Hoax Email Blast Abused Poor Coding in FBI Website
Summary: The FBI confirmed that its fbi.gov domain and Internet address were used to send tens of thousands of fake emails on the evening of Nov. 12 ET, warning about nonexistent cyberattacks. A person claiming responsibility as Pompompurin said the messages were sent by abusing insecure code in the FBI's Law Enforcement Enterprise Portal (LEEP), where the one-time confirmation passcode was generated client-side and leaked in the page's HTML, and a POST request's subject and body parameters could be edited to send arbitrary mail from eims@ic.fbi.gov.
Why it matters: The FBI's own update called it a software misconfiguration in LEEP, the infrastructure it uses to communicate with state and local law enforcement partners, and the hoax was aimed at smearing researcher Vinny Troia over a long-running feud with the RaidForums hacking community. If a portal trusted to reach law enforcement partners can be turned into a megaphone for tens of thousands of forged messages, the sender address in your inbox is only as trustworthy as the weakest form handler behind it.
Read the original at Krebs on Security ↗
- Topics
- Cybercrime & Law Enforcement
- Related
- Gootloader Malware Disrupted After Infecting 25,000 Computers Cyber Risks · Nov 13, 2026354 dark web vendors and buyers arrested in Operation Tor Nado Cyber Risks · Nov 13, 2026Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure Cyber Risks · Nov 13, 2026