target of unauthorized access. That distinction matters because recipients may treat messages sent from the FBI’s systems as authoritative.
First-order effects
The FBI must treat LEEP and the connected email capability as an abuse path after the claimant said insecure portal code enabled spam delivery.
BrianKrebs was directly targeted through the FBI’s email infrastructure, while the related account says the campaign’s apparent aim was to discredit Vinny Troia in the FBI email spam campaign.
Second-order effects
Security researchers and other recipients of FBI-originated messages have reason to scrutinize the provenance of urgent warnings, reducing the immediate credibility benefit of the agency’s sending domain.
For the FBI, securing the portal is not only an access-control issue: restoring confidence requires separating legitimate agency communications from messages sent through a compromised workflow.
Third-order effects
The incident points to a recurring security problem in which weaknesses in an outward-facing portal can be leveraged to misuse a trusted institution’s communications channel, making message authenticity part of the system’s security boundary.
If similar incidents recur, public-sector operators will face pressure to design externally reachable services so that a portal flaw cannot grant access to high-trust outbound communications.
The trend: Security failures are increasingly judged by whether they let attackers appropriate a trusted organization’s identity and distribution channels, not only by whether data was accessed.
So, Brian Krebs interviewed the alleged hacker, who said he did it to point out a “glaring vulnerability in the FBI's system.” Not sure why this isn't being reported more widely. https://krebsonsecurity.com/ ... https://twitter.com/...
Good example of both: 1) it WILL happen to everyone and 2) manage your scope so that when it does, the impact is minimized. Do not feel bad when you say “it could have been worse.” Instead, know that you did your job. https://twitter.com/...
Another update: The FBI acknowledged Sunday that someone had exploited a software configuration in an IT system the FBI uses to communicate with state and local law enforcement to send the emails. https://www.cnn.com/...
Updated FBI statement. I think it's pretty open and transparent, and a quick isolation. LEEP webapp was indeed abused. Well handled incident I think. Orgs should take note talking about it stops rumour mill stories. https://krebsonsecurity.com/ ... https://twitter.com/...
FBI confirms yesterday's reporting, says its Law Enforcement Enterprise Portal (LEEP) portal was abused to send fake emails. “No actor was able to access or compromise any data or PII on FBI's network.” Full statement in update: https://krebsonsecurity.com/ ...
It kind of immediately felt it must have been such a basic vuln when I glanced at that website. It smells legacy all over the place. It really reminds me of my early pentest days when I was so excited to be able to change email content sent from target sites 😆 https://twitter.com…
The “one-time” passcode was hard coded into the site and the emails were generated client-side... when was this website developed, 1990? https://twitter.com/...
The person claiming responsibility for yesterday's shenanigans says they were able to send the messages by abusing flawed code on the FBI LEEP portal. An interesting read from @briankrebs: https://twitter.com/...
The waste of (allegedly) hacking an fbi email account for a weird grudge and not running some sort of bitcorn scam. https://twitter.com/... https://twitter.com/...
Fun fact: Getting this hoax email 8 hours before the biggest charity event of the year for @RoosterTeeth — even with how silly it was written AND not following protocol — was NOT the weird juju I wanted going into this weekend. https://krebsonsecurity.com/ ... https://twitter.com…
1) Breach FBI LEEP system. 2) Use it to email security specialist Brian Krebs. 3) Tell Krebs he is hosting a botnet “on his forehead”. 4) Carry one's large balls home in a wheelbarrow. https://twitter.com/...
The ever-timely @briankrebs already has an interview with the person who claimed responsibility. https://krebsonsecurity.com/ ... https://twitter.com/...