Green Energy

Update: Clinton’s e-mail is on a hosted Exchange 2010 server, not in Chappaqua

There's been a lot of controversy over how Hillary Clinton apparently used a mail server running in her Chappaqua, New York, home when she started her tenure as secretary of state. But if you want to know what she's using now, all you have to do is point your browser at it—you'll get a login page for Outlook Web access from a Microsoft Exchange 2010 server. And so will anyone who wants to brute-force guess her e-mail password or simply take the server down with a denial-of-service attack. (This is not a suggestion that you should.)

Clinton has probably changed her e-mail address since the scandal began—particularly since the hdr22 account she used has been widely published and has likely become a magnet for all sorts of unwanted messages. And the hosted Exchange server is certainly an upgrade from her original server configuration—Until October of 2010, based on historic DNS records viewed by Ars, Clinton's e-mail server was in fact at a static IP address provided by Optimum, a Cablevision subsidiary, that corresponded to the Clintons' Chappaqua address.

The domain was registered on January 13, 2009, just days before Clinton's confirmation as secretary of state—but it did not gain a certificate for secure client connections until March. The current certificate for clintonemail.com was issued by GoDaddy in 2013 just as the original certificate was about to expire.

At some point shortly after the home server was dropped in 2010, the mail exchange record for clintonemail.com was moved to a hosted Exchange server. Currently, that server appears to be running out of a data center in Huntsville, Alabama. The server uses McAfee's MXLogic e-mail filtering service to screen for malware and spam (though it's not certain when the service was added).

[Update: Technical analysis of the network routing for mail.clintonemail.com places it somewhere on Internap's network, connected via one of the company's private network access points. That makes it difficult to resolve exactly where the server is. The server itself may be in a data center in Atlanta.]

There are a couple of potential hazards posed by the Clintons' hosted mail server. First, Outlook Web App is enabled, and that offers an avenue for attackers to attempt to brute-force their way into mail accounts by guessing passwords. Exchange server offers some policies to block these sorts of password attacks, but using them runs the risk of denying users access at all—all someone has to do to basically shut down a user's e-mail is enter bad passwords a few times to activate the lockout.

The other problem is that it's not certain just how well patched this Exchange 2010 server running on a Microsoft Windows Server instance really is. Based on server data, mail.clintonemail.com is running on an instance of Microsoft Windows Server 2008 with Internet Information Server 7.5, both of which have had numerous security vulnerabilities uncovered since this particular server was configured. On the bright side, since it's Windows, it wasn't vulnerable to Heartbleed or Shellshock.

- Hillary's Deleted Emails May Have Been Backed Up On "cloud" - Cloud Provider Agrees To Release Data
Hillary Clinton - Drunk As Usual From McClatchey: On Friday, Clinton’s attorney, David Kendall, and Platte River agreed to allow Datto to turn over the data from the backup server to the FBI, said the person familiar with Datto’s storage, who spoke...

- Fbi Finds Hillary Clinton’s Deleted Emails On Her Server
FBI Finds Hillary Clinton’s Deleted Emails on Her ServerThe Federal Bureau of Investigation (FBI) has successfully recovered personal and work emails from Hillary Clinton’s private email server, according to a new report.Sources told Bloomberg News that...

- Technie Question. I'm Confused.
Hillary Clinton's recent boo-hoo "apologies" seem ludicrous to me. For one thing, her eyes are suddenly extra blue. For another, her voice sounds phony. Whatever. Here's my question.... Do email addresses and web servers equate? ...

- Hillary Staffer Subpoenaed - Will Take The Fifth
From the Washington Post: A former State Department staffer who worked on Hillary Rodham Clinton’s private e-mail server tried this week to fend off a subpoena to testify before Congress, saying he would assert his constitutional right not to answer...

- Hillary Handed Over Blank Server To Fbi
From the Washington Examiner: Hillary Clinton’s personal email server, now in possession of the Justice Department, contains no data from her time as secretary of state. The emails it once contained were shifted onto a different server in June 2013...

Green Energy