It was even less secure than previously thought.
This is my shocked face.
As someone noted on Twitter, this is the equivalent of leaving a new Mercedes out on the street with the key taped to the outside of the windshield.
18 thoughts on “Hillary’s Server”
Comments are closed.
Previous reports were that the server (like the State Department’s official email system) had been hacked. This report is that the private server was running software that made it vulnerable to being hacked. The story seems to be moving backwards.
It only seems that way to people utterly ignorant of computer security.
I’m guessing Baghdad Jim’s knowledge of computer security is on a par with his knowledge of economics. Or the truth, for that matter.
You would think that the hackers would leave a thank you note, wouldn’t you?
/sarc
They really should have, in this case as Clinton made it so damnably easy for them.
Jim said;
“Previous reports were that the server (like the State Department’s official email system) had been hacked. This report is that the private server was running software that made it vulnerable to being hacked. The story seems to be moving backwards.”
Jim, you’re cherry-picking, because only a few around the ‘net said the server WAS hacked. The overwhelming majority said it was vulnerable and thus probably had been. Now, we find out it was far more vulnerable than thought. The story is moving backwards, all right, but only from Hillary’s POV, because it just gets worse and worse.
She was in charge, Jim. She set this up, and then allowed classified info to exist on it. Amongst other things, that’s a felony. I can cite at least some of the relevant federal statutes if you like (she violated quite a few, so I doubt I could list them all).
I think cherry-picking is too kind. Jim actually seems fairly ignorant and has no problem displaying his ignorance. Blumenthal’s email was hacked. That hack showed that Hillary was receiving guidance on how to handle Libya from her old pal that Obama forbid from working in his Administration. It also gave further grounds for Judicial Watch FOIA requests, because if Sidney could be made privy to State Department memos, then every American had a right to see those memos as well.
I was one of the people claiming she had been hacked but I was wrong, it was Blumenthal that had been hacked. But it was through Blumenthal’s hacked emails that we learned that Hillary didn’t turn over all of her emails as she claimed and that she altered some of the ones she did turn over.
Enh, the people who matter, Democrats, don’t care about the security angle. They generally don’t care about our national security and are always advocating for weakening it. The people who think of Snowden and Manning as being national heros are not going to get worked up about Hillary’s poor security. They might even become more enamored of her if state secrets were hacked and released to the public.
Look at OPM, Democrats are silent about the largest breach of national security in our history. They don’t care.
This is really a general election issue and not a primary one in terms of what audience will find this issue important.
I BEG your pardon! We on the extreme left definitely care about breaches of security. When Valerie Plame was mentioned as being a CIA employee in print (after her husband had done it in public for years), we demanded that someone’s life be destroyed. And so Scooter Libby, who had nothing to do with it, had his life destroyed. We can do that, you right-wing bastards!
From the second paragraph alone I can tell that whoever set up the email server knew practically squat about running a secure server. Easy remote administration was favored over keeping intruders out.
@ PeterH,
I’m pretty much incompetent when it comes to network issues, security included, and I don’t have much to protect, but even I make darn sure that my router can only have its command interface accessed via a hardwired connection, plus a hard password. Same with my alarm system; I disabled its ability to be commanded from anywhere but the keypad in the house, and it’s a hardwired system, not wireless.
Remote administration of a server? Even I know that’s a very, very bad idea, and I sure as heck don’t know enough to set one up.
Bear in mind that the Clinton Administration CIA director was prosecuted for having not-marked-as-classified classified data on a laptop in his home, a laptop that was *not* connected to the internet.
I wonder if incompetence can be used as a legal defense in this case? I don’t mean simple incompetence, but the legal kind in criminal matters; the inability to understand the nature of a trial (such as due to very low IQ, brain damage, mental illness). In these cases defendant is usually institutionalized until such time as he/she regains sanity and can be tried. I think Hillary qualifies.
Well… remote administration of a server, as a general concept, can be a very useful tool. These days ISPs, for example, run enormous server farms in which there may be a thousand “blade server” boxes racked up in a single room. Finding the specific one that’s having problems and physically connecting a keyboard and monitor to it can be difficult and labor-intensive.
But there is a right way and a wrong way to do it, and the easy way, using manufacturer’s default settings and default passwords, is very much the wrong way, at least if you are trying to protect Important Stuff.
The rule of thumb in the classified world is: if it’s connected to the internet, it is known to the enemy. Period.
What we don’t know is what is known to the enemy, because the b***h [1]erased all of her e-mail.
[“bitch”]
I feel like I’m beating a dead horse. I’ve run Microsoft mail servers, they leak like sieves. If it were me, I would use a no-services Linux-based firewall to create a DMZ zone, then use a Linux-based mail server (Postfix and Dovecot) that is firewalled to a fare thee well. The point is to present as small an attack surface to the Internet as you can, with multiple layers of defense. No outside SSH or POP3, for example. If you want to do remote administration or mail access, use a nice VPN to a dedicated VPN-equipped Linux box in the DMZ, then sidle over to the mail server from there. Ne’er-do-wells can’t pick what they can’t reach. Oh, did I mention severely restricting the IP addresses that can have packets forwarded into the DMZ? Blocking EVERYTHING except those subnets you actually use keeps the majority of black hats away — the source IP address is good for this. If you are the Secretary of State for the USA, you will need another server to act as a cut-out, one that, like the firewall, has no Internet-facing services of its own, other than the software to do the bouncing.
Anyone care to make any bets on what the server’s administrative password was?
Given the competency displayed this far, I have a hunch it was either “password” or “1234”.
Still, could be worse,
You’re assuming it was configured to require a password and not say “Hello, sailor!” to the first person to telnet in.
Yes, there is equipment out there, and also operating systems out there, that by default are THAT wide-open.