Podesta’s leaked emails
The story isn’t as simple as some folks lay it out.
So.. you got me looking at the Phishing details…
CBS actually did a nice piece on the phishing email, which I’ll summarize:
Sara Latham, Podesta’s chief of staff, contacted Chrales Delevan at the HFA help desk with an email ‘apparently’ from Gmail indicating the Gmail id had been attempted to be accessed from Ukraine, and a password update was needed.
Sadly, Delevan indicated that the email was legitimate, and the password should be changed. While Delevan did supply the proper place to go to do this, Podesta used the original email Delevan indicated was legitimate and got ‘spear-phished’.
So was Podesta a complete idiot for ‘giving away’ the password? I’d have to say ‘no’, he was giving bad advice, which was followed a bit ‘too closely,’ and the original email was treated as legitmate and the provided link used. Unfortunate, but not particularly Podesta fault. One trusts the security expert.
Later Delevant will indicate it was ‘just a typo’, he ‘meant’ to type ‘illegitimate.’ I find the statement an over simplification. The fact is, if the email from gmail support was ‘illegitimate’, then the likely hood the password was actually compromised was somewhere between low to nil. I say at best Delevant was trying to ‘save face.’ This is what he -should- have written: -alternative cast:
This is an illegitimate email. Do NOT follow any links in it, nor forward the email to anyone else. While it is unlikely John’s password was compromised, it would be wise for him to change his password promptly and it is critical to ensure that two-factor authentication is turned on for his account.
When updating the password and enabling two-factor authentication, it is critical the link https://myaccount.google.com/security is used for both. It is absolutely imperative this is done ASAP.
— — end casting.
If Delevant were particularly far sighted, he might have further suggested the false gmail be moved to a particular folder, an investigation launched, and the email deleted after the investigators had what they needed but… there’s so many spear-phish attempts these days, it is hard to get worked up over one in particular. Bear in mind, if Podesta had just been clearly ‘warned away’ from the original email, none of this compromise would likely have occurred.
That this was likely a deliberate attack against Podesta makes this all the worse. While it is easy to blame the victim when he falls for a con, in this case, I’m not entirely sure we should throw Podesta under the bus for this one.