Friday, November 22, 2024
Latest:
The Register 

FBI spams thousands with fake infosec advice after ‘software misconfiguration’

TH Author

The United States Federal Bureau of Investigation has admitted that a software misconfiguration let parties unknown send email from its servers.

A statement from the Bureau, dated November 14th, states that the agency “is aware of a software misconfiguration that temporarily allowed an actor to leverage the Law Enforcement Enterprise Portal (LEEP) to send fake emails”.

Spam-tracking service Spamhaus tweeted about the incident on November 13.

The mails contained a warning that FBI monitoring had detected “exfiltration of several of your virtualized clusters in a sophisticated chain attack” perpetrated by a chap named Vinny Troia, the founder of infosec firms named Shadow Byte Cyber and Night Lion Security.

There is no indication Troia had anything to do with the incident and The Register makes no suggestion he was in any way involved. However, an entity using the name and Twitter handle “@pompompur_in” appears to have told Krebs on Security they were behind the incident.

“I could’ve 1000% used this to send more legit looking emails, trick companies into handing over data etc.,” Pompompurin told Krebs. “And this would’ve never been found by anyone who would responsibly disclose, due to the notice the feds have on their website.”

Troia also appears to have attributed the incident to @pompompur_in.

For what it’s worth, @pompompur_in’s Twitter profile states it also operates a private account on the service with the handle @seds. The profile for that account reads: “Call me vinny troia the way I be selling DBs.” Other @pompompur_in posts suggest bad blood between whoever operates the account and Troia.

Whoever was behind the attack, the FBI has admitted it was real and that a server it operates was used to send the mails. Another Spamhaus Tweet suggests that whoever got in was able to use the FBI server to send two spurts of mail, with around 100,000 messages making it out.

The server in question was part of LEEP, which the FBI describes as “a secure platform for law enforcement agencies, intelligence groups, and criminal justice entities [that] provides web-based investigative tools and analytical resources” for other law enforcement agencies.

“Users collaborate in a secure environment, use tools to strengthen their cases, and share departmental documents.” Or at least that’s what they do when they’re not trying to figure out what “exfiltration of several of your virtualized clusters in a sophisticated chain attack” means.

But we digress.

The FBI explains that the server was “dedicated to pushing notifications for LEEP and was not part of the FBI’s corporate email service”, and that no data or personally identifiable information was accessed.

“Once we learned of the incident, we quickly remediated the software vulnerability, warned partners to disregard the fake emails, and confirmed the integrity of our networks.”

Unusually, the FBI’s posts don’t mention an investigation into the incident. Perhaps the Bureau’s waiting for the weekend to end before trying to track down @pompompur_in. ®

READ MORE HERE