FBI Password Database Compromised by Consultant 373
LackThereof writes "An IT consultant for the FBI, hired to work on their new 'Trilogy' computer system, apparently got hold of the username and password hash databases for the FBI's network. He then used a common dictionary attack to get usable passwords out of the hashes, including that of FBI director Robert Muller, making him able to access virtually any data stored electronically at the FBI, including Witness Protection program records. The consultant, Joseph Thomas Colon, claims he used the passwords to avoid bureaucratic obstacles, and that his actions were condoned by the FBI agents he was working with at the agency." (More below.)
"He has pleaded guilty to 4 counts of 'intentionally accessing a computer while exceeding authorized access and obtaining information from any department of the United States.' He initally gained access to the hash database by borrowing an agent's username and password; he then re-downloaded and re-cracked it three more times to keep up with the FBI's 90-day password expiration policy. Lesson: Your users are your biggest security hole. Don't trust your users, especially if they're government agents."
Upon trying to read the blurb (Score:4, Funny)
Indeed... in-deed...
Has the 'consultant' (Score:3, Insightful)
the database he had tenative acccess to. If he needed greater acces, he would have had it. The
article is , at best, lacking in solid information. At least to me it is.
Re:Has the 'consultant' (Score:5, Insightful)
Re:comprise != compromise (Score:2, Funny)
Sincerely,
James Colon
scary (Score:5, Insightful)
Re:scary (Score:3, Funny)
Re:scary (Score:5, Interesting)
Re:scary (Score:5, Insightful)
[ Same answer as "why does the whitehouse need to know who every undercover CIA agent is ?" ]
Re:scary (Score:3, Interesting)
Re:scary (Score:5, Insightful)
Rely on yourself for survival - rely on others to grow.
Re:scary (Score:5, Funny)
Fuck that. I grow my own.
Re:scary (Score:3, Insightful)
Re:scary (Score:5, Insightful)
Re:scary (Score:2)
Re:scary (Score:3, Informative)
Re:scary (Score:4, Insightful)
Huh?
What ever gave you that idea? What evidence is there? Next, people will believe that "Homeland Security" is... Or the war in Iraq was...
Re:scary (Score:3, Insightful)
Well to be fair, you are more likley to die from a drunk driver so I'd be more concerned how your local State Troopers are behaving.
Briefly... (Score:4, Informative)
Re:Briefly... (Score:2)
s#$#/#
And we're going to fix this... (Score:5, Insightful)
Re:And we're going to fix this... (Score:5, Insightful)
A dictionary attack.... OMFG!
If the director had a secure password then it would not have been a big deal.
Listen kids, Big98Boob$-311 as your password is pretty damned secure and makes a dictionaty attack useless against it.
Next question, WTF is the feds doing not using securID on all of their logins to eliminate such a problem??
Would that it were that easy. (Score:4, Insightful)
As for two-factor, I know VA is moving towards it (and was before the whole laptop debacle). Might be fed-wide. Hopefully this will light a fire under it.
Re:And we're going to fix this... (Score:5, Insightful)
Re:And we're going to fix this... (Score:3, Interesting)
When the time comes to change my password, you know what I do? I add an exclamation point. I'm up to four now.
People just need to devise their own system that they can use to make their password more secure, but memorable. Here's a fairly easy to remember, secure password: 123
Re:And we're going to fix this... (Score:4, Insightful)
It's not that the higher ups are idiots for choosing crackable passwords. It's that passwords don't work. Not well enough to do what we want them to do.
They can be made less dysfunctiona by checking for things like dictionary attacks, but a password that is strong enough to be used for something like tracking terrorists or launching nuclear missiles is too strong for a human to remember.
And there have been solutions for this around forever. Lotus Notes has had two factor security with strong crypto for twenty years now. RSA and other vendors have been selling solutions that work for basically forever.
This guy was foolish to do what he did. Not because it was wrong, but because the results to himself were predictable. The FBI reaction in this case reminds me of the Catholic Church's reaction to priest pedophilia. The Church has a rule that it is wrong to bring the Church into disrepute. But instead of interpreting this rule as "don't do anything that is shameful", it became "don't let the truth about shameful things get out."
So, what we have here is a geek who just wanted to get his job done, up against the slowness of the bureacracy. Why is the bureacracy slow? Because slow is safe. Decisions that don't get made don't leave anybody responsible. But bureacracies are still jealous of their rights to make decisions, even if they are put off indefinitely. Making things happen fast, and along the way exposing weaknesses that attach to individuals, that's almost unimaginably evil from that point of view.
Re:And we're going to fix this... (Score:5, Funny)
It only appears as Big98Boob$-311 to you since it's your password. To me it just looks like **************
Re:Actually, that is not a secure password... (Score:3, Informative)
Take a look at password generation tools like "apg" and "pwgen". They use tools like trigraphs, triphthongs, diphthongs to make easy-to-remember, non-dictionary passwords. Sure, using these techniques reduces the keyspace for a brute force attack, but keyspace size and easy-to-remember are pretty much mutually exclusive.
http://pwgen.org/ [pwgen.org]
http: [puroga.com]
Re:Yep, works for me. (Score:3, Funny)
For boys:
MyPrettyPony
BarbieIsNeat
ILikeGirls (only embarrassing up to a certain age, I suppose)
For girls:
ExtraHairy
GirlsRSmelly
BoysAreCool
Now that I've had fun dreaming these up, though, I wonder if the password could be so 'repulsive' that they will refuse to use the computer at all?
Re:And we're going to fix this... (Score:2)
Re:And we're going to fix this... (Score:5, Insightful)
Re:And we're going to fix this... (Score:2)
Perhaps we could be moving to a system not so easily compromised...
Re:And we're going to fix this... (Score:5, Funny)
>Are we also going to do something to prevent this from happening again
No. That would be wrong for the following reasons:
- It would require admitting that the existing security system is sub-optimal.
- It would imply that the Dear Leader/FBI Director had made a mistake.
- Acknowledging that there was a problem would aid terrorists and Democrats.
- Creating a culture of accountability would damage agent morale and lead to #3 above.
- Sending some wanker consultant to jail makes staff feel good.
- The option of sending agents to jail and/or Butte, Montana must be reserved for the serious crime of embarrassing the Dear Leader.
Thank you for asking. However, the fact that you asked shows that you have no possible future with the FBI and are probably a threat to our National Security. We'll be in touch.How about educating the programmers? (Score:3, Informative)
The classic newbie mistake is thinking, basically, "I know, I'll take the password as it is, run it through MD5 and store the hash. It's uber-secure because it's MD5, right?" Turns out: wrong. An attacker can, yes:
1) download a program that will try every word in the dictionary until it finds a match, like this guy did. (And it _will_ find a ma
Way worse than what Merlyn did (Score:5, Insightful)
Compare that to the clearly less harmful actions of Randal Schwartz [google.com], who went gray-hat (one time, without using the logins, as a security warning). Three felony convictions and a rather severe sentence.
Most Common Passwords (Score:2)
Didn't you get the memo? Don't use god, love, sex, or secret. Also
Re:Most Common Passwords (Score:2)
Re:Most Common Passwords (Score:5, Informative)
And just for some additional information for others not familiar with this kind of thing, there are dozens of programs that can do brute-force comparisons. It's also possible that he just used a rainbow table, which are available on (sometimes more than one) DVD for relatively small sums for the comparison. With a few really good computers, or a distributed computing project, it's not terribly hard to build up a sizable rainbow table in a relatively short period of time.
Re:Most Common Passwords (Score:3, Interesting)
Are you suggesting the FBI doesn't seed their password hashes?
That's hard to believe! I would assume those that write the authentication mechanisms for FBI software have taken a class (or read a book) on the very basics of password-based authentication.
Actually, I take that back.
Re:Most Common Passwords (Score:2)
Re:Most Common Passwords (Score:2)
The Most Common Password (Score:2)
Also a lot of people just use their usernames as passwords, as long as the system allows it. Maybe tack on a 1 on the end.
Re:Most Common Passwords (Score:2)
Our Government (Score:2)
And he was caught too, so crisis averted, everyone told us they caught him and there have never been similar attacks before!
I feel completely safe with my information knowi
Re:Our Government (Score:2)
2) The NSA's computers are much better protected because they are in the business of information monitoring and security.
3) The FBI is a law enforcement agency with files on millions of Americans, including those that have security clearances. Said files may include information which can be used to apply pressure to or to find weaknesses of said people with security clearances.
4) How much do you think the Witness Relocation and Pro
Re:Our Government (Score:4, Funny)
If we dont get all this information together we wont be safe, and without being safe our entire country would fall apart. So we have to have complete and unfettered trust in our government that it is doing the right thing as they know everything about us!
Remember to smile for the security camera, there is an angel on the other side.
Wow. (Score:5, Funny)
Re:Wow. (Score:2)
Could be worse -- he could be a "new fragrance for men"...
Forced password expirations (Score:5, Interesting)
Lesson #2: Don't use stupid password expiration periods, which force users to come up with new yet easy-to-remember (=> crackable) passwords. If passwords never expire, your users are bound to pick a more secure password in the first place since they know that they don't have to change it every full moon. Make the passwords never expire and just run a dictionary attack against your users - if you get through, THEN start harassing your user about proper security.
Re:Forced password expirations (Score:3, Insightful)
Or better yet, use a biometric system
Re:Forced password expirations (Score:2, Informative)
http://service.spiegel.de/cache/international/0,15 18,415638,00.html [spiegel.de]
Re:Forced password expirations (Score:2)
Re:Forced password expirations (Score:2)
They organized the first data banks of fingerprints in the nation and developed laboratories for processing crime scene material that were the forerunners of today's crime scene investigation units. They have had to stay one step ahead of criminals, but in recent decades seem to have lost their edge, perhaps from becoming too beaureauracritized. The 9/11 Commission certainly took them to task for their failure to communicate vital information, but then again, a lot of people dropped the ball then, not just
Re:Forced password expirations (Score:5, Insightful)
Re:Forced password expirations (Score:2)
At least if my password is compromised I can change it; not so with my thumbprint.
Which is why you can't rely on one biometric system alone. I would think a combination of maybe retinal, fingerprint, and voice recognition would make it much harder to impersonate someone to gain access.
Re:Forced password expirations (Score:5, Insightful)
1 - biometric (fingerprint, voice, retina, etc.)
2 - item (SecureID card, etc.)
3 - password
If biometric fails, the cracker still doesn't have the item or password. If the item is stolen, the cracker doesn't have a fingerprint or password. If the doofus tells someone his password, the cracker doesn't have the fingerprint or item.
jfs
Re:Forced password expirations (Score:2)
I second that. Everytime that I have had to deal with passwords that must be changed monthly I've found that users append or prepend the number of the month. In July, most of the password will begin or end in "07".
Another stupid rule: "a new password must contain three characters not found in the previous password". This was created to try to stop the "number of month" problem noted above. Instead it makes it hard to have long passwords. I created a 20 character password (pass phrase) once. The follow
Re:Forced password expirations (Score:5, Informative)
I thought it had two things going for it. Suceptible passwords were weeded out and in theory your password should be cracked by a friendly before someone else.
Re:Forced password expirations (Score:2)
Instead a much more secure system would have the password expire once a year, can't use your previous password, and require 2 numbers
The only thing interesting to me is the pricetag. (Score:5, Insightful)
I need to check the Government Accountability Office more often. It's good to know we're spending 1 billion dollars to found a, most likely, failed attempt at secure computing for the FBI. Doh.
Good news! (Score:3, Funny)
A hacker? (Score:4, Insightful)
Re:A hacker? (Score:5, Funny)
Unqualfied moron (Score:5, Insightful)
Re:Unqualfied moron (Score:4, Informative)
Re:Unqualfied moron (Score:2, Insightful)
Admins, security depts and managers (though to a lesser extent generally) usually get pretty uppity with sharing passwords on ANY systems, and thats on internal systems for small time companys with sweet FA worth breaking in to. What the hell was this guy thinking? I suppose he thought those relaxed, easy going folks over at the FBI wouldnt mind if he ran some random script/program off the internet to retrieve some passwords so he can get on with the job.
I mean, its only a cracking/hacking script
And now for the "flip-side"... (Score:3, Insightful)
Employees suck! (Score:4, Insightful)
Employers need to be more careful about whom they hire and what their employees are doing. Even the members of
Re:Employees suck! (Score:5, Insightful)
Employers need to be more careful about whom they hire and what their employees are doing.
In the U.S. the workplace has developed an adversarial relationship between employers and employees. The mantra, "nothing personal, this is just business" has removed the major factor stopping employees from screwing over their employer. If it is just business when an employer lies to the employees, fires them when they need a boost in the numbers, outsources their job, cancels benefits, or takes other action that affects the employees negatively then it is also just business when the employee lies to the employer, walks off with equipment, moves to another job at a bad time without giving any notice, or loots the database for info they can sell.
You see, it was not the law that prevented this sort of behavior, it was an ethical motivation. People, in general, don't like to hurt or even disappoint others. They want to do right by them. When they are treated unethically in turn, that motivation disappears. Do you want your employees to be loyal and honest? I certainly recommend checking up on each one, but more importantly, treat them well and with concern. Make sure they know, even if they screw up they won't be fired. Make sure they know you're doing the best you can to provide them with a reasonable income, friendly workplace, and what they need to be happy. Make sure you reward their good works. Make sure that if they run into money troubles you're the first person they talk to. Make sure they know you respect them. This is not only ethical, it is good business.
Re:Employees suck! (Score:3, Insightful)
Re:Employees suck! (Score:3, Insightful)
However, there is no legal justification to large scale theft, regardless of how good Office Space was.
Laws are not a very good way to motivate behavior. The death penalty is not a good deterrent because most killers are either desperate, emotionally driven, or believe they will not be caught anyway. Similarly, threat of punishment is a terribly way to motivate employees to not steal and that is what the laws are really. Don't steal or we'll throw you in jail is not nearly as effective as the ethical mot
Re:Employees suck! (Score:3, Insightful)
While I agree that the qualities you've listed make for a better business, both in terms of a better workplace as well as a business that is concerned more with the next 10 years than the next quarter, I have to disagree with the above statement. It
Re:Employees suck! (Score:2)
You're in luck. Many companies fire them these days!
Employees cope, is what they do (Score:2)
Sure does sound like the attitude that employees "suck" created the circumstances in which this little exploit was possible in the first place. First and most obvious example: a 90-day renewal policies on passwords only make your passwords more likely to be crackable, because people are choosing passwords they can more easily remember. That's exactly the sort of corrosive pressure that'll make otherwise security-conscious employees try to cut corners just to get their jobs done.
Technical support people de
Laws against security tools (Score:3, Insightful)
Re:Laws against security tools (Score:2)
Passwords (Score:2, Insightful)
The perils of consulting (Score:2)
See what happens when you don't give a consultant the access he needs? He goes out and gets it himself!
Note to FBI: maybe outsourcing some things is not such a good idea.
Who was this agent? (Score:2)
If he really was in a valid position to need access to it, then they definitely need to screen the mental abilities of people they give sensitive positions more carefully - any half way decent sysadmin knows not to give their password out.
Password Expiration Policies (Score:4, Interesting)
Would it have been so easily cracked if everyone had a 10+ character password that was truly strong, even if it was only changed once a year or never?
Is there an argument for password systems including a dictionary attack test phase for new passwords that if the new password fails, the user has to change it again?
And maybe when data is really important, they might wish to utilise some other form of identification besides passwords. Certainly witness protection details should be far more protected. A biometric system, fingerprints are the easiest to implement these days without much cost, in addition to the password...
Of course the consultant had an 'in', as he was consulting for them. Some minor social engineering and they're all letting him access the systems, bypassing proper procedure.
In the end, there's no excuse for data this important being accessed illegitimately like this. Security measures should be in place, access procedures should be in force, restrictions on data movement from secure to insecure should be enforced. Yet we see it every week - laptop stolen with confidential data on, unencrypted, open, in a file on the desktop probably called "Social Security Database.xls" or "List Of Witnesses On Protection Program, Do Not Show To Criminals Who Will Pay Good Money For This.doc".
Re:Password Expiration Policies (Score:3, Insightful)
Surely this really proves that the IT department wasn't enforcing strong passwords and that's about all it proves. Having strong passwords that change every 90 days is NOT an unreasonable policy and is easy to enforce with any OS.
The IT department should be on trial along with the consultant.
Re:Password Expiration Policies (Score:2)
If all you are worried about is external attacks, the fact that 60% of the company's passwords
comprised, eh? (Score:3, Informative)
Why would the director (Score:3, Insightful)
In many cases, the higher upthe person, the LESS data they need from the computer systems.
Disaster averted! (Score:5, Insightful)
Of course, the whole thing could have also been averted if normal users didn't have access to the password file. The Unix world figured out that shadow password files are a good idea a long time ago. Too bad the wisdom there hasn't caught on.
One thing everyone should know when working for a large organization is that they have policies for everything because they assume everyone is dumber than paste. The up side of this as a consultant is that you can bill a week for 30 minutes of work because there's a week of paperwork needed before you can perform any task. This guy tried to get things done more efficiently by sidestepping the boundaries. Small companies can respect that kind of attitude, but not the government. That kind of behavior results in lower billings to the government, and that is unamerican.
Jumping through hoops, as silly as they may be, is an important part of any technical job within a large organization.
And the FBI agreed to this? (Score:5, Insightful)
Colon claimed that he did this because he was tired of having to seek bureaucratic authorization for every last task, including adding printers. Having worked with government agencies before, I can say I understand his frustration. But his later justification was priceless:
Okay, so: getting authorization was onerous, so he asked for permission from agents in the Springfield office to forge their superiors' credentials in order to speed up the process. And they gave it to him.
Did you get that? I was originally gonna boldface the best parts, but I couldn't decide where to start.
1. The contractor, fed up with an onerous and ridiculous authorization process,
2. asked for permission from FBI officials to crack their superiors' passwords,
3. and the FBI officials in question said yes.
Okay, so, Colon is in court. What happened to the FBI staffers who gave him the go-ahead?
Re:And the FBI agreed to this? (Score:5, Informative)
My question exactly. I used to work for the government, and it's highly believable that the guy was given approval to do this. (You have no idea how much red tape there is, let alone the process to get an account with the type of access he was after.) However, Colon shouldn't have cracked the database multiple times (let alone once). He should have either 1) kept requesting the agent's password when it changed, or 2) quit. There's a reason those processes were there, and if he didn't like it, he should have left. Also, the staffers can claim ignorance all they want, but I find it very hard to believe that none of them knew he was doing this to get his work done.
Re:And the FBI agreed to this? (Score:5, Insightful)
Re:And the FBI agreed to this? (Score:2)
Well, we now know the FBI doesn't audit. (Score:5, Insightful)
I call for this every time something like this gets published , and I'll call for it again :
We need (real) IT professionals in Congress, they need to form an oversight committee, and they need to have pretty much unrestricted access to most systems so they can be effective.
These holes have *got* to get plugged. Its not only embarrassing, its media porn and its going to encourage hacks that *do* result in something bad happening.
Nimrods.
Yikes!!! (Score:3, Insightful)
What, like due-process, warrants, and legal considerations?
So FBI agents just stand around while he illegally accesses everything he's not supposed to so it can make their jobs easier? If there were actual agents standing around thinking this was good, we're in deep doo-doo, because they have now taken the stance that if they subcontract the illegal stuff, they're all good.
Yikes!
Sh*t Rolls Downhill (Score:2)
I'd think that the FBI could afford to implement two-factor authentication for its employees.
Witness Protection Info on shared database? (Score:5, Insightful)
Isn't witness protection data Need To Know? Why would the FBI director Need To Know anything at all at a moment's notice from his desktop PC? It would make much more sense to have a separate system, and have him walk down the hall, ask someone to retrieve what he needs, and maybe get ONE record made available for a limited time.
I'm not trolling or anything. Seriously, can someone suggest scenarios whereby immediate, free access to that data is valuable, especially by people who don't already know whether you or I are in the program?
Mod parent up! (Score:2)
Re:Witness Protection Info on shared database? (Score:2)
Making him walk to a room would be a waste.
Also, he will need to pass senisitive data to others. Like the
Run crack daily and lock any failed accounts. (Score:2)
What the contractor should have done is to increase his rates when waiting around for permissions. You may well hate the bureaucracy but at least you're then being well paid for it.
scary (Score:4, Interesting)
first off (Score:2)
Fuck you.
Now, on with our story.
Many years ago, I was interviewing for a position at a up and coming online store.
During the interview they showed me there database. In it, there were the CC numbers, name expire dates of all credit card transactions(thousands of them) unencrypted.
Anybody, at any time, could ahve downloaded that information to floppy and walked out.
It was a sweat shop, with 2 programer per card table(yes you read that right.).
So What? (Score:5, Funny)
Database salting (Score:3, Interesting)
Once again (Score:3, Interesting)