How did alleged hackers get access to the email account of John Podesta, the chair of the Hillary Clinton campaign? Apparently he just gave them his password.
This is according to a leading cybersecurity firm, which says Podesta fell for a simple phishing scam frequently used in spam mail.
A researcher at the company SecureWorks told Motherboard that Podesta was sent an email on March 19 that appeared to have come from Google. In the email was a link using Bitly, a URL shortening service. Podesta clicked on this link, which took him to a fake Google page, where he then typed in his login information.
According to the cybersecurity firm, this is how the email account of former secretary of state Colin Powell was also hacked.
The alleged hackers appear to later have sent Podesta's emails to the whistleblowing journalism organization WikiLeaks, which has published them this month in installments. WikiLeaks says it has 50,000 messages to and from Podesta, and has published roughly 2,000 per day.
Revealed in the emails have been excerpts of Clinton's paid speeches to Wall Street, evidence of collusion between the Clinton campaign and prominent journalists, strategies the Clinton campaign used to undermine Sanders, examples of the close ties between the Clinton Foundation and the U.S. government and more.
The Clinton campaign immediately blamed the alleged hack of Podesta's email account on the Russian government. The Clinton campaign also previously blamed the alleged hack of the Democratic National Committee on Russia, claiming it was part of an elaborate conspiracy by President Vladimir Putin to sway the U.S. election in favor of Donald Trump — although campaign officials admitted they did not have any evidence.
The leaked DNC emails showed how the Democratic Party leadership, which is bound by its own rules to be impartial, undermined the campaign of Bernie Sanders, helping Hillary Clinton clinch the nomination. Four top DNC officials resigned in response to pressure after the leak.
In early October, the Obama administration took the accusations a step further. The Department of Homeland Security released a statement officially blaming the Russian government. The brief, three-paragraph statement did not cite any solid evidence, however. It was also full of ambiguous language — noting that the U.S. intelligence community "is confident," and that the hacks "are consistent with" methods used by Russia.
Most major media outlets have echoed these accusations, but the U.S. government has yet to provide any solid proof. When asked what substantiation the U.S. government has, White House spokesperson Josh Earnest insisted that "much of the evidence is not something that we can discuss publicly," forcing the public to take the government's claims on faith.
The Russian government has denied meddling in the U.S. election.
Many news reports blaming the Russian government are eerily reminiscent of those published about Saddam Hussein's supposed "weapons of mass destruction" in the lead-up to the 2003 invasion of Iraq. U.S. officials who are quoted are frequently kept anonymous, and no specific evidence is presented.
The cybersecurity firm SecureWorks said the alleged hacking method used to obtain access to Podesta's email account is a method the Russian hacker group Fancy Bear has used in previous campaigns.
“The Google-spoofing domain in the Motherboard article is one we observed used by Fancy Bear,” a SecureWorks researcher told Politico.
Researchers have accused Fancy Bar of having ties to Russian intelligence services, although, again, evidence has been sparse.
Motherboard noted, "None of this new data constitutes a smoking gun that can clearly frame Russia as the culprit behind the almost unprecedented hacking campaign that has hit the DNC and several other targets somewhat connected to the US presidential election."
Shares