Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Did the Clinton Email Server Have an Internet-Based Printer?

krebsonsecurity.com

Post reply on HN
Print view View original

11–20 of 259 posts

Re: Did the Clinton Email Server Have an Internet-Based Printer?

#11

Post by Jerry2 »

Here's some more details about the state of security of her private server [0]:

>Outlook Web Access, or OWA, was running on port 80 without SSL (unencrypted)

>Remote Desktop Protocol, port 3389, was exposed through the DMZ (open to anyone on the internet.) This, at the time it was being used, was open to critical vulnerabilities that would allow for remote execution of code.

>VNC Remote Desktop, port 5900, was also exposed through the DMZ.

>SSL VPN used a self-signed certificate. This isn't inherently bad, but left them open for "spearphishing" attacks, which have already been confirmed to be received by Hillary Clinton and her staff

It's also interesting how they responded to attacks on the server [1]:

>Here is the section from page 41 of the report which references an “attack”:

> On January 9, 2011, the non-Departmental advisor to President Clinton who provided technical support to the Clinton email system notified the Secretary’s Deputy Chief of Staff for Operations that he had to shut down the server because he believed “someone was trying to hack us and while they did not get in i didnt [sic] want to let them have the chance to.” Later that day, the advisor again wrote to the Deputy Chief of Staff for Operations, “We were attacked again so I shut [the server] down for a few min.” On January 10, the Deputy Chief of Staff for Operations emailed the Chief of Staff and the Deputy Chief of Staff for Planning and instructed them not to email the Secretary “anything sensitive” and stated that she could “explain more in person.”

[0] https://np.reddit.com/r/politics/comments/4j2r94/judicial_wa...

[1] http://lawnewz.com/high-profile/clinton-tech-says-private-em...

Re: Did the Clinton Email Server Have an Internet-Based Printer?

#12

Post by ZenoArrow »

drakefire wrote: post #3

This story just keeps getting better. There is either a grand nefarious plot, or worse, horrific incompetence. I just can't find a third possibility.

Depends if you class lobbying as a grand nefarious plot or not. I suspect there's likely to be financial reasons for the private email server in this case.

Re: Did the Clinton Email Server Have an Internet-Based Printer?

#13

Post by zaroth »

The emails themselves sent from Clinton's server were unencrypted for several months, so unencrypted printing is just more of the same.

There's no reasonable question anymore that laws on handling classified data were broken, the only question is will charges actually be brought?

Re: Did the Clinton Email Server Have an Internet-Based Printer?

#14

Post by Kluny »

gizmo wrote: post #8
drakefire wrote: post #3

This story just keeps getting better. There is either a grand nefarious plot, or worse, horrific incompetence. I just can't find a third possibility.

No nefarious plot. My understanding is that it went roughly like this. Back in 2009 Clinton requested a secure smartphone from the NSA. It's a custom made device (security by obscurity?). Anyway, the president gets one. As the secretary of state she has to travel a lot, and not being able to do email on the road is highly impractical. So she thought she should get one too. The NSA denied her request for a secure smar…

That's the most believable version I've heard so far by a long shot.

Re: Did the Clinton Email Server Have an Internet-Based Printer?

#15

Post by mergy »

Other very serious concerns:

1. Was it running RAID? If so, what level? Better not be RAID 5. Horrible write speed.

2. Let's REALLY dig into the DNS. What about reverse lookups and CNAMEs.

3. Any idea what the screensaver was? I'll reserve judgement until I have some confirmation.

4. NIC driver version: Hearing that she just ran a generic MS driver for the Intel dual network card. Unbelievable.

Re: Did the Clinton Email Server Have an Internet-Based Printer?

#17

Post by extrapickles »

moyix wrote: post #9
ghostly_s wrote: post #5

Does this really indicate any private correspondence was printed via the internet? Even if a printer was set up which _was_ writable via this web address, that doesn't mean that emails from the email server itself were printed to that address rather than directly to the device, does it? In fact, presumably the printer and email were hosted on the same server so it doesn't make much sense to me that they would send on…

It seems like it would be strange to give a printer a DNS name if you didn't intend to talk to it over the internet. If you're directly connected it doesn't need an IP at all. I think the sniffing threat mentioned is overblown. As one of the commenters mentions, ISPs don't generally allow adjacent IPs to sniff traffic. A bigger threat is that a vulnerability in the printer may have been exploited. E.g., for a long ti…

Printer firmware and drivers are the worst. I've integrated with a software package that supplies its own printer drivers because the manufactures can't make a driver that will actually work well.

They constantly screw up the most basic of things. A good test of a network printer is to set it offline, send 20 print jobs to it (a test page is fine), then set it back online. Way too many printers will not print out all 20 print jobs, despite reporting success for all of them (This is true even of $30k printers).

Re: Did the Clinton Email Server Have an Internet-Based Printer?

#18

Post by blhack »

gizmo wrote: post #8
drakefire wrote: post #3

This story just keeps getting better. There is either a grand nefarious plot, or worse, horrific incompetence. I just can't find a third possibility.

No nefarious plot. My understanding is that it went roughly like this. Back in 2009 Clinton requested a secure smartphone from the NSA. It's a custom made device (security by obscurity?). Anyway, the president gets one. As the secretary of state she has to travel a lot, and not being able to do email on the road is highly impractical. So she thought she should get one too. The NSA denied her request for a secure smar…

Do you have any sources for that?

The story I keep hearing is that she had this set up to make FOIA requests more difficult/impossible to fulfil.

The really out there stuff is that this was to hide any cash-for-favors exchanges that happened with relation to The Clinton Foundation.

Re: Did the Clinton Email Server Have an Internet-Based Printer?

#19

Post by engi_nerd »

gizmo wrote: post #8
drakefire wrote: post #3

This story just keeps getting better. There is either a grand nefarious plot, or worse, horrific incompetence. I just can't find a third possibility.

No nefarious plot. My understanding is that it went roughly like this. Back in 2009 Clinton requested a secure smartphone from the NSA. It's a custom made device (security by obscurity?). Anyway, the president gets one. As the secretary of state she has to travel a lot, and not being able to do email on the road is highly impractical. So she thought she should get one too. The NSA denied her request for a secure smar…

And those slipups should open her to prosecution under the Espionage Act.

A number of security professionals (I mean security in the government, Information Assurance sense) have told me that if they or I were to do anything like what Secretary Clinton did, we would be liable to be prosecuted.

Re: Did the Clinton Email Server Have an Internet-Based Printer?

#20

Post by drakefire »

gizmo wrote: post #8
drakefire wrote: post #3

This story just keeps getting better. There is either a grand nefarious plot, or worse, horrific incompetence. I just can't find a third possibility.

No nefarious plot. My understanding is that it went roughly like this. Back in 2009 Clinton requested a secure smartphone from the NSA. It's a custom made device (security by obscurity?). Anyway, the president gets one. As the secretary of state she has to travel a lot, and not being able to do email on the road is highly impractical. So she thought she should get one too. The NSA denied her request for a secure smar…

I just don't believe that Hillary Clinton could not get an email account on a government email server and that somehow having exchange at her house with no controls was the last option she had. I can't think of a scenario where a server at her house is better than almost any other option.
Post reply on HN