Trump Campaign Site Hacked – What We Know & Lessons Learned

On October 27, 2020 at approximately 4:50pm Mountain Time, Donald Trump’s campaign website, www.donaldjtrump.com, was defaced. The attackers left a message claiming they had compromising information on President Trump. The defacement page contained two Monero cryptocurrency wallet IDs encouraging visitors to “vote” by sending cryptocurrency to the wallets, indicating that if the first wallet received more money than the second wallet, the attackers would release this compromising information.

While the site was compromised, visitors were greeted with the following:

Wordfence protects WordPress websites, and we offer a hacked site cleaning service for WordPress site owners. Donald Trump’s campaign website is hosted using Expression Engine, which is an alternative content management system to WordPress. While Wordfence doesn’t protect sites using Expression Engine, we thought we’d take a look at the facts surrounding this incident and what lessons we might learn.

Technical Analysis

The campaign website made use of the Expression Engine CMS, a commercial CMS with few known vulnerabilities. The site used Cloudflare as a content delivery network (CDN).

Since the site was protected by Cloudflare, the attackers would not have been able to access the site via FTP or SSH unless they knew the Origin IP, that is, the IP of the server hosting the site. When a site uses Cloudflare, the Cloudflare servers are what site visitors access, rather than the ‘origin’ server that actually contains the content and any web application. Cloudflare tries to hide the origin server IP address, making it difficult to access that server unless you can discover the IP address.

The defacement page itself displayed two XMR (Monero) wallets. Monero is a cryptocurrency popular amongst threat actors because it uses an obfuscated public ledger. This means that, while transactions are recorded, they’re not currently traceable. This makes it impossible for outsiders to discover who sent money to each wallet or the amounts involved.

The attackers also left a Pretty Good Privacy(PGP) Public Key on the defacement page. A PGP Public Key can be used to verify signed messages and ensure that a message sender is the same person who posted the public key. If the attackers later decided to release information, they could prove they were the same threat actors who defaced the site by signing released information with their private key.

Only information signed with their private key would be verifiable using the published public key. In this case, the Public Key appears to correspond to a nonexistent email address, hack@planet.gov. Nonetheless, we have provided the PGP key for posterity:

Potential Intrusion Vectors(IVs)

There are several possible intrusion vectors, or mechanisms that the attackers could have used to gain access and deface the Trump campaign website. We describe several possibilities below, but to be clear, without forensic evidence to verify these theories, we cannot definitively know how the site was compromised.

In each case, compromised credentials are by far the most probable Intrusion Vector. A Dutch Researcher recently claimed to have accessed Trump’s Twitter account using the password “maga2020!”. Trump’s Twitter account was also hacked In 2016 when a data breach revealed that he was using the password “yourefired”.

IV: Compromised credentials used to sign into Expression Engine – High Probability

Expression Engine, like most content management systems, provides an administrative panel for publishing content. By default this is located at /admin.php. On donaldjtrump.com, however, the admin login has been relocated to a different location, an example of security through obscurity.

The Internet Archive indicates that the last time the admin page was accessible in the default location was in June of 2015. Even in this hidden location, if an attacker was able to access the administrative panel they would have been able to alter any content on the site, though they would not have had access to any sensitive information.

The “Privacy Policy” and “Terms & Conditions” pages are displaying a “404 page not found” error hours after the site has been restored. This indicates that something changed on the content management system itself, rather than on the Cloudflare configuration. So we believe that the CMS being compromised is therefore a higher probability than Cloudflare being compromised, which we describe below.

IV: Compromised credentials used to sign into Cloudflare – Medium Probability

If an attacker was able to sign into the campaign’s Cloudflare account, they could have pointed the domain to an IP address under their control, effectively replacing the site’s content with the content on their own hosting account. This might also explain how the campaign was able to “restore” the original site content so quickly.

Simply pointing the domain back to the correct IP would have reverted the defacement. The fact that some pages on the site, such as the “Privacy Policy” and the “Terms of Service” are still displaying 404 errors at the time of our publication indicates that this is a less likely intrusion vector.

IV: Compromised Credentials or Social Engineering used to change domain nameservers at registrar – Low Probability

This would work using a similar mechanism to the Cloudflare compromise. If an attacker was able to login to the account where the domain donaldjtrump.com was registered, or socially engineer their way into the account at the domain’s registrar, they might have been able to point it away from Cloudflare’s nameservers and to nameservers under their control.

The fact that some pages on the site are still displaying 404 errors indicates that this is a less likely possibility. Additionally, nameserver changes typically take long enough to propagate that the defaced page would likely still be visible from some locations.

IV: Origin server hacked via FTP or SSH – Low Probability

This is the least likely scenario since the attackers would need to know the site’s origin IP address as well as the FTP or SSH credentials for the site’s hosting account in order to connect directly to the site without being blocked by Cloudflare.

IV: Web Application Vulnerability – Low Probability

While it is possible that a vulnerability in Expression Engine was exploited, Expression Engine has had few known vulnerabilities and the chances of a 0-day vulnerability in this CMS remaining unknown for long are low. Additionally, a vulnerability or exploit chain would be required to allow privilege escalation or remote code execution in order for the attacker to deface the site in this manner.

Takeaway Lessons

Almost every possible scenario includes reused credentials being exploited to gain access to the donaldjtrump.com site. In almost every case, having 2-Factor Authentication enabled would have prevented such a scenario from occurring. It’s also a reminder that it is important to enable 2-Factor Authentication not only on your website’s administrative panel, but on every service that offers it, including services you might not think of as being vulnerable.

If the credentials you are using have been exposed in a data breach, it doesn’t matter how secure the service you’re using is. By enabling 2-Factor Authentication, you add an extra layer of protection.

While Wordfence doesn’t offer protection for Expression Engine, we do offer best-in-class protection for WordPress. This includes 2-Factor Authentication as a completely free feature.

Don’t wait for an attacker to guess your password. Turn on 2-Factor Authentication to protect your web assets.