Did the Clinton Email Server Have an Internet-Based Printer?
krebsonsecurity.com
Did the Clinton Email Server Have an Internet-Based Printer?
1–10 of 259 posts
Re: Did the Clinton Email Server Have an Internet-Based Printer?
#2Am I the only one who dislikes the domain name itself? Every time I see it, I read it as "Clint One Mail", not "Clinton Email".
Re: Did the Clinton Email Server Have an Internet-Based Printer?
#3This story just keeps getting better. There is either a grand nefarious plot, or worse, horrific incompetence. I just can't find a third possibility.
Re: Did the Clinton Email Server Have an Internet-Based Printer?
#4This story just keeps getting better. There is either a grand nefarious plot, or worse, horrific incompetence. I just can't find a third possibility.
"Many journalists have fallen for the conspiracy theory of government. I do assure you that they would produce more accurate work if they adhered to the cock-up theory." -Bernard Ingham
Re: Did the Clinton Email Server Have an Internet-Based Printer?
#5Does this really indicate any private correspondence was printed via the internet? Even if a printer was set up which _was_ writable via this web address, that doesn't mean that emails from the email server itself were printed to that address rather than directly to the device, does it? In fact, presumably the printer and email were hosted on the same server so it doesn't make much sense to me that they would send one to the other via the web address.
Re: Did the Clinton Email Server Have an Internet-Based Printer?
#6This story just keeps getting better. There is either a grand nefarious plot, or worse, horrific incompetence. I just can't find a third possibility.
Obvious throwaway account for obvious reasons. I worked at a well known international "activism" type organization. If our data practices ever came to light, the organization wouldn't exist anymore. I promise.
Never underestimate the incompetence even by the largest of organizations.
Re: Did the Clinton Email Server Have an Internet-Based Printer?
#7This story just keeps getting better. There is either a grand nefarious plot, or worse, horrific incompetence. I just can't find a third possibility.
"Many journalists have fallen for the conspiracy theory of government. I do assure you that they would produce more accurate work if they adhered to the cock-up theory." -Bernard Ingham
Seems similar to Hanlon's Razor:
Re: Did the Clinton Email Server Have an Internet-Based Printer?
#8This story just keeps getting better. There is either a grand nefarious plot, or worse, horrific incompetence. I just can't find a third possibility.
No nefarious plot. My understanding is that it went roughly like this. Back in 2009 Clinton requested a secure smartphone from the NSA. It's a custom made device (security by obscurity?). Anyway, the president gets one. As the secretary of state she has to travel a lot, and not being able to do email on the road is highly impractical. So she thought she should get one too.
The NSA denied her request for a secure smartphone and gave her some nonsense excuse. She tried a few more times to get one, and then Clinton gave up and ordered somebody to set her up with a private email server. She used this unsecure email server for years. She used it to communicate with top level officials (including the president). That she had this server was common knowledge in the administration. She knew it wasn't secure and she's been very careful not to discuss any classified information over email at all. In a handful of cases she slipped up and some classified information ended up on email anyway.
Re: Did the Clinton Email Server Have an Internet-Based Printer?
#9Does this really indicate any private correspondence was printed via the internet? Even if a printer was set up which _was_ writable via this web address, that doesn't mean that emails from the email server itself were printed to that address rather than directly to the device, does it? In fact, presumably the printer and email were hosted on the same server so it doesn't make much sense to me that they would send on…
It seems like it would be strange to give a printer a DNS name if you didn't intend to talk to it over the internet. If you're directly connected it doesn't need an IP at all.
I think the sniffing threat mentioned is overblown. As one of the commenters mentions, ISPs don't generally allow adjacent IPs to sniff traffic.
A bigger threat is that a vulnerability in the printer may have been exploited. E.g., for a long time most HP printers could have their firmware upgraded by sending them a print job. And so far the cursory look I've taken at various printer firmware has been really alarming – think thousands of calls to strcpy/memcpy and other unsafe friends.
Edit: Here's a reference for firmware upgrade via print job: http://www.internetsociety.org/sites/default/files/03_4_0.pd...
Edit2: Also, when I say "firmware upgrade" I mean arbitrary code – it wasn't verifying a digital signature or anything.
Re: Did the Clinton Email Server Have an Internet-Based Printer?
#10Does this really indicate any private correspondence was printed via the internet? Even if a printer was set up which _was_ writable via this web address, that doesn't mean that emails from the email server itself were printed to that address rather than directly to the device, does it? In fact, presumably the printer and email were hosted on the same server so it doesn't make much sense to me that they would send on…
Just the idea that this configuration may have existed is a red flag for me on what other configuration choices may have been made.