Lessons learned from the Podesta email hack

Lessons learned from the Podesta email hack

ROCCO MAGLIO 12/30/2016

Rocco Maglio, Certified Information Systems Security Professional, CISSP, has over 20 years in the field of software engineering.

The hacking of Clinton Campaign Chairman John Podesta’s email provided a lesson for us all. It was an amazingly simple phishing email that caused his password to be revealed. An email was sent to Podesta’s gmail account saying someone had used his password to login to his account from the Ukraine and he should change his password. It included a link to change the password.

The link to change the password used a url shortening service bit.ly. This by itself is not a complete giveaway. The url shortening takes a long url and reduces it to a much shorter url — in this case it was (Removed so no one clicks on it.) . When the shortened url is clicked on it redirects to the longer url.

IT Technician Charles Delavan told The New York Times that the hack was partially his fault. He used the word “legitimate” instead of “illegitimate” in referring to the the emails by mistake and mentioned that it was probably a good idea in any case to change the password. He included a link to change the email since he did not trust the link in the email.

The staff member clicked the link in the phishing email — not the one added by Delavan — when they went to change the password thus providing the phisherman with the the password to Podesta’s emails. He also instructed that they should enable two-factor authentication. If this had been done, the password would not let the phisherman in...

Read more:
https://hernandosun.com/podesta_email_20161230