MyDD :: A Follow-up on the Lieberman Hacking Lie

A Follow-up on the Lieberman Hacking Lie

by Matt Stoller, Tue Aug 08, 2006 at 03:40:44 PM EST

Update: Now the Lamont campaign's blog has linked to a cache (which means an older copy) of the Lieberman website. So apparently the Lieberman campaign can put statements up on their supposedly hacked site, but didn't link to the cache of their site. And the Lieberman camp still hasn't accepted the Lamont campaign's offer to help them with their technical glitch. This stinks.

More on this: It looks like this could be simple incompetence on the Lieberman campaign's part. They aren't apparently running a load-balancer or a firewall. In case you're wondering, Dan Geary is the web genius at Dewey Square who is in charge of hosting Joe2006.com. I've written about Dewey Square before. Now aside from corporate lobbying and campaign work, they are Beltway screw-up artists extraordinaire, apparently. Someone from Dewey Square confirmed to me that Geary doesn't work for them and never has. My apologies.

Even more: Paul Kiel's coverage gets even worse. Just pathetic.

Here's an email from a technical contact. If you are a reporter working on this story, read this or consult the technical reporter at your paper. Bottom line, it shouldn't have taken the Lieberman camp more than an hour to fix this.

1. Unless and until Lieberman's hosting provider releases his logfiles (gateway router, www server, mail server, DNS server) for forensic review, all of this is speculation.

2. Using the following information:
a. the site has been down for 18 hours
b. email to (and from?) Joe2006.com addresses has been affected
c. Joe2006.com and mail.joe2006.com resolve to IP 69.56.129.130
d. the reverse lookup on that IP is 82.81.3845.static.theplanet.com
e. joe2006.com now forwards to http://server1.myhostcamp.com/
suspended.page/

3. It's highly unlikely this is a true DoS of DDoS attack. This is because we can ping all the IPs noted above and we can see the page at http://server1.myhostcamp.com/suspended. page. If this was a real DoS or DDoS attack, we'd not be able to see any of this and their servers would not be answering their ping at an average of 50ms (millisecond) per packet. True attacks bring down servers, routers and networks. From all available outside evidence this does not appear to be the case.

4. Here what might have happened:
a. Web traffic spikes as national focus on the campaign grows
b. Based on (2b) above, if the webserver is throttled by traffic (due to actual traffic or poor response tuning or an attack or a combination of the three), this would also affect mail delivery to joe2006.com. It could also affect outbound mail if users on that domain use that address for SMTP service.
c. The server is most likely a shared one, since the name, server1.myhostcamp.com, implies lots of other hosts live on it.

5. Regardless of the explanation (3 or 4), here is what you do when that happens:
a. You grab your local backup (you do have a local backup of your files (both scripts and database snapshots, right?).
b. You find a host that specialized in high bandwidth hosting and you get an account going ASAP. There are plenty of ISPs that would take your money to expedite this.
c. You move your files up, test that everything is working
d. You redirect your DNS so that Joe2006.com points to you new
server; this change doesn't take very long to propagate because you make sure that the DNS update uses a very low TTL (time to live).
e. If needed, you separate your mailserver mail.joe2006.com from
your webserver joe2006.com/www.joe2006.com so as to keep your mail up and going.
Steps a-e can be accomplished, especially with the kind of site Joe had up and running before this incident (nothing particularly
complex), in less than an hour or so by a competent sysadmin.

Tags: Ned Lamont, Joe Lieberman, CT-Sen, Connecticut (all tags)

Permalink :: 49 Comments :: Post a Comment

Re: A Follow-up on the Lieberman Hacking Lie (none / 0)

Seems like Joe's tech people are just plain incompetent, and his media connected people saw that they could turn a disaster into assault figuring most main stream media would be incapabale of actually researching enough to determine the truth before the polls closed.

Good Catch Matt!

Chalk another small victory to the internet overmind.

by smacfarl on Tue Aug 08, 2006 at 03:13:24 PM EST

Re: A Follow-up on the Lieberman Hacking Lie (none / 0)

The lazy-ass media is not going to bother with that, Matt.

I saw Tim Tagaris' statement on the alleged hack. It's just about exactly what I said the Lamont campaign should have done.

The problem is, it's on the campaign blog and nobody who's not already a die-hard, web-savvy Lamont supporter's going to see it.

Ned Lamont, or his most high profile campaign staffer should directly address the media.

Treating this is no big deal won't work. The media is already treating it like a big deal. And the Lamont campaign must get a soundbite out there that the TV media can use to pair with the Lieberman campaign's accusations.

This is campaogn 101 stuff! And, you;d thnk that afetr all those blog posts moaning and groaning about the incompetent Washington Consultants on this and otrher sitres, that actual blogger/consultants wouldn't be so goddamn stupid as to fall into the exact same trap.

by Hesiod Theogeny on Tue Aug 08, 2006 at 03:13:25 PM EST

Re: A Follow-up on the Lieberman Hacking Lie (none / 0)

For the record, the last incident of hacking that I know of was criticized by the same blogs backing Lamont. Why does Lamont want to cut off the debate online, Lamont is right. It is the Lieberman people who fear knowledge (why else would they hire a campaign manager whose claim to fame is "low information voters" -- assuming the people are stoopid).

This is total B.S. and anyone who is working for Lieberman in this race should never be hired again by a Democratic campaign.

Bob Brigham Blog

by Bob Brigham on Tue Aug 08, 2006 at 03:15:45 PM EST

Re: A Follow-up on the Lieberman Hacking Lie (none / 0)

All this shows a hokey attempt at a campaign dirty trick.

What is a notable observation about this election is the tremendous fear that the MSM and their punditocracy that the control over public opinion might be slipping from their grasp. They correctly sense a threat that the netroots offers a democratization of the political process and the flow of communication. This election could be the beginning of the end for the corporate monopoly on politics and political activity. The consultants hate it, the pundits hate it, the coporate media hacks hate it. Rock on!!

by cmpnwtr on Tue Aug 08, 2006 at 03:16:33 PM EST

Re: A Follow-up on the Lieberman Hacking Lie (none / 0)

It's a dirty trick that';s working because:

A) The Media people who are covering the election are tech-idiots and pro-Joe

B) The Laont Campaign has Tim Tagaris responding to this high profile attack on the Lamont Weblog, rather than Ned Lamont issuing a prepared statement in front of a Camera somwhere.

It's like watching the incompetent Kerry campaign all over again.

by Hesiod Theogeny on Tue Aug 08, 2006 at 03:20:00 PM EST
[ Parent ]

Re: A Follow-up on the Lieberman Hacking Lie (none / 0)

Can anyone who's up there in CT in the field offices get someone to make a statement like that?

Blogging politics and life in general at jimmy.bouma-holtrop.com

by forecaster15 on Tue Aug 08, 2006 at 03:22:57 PM EST
[ Parent ]

Re: A Follow-up on the Lieberman Hacking Lie (none / 0)

Whoever's running the media operation is an idiot. They thnk downplaying this will make it go away. But Lieberman is hyping this like crazy. It's all over the free media.

Anything other than an indignant denial, and snarky comeback by Lamont is not going to cut it.

by Hesiod Theogeny on Tue Aug 08, 2006 at 03:26:14 PM EST
[ Parent ]

Re: A Follow-up on the Lieberman Hacking Lie (none / 0)

Yes, please! Maybe it would stop them from going to generic (R) and (D) talking heads asking about dirty tricks. Well, maybe not, but at least there'd be SOMETHING other than that on the news.

by bythepeople on Tue Aug 08, 2006 at 03:28:55 PM EST
[ Parent ]

Re: A Follow-up on the Lieberman Hacking Lie (none / 0)

So the media's problem is that they don't know what is going on and Lamont's problem is that somebody who knows what is going on is explaining it?

Dude, calling Lamont like Kerry (when Lamont has been all over this from within a couple of hours) is the craziest thing you've said since you tried to lie to the entire netroots about the swiftboating of Paul Hackett.

Bob Brigham Blog

by Bob Brigham on Tue Aug 08, 2006 at 03:25:16 PM EST
[ Parent ]

Re: A Follow-up on the Lieberman Hacking Lie (none / 0)

You guys like losing don't you? Just admit it.

And, for the record, Hackett realized he was being an ass and wholeheartedly endorsed Sherrod Brown and supports him.

Maybe you dumbasses should figure that out?

Tim is doing the right ting, but posting it on Lamont's weblog is not going to help in the IMMEDIATE media battle.

by Hesiod Theogeny on Tue Aug 08, 2006 at 03:28:42 PM EST
[ Parent ]

Re: A Follow-up on the Lieberman Hacking Lie (none / 0)

Tim is doing the right ting, but posting it on Lamont's weblog is not going to help in the IMMEDIATE media battle.

You flunked logic, if campaign websites don't matter then why is this an issue?

The Lamont campaign isn't the problem, the problem is the media. Instead of bitching about one of the best Democratic campaigns ever, why don't you get off your ass and call the press?

Bob Brigham Blog

by Bob Brigham on Tue Aug 08, 2006 at 03:32:07 PM EST
[ Parent ]

Re: A Follow-up on the Lieberman Hacking Lie (none / 0)

if campaign websites don't matter then why is this an issue?

Because the Lieberman campaign held a PRESS CONFERENCE attended by a swarm of TV and print reporters who are now hammering the Lamonmt campaign wioth this bullshit meme.

God you are an idiot.

by Hesiod Theogeny on Tue Aug 08, 2006 at 03:36:53 PM EST
[ Parent ]

Re: A Follow-up on the Lieberman Hacking Lie (none / 0)

you act as if lamont can wave a hand and change the dynamics of the media. everything you say about the meai is true,a nd there is not a damn thing we can do about someone not listening if they dont want to listen

by bruh21 on Tue Aug 08, 2006 at 04:00:37 PM EST
[ Parent ]

Re: A Follow-up on the Lieberman Hacking Lie (none / 0)

You mewn Lamont his his "scurrilous charge" comment?

Oh fer christ sake, you people are hopeless.

I'm surprised he didn't say it was "mendacious" and "dastardly" as well.

Why not just say Joe is LYING?

by Hesiod Theogeny on Tue Aug 08, 2006 at 03:33:53 PM EST
[ Parent ]

Re: A Follow-up on the Lieberman Hacking Lie (none / 0)

I'm sure everything would be better if you were in charge. Especially the comments about lying -- since it is something you know all about.

Bob Brigham Blog

by Bob Brigham on Tue Aug 08, 2006 at 03:36:53 PM EST
[ Parent ]

Re: A Follow-up on the Lieberman Hacking Lie (none / 0)

Yup.

I'd actually win campaigns if I were in charge.

And to paraphrase Winston Churchill:

"In [Politics], truth is so precious that she should always be attended by a bodyguard of lies."

by Hesiod Theogeny on Tue Aug 08, 2006 at 03:41:01 PM EST
[ Parent ]

Re: A Follow-up on the Lieberman Hacking Lie (none / 0)

Appears to be a nearly-transparent attempt at an excuse for Lieberman to further justify running as an Independent.

Doubt Lamont or Lieberman had anything to do with this, though: it reeks of the disingenuous drivel we've come to expect from the WH and so called intel operatives.

No expert, but it does seem that election day would be one of the least important days for a candidate's website--haven't most folks made up their minds by now..

by muircoast on Tue Aug 08, 2006 at 03:18:22 PM EST

Re: A Follow-up on the Lieberman Hacking Lie (none / 0)

great reporting thanks.

by mbair on Tue Aug 08, 2006 at 03:21:07 PM EST

Re: A Follow-up on the Lieberman Hacking Lie (none / 0)

I agree that the Lieberman folks appear to be milking this so that, when Joementum loses, they can blame it on the internet terrorists.

But I'm not convinced that they aren't just taking advantage of a genuine attack rather than creating one all their own.

I believe this if for no other reason that it has been reported that they have complained to the U.S. Attorney's office. Now, maybe the reporting is wrong, but it would take a special kind of stupid to file a false report with a U.S. Attorney. I'm not sure how many of Joe's cocktail party consultants want to throw themselves on a grenade for the next Secretary of the Defense.

by space on Tue Aug 08, 2006 at 03:29:37 PM EST

Re: A Follow-up on the Lieberman Hacking Lie (none / 0)

Perhaps, but there could have been a very minor genuine attack followed by them allowing their site to be down for 18 hours. They really don't seem to have put any effort into fixing things, so it seems like they believe having the "hacking" story in the news helps them more than actually having a website does.

DC Drinking Liberally • DC for Democracy

by KCinDC on Tue Aug 08, 2006 at 03:45:36 PM EST
[ Parent ]

Re: A Follow-up on the Lieberman Hacking Lie (none / 0)

Someone better explain to the Lieberman tech people that the internet is not something you just dump something onto. It's not a big truck. It's a series of tubes!

by who threw da cat on Tue Aug 08, 2006 at 03:30:28 PM EST

Re: A Follow-up on the Lieberman Hacking Lie (none / 0)

Never forget, it's all about the message. To people on the street who can't or won't get access to this site, the message stands. Netroots people are the perceived attackers of Lieberman so the best way to twofer Lieberman's victim stance is to point the finger at the internet. The Sen. Stevens'like definition of the hacked site merely makes it all obvious. But never forget, they got the message out, they timed it and they exploited it. This is the future of the netroots' participation in campaigns. One important lesson here is to get to the bottom of what happened, good or bad, right or wrong, and have the netroots shout the truth out from every keyboard.

by mainsailset on Tue Aug 08, 2006 at 03:31:45 PM EST

First they pull their GOTV (none / 0)

and then they extend their "the bloggers bit us" narrative into election day.

Looks like they're spinning their failure.

Once this hits the right blogsphere, it will be Lieberman and the Republicans on one side attacking the Democrats on the other.

In other words, nothing changes.
.

by Grand Moff Texan on Tue Aug 08, 2006 at 03:32:08 PM EST

Re: First they pull their GOTV (none / 0)

They are trying to cement tehir support for the general election. By making Joe's voters angry at Lamont for "screwing" Joe.

They are also trying to generate as much nmegative saturation free media bombing of Lamont as possible before the polls close to sway just a few more votes.

by Hesiod Theogeny on Tue Aug 08, 2006 at 03:35:29 PM EST
[ Parent ]

Re: First they pull their GOTV (none / 0)

I couldn't agree more, but would add that look at the amount of attention that our side is devoting to this issue. Is it possible that it is just there to slow down the GOTV effort on our side with a "technical" distraction?

by davewolfusa on Tue Aug 08, 2006 at 03:52:01 PM EST
[ Parent ]

Re: First they pull their GOTV (none / 0)

The thought had occurred to me that this was designed to throw chaff in the blopgs' faces.

But, to be honest, It's more likely a desperate campaign stunt to try and sway last minute votes.

by Hesiod Theogeny on Tue Aug 08, 2006 at 03:57:27 PM EST
[ Parent ]

Re: A Follow-up on the Lieberman Hacking Lie (none / 0)

Stoller -- you're off base a bit here. Dan Geary does not work at or for DSG; he's a contractor. Check out their website. Its a CA-based company that does a lot of work for the Clark County Democratic party in NV and for a wide range of NV candidates, including Dina Titus who is running in a hotly-contested Democratic primary here in NV next week, and

by desmoulins on Tue Aug 08, 2006 at 03:39:17 PM EST

Re: A Follow-up on the Lieberman Hacking Lie (none / 0)

Then why would Dewey give him his own e-mail address?

by Hesiod Theogeny on Tue Aug 08, 2006 at 03:49:10 PM EST
[ Parent ]

I have one for my contract jobs (none / 0)

For the client's convenience, often they will set up an internal email address.

Before you win, you have to fight. Come fight along with us at TexasKaos.

by boadicea on Tue Aug 08, 2006 at 06:21:32 PM EST
[ Parent ]

One Friends of Joe web site still works (none / 0)

One point that I think isn't getting enough attention: Joe Lieberman still has a working web site on the exact same server as Joe2006.com. MeetNed.com, the Lieberman's campaign anti-Lamont web site, is up and running without any problems. It's at the same IP address as Joe2006.com. This makes it seem unlikely that the server is actually having any serious problems.

by bobkopp on Tue Aug 08, 2006 at 03:43:02 PM EST

Re: A Follow-up on the Lieberman Hacking Lie (none / 0)

Loved the technical breakdown.

Go Ned!

by justadood on Tue Aug 08, 2006 at 03:54:36 PM EST

Re: A Follow-up on the Lieberman Hacking Lie (none / 0)

Kos nailed it:

They are paying $15/month for hosting at a place called MyHostCamp, with a bandwidth limit of 10GB. MyHostCamp is currently down, along with all their clients.

by beedee on Tue Aug 08, 2006 at 03:57:57 PM EST

Re: A Follow-up on the Lieberman Hacking Lie (none / 0)

And now they have updated their DNS to point to:

NS3.SECURESERVER.NET 64.202.165.10
NS4.SECURESERVER.NET 68.178.211.105

Which is GoDaddy. I bet he went with the $3.99 a month hosting package that really idles your cpu usage.

by hovercrafter on Tue Aug 08, 2006 at 04:20:04 PM EST
[ Parent ]

Re: A Follow-up on the Lieberman Hacking Lie (none / 0)

The reporters and TV pundits you are targetting with this technical data couldn't distinguish an URL from a Bubba.

But, hey, all those undecided technogeeks out there will flood the polls for lamont now.

by Hesiod Theogeny on Tue Aug 08, 2006 at 04:01:15 PM EST

Wasn't there some sort of message left? (none / 0)

Something about the hacker "owning" the site? That's what MSNBC reported.

by Drummond on Tue Aug 08, 2006 at 04:15:46 PM EST

Re: Wasn't there some sort of message left? (none / 0)

That was a prior series of hacks. Somewhere on dKos there's an explanation of this: Joenertia's site uses (used?) a Content Management System called 'Joomla', and Joomla has had security vulnerabilities recently.

I've got reams of Web logs on my own site indicating script-kiddies testing for assorted vulnerabilities. All of them no doubt were automated, and all will fail, because I don't use packaged code. Nonetheless, they still test, and when they hit Joe's site, they succeeded.

by Phoenix Rising on Tue Aug 08, 2006 at 06:06:00 PM EST
[ Parent ]

Re: A Follow-up on the Lieberman Hacking Lie (none / 0)

You don't suppose Lieberman is setting himself up as being a victim for the Get Out and Vote type of phone jamming case we just saw go through with the Rep's??

by mainsailset on Tue Aug 08, 2006 at 04:22:19 PM EST

Re: A Follow-up on the Lieberman Hacking Lie (none / 0)

The story seems to be losing steam on MSNBC. I think that it is becoming clear that Joementum is grasping at straws to support an indie bid and to cover for signing up with an internet server that normally hosts high school garage bands.

by magster on Tue Aug 08, 2006 at 04:27:41 PM EST

Re: A Follow-up on the Lieberman Hacking Lie (none / 0)

well, all things said (lieberman's a scumbag, his campaign has broken nearly every rule of civility, etc.) losing the website will probably significantly affect their gotv.

personally, i think the timing is far too convenient, and that it was almost certainly messed with. i also think that joementum's crew is doing a great job of getting this to be an issue, and that it'll affect some vote intentions, swinging them into joe's column. hopefully the damage to their gotv will offset these results.

also, i'm not sure about connecticut election law, but federally, vote suppression can't negate a primary result unless there was some tie to the opposition AND it was systematic. hitting a website doesn't meet the threshold.

by island empire on Tue Aug 08, 2006 at 06:02:59 PM EST

Re: A Follow-up on the Lieberman Hacking Lie (none / 0)

well, daily kos has just added a nice update on why the website couldn't have handled the hacking and/or overload.

http://www.dailykos.com/story/2006/8/8/1 71512/6117

personally, i've always been a lot more skeptical about lamont's prospects for victory, but this kind of thing really does just solidify the sense of utter incompetence that emanates from the lieberman campaign.

hilariously, sean smith has probably made so many connections that he'll have no problem finding a presidential campaign to work on for next cycle. damn, and he's so pointlessly vicious. if he was running any other campaign but lieberman's (who's too bland to be vicious) he's have turned more voters off than he mobilised. you just shake your head.

by island empire on Tue Aug 08, 2006 at 06:27:19 PM EST

Re: A Follow-up on the Lieberman Hacking Lie (none / 0)

ah, wait - so no hacking at all, "MyHostCamp is currently down, along with all their clients."

HAHAHAHAHAHAHAHAHAHA!!!!

the lamont folks must feel like their campaigning against a campaign from the 1970s!!!

by island empire on Tue Aug 08, 2006 at 06:40:06 PM EST

Apologies? Why???? (none / 0)

"Someone from Dewey Square confirmed to me that Geary doesn't work for them and never has. My apologies."

Why apologize? No, if Geary wasn't working for them, why did he make this ridiculous statement, insisting that the campaign did pay for the traffic? How would he know? What's his role in this Kabuki theatre? Lieberman's staff should answer those questions if they want to counter suspicions that they deliberately mislead the public!

No way, no how, no McCain!

by Gray on Tue Aug 08, 2006 at 07:13:43 PM EST

CT-Sen: Why Lieberman's site is down (none / 0)

Tue Aug 08, 2006 at 12:38:27 PM PDT
Two posts down it's clear that Lieberman's website isn't suffering from a Denial of Service attack.

But now I have the definitive answer as to why Lieberman's site went down.

They are paying $15/month for hosting at a place called MyHostCamp, with a bandwidth limit of 10GB. MyHostCamp is currently down, along with all their clients.

Here's the deal -- you get what you pay for. My hosting bill is now over $7K per month. A smaller site doesn't need that much bandwidth, but if you're paying $15 because your $12 million campaign is too freakin' cheap to pay for quality hosting, then don't go blaming your opponent when your shitty service goes out.

For their part, the Lamont campaign has offered its technical expertise to get Lieberman's site back up (which could be done in an hour by a competent sysadmin), and has added a link to the googlecached version of Lieberman's site at the top of their blog.

One side is acting mature, the other is running around making baseless accusations.

Update: Dan Gerstein, Lieberman spokesperson, admits they have no evidence Lamont's campaign or his supporters are behind their website woes.

I'm telling you, it's down because they were too cheap to pay for quality hosting. That's a lesson to all of you campaigns skimping on hosting. $15 won't cut it.

Update II: Joe's site shares one server with 73 other sites. They pay $15/month for an overcrowded server, and then they blame others when it goes down? Full list of sites on Joe's server on the flip.

Update III: From an email:

DoS attacks don't affect particular accounts on a server. They bring down the whole server. The attack site is up, their campaign site is down. This isn't a DoS attack.

Will the Lieberman campaign reimburse state and federal investigators wasting resources to confirm that the site went down because the campaign was too cheap to hire a quality hosting provider?

Race tracker wiki: CT-Sen

____________
Romeo y Julieta