Welcome to DU! The truly grassroots left-of-center political community where regular people, not algorithms, drive the discussions and set the standards. Join the community: Create a free account Support DU (and get rid of ads!): Become a Star Member Latest Breaking News General Discussion The DU Lounge All Forums Issue Forums Culture Forums Alliance Forums Region Forums Support Forums Help & Search

OKNancy

(41,832 posts)
Thu Mar 3, 2016, 06:33 PM Mar 2016

Security Logs of Hillary Clinton’s Email Server Are Said to Show No Evidence of Hacking

Source: New York Times

WASHINGTON — A former aide to Hillary Clinton has turned over to the F.B.I. computer security logs from Mrs. Clinton’s private server, records that showed no evidence of foreign hacking, according to people close to a federal investigation into Mrs. Clinton’s emails.

The security logs bolster Mrs. Clinton’s assertion that her use of a personal email account to conduct State Department business while she was the secretary of state did not put American secrets into the hands of hackers or foreign governments. The former aide, Bryan Pagliano, began cooperating with federal agents last fall, according to interviews with a federal law enforcement official and others close to the case. Mr. Pagliano described how he set up the server in Mrs. Clinton’s home in Chappaqua, N.Y., and according to two of the people, he provided agents the security logs. The law enforcement official described the interview as routine. Most of those close to the case spoke on condition of anonymity because they were not authorized to discuss the continuing investigation.

Mrs. Clinton’s work-related emails as secretary of state, which have been made public as part of a Freedom of Information Act lawsuit, show that she received spam emails intended to try to lure her into clicking a malicious link. Those emails, known as “spear phishing” attempts, were traced to Russia, but it was not clear from the emails alone whether anyone clicked on those links or whether the security was compromised.

Mr. Pagliano told the agents that nothing in his security logs suggested that any intrusion occurred. Security logs keep track of, among other things, who accessed the network and when. They are not definitive, and forensic experts can sometimes spot sophisticated hacking that is not apparent in the logs, but computer security experts view logs as key documents when detecting hackers.

Mrs. Clinton’s campaign reiterated Mr. Pagliano’s information on Thursday. “We’re not aware of any evidence whatsoever that the server was hacked,” said Brian Fallon, a campaign spokesman.

--- the rest of the story is at the link above---

Read more: http://www.nytimes.com/2016/03/04/us/politics/security-logs-of-hillary-clintons-email-server-are-said-to-show-no-evidence-of-hacking.html?smid=tw-nytpolitics&smtyp=cur



I realize some people will be disappointed. LOL

The State Department was Hacked, but so far, no evidence that Hillary's private server was.
87 replies = new reply since forum marked as read
Highlight: NoneDon't highlight anything 5 newestHighlight 5 most recent replies
Security Logs of Hillary Clinton’s Email Server Are Said to Show No Evidence of Hacking (Original Post) OKNancy Mar 2016 OP
Good if true. morningfog Mar 2016 #1
The first thing a good hacker does nichomachus Mar 2016 #11
Thank you complain jane Mar 2016 #19
This^ Also... phazed0 Mar 2016 #26
sound disappointed it wasn't hacked n/t Justice Mar 2016 #43
What make you certain it wasn't bahrbearian Mar 2016 #62
That sound isn't "disappointment", it's "facts" you hear phazed0 Mar 2016 #71
Thanks still_one Mar 2016 #12
Any pops we hear represent BlueMTexpat Mar 2016 #2
Yup.. and I predict the FBI report will exonerate her too. OKNancy Mar 2016 #4
It likely won't take long. BlueMTexpat Mar 2016 #5
Maybe we could resurrect the Christmas Card List Conspiracy wryter2000 Mar 2016 #20
Such sad news for the GOP. SunSeeker Mar 2016 #3
Great news. Kingofalldems Mar 2016 #6
the state department email server on the other hand.... getagrip_already Mar 2016 #7
Oh, say it ain't so.......Go Hillary !!!! Trust Buster Mar 2016 #8
Yes, please -- just go. nt nichomachus Mar 2016 #13
George don't need your Wah Wah... LuvLoogie Mar 2016 #29
Yes rock Mar 2016 #37
I imagine some will believe this is a conspirisy still_one Mar 2016 #9
KNR Lucinda Mar 2016 #10
have they checked her voicemail services, thats what those 'news corpsR' 'hacked' back then. Sunlei Mar 2016 #14
Whether she was hacked or not is irrelevant. blackspade Mar 2016 #15
Message auto-removed Name removed Mar 2016 #31
Exactly. Note how many people did not pick up on that. harun Mar 2016 #86
Here's the thing.... retrowire Mar 2016 #16
^that^ elljay Mar 2016 #41
Message auto-removed Name removed Mar 2016 #17
Welcome to DU! MelissaB Mar 2016 #21
Message auto-removed Name removed Mar 2016 #23
Looks like she did the same thing as Powell and Rice. Kingofalldems Mar 2016 #24
Message auto-removed Name removed Mar 2016 #54
So you link an extremist right wing site? Kingofalldems Mar 2016 #65
Message auto-removed Name removed Mar 2016 #67
I'll be honest. I do not believe you for one second. Kingofalldems Mar 2016 #70
(I call bullshit...) LuvLoogie Mar 2016 #69
Glad you posted this here. nt complain jane Mar 2016 #18
This is great news but I thought the investigation was the @ the improprietary Arazi Mar 2016 #22
Part of the accusations by the anti Clintons is that Kingofalldems Mar 2016 #27
That *was* a big part of the argument. Agschmid Mar 2016 #33
if so she was incredibly lucky PaulaFarrell Mar 2016 #25
Not even by Sanders' staff? Hoyt Mar 2016 #28
Well they probably needed a full 45 minutes and only got half that. Kalidurga Mar 2016 #32
Smart woman... Mike Nelson Mar 2016 #30
That's helpful for her Trajan Mar 2016 #34
You Have To prove Intent videohead5 Mar 2016 #80
There are different systems for different levels of classification... TipTok Mar 2016 #84
?......With the US Government so heavily targeted all the time. Half-Century Man Mar 2016 #35
Btw ... So glad Bernie won OK Trajan Mar 2016 #36
So glad Hillary will win the nomination OKNancy Mar 2016 #42
Do you think posts like that further that goal? Jester Messiah Mar 2016 #47
I was responding to a snarky post OKNancy Mar 2016 #50
Really? I think my vote counts the same as yours. Jester Messiah Mar 2016 #51
You seem pretty sure Trajan Mar 2016 #74
" No Evidence of Hacking" is answering a question not asked. dchill Mar 2016 #38
Good news jpak Mar 2016 #39
Because Rafale Mar 2016 #40
Mishandling classified information is still a crime. n/t Jester Messiah Mar 2016 #44
but you forget--some of the emails were only classified RETROactivly. now you know. riversedge Mar 2016 #61
And yet, still a crime. n/t Jester Messiah Mar 2016 #64
Only in your bubble. bye riversedge Mar 2016 #66
Bizzare that some people would be happier w/ evidence of hacking Justice Mar 2016 #45
There are legions of the disappointed, here at DU. Paladin Mar 2016 #57
Yep. They are already scrambling. Kingofalldems Mar 2016 #72
Whew! lark Mar 2016 #46
Imagine a building with a card reader necessary to gain access to the front door... TipTok Mar 2016 #48
Message auto-removed Name removed Mar 2016 #49
As stated above... TipTok Mar 2016 #53
Message auto-removed Name removed Mar 2016 #56
That may an inaccurate word in the legal sense... TipTok Mar 2016 #58
I beleive he is saying that there are more accutrate ways to detect hacking. TriplD Mar 2016 #59
Did she or didn't she enter into a partnership with a Nigerian businessman rpannier Mar 2016 #52
Hillary fans who feel relief, ask yourselves: thereismore Mar 2016 #55
The Feds should hire this man!--pic riversedge Mar 2016 #60
Non-Scandal, dies. Saddening the 'Not Hillary' Party. nt onehandle Mar 2016 #63
Ohhhh NO,,, EMAILS,,,,, Oh the horror of it all!,,Drink! Cryptoad Mar 2016 #68
Believe it or not, I have not kept up with the subject. . Am I to understand all this is about a patricia92243 Mar 2016 #73
So "people close to the investigation" are talking? Color me skeptical. n/t winter is coming Mar 2016 #75
NBC says that story was planted in NYT by the campaign. grasswire Mar 2016 #76
And it was legal at the time for her to use a private email server. Agnosticsherbet Mar 2016 #77
Sooooo, her server was safer than the government's? Beacool Mar 2016 #78
Well Rafale Mar 2016 #79
Yes, they do it all the time leftynyc Mar 2016 #81
Let's just see how much money the GOP will spend MissMillie Mar 2016 #82
Yeah, but she Bcc'd Vladimir on every email, Darb Mar 2016 #83
Basically meaningless, IMO. Yo_Mama Mar 2016 #85
I'm in the software security industry, and this "report" is totally meaningless. Calista241 Mar 2016 #87

nichomachus

(12,754 posts)
11. The first thing a good hacker does
Thu Mar 3, 2016, 06:44 PM
Mar 2016

Is erase any record of his entry, exit, and activity from the security logs. For someone who knows what they're doing, it's not that hard to do. Many people who have been hacked have no idea that they have been.

The only time a good hacker will leave a trail is when he/she wants a quick in and quick out and doesn't care if the victim knows or not.

So the lack of evidence on security logs isn't the magic bullet that Mrs. Clinton's claque thinks it is.

 

phazed0

(745 posts)
26. This^ Also...
Thu Mar 3, 2016, 07:03 PM
Mar 2016

As an IT professional myself I write my own log entries and have full abilities to write (With corrected timestamps) or delete any logs I see fit. Secondly, anybody that thinks that log files "log everything" is sorely mistaken. Logs are only created for events that have programming to make an entry to the logs. Seeing as most attacks don't "login" in a traditional manner or require the use of "programmed" entry access - no log entry is ever created. MiTM attacks, IP and MAC spoofing, Meterpreter Shells - most of these wouldn't make a security log event.

The best place to start looking for past intrusions would be the networking logs of the ISP and/or the UTM Security Appliance they had in place - No mention of the things that would actually matter though.


For an IT pro, something smells fishy - or at the very least like BS (regardless of lawfulness).

EDIT:
I re-read the article and at the bottom they have:

"...show that she received spam emails intended to try to lure her into clicking a malicious link. Those emails, known as “spear phishing” attempts, were traced to Russia, but it was not clear from the emails alone whether anyone clicked on those links or whether the security was compromised."

It would appear to me that, because of the spam spear phishing emails, they had NO or very little protection in place other than the server itself. Any respectable mail service, UTM, or other filtering device would not have allowed these types of emails to be delivered. I use LogicNow and their Max Mail service for MSP's and they claim 1 false positive for every 100,000 messages... which seems to be true according to my over 300 managed business customers. Hard to believe there were respectable countermeasures installed.

 

phazed0

(745 posts)
71. That sound isn't "disappointment", it's "facts" you hear
Thu Mar 3, 2016, 08:40 PM
Mar 2016

It would be astonishing if the server was not compromised in one way or another.

Here's what we do know, that is not in dispute:

1. Emails sent to Clinton's private clintonemail.com address were first discovered in March 2013, when a hacker named "Guccifer" widely distributed emails sent to her from Sidney Blumenthal, obtained by illegally accessing Blumenthal's email account.


... and this, ladies and gentlemen is why we shouldn't have our own private email server setup by Justin Cooper(longtime aide to Clinton) in 2008, of which has no security clearance or expertise in computer security. Let's not get this twisted... this is a "friend doing a friend a favor"; this email server.

2. Marc Maiffret, a cybersecurity expert, said that the server had "amateur hour" vulnerabilities.

"That's total amateur hour," said Marc Maiffret, who has founded two cybersecurity companies. He said permitting remote-access connections directly over the Internet would be the result of someone choosing convenience over security or failing to understand the risks. "Real enterprise-class security, with teams dedicated to these things, would not do this," he said. http://www.dailyherald.com/article/20151013/business/310139975/


When Marc Maiffret speaks, if your in IT, you listen. He is a foremost expert in the field and I agree with his assessment fully. Opening up ports on your firewall and allowing remote access directly on the net is a 101 "duh" mistake. RDP (Microsoft Remote Desktop), which Clinton was using, is by far one of the most exploited vulnerabilities ever. Then exposing it directly to the net without anything.. no VPN or Proxy or anything is just plain stupid, bordering on negligence.


The U.S. National Institute of Standards and Technology, the federal government's guiding agency on computer technology, warned in 2008 that exposed server ports were security risks. It said remote-control programs should only be used in conjunction with encryption tunnels, such as secure VPN connections.

Also in 2012, the State Department had outlawed use of remote-access software for its technology officials to maintain unclassified servers without a waiver. It had banned all instances of remotely connecting to classified servers or servers located overseas.
The findings suggest Clinton's server "violates the most basic network-perimeter security tenets: Don't expose insecure services to the Internet," said Justin Harvey, the chief security officer for Fidelis Cybersecurity.

Mikko Hypponen, the chief research officer at F-Secure, a top global computer security firm, said it was unclear how Clinton's server was configured, but an out-of-the-box installation of remote desktop would have been vulnerable. Those risks - such as giving hackers a chance to run malicious software on her machine - were "clearly serious" and could have allowed snoops to deploy so-called back doors.


I guess once you get past how to use AOL it's time for the real world. Hillary is still in AOL land.

OKNancy

(41,832 posts)
4. Yup.. and I predict the FBI report will exonerate her too.
Thu Mar 3, 2016, 06:38 PM
Mar 2016

Then some people will have to find a different non-scandal.

wryter2000

(46,045 posts)
20. Maybe we could resurrect the Christmas Card List Conspiracy
Thu Mar 3, 2016, 06:53 PM
Mar 2016

A lot of fraudulent Santa stuff in there.

getagrip_already

(14,750 posts)
7. the state department email server on the other hand....
Thu Mar 3, 2016, 06:40 PM
Mar 2016

was hacked. they lost everything. woops.

Hillary kept better care of the data than the guvvies....

blackspade

(10,056 posts)
15. Whether she was hacked or not is irrelevant.
Thu Mar 3, 2016, 06:47 PM
Mar 2016

The classified documents and their handling are the potential issue.

Response to blackspade (Reply #15)

retrowire

(10,345 posts)
16. Here's the thing....
Thu Mar 3, 2016, 06:48 PM
Mar 2016

I'm relieved to hear it wasn't hacked.

But if it's your job not to put that stuff at risk, then you've still broken the rules. That's where I sit on it.

Response to OKNancy (Original post)

Response to MelissaB (Reply #21)

Response to Kingofalldems (Reply #24)

Kingofalldems

(38,456 posts)
65. So you link an extremist right wing site?
Thu Mar 3, 2016, 08:15 PM
Mar 2016

And according to your name you are a Socialist. Doesn't add up. Those people despise Socialists.

Response to Kingofalldems (Reply #65)

Arazi

(6,829 posts)
22. This is great news but I thought the investigation was the @ the improprietary
Thu Mar 3, 2016, 06:58 PM
Mar 2016

of having classified documents on her server and how they were handled

Kingofalldems

(38,456 posts)
27. Part of the accusations by the anti Clintons is that
Thu Mar 3, 2016, 07:03 PM
Mar 2016

secrets were obtained by foreign governments, at least to my understanding. Apparently that did NOT happen.

PaulaFarrell

(1,236 posts)
25. if so she was incredibly lucky
Thu Mar 3, 2016, 07:01 PM
Mar 2016

Even piddling little companies get multiple intrusion attempts every single day

 

Trajan

(19,089 posts)
34. That's helpful for her
Thu Mar 3, 2016, 07:09 PM
Mar 2016

But, it doesn't defend that lack of discipline with classified ... Whether some bad actor took advantage of her undisciplined behavior is a different question ..

She still stored classified on unprotected mail servers ... Bottom line ...

videohead5

(2,172 posts)
80. You Have To prove Intent
Fri Mar 4, 2016, 06:15 AM
Mar 2016

Since these e-mails was sent to her and she did not generate any of the e-mails in question you have to prove intent.that she purposely knew they were classified and that she purposely stored them on her server.there is also no difference between a .gov e-mail account and her server. neither one was secured for classified information.

 

TipTok

(2,474 posts)
84. There are different systems for different levels of classification...
Fri Mar 4, 2016, 12:15 PM
Mar 2016

... inside both the military and state.

One of the complaints against her is that she or her folks manually copied info from the secure system to her private one.

Even your basic green side / lowest level government e-mail has some protection.

Half-Century Man

(5,279 posts)
35. ?......With the US Government so heavily targeted all the time.
Thu Mar 3, 2016, 07:10 PM
Mar 2016

Nobody found links or data paths to her unprotected server or either one of it's cloud backups?

Really?



Pagliano wiped the server and the FBI recovered everything. In the forensic analysis of the server, did the FBI find evidence of intrusion?
Pagliano might not be the best witness available.

 

Jester Messiah

(4,711 posts)
47. Do you think posts like that further that goal?
Thu Mar 3, 2016, 07:27 PM
Mar 2016

Because I can tell you, I'd rather stick a fork in my eye than give you Hillarites the satisfaction.

OKNancy

(41,832 posts)
50. I was responding to a snarky post
Thu Mar 3, 2016, 07:39 PM
Mar 2016

If you don't vote for the Democrat in the general, then I really don't care what you think.
You are not someone whose opinion matters.

 

Jester Messiah

(4,711 posts)
51. Really? I think my vote counts the same as yours.
Thu Mar 3, 2016, 07:40 PM
Mar 2016

So yes, my opinion matters, to the extent that anyone's does who isn't wielding PAC money.

 

Trajan

(19,089 posts)
74. You seem pretty sure
Thu Mar 3, 2016, 09:02 PM
Mar 2016

I want everybody to be happy ... Usually ...

In this case, however, I'm expecting a groundswell of support for Bernie ... Looking at the long range forecasts (like those here >http://www.democraticunderground.com/12511395124#post2 ), Hillary is only leading in 4 of those states ...

The South was her firewall?

The North is her demise ...

I haven't ignored you because, on the whole, you are not offensive ...

You will note that I never debased you or your character ... That fact that you present my disagreement as 'snarkiness' .. Well, you chose that description, not I ...

dchill

(38,489 posts)
38. " No Evidence of Hacking" is answering a question not asked.
Thu Mar 3, 2016, 07:11 PM
Mar 2016

It's whether the contents of the home server are legal.

Rafale

(291 posts)
40. Because
Thu Mar 3, 2016, 07:13 PM
Mar 2016

It was easier to do a man-in-the-middle cyber attack.

Go ahead; shoot the messenger 'cause that will change the facts.

Justice

(7,188 posts)
45. Bizzare that some people would be happier w/ evidence of hacking
Thu Mar 3, 2016, 07:27 PM
Mar 2016

The "disappointment" with the postive news speaks volumes about where people's minds are.

lark

(23,099 posts)
46. Whew!
Thu Mar 3, 2016, 07:27 PM
Mar 2016

This whole thing just irritates the crap out of me. Seems there are 2 sets of laws in this country, one for the rich Repugs and one for everyone else. Colin Powell did the same thing she did, crickets, Cheney and Bush were found to have secret email servers hooked to CIA, they destroyed the evidence, again crickets. HRC, thinking everyone else does it, went there and she's being portrayed as a betrayer to our country, emails almost certainly hacked, on and on ad nauseum. So glad the emails weren't hacked and hope the rest proves to be just as big a fishing expedition as Benghazi.

She isn't my choice for president, but I still hate to see this happening.

 

TipTok

(2,474 posts)
48. Imagine a building with a card reader necessary to gain access to the front door...
Thu Mar 3, 2016, 07:32 PM
Mar 2016

This same building has windows, a loading bay and sewer entrances. The computer that logs entry through the front door is in the corner and once you are in the building you have free access to it.

The fact that the card reader doesn't show illegal entry doesn't mean that someone didn't come in through the alternate entrances or didn't delete their swipe from the log computer.

In short, this means nothing. Neither positive or negative... Null...

Response to TipTok (Reply #48)

 

TipTok

(2,474 posts)
53. As stated above...
Thu Mar 3, 2016, 07:41 PM
Mar 2016

It depends on the skill and intent of the intruder.

Systems can be more secure. Imagine if the logging computer was in its own room with a lock and a password.

It can still be defeated but it's harder.

The system that Clinton set up appears to be closer to the former than the latter.

In any case, the hacking issue is secondary. This is the equivalent of printing out classified information, putting it in a folder and leaving it on a bench in a shady part of town.

The fact that you came back later and found it doesn't mitigate the gross negligence of putting it out there in first place.

Response to TipTok (Reply #53)

 

TipTok

(2,474 posts)
58. That may an inaccurate word in the legal sense...
Thu Mar 3, 2016, 07:46 PM
Mar 2016

It's actually a criminal act since the intent was to defeat the safeguards in place on the approved government systems.

TriplD

(176 posts)
59. I beleive he is saying that there are more accutrate ways to detect hacking.
Thu Mar 3, 2016, 07:50 PM
Mar 2016

as the article says:

They are not definitive, and forensic experts can sometimes spot sophisticated hacking that is not apparent in the logs


rpannier

(24,329 posts)
52. Did she or didn't she enter into a partnership with a Nigerian businessman
Thu Mar 3, 2016, 07:40 PM
Mar 2016

or the lawyer of some deceased (insert country here) businessman, businesswoman or politico who remembers her as a fine Christian woman whom they trusted implicitly and wishes to enter a business partnership where she deposits X-millions for him/her and receives a percentage


No attack on Ms Clinton. It was just the first thing I thought of when I saw the part of the phishing scam
I used to get those. I read a few. I always laughed when it said they remembered me as a fine Christian. A 'fine' Christian is not likely the thing most people remember about me from a short meeting, whether it be yesterday or years ago

thereismore

(13,326 posts)
55. Hillary fans who feel relief, ask yourselves:
Thu Mar 3, 2016, 07:41 PM
Mar 2016

Are you relieved because state secrets (hopefully) did not get hacked, or are you relieved because your candidate got lucky?

Your heart will tell you.

patricia92243

(12,595 posts)
73. Believe it or not, I have not kept up with the subject. . Am I to understand all this is about a
Thu Mar 3, 2016, 08:59 PM
Mar 2016

server she had in her home - I thought it was in her office at work - which I admit would not be such a good idea.

But in her home where I assume she didn't get that many serious emails - unless she worked from home a lot more than most people do. Somehow that it was at her home makes it seem like it is much ado about nothing.

Knowing that it is the Republicans behind it all makes it doubly seem much ado about nothing.

Agnosticsherbet

(11,619 posts)
77. And it was legal at the time for her to use a private email server.
Thu Mar 3, 2016, 09:15 PM
Mar 2016

Using a private email server was legal at the time, and it was not hacked.

Rafale

(291 posts)
79. Well
Fri Mar 4, 2016, 02:38 AM
Mar 2016

Does the Justice Dept offer people immunity from prosecution when there's no crime? It's okay. In a few months there will be an indictment of someone.

 

leftynyc

(26,060 posts)
81. Yes, they do it all the time
Fri Mar 4, 2016, 06:39 AM
Mar 2016

in order to get people testify. Any lawyer worth his/her money is going to insist they don't talk without immunity - just like an innocent person should NEVER talks to cops without a lawyer present - you have no idea how they will manipulate what you say to try and get you in trouble. This is basic good sense.

MissMillie

(38,556 posts)
82. Let's just see how much money the GOP will spend
Fri Mar 4, 2016, 07:04 AM
Mar 2016

investigating this a dozen times....

Benghazi? Planned Parenthood?

I say, three strikes and you're out.

If you have 3 investigations w/ nothing out of it.... then from now on the cost of any further investigation has to come out of your own pocket (or that of your super PAC, I suppose).

Yo_Mama

(8,303 posts)
85. Basically meaningless, IMO.
Fri Mar 4, 2016, 01:22 PM
Mar 2016

Security logs are helpful, but only that. There are ways to access data without leaving traces in logs, and if a hacker is good enough, the log can just be "corrected".

We don't know what was being logged. Were accesses to documents being logged? I suspect not.

Calista241

(5,586 posts)
87. I'm in the software security industry, and this "report" is totally meaningless.
Fri Mar 4, 2016, 06:49 PM
Mar 2016

Any logs files would only have recorded the most unsophisticated and incompetent script kiddie attacks. A government agency that wanted into the server would have left no tracks, and would totally have owned the server.

Latest Discussions»Latest Breaking News»Security Logs of Hillary ...