Hacker News new | ask | show | jobs
by dsukhin 1681 days ago
The email domain where the messages originate is from some sort of federated identity management system that was created in 2010 (here is a proposal deck [0] with technical details). Found this program simply by searching Google for the sending domain.

Based on the guide for using this system [1] (see step 15) looks like this specific email address is the one that sends automated confirmation emails upon registration. Perhaps someone was able to inject a message instead of the regular canned text through some sort of reflection attack? This explains why replies to the message result in a canned response. The system also now appears to be temporarily down. So it’s getting some sort of attention (internally taken down (most likely) or maybe denial of service from the abuse).

The Reddit thread suggests the recipients’ emails are likely ARIN IP range contacts. Those are very available from tools like this [2] so nothing interesting with that, but the real question is WHY someone would do this at all? This was clearly given some thought (on who to send this to who would actually take the time to verify the headers) but given the sloppiness of everything else, is this just a script kiddie flex? Whoever it is pissed off the FBI and gained absolutely nothing.

[0] https://bja.ojp.gov/sites/g/files/xyckuh186/files/media/docu...

[1] https://www.justice.gov/tribal/page/file/1260671/download

[2] http://itools.com/tool/arin-whois-domain-search

5 comments

Awesome. A guide written in 2019 from the FBI that suggests Internet Explorer.
I would assume they're recommending Edge now. We switched from IE to Edge around that time; and our company is very security conscious because of our clients.
I would assume you're wrong. I don't think you appreciate how many government websites run ancient software sold to them by a politician's cousin, who thinks even having a developer on staff is a waste of money.
They also run ancient shit that was promoted internally. Not to mention how many sites/tools are outsourced to vendors who then outsource development to foreign development vendors.

To clarify, this is concerning from a security standpoint and is not out of xenophobic bigotry.

"Life is too short to depend on unstable software"

https://news.ycombinator.com/item?id=29209353

Yep, as late as earlier this year there's a ton of stuff inside the DHS that still requires IE and flash.
What’s wrong with internet explorer? It’s still in active support.
It's actively supported by a company who themselves recommend against it and described its use as technical debt (in 2019)

https://techcommunity.microsoft.com/t5/windows-it-pro-blog/t...

They didn’t say not to use IE, just to restrict IE’s use to specific applications where it’s needed. The FBI has technical debt too!
I think the problem is that you have to clarify it's still in active support
So you’re against LTS releases I suppose?
2001 called - either you're with us or you're against us.
Depends which one you use, how many years out of security updates is your openssh package...?
What site is this?, wow
You must be trolling
"Enter your official business email address...Do not use hyphens or dashes in the social security number (SSN#) and Date of Birth fields....Enter your employer’s information in the “Employer” fields"

Oh, fun. Connected to a treasure trove of LEO personal info.

> The Reddit thread suggests the recipients’ emails are likely ARIN IP range contacts.

It's likely multiple different sources. I just noticed I got it as well on my personal email (which has custom domain) and I don't own any IP ranges.

Yeah, I got it to two accounts I use with ARIN, as well as another that is confusing me.

That one is not very old, I know I have the entire outbound history for it, and have not used it for ARIN or anything similar.

The twitter link[0] posted in another thread appears to show a copy of the attacker's email. It looks like the attacker sent the email in a bid to lay down psychological cover fire in order to get sysadmins to work with an attacker who would identify themselves as "TheDarkOverlord".

[0] https://twitter.com/spamhaus/status/1459452609979371520/phot...

It could be the Russians trying to make the FBI look incompetent and make people trust the government less.
The Russians would likely try to exploit such an e-mail to gain something more tangible or if their goal was to make the FBI look inept they would send the message to a much wider audience.
Done and done.