The specific attack vector isn't the only IOC they're working from for these incidents; there are probably dozens of IOCs associated with each attack, some of which are extremely specific to just one or two threat actors. Many of those IOC signatures are non-public; you only get them by being in intelligence or law enforcement, or by being one of the handful of threat intelligence companies deployed at enough giant enterprises to see enough of a cross-section of attackers.

So when people say things like "anyone could have carried out this attack" or "these systems are so insecure it could have been anybody who did it", they're not actually addressing the argument.

Makes sense, but at the end of the day didn't he fall for the same basic phishing attack so many others do? If it's so effective and easy I have to imagine the NSA is doing the same.

Whole thing makes me really wonder if using insecure email in government is a good idea...

It's long been known not to use insecure endpoints, email, etc in government. NSA used to certify the high-assurance alternatives. Here was one of the early ones with incredibly-strong TCB for the time:

http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.454...

Almost all older or modern ones build email processing capabilities onto guards optionally with a proxy on client's side to integrate with common, mail client. Here's an article describing what a guard is along with some examples government uses today:

https://en.wikipedia.org/wiki/Guard_(information_security)

Firewalls are knockoffs of guards that were created after businesses and much of government rejected high-assurance systems since they didn't have development pace and [insecure] features of low-security competition. Firewalls were cheap, fast, constantly added features, and totally left off the whole "design it to be nearly unhackable" aspect of guards. Even the guards themselves have lowered their assurance at the TCB and guard software over the years as neither military nor commercial market really care outside a small niche of customers. Remaining ones like Boeing SNS Server and BAE's XTS-400 go for $100,000+ a unit due to limited market + high development & certification costs.

So, that's that. Medium-assurance solutions like Nexor's and General Dynamics continue being developed and adopted. They'll get smashed, though, since they're all adopting Linux-based cores & other COTS tech. Such are the market incentives.

I think there are countless examples across government, industry and personal accounts that using insecure email is a universally bad idea.

Unfortunately it has the strongest network effect at the moment, and no one's come up with a way to get everyone to use encryption/cryptographic signatures yet.

Surely an agency like NSA could make such rules?!

There is no secure email. If you need to send a message securely, don't use email to do it. I agree with you.

Given the saber rattling going on between the US and Russia at the moment, it would seem to matter very much. Blaming the Russians gives them more room to deflect without acknowledging content of the leaks.

You're right, I'm sure they tested the message "but...but...the Russians".

I think HRC wins this easily, but these scandals won't just go away. There's enough meat in them to fuel 1-2 years of republican attacks. I fear she'll be the most ineffective President of my time.

Time will tell I suppose. Here's a fun one from today: https://i.redd.it/dxedkw7jwosx.png

is that real ?

yes: https://wikileaks.org/podesta-emails/emailid/23199

The fact that it's on wikileaks doesn't actually prove it's real. Russia has already been proven to have altered a few documents in a big document dump they did a while back (I actually forget the specifics of this one, but it was on HN fairly recently). And Bruce Schneier wrote an article about this very subject a month ago (https://www.schneier.com/blog/archives/2016/09/organizationa...).

Seems people are discovering DKIM.

Messages are hashed and signed by a private key in the exclusive possesion of the email system, such as gmail. The public keys are published in DNS. This allows anyone to verify the messages are unaltered using widely available tools. It seems this system may have been in place on one of the Exchange servers as well, though the integrity of that key is questionable.

Replying to the reply.

Yes, which is why I consider the keys for the Exchange server questionable, as there is no way to disprove intrusion into those systems.

My claim surrounds gmail.com and the set of emails that passed through gmail.com. I am not aware of an intrusion into Google's systems that would have obtained highly protected keys. This also limits the number of actors who could forge the complete collection of messages obtained from a gmail.com account.

(i.e. the only thing obtained was a password, not system level access.)

If the attachments are BASE64 encoded and part of the MIME source, they should also be protected by the DKIM signature.

As far as any documents obtained from blogspot, I have no assertion to make reguarding the integrity of those message contents. The use a specific cracked version of Office may explain the document summary information not matching the proclaimed nationality of the publisher of the documents on blogspot.

I object to the (sometimes deliberate) conflating of the multiple collections and sources and the attendant implied discrediting of all be ine.

This is a forum that I hope values technical explainations and inquiry, many forums have their own version of reality.

May the truth be known, whoever is damned or praised.

If you're talking about email specifically, and if the email server has DKIM, and if the keys are secure (if the hacker can break into the server to steal emails, are you sure they didn't steal the key too?), then yeah. But many document dumps include a lot of stuff that isn't just emails, and many email document dumps probably aren't fully covered by DKIM (I say probably because I haven't checked, nor am I really in a position to do so) or the DKIM key may not necessarily be secure (if the email server itself is hacked, it may not be; if the user login to the email was hacked, presumably it will be).

While technically true, Wikileaks hasn't lied yet in their history.

They used to say they had lots of people with the ability to protect sources back when they were just a few with no such ability. That's a nice start on integrity. Far as leaks, they posted a lot of them over time that people couldn't verify if they wanted to given lack of internal access. So, my claim on them wouldn't go as far as yours.

Define "lied". Wikileaks publishes material that other people give them. I'm not saying Wikileaks would alter documents, I'm saying the people giving the documents to Wikileaks would alter them, and then Wikileaks will do its job and publish them.

can you provide the link to reddit. it is hard to understand what the context is.

here's the link, largely just typical the_donald spam in comments that isn't terribly helpful haha.

https://www.reddit.com/r/The_Donald/comments/58j7jn/gentleme...

based on dates in the message, they're likely referring to the hearing on 10/22/15.

A more specfic resource is /r/DNCleaks and seems to be less overtly partisan or pro-candidate.

Why should this fuel just Republican attacks? The number of people that walked out of the DNC convention because of the rigging against Sanders shows there is far more trouble than just Republicans. The movement within the DNC that actually stands against government corruption will only grow stronger.

Not very important, but: as a lifelong Democrat (voting since about 1970), I have left the Democratic party over the DNC cheating. Fed. Up. In the past I have donated a ton of money to Democratic candidates, so I still get lots of calls; I politely explain each time why I am no longer a Democrat.

EDIT: some fundraising callers pretty much hang up on me in anger, but a lot are also sympathetic. Not hard evidence, but I have heard a convincing "I understand" often enough to think that a lot of rank and file Democrates are Fed. Up.

> I fear she'll be the most ineffective President of my time

One could hope ...