Slashdot is powered by your submissions, so send in your scoop

 



Forgot your password?
typodupeerror
Government Privacy Security Politics IT

Gizmodo Went Phishing With the Trump Team -- Will They Catch a Charge? (arstechnica.com) 122

Earlier this month, technology publication Gizmodo published a report on how it "phished" members of the administration and campaign teams of President Donald Trump. The blog said it identified 15 prominent figures on Trump's team and sent e-mails to each posing as friends, family members, or associates containing a faked Google Docs link. But did the publication inadvertently break the law? ArsTechnica reports: "This was a test of how public officials in an administration whose president has been highly critical of the security failures of the DNC stand up to the sort of techniques that hackers use to penetrate networks," said John Cook, executive editor of Gizmodo's Special Projects Desk, in an e-mail conversation with Ars. Gizmodo targeted some marquee names connected to the Trump administration, including Newt Gingrich, Peter Thiel, (now-ex) FBI director James Comey, FCC chairman Ajit Pai, White House press secretary Sean Spicer, presidential advisor Sebastian Gorka, and the administration's chief policymakers for cybersecurity. The test didn't appear to prove much. Gingrich and Comey responded to the e-mail questioning its provenance. And while about half of the targeted officials may have clicked the link -- eight devices' IP addresses were recorded accessing the linked test page -- none entered their login credentials. The test could not determine whose devices clicked on the link. What the test did manage to do is raise the eyebrows of security experts and some legal experts. That's because despite their efforts to make it "reasonably" apparent that this was a test, Gizmodo's phishing campaign may have violated several laws, ignoring many of the restrictions usually placed on similar tests by penetration-testing and security firms. At a minimum, Gizmodo danced along the edges of the Computer Fraud and Abuse Act (CFAA).
This discussion has been archived. No new comments can be posted.

Gizmodo Went Phishing With the Trump Team -- Will They Catch a Charge?

Comments Filter:
  • by SensitiveMale ( 155605 ) on Monday May 15, 2017 @11:05AM (#54419141)

    So I'm guessing that Gizmodo is now Russian.

    • by sycodon ( 149926 ) on Monday May 15, 2017 @11:18AM (#54419273)

      I hope the Secret Service finds some law with which to hang these fuckers.

      How is this not different than putting a fake gun in your carry on to "test" security?

      • by Nidi62 ( 1525137 )

        How is this not different than putting a fake gun in your carry on to "test" security?

        Gizmodo actually got caught?

      • by chihowa ( 366380 )

        It looks like the laws used to prosecute phishing at the federal level [justice.gov] are:

        18 U.S.C. 1029 (access device fraud)
        18 U.S.C. 1028 (fraud in connection with identification documents and authentication features)
        18 U.S.C. 1028A (aggravated identity theft)
        18 U.S.C. 1343 (wire fraud)
        18 U.S.C. 1030(a)(4) (accessing a computer to defraud and obtain something of value)
        18 U.S.C. 1001 (making false statements in any matter within the jurisdiction of the government)

        There are a number of state laws [ncsl.org] that handle it, to

  • But yes, these guys went too far.

    • by Shatrat ( 855151 ) on Monday May 15, 2017 @12:37PM (#54419873)

      It was also pretty juvenile and myopic if they think that Comey and Gingrich are part of 'Trump's team'. Comey was investigating his Russian ties and Gingrich is calling for Comey to testify publicly about his firing. I think this is another example of people conflating everyone they don't like as being somehow magically the same person.

      • Comey was investigating his Russian ties and Gingrich is calling for Comey to testify publicly about his firing.

        I think that you will find that is fake news.

        According to this article [go.com], Comey has declined to testify in private, but has indicated his willingness to testify in public. It's not clear if he has been officially invited to do so.

      • I'll give you Comey, but Gingrich is certainly part of "Trump's team". He worked as a consultant [thedailybeast.com] for Trump's campaign, was considered as a VP candidate for Trump and just had his (3rd) wife appointed to an ambassadorship by Trump. Since she has no diplomatic experience, one would assume it is political compensation to Newt. If that's not on Trump's team I don't know what is.

        It makes a lot of sense for them to align, after all they both created a Contract with America (Newt's [wikipedia.org]) (Donald's [donaldjtrump.com]) on which they bot

  • Inadvertently? (Score:5, Insightful)

    by aardvarkjoe ( 156801 ) on Monday May 15, 2017 @11:26AM (#54419347)

    But did the publication inadvertently break the law?

    Maybe they didn't think the consequences through, but I find it hard to believe that nobody involved realized that this sort of thing is illegal.

    • The claim this is illegal is too conclusory at this point. I am sure a lot of lawyers were consulted, and I'm sure we'll hear from more in the future. However, even TFA points out the relative illegality is debatable based on a lot of different factors. And the article also points out the government is likely disinclined to pursue a media outlet, and for good reason: as this activity was for the purposes of investigative journalism the 1st Amendment (which supersedes the CFAA) may provide additional protect
    • It's something to do with hurting Trump.

      EVERYTHING is justifiable in a tight-enough echo chamber.

    • by Ichijo ( 607641 )

      I find it hard to believe that nobody involved realized that this sort of thing is illegal.

      If mimicking the look and feel of an authentic Google sign-in page is a copyright violation, then Google will come after them.

      Or was some other illegal act committed?

      • by chihowa ( 366380 )

        Are you claiming that phishing isn't illegal?

        On a federal level it seems to be prosecuted mostly under wire fraud and identity theft laws, but there are other laws that also apply. There are also various state laws that deal with it. Here is a little information on the state laws that apply. [ncsl.org] Here is a Justice Dept discussion of federal computer crimes that mentions phishing. [justice.gov]

        The law mostly used to prosecute phishing seems to be 18 U.S.C. 1029(e)(1). "Penalties for violations of section 1029 range from a max

        • by Ichijo ( 607641 )

          The page was not set up to actually record or retain the text of their passwords, just to register who had attempted to submit login information.

          If the page was incapable of storing passwords, was it phishing?

          • by chihowa ( 366380 )

            Beats me; I'm not a lawyer. That distinction sounds like a matter for the courts, as well as the matter of proving that the page was incapable of storing passwords. If you look at some of those laws I linked to, even attempts at solicitation of credentials are listed as offenses, so your competence at carrying out the crime might not be all that important.

  • by xxxJonBoyxxx ( 565205 ) on Monday May 15, 2017 @11:27AM (#54419361)
    As opposed to the candidate whose official site allowed people to phish their friends?
    http://cybertical.com/clinton-phishing.html
  • by Glock9mm ( 4961835 ) on Monday May 15, 2017 @11:38AM (#54419439)
    First they go after Hulk Hogan's genitals, now they're phishing Trump? Do they realize how stupid and illegal that is? The entire Gizmag/Gizmodo/Jezebel syndicate is a load of politically sponsored crap.
  • by onyxruby ( 118189 ) <onyxrubyNO@SPAMcomcast.net> on Monday May 15, 2017 @11:39AM (#54419449)

    They didn't dance along the edge of legality. They danced over and never looked back. Legitimate pen test services are painfully aware of this and have the paperwork to prove it.

    Ars should have enough sense to check things out for the sake of their own credibility. If Ars Technica bothered to ask anybody who's ever worked in the security industry they would have quickly learned the indemnification is taken very seriously.

    http://www.isaca.org/chapters3... [isaca.org]
    https://pen-testing.sans.org/b... [sans.org]

    Hell, even metasploit has been talked about this for years!
    https://dev.metasploit.com/pip... [metasploit.com]

    The only people fooled by Gizmodo's phishing logic were the editors who signed off on this to begin with. Next time ask a pro before you publish, it will help you avoid looking the fool.

  • Didn't Prove Much? (Score:4, Insightful)

    by 31415926535897 ( 702314 ) on Monday May 15, 2017 @11:45AM (#54419491) Journal

    Makes it sound "inconclusive"--that's not a great way of putting it. The test was a success from the perspective of the administration and a failure on the part of Gizmodo. Gizmodo surely wanted to prove that Trump's administration is as inept as the DNC, and it's clear that nobody fell for it.

    I don't really care that Gizmodo did the test, though it seems like they were pretty dumb to go for it without checking on the legality first, but they should be punished in the court of public opinion for failing at a blatantly partisan attack.

    • by Anonymous Coward

      Yeah, this just seems ridiculous. Even if they want to claim clicking the link is bad, they can't even prove it was the recipient that clicked the link. Some of them may have forwarded the email to one of their IT staff who opened the link in a sandbox.

      If no one entered their login details then no one got phished.

    • It's partisan to test someones claims that they are better at security?

      Questioning someones claimed capabilities is not Partisan. Under your definition everything is partisan. You are the problem.

      • Sure, you jump to dumb conclusions and I'm the problem.

        I literally said that I didn't care that they did the test, but that's the first thing you attack in response. It's partisan because if Hillary had won, Gizmodo would not have conducted this "test".

        When I smell partisan BS, I'm going to call it out. Reds and Blues being at each other's throats is not going to solve anything in this country.

        PS You're pretty naive if you don't see the bias and partisanship in this and most of the world. I wouldn't go so f

  • instead of Gizmodo clicking on a link would likely have compromised the target's machine. There's been indication that Russia compromised the RNC in the same way it got into the DNC, they just didn't publish the results because they wanted to asymmetrically influence the election. This just re-enforces that had the Russians wanted to they could have gotten through.

    What's mildly surprising is that after everyone knew the DNC was hacked and that it was by way of phishing still a lot of these key players s

  • Why doesn't he just set up his own independent email server that's totally against departmental rules and traffic classified information through it? Then the media would excuse anything he ever did and the FBI would leave him alone completely!

  • False Positives?? (Score:5, Informative)

    by xanthos ( 73578 ) <xanthos AT toke DOT com> on Monday May 15, 2017 @12:51PM (#54419979)
    Just because the email was opened, doesn't mean it was done intentionally by an actual human being.

    It can be difficult to distinguish between a human being opening an email and a malware scanning engine opening a email. Modern systems will actually follow links and run executables in sandboxes before releasing the actual email to the end user. What looks like someone opening the email, usually a callback via a pixel image or js include, doesn't involve a human actually opening the email. In fact, just using a preview pane can make it seem like the email has been opened.

    Sorry to be a kill joy, but this phishing test proved absolutely nothing.
    • Re: (Score:3, Insightful)

      Sorry to be a kill joy, but this phishing test proved absolutely nothing.

      Now now...don't be cruel to the children. They wanted to have their little tantrum/party and if you tell them it was a complete failure they'll just cry, scream, call you racist/sexist/homophobic/xenophobic, demand a safe space, and petition to have you fired so they can prove they're more tolerant than you.

    • It can be difficult to distinguish between a human being opening an email and a malware scanning engine opening a email. Modern systems will actually follow links and run executables in sandboxes before releasing the actual email to the end user. What looks like someone opening the email, usually a callback via a pixel image or js include, doesn't involve a human actually opening the email. In fact, just using a preview pane can make it seem like the email has been opened.

      [citation needed]

  • This is what happens when you let your SJW predilections override and interfere with doing journalism. The frothing desire to embarrass members of Trump's administration completely bypassed the normal "is this a good idea?" discussion that should have stopped this ill-conceived venture before it ever started. But it's also totally unsurprising. Gizmodo's not-very-slow descent into left-wing rant rag began a while back. It's clear they have no interest in attempting even the pretense of objectivity anymo

Going the speed of light is bad for your age.

Working...