Julian Assange's Claim About John Podesta Email Hack Taken Apart In Detailed Twitter Thread

Given all the evidence, it's incredibly unlikely.
Julian Assange was interviewed on Fox News this week
Julian Assange was interviewed on Fox News this week
Fox News

WikiLeaks founder Julian Assange’s claim that a 14-year-old could have hacked the email account of Hillary Clinton’s campaign chairman has inspired a thorough explanation of why that almost certainly didn’t happen.

Assange said the accessing of John Podesta’s emails was due to an obvious choice of password during an interview with Fox News at the Ecuadorian embassy in London.

He told presenter Sean Hannity: “A 14-year-old kid could have hacked Podesta that way.”

John Podesta, Clinton's campaign chairman, using his smartphone in June 2015
John Podesta, Clinton's campaign chairman, using his smartphone in June 2015
The Washington Post via Getty Images

And President-Elect Donald Trump later tweeted: “Julian Assange said ‘a 14-year-old could have hacked Podesta’ - why was [Democratic National Committee] so careless? Also said Russians did not give him the info!”

However Matt Tait, a information security researcher who posts under the Twitter name Pwn All The Things, has issued a new analysis to prove Assange’s claim false.

Tait tweeted: “Could [a 14-year-old] have? Sure. Did hack? No. Let me go through why not.”

This is a reconstruction of that phishing email. (All of the information is bogus - the mention of Ukraine isn't relevant here). pic.twitter.com/EvFhdYfZaI

— Pwn All The Things (@pwnallthethings) January 4, 2017

You can't tell just by looking, but that "Change Password" link doesn't take you to Google. It takes you to Bit.ly. pic.twitter.com/e6Rm71YTfG

— Pwn All The Things (@pwnallthethings) January 4, 2017

This link expands to a fake login page (note URL is for a .tk site). This is what Podesta saw when he accidentally gave creds to hackers. pic.twitter.com/3Cc8KxvjNf

— Pwn All The Things (@pwnallthethings) January 4, 2017

But the hackers screwed up. The hackers weren't hacking one-by-one; so URL contraction wasn't done manually. It was done via the Bitly API.

— Pwn All The Things (@pwnallthethings) January 4, 2017

Using the Bitly API requires you create an account. So the hackers had to create an account. And they forgot to make their account private.

— Pwn All The Things (@pwnallthethings) January 4, 2017

It's no longer possible - the hackers have changed their settings - but before you could simple enumerate ALL of the contracted links.

— Pwn All The Things (@pwnallthethings) January 4, 2017

The Bitly link in John Podesta's email is visible in the Wikileaks dump here https://t.co/H6ACVvnOXH pic.twitter.com/PNEN96Cfq3

— Pwn All The Things (@pwnallthethings) January 4, 2017

We can ask Bitly to expand it. This is what it says https://t.co/Qo9ZkkFGP0 pic.twitter.com/uEvg25shJA

— Pwn All The Things (@pwnallthethings) January 4, 2017

Those gobble-de-gook strings aren't encrypted. They're Base64 encoded. In this case, it tells us the link was for john.podesta@gmail.com pic.twitter.com/ebLWQndneO

— Pwn All The Things (@pwnallthethings) January 4, 2017

Why did the hackers include this info? Same reason they contracted links via API. Because they're not hacking 1-by-1. Are hacking at scale.

— Pwn All The Things (@pwnallthethings) January 4, 2017

This information lets their attack server populate fields to look more authentic (it's why it's able to pre-fill Podesta's name and picture)

— Pwn All The Things (@pwnallthethings) January 4, 2017

But it also means this opsec screw up is bad. Bc we can see the links contracted by the account, we can see all of the spearphishing URLs

— Pwn All The Things (@pwnallthethings) January 4, 2017

And the spearphishing URLs tells us the accounts that were targeted.

— Pwn All The Things (@pwnallthethings) January 4, 2017

How many accounts did this "14 year old" hack? About 1800. In 2015.

— Pwn All The Things (@pwnallthethings) January 4, 2017

Who were these accounts? Mil, govt personnel in the West, defence cos, journos critical of govt in Russia etc pic.twitter.com/NyZEkWLncf

— Pwn All The Things (@pwnallthethings) January 4, 2017

Here's a pie chart of some of the accounts the 14 year old hacker hacked outside of Russian sphere of influence pic.twitter.com/AzdtL0Umbt

— Pwn All The Things (@pwnallthethings) January 4, 2017

This 14 year old is apparently an avid reader, given how many authors they're hacking. What are their interests? Another pie chart. pic.twitter.com/TKSXePJViJ

— Pwn All The Things (@pwnallthethings) January 4, 2017

And which countries is our friendly 14 year old hacker interested in? These ones. Remember. This is 1800 gmail accounts *in 2015 alone*. pic.twitter.com/TZ2B2p6bw9

— Pwn All The Things (@pwnallthethings) January 4, 2017

Is it possible this was all a 14 year old? Sure. Also possible I'm a bridge salesman, and boy have I got a great deal for you today.

— Pwn All The Things (@pwnallthethings) January 4, 2017

When hackers hack at scale, they reuse infrastructure. They make mistakes. This isn't unusual. You can piece the bits together.

— Pwn All The Things (@pwnallthethings) January 4, 2017

And this isn't even the DNC hack. It's just the Podesta one. And it's only one of many different strands in just the public attribution case

— Pwn All The Things (@pwnallthethings) January 4, 2017

Note: Tait uses graphs from Secure Works.

Assange’s interview was used by Trump to again cast doubt on US intelligence officials’ conclusion that Russia was behind hacks during the presidential election that boosted his candidacy.

Assange denied Russia was the source of a hack on the Democratic National Committee despite the FBI and Department of Homeland Security having released an extensive report last week, detailing evidence that Russia was in fact behind the attacks.

Answering criticism for his repeating of Assange’s claim, Trump tweeted on Thursday: “The dishonest media likes saying that I am in Agreement with Julian Assange - wrong.

“I simply state what he states, it is for the people to make up their own minds as to the truth.

“The media lies to make it look like I am against “Intelligence” when in fact I am a big fan!”

Close

What's Hot