Some notes on #MacronLeak

Tonight (Friday May 5 2017) hackers dumped emails (and docs) related to French presidential candidate Emmanuel Macron. He's the anti-Putin candidate running against the pro-Putin Marin Le Pen. I thought I'd write up some notes.

Are they Macron's emails?

No. They are e-mails from members of his staff/supporters, namely Alain Tourret, Pierre Person, Cedric O??, Anne-Christine Lang, and Quentin Lafay.

There are some documents labeled "Macron" which may have been taken from his computer, cloud drive -- his own, or an assistant.

Who done it?

Obviously, everyone assumes that Russian hackers did it, but there's nothing (so far) that points to anybody in particular.

It appears to be the most basic of phishing attacks, which means anyone could've done it, including your neighbor's pimply faced teenager.

Update: Several people [*] have pointed out Trend Micro reporting that Russian/APT28 hackers were targeting Macron back on April 24. Coincidentally, this is also the latest that emails appear in the dump.

What's the hacker's evil plan?

Everyone is proposing theories about the hacker's plan, but the most likely answer is they don't have one. Hacking is opportunistic. They likely targeted everyone in the campaign, and these were the only victims they could hack. It's probably not the outcome they were hoping for.

But since they've gone through all the work, it'd be a shame to waste it. Thus, they are likely releasing the dump not because they believe it will do any good, but because it'll do them no harm. It's a shame to waste all the work they put into it.

If there's any plan, it's probably a long range one, serving notice that any political candidate that goes against Putin will have to deal with Russian hackers dumping email.

Why now? Why not leak bits over time like with Clinton?

France has a campaign blackout starting tonight at midnight until the election on Sunday. Thus, it's the perfect time to leak the files. Anything salacious, or even rumors of something bad, will spread viraly through Facebook and Twitter, without the candidate or the media having a good chance to rebut the allegations.

The last emails in the logs appear to be from April 24, the day after the first round vote (Sunday's vote is the second, runoff, round). Thus, the hackers could've leaked this dump any time in the last couple weeks. They chose now to do it.

Are the emails verified?

Yes and no.

Yes, we have DKIM signatures between people's accounts, so we know for certain that hackers successfully breached these accounts. DKIM is an anti-spam method that cryptographically signs emails by the sending domain (e.g. @gmail.com), and thus, can also verify the email hasn't been altered or forged.

But no, when a salacious email or document is found in the dump, it'll likely not have such a signature (most emails don't), and thus, we probably won't be able to verify the scandal. In other words, the hackers could have altered or forged something that becomes newsworthy.

What are the most salacious emails/files?

I don't know. Before this dump, hackers on 4chan were already making allegations that Macron had secret offshore accounts (debunked). Presumably we need to log in to 4chan tomorrow for them to point out salacious emails/files from this dump.

Another email going around seems to indicate that Alain Tourret, a member of the French legislature, had his assistant @FrancoisMachado buy drugs online with Bitcoin and had them sent to his office in the legislature building. The drugs in question, 3-MMC, is a variant of meth that might be legal in France. The emails point to a tracking number which looks legitimate, at least, that a package was indeed shipped to that area of Paris. There is a bitcoin transaction that matches the address, time, and amount specified in the emails. Some claim these drug emails are fake, but so far, I haven't seen any emails explaining why they should be fake. On the other hand, there's nothing proving they are true (no DKIM sig), either.

Some salacious emails might be obvious, but some may take people with more expertise to find. For example, one email is a receipt from Uber (with proper DKIM validation) that shows the route that "Quenten" took on the night of the first round election. Somebody clued into the French political scene might be able to figure out he's visiting his mistress, or something. (This is hypothetical -- in reality, he's probably going from one campaign rally to the next).

What's the Macron camp's response?

They have just the sort of response you'd expect.

They claim some of the documents/email are fake, without getting into specifics. They claim that information is needed to be understand in context. They claim that this was a "massive coordinated attack", even though it's something that any pimply faced teenager can do. They claim it's an attempt to destabilize democracy. They call upon journalists to be "responsible".