Teen Who Hacked CIA Director’s Email Tells How He Did It(wired.com)
wired.com
Teen Who Hacked CIA Director’s Email Tells How He Did It
http://www.wired.com/2015/10/hacker-who-broke-into-cia-director-john-brennan-email-tells-how-he-did-it/
142 comments
I don't think anyone should be surprised that an intelligence agency - that has repeatedly violated its own country's law, and actively contributed to the weakening of civil rights - be guilty of this sort of negligence. That is exactly what happens when an institutions is allowed to grow unchecked, with no or little civilian oversight or consequences for the wrong-doings.
What's scary is that this kind of clueless, and technology illiterate, people are actively involved in shaping the future landscape of massive data collection.
I think we are about to witness, in the next decade, multiple "incidents" where millions, perhaps billions, of private records about innocent citizens will be leaked because of this kind of negligence.
What's scary is that this kind of clueless, and technology illiterate, people are actively involved in shaping the future landscape of massive data collection.
I think we are about to witness, in the next decade, multiple "incidents" where millions, perhaps billions, of private records about innocent citizens will be leaked because of this kind of negligence.
Nice rant. The last two paragraphs threw me off, though... how exactly is the CIA Director involved in shaping the future landscape of massive data collection?
I think people do deserve to be surprised. Competence is not the same as selflessness. Many people routinely question whether the FBI is operating for the good of the country, but most people at least believe that they are good at their job.
If interested in the CIA, you should read "Legacy of Ashes". That book documents how the CIA's biggest flaw through the years has been incompetence.
cf: Competence "What The Khost Bombing Says About The CIA" (Robert Baer) ~ http://www.npr.org/templates/story/story.php?storyId=1247377... and "A Dagger to the CIA" ~ http://www.gq.com/story/dagger-to-the-cia
and I would have gotten away with it too if only it weren't for my one flaw... being incompetent at everything!
I prefer an incompetent adversary over a competent one.
How about ally? Or is it so bad now that the CIA is an adversary, rather than an ally? I am sad that's actually a question.
I'm not sure that the CIA has ever been a real ally of the people in general, but to the extent that they are, it's similar to the inclusion of the USSR in the Allied Powers during World War II.
On top of that the previous CIA director was undone by a Gmail account he shared with his mistress. You'd think email security would have come up during the onboarding process. The CIA is an intelligence agency, but its leaders are apparently just regular bureaucrats.
To be fair, being an accomplished member of an agency of foreign affairs, and being in any way competent with information security and being a US citizen in the notice of the highest echelons of our government is asking a lot from a small circle of potential candidates who are predominately far older than your tech savvy computer engineer.
And in most ways, leaving his e-mail to a provider which works with e-mail and has dealt with attacks before, is probably the most sensible thing to do.
And of course, I've read Legacy of Ashes and a few of Robert Baear's books (Beaer?) and understand being accomplished in the world of the CIA just avoiding political entanglement and not fucking up too badly, but whatever, the point stands ;-).
And in most ways, leaving his e-mail to a provider which works with e-mail and has dealt with attacks before, is probably the most sensible thing to do.
And of course, I've read Legacy of Ashes and a few of Robert Baear's books (Beaer?) and understand being accomplished in the world of the CIA just avoiding political entanglement and not fucking up too badly, but whatever, the point stands ;-).
The sensible thing to do is to leave his work email in his work account. That guidance should be email training 101 as well as common sense. You're not supposed to take classified government documents home with you, and you don't take government property home with you, and you don't send official work email to your random private email account.
He has 24/7 instant access to very high quality opsec though, it doesn't matter that he's old. If he's too old to know any better he doesn't belong anywhere near classified material.
If it makes you feel any better (it won't), anyone else in the company would have been summarily fired and barred from further work in the IC if they had done the same.
I wonder if the primary fallout of this incident will be a government-wide mandatory email security training course.
There already is. It's part of the annual Information Assurance training that everyone has to take to maintain access to networks.
This isn't to excuse his conduct in any way shape or form, but I suspect that every high ranking official in the public or private sector keeps a private e-mail account for conducting business off-the-books.
Or just having a personal email address for non-work reasons. They're still human, even if they're high-level elected officials or CEOs, and they won't have that job/office forever.
> "...where they read several dozen emails, some of them that Brennan had forwarded from his government work address and that contained attachments..."
Sorry, but this doesn't sound like "personal email address for non-work reasons"...
Sorry, but this doesn't sound like "personal email address for non-work reasons"...
At this point, I feel like the AOL account was actually a clever honeypot.
> After providing the Verizon employee with a fabricated employee Vcode—a unique code the he says Verizon assigns employees—they got the information they were seeking. This included Brennan’s account number, his four-digit PIN, the backup mobile number on the account, Brennan’s AOL email address and the last four digits on his bank card.
There are obviously a _lot_ of wtf moments reading this article, but this one just strikes me as the most egregious - why in the world would a Verizon employee of any kind be able to obtain this information from anyone other than the account holder? The account number, ok maybe, but absolutely none of those other items should be communicated between employees. Absurd.
There are obviously a _lot_ of wtf moments reading this article, but this one just strikes me as the most egregious - why in the world would a Verizon employee of any kind be able to obtain this information from anyone other than the account holder? The account number, ok maybe, but absolutely none of those other items should be communicated between employees. Absurd.
That information is internally available within Verizon, to its employees, to (presumably) verify ownership of an account when speaking to a customer. None of that is surprising - that information is commonly used as security challenge questions in phone support situations.
Whether it should be, well that is another matter.
Whether it should be, well that is another matter.
It's understandable that the information is there and accessible. But, again, it should never be communicated between employees, only between employee and account holder. Maybe such policy is not common practice for businesses? It seems like an obvious security measure.
When I worked for Embarq doing DSL support the procedure for a field technician to obtain customer information was to call into a special phone number provide a technician code.
There are several problems with this:
1.) The phone number can be found on the internet.
2.) The technician code is just noted down as part of the request. It is not verified.
3.) The support employee's validation process that they are a field technician was that they were calling over the special phone number.
Obviously sensitive information was not supposed to be given out, but they hired anyone that was alive enough to answer a phone and tell people to reset their router.
There are several problems with this:
1.) The phone number can be found on the internet.
2.) The technician code is just noted down as part of the request. It is not verified.
3.) The support employee's validation process that they are a field technician was that they were calling over the special phone number.
Obviously sensitive information was not supposed to be given out, but they hired anyone that was alive enough to answer a phone and tell people to reset their router.
Well, it seems like employees should be able to verify that the security information matches what's on file without actually seeing. So, an employee could enter the last four digits of the CC number into a form and then get verification if they're correct, but wouldn't be able to just pull up that info and give it to someone else.
>None of that is surprising - that information is commonly used as security challenge questions in phone support situations. //
The PIN at least seems like it should have been hashed, then an employee puts in a form the stated PIN to see if it's correct and the hashes are compared on the backend.
The other info though is needed for initiating contact and to allow customers to perform transactions (verifying card details for example).
The PIN at least seems like it should have been hashed, then an employee puts in a form the stated PIN to see if it's correct and the hashes are compared on the backend.
The other info though is needed for initiating contact and to allow customers to perform transactions (verifying card details for example).
Hashing wouldn't help much for a PIN (which is usually just 4 digits). You could get a rainbow table for that in like 5 seconds. Even salting wouldn't help, given how tiny the keyspace is.
The suggestion wasn't about having verizon's database being hacked, but rather that other employees can see this data at all.
That's definitely not how the PIN verification happens, as I got a single digit wrong once and the person on the phone told me that fact.
> The hackers described how they were able to access sensitive government documents stored as attachments in Brennan’s personal account because the spy chief had forwarded them from his work email.
How is this acceptable? Shouldn't he be held accountable for this kind of stuff?
How is this acceptable? Shouldn't he be held accountable for this kind of stuff?
It's also VERY foolish from a liability standpoint to do this kind of thing, as it gives someone justification to subpoena your personal email.
>How is this acceptable? Shouldn't he be held accountable for this kind of stuff?
You're the new young email admin. You see this in your logs. You tell your boss. Your boss shrugs and says, "He's the director and I don't feel like getting fired."
I don't know why people think government, be it any agency including intelligence, is run any different than any other political or corporate bureaucracy. Humanity has a natural pecking order cooked into it and it reflects in our organizations. One does not just challenge the big dog without consequences. Hell, staff may not be able to even audit him the same way Congress has made itself immune to the NSA wire-tapping programs.
You're the new young email admin. You see this in your logs. You tell your boss. Your boss shrugs and says, "He's the director and I don't feel like getting fired."
I don't know why people think government, be it any agency including intelligence, is run any different than any other political or corporate bureaucracy. Humanity has a natural pecking order cooked into it and it reflects in our organizations. One does not just challenge the big dog without consequences. Hell, staff may not be able to even audit him the same way Congress has made itself immune to the NSA wire-tapping programs.
>I don't know why people think government, be it any agency including intelligence, is run any different than any other political or corporate bureaucracy. //
Maybe it's the big "democracy" label that people apply to it.
Maybe it's the concept of "Rule of Law" that underpins Western Democracy.
If it's possible to be fired for simply applying the statutory regulations to a civil servant then any semblance of either democracy or rule of law has clearly been replaced with other structures.
Presumably the CIA would try to kill you to cover this up, because otherwise the sacking of the infringer should be a normal conclusion?
Maybe it's the big "democracy" label that people apply to it.
Maybe it's the concept of "Rule of Law" that underpins Western Democracy.
If it's possible to be fired for simply applying the statutory regulations to a civil servant then any semblance of either democracy or rule of law has clearly been replaced with other structures.
Presumably the CIA would try to kill you to cover this up, because otherwise the sacking of the infringer should be a normal conclusion?
Agreed, that's frankly amazing. How can he even get it through their mail system with an attachment to an unsecure address.
They have separate computers & networks for unclassified vs classified material. You probably couldn't do that on a classified network.
Yeah, that seems to be very foolish.
However, I wonder why the agency simply does not disable forwarding or at least add sure warnings in bright red that doing so violates policy and subject to charges.
Sure, disabling fwd-ing is trivial to defeat but it makes clear fwd-ing is non standard.
However, I wonder why the agency simply does not disable forwarding or at least add sure warnings in bright red that doing so violates policy and subject to charges.
Sure, disabling fwd-ing is trivial to defeat but it makes clear fwd-ing is non standard.
None of it was classified.
Doesn't matter-- He's talking about torture and Iranian "realpolitik" on an @AOL email address. In an election cycle. With one headline candidate already getting grilled over improper use of private email.
It was sensitive however. Some contained employee SSNs.
How do you know? Maybe this 'hacker' hasn't released the classified stuff yet.
Accountable for hackers claiming something that's not necessarily true?
Social engineering is, and will always be, the fastest way to compromise a system.
Computers are pretty good at security; humans, especially underpaid and overworked helpdesk jockeys, are not.
Computers are pretty good at security; humans, especially underpaid and overworked helpdesk jockeys, are not.
I read the autobiography of hacker Kevin Mitnick and the thing that struck me the most was how his "hacking" consisted of manipulating people. I can recall one case in the book where he compromised a system on a purely technical level. Almost every other hack was based on convincing people to tell him things they should not.
Why break into a system when you can ask someone to unlock it for you?
Why break into a system when you can ask someone to unlock it for you?
It definitely was a little disillusioning when I learned that many famous hackers were not technical wizards (like bunnie) but in fact basically con artists.
Take a broader view of hacking. A system is not just its code, it's the people that run it, too. If you want to break into a system, they are frequently the best point of entry.
To paraphrase from the first season of Mr. Robot as they're looking over surveillance pictures of a secure data center compound with high walls, biometrics, security cameras, and 4 armed security guards;
"How do you break into a place with no weak points?"
"I see four weak points right there."
"How do you break into a place with no weak points?"
"I see four weak points right there."
"I see about six walking around."
I find it interesting how Verizon didn't notice that they used a fake employee id. I wonder if they just made up one that looked like it could pass or if they had to generate one that passed a verification, and if so, how.
Even if they used a real Employee ID, would it be better?
The barrier to entry to become a Verizon employee is lower than the barrier to obtaining this info should be.
The barrier to entry to become a Verizon employee is lower than the barrier to obtaining this info should be.
Fun fact: The telco's have the notion of a "VIP" customer where their information is restricted to a very small group of customer service reps who are trained to protect their privacy.
Their clients usually include celebs, pro athletes, etc... I'm surprised that the CIA chief isn't on that tier.
Their clients usually include celebs, pro athletes, etc... I'm surprised that the CIA chief isn't on that tier.
Isn't this basically the telcos admitting they don't protect the privacy of "normal" customers?
No, it's understanding that different customers have different risk profiles and using that information to deploy your security resources efficiently. Verified accounts on Twitter use the same concept... not everybody needs that.
It would be nice to be able to purchase this kind of thing directly though.
It would be nice to be able to purchase this kind of thing directly though.
How do you become a VIP? Can you just ask? Do all the Michael Jordans just get to share automatic VIP status with the MJ?
A real employee ID could at least be verified.
> The barrier to entry to become a Verizon employee is lower than the barrier to obtaining this info should be.
The problem with this approach is that it leaves a pretty clear trail. At best you need to hand the customer info off to someone else with no obvious ties and claim you were social-engineered in giving up your employee id. Also you can really only do this once.
> The barrier to entry to become a Verizon employee is lower than the barrier to obtaining this info should be.
The problem with this approach is that it leaves a pretty clear trail. At best you need to hand the customer info off to someone else with no obvious ties and claim you were social-engineered in giving up your employee id. Also you can really only do this once.
Humans are the softy vulnerable underside of the computer-dragon.
Norman? This is Mr. Eddie Vedder, from Accounting.... My BLT Drive on my computer just went AWOL .... http://cyberdelianyc.tumblr.com/post/131628279720/hackers-ci...
Wikileaks has now published the emails:
https://wikileaks.org/cia-emails/
https://wikileaks.org/cia-emails/
+1. I just clicked to read the frontpage, but living in the USA, I'm honestly concerned of consequences of clicking any HTML/PDF links.
What this country grew to become :(
What this country grew to become :(
I think your fear says more about you than the country. I open these links without a second thought.
EDIT: The leaks are pretty disappointing, unless you care about how many times the director ate with Alan Lovell. The real story is the fact that there were leaks at all, not the leaks themselves.
EDIT: The leaks are pretty disappointing, unless you care about how many times the director ate with Alan Lovell. The real story is the fact that there were leaks at all, not the leaks themselves.
> The Conundrum of Iran.
> Iran will be a major player on the world stage in the decades ahead, and its actions and behavior will have a major and enduring impact on near- and long-term US interests on a variety of regional and global issues. With a population of over 70 million, XX percent of the world's proven oil reserves, a geostrategic location of tremendous (enviable?) significance, and a demonstrated potential to develop a nuclear-weapons program, the United States has no choice but to find a way to coexist - and to come to terms with - whatever government holds power in Tehran. [...]
> An unfortunate hallmark of US-Iranian relations since 2001 has been [the] growing divide between Washington and Tehran, chronicled by bombastic rhetorical broadsides that have been hurled publicly by each side against the other. The tragedy of the al-Qa'ida launched terrorist attacks against the US homeland in September 2001 prompted the US administration to engage in a far-reaching campaign to eradicate the sources of terrorism, and Iran, understandably - but regrettably - was swept up in the emotionally charged rhetoric that emanated from Washington under the seemingly all-encompassing rubric of "The Global War On Terrorism". The gratuitious labeling of Iran as part of a worldwide "axis of evil" by President Bush combined with strong US criticisms of Iran's nascent nuclear program and its meddling in Iraq led Tehran to view that Washington had embarked on a course of confrontation in the region that would soon set a kinetic focus on Iran. Even Iran's positive engagement in helping repair the post-Taliban political environment in Afghanistan was met with indifference by Washington. [...]
https://wikileaks.org/cia-emails/The-Conundrum-of-Iran/page-...
While this leak may not be particularly confidential nor surprising to informed readers, I'd say reading this kind of insight into what US leaders really think is pretty damn interesting.
> Iran will be a major player on the world stage in the decades ahead, and its actions and behavior will have a major and enduring impact on near- and long-term US interests on a variety of regional and global issues. With a population of over 70 million, XX percent of the world's proven oil reserves, a geostrategic location of tremendous (enviable?) significance, and a demonstrated potential to develop a nuclear-weapons program, the United States has no choice but to find a way to coexist - and to come to terms with - whatever government holds power in Tehran. [...]
> An unfortunate hallmark of US-Iranian relations since 2001 has been [the] growing divide between Washington and Tehran, chronicled by bombastic rhetorical broadsides that have been hurled publicly by each side against the other. The tragedy of the al-Qa'ida launched terrorist attacks against the US homeland in September 2001 prompted the US administration to engage in a far-reaching campaign to eradicate the sources of terrorism, and Iran, understandably - but regrettably - was swept up in the emotionally charged rhetoric that emanated from Washington under the seemingly all-encompassing rubric of "The Global War On Terrorism". The gratuitious labeling of Iran as part of a worldwide "axis of evil" by President Bush combined with strong US criticisms of Iran's nascent nuclear program and its meddling in Iraq led Tehran to view that Washington had embarked on a course of confrontation in the region that would soon set a kinetic focus on Iran. Even Iran's positive engagement in helping repair the post-Taliban political environment in Afghanistan was met with indifference by Washington. [...]
https://wikileaks.org/cia-emails/The-Conundrum-of-Iran/page-...
While this leak may not be particularly confidential nor surprising to informed readers, I'd say reading this kind of insight into what US leaders really think is pretty damn interesting.
Did you just glance at them or do you mean not a lot of interesting national sec/CIA stuff. There's some pretty personal private stuff in there including a complete SF86 form with a minefield of personal information including SSN numbers, previous addresses etc. I imagine these could be useful to someone who might be interested in compromising a few more of his personal accounts.
Is it available as one big torrent anywhere or is that more likely once its all been leaked?
The worst news here is that the director of the most powerful information gathering agency on the planet uses AOL.
I know what you mean, but in a way I find it strangely reassuring that the head of the CIA is (in some respects at least) plain old old-skool dumb.
It tends to confirm me in my suspicions that the media-projected image of ruthlessly efficient and mindbogglingly smart intel apparatchiks is a fantasy, and that the reality might be more like Burn After Reading[1]
1: https://www.youtube.com/watch?v=8FHpOLiobmA
It tends to confirm me in my suspicions that the media-projected image of ruthlessly efficient and mindbogglingly smart intel apparatchiks is a fantasy, and that the reality might be more like Burn After Reading[1]
1: https://www.youtube.com/watch?v=8FHpOLiobmA
Even more so that he actually thought it was secure enough to apply for the job at the CIA with an AOL email and that they actually hired him.
What does this article have to do with Google and Facebook's CEOs?
edit: No, seriously. I can't see how the CIA is the most powerful information gathering agency on the planet. Even restricting to government organizations, the NSA likely has far more access to information. Allowing for private organizations, Google/Facebook likely know far more about individual people than any government agency does given Google Analytics, Facebook Like buttons, etc. strewn around virtually every public internet page.
edit: No, seriously. I can't see how the CIA is the most powerful information gathering agency on the planet. Even restricting to government organizations, the NSA likely has far more access to information. Allowing for private organizations, Google/Facebook likely know far more about individual people than any government agency does given Google Analytics, Facebook Like buttons, etc. strewn around virtually every public internet page.
Google, Facebook, and the NSA may have more data, but the CIA can actually do something with it.
Is it worse than any other free email provider? None of them have two factor login by default and they all have sketchy password reset policies/mechanisms. Brennan is 60 years old. He's probably been using AOL since the 90's. He felt no need for change. A lot of our top leadership are boomers and will have boomer habits.
If you read that article you'll see this is more of a social engineering hack on Verizon than AOL. Verizon gave up all sorts of information about him which made answering AOL's password reset questions easy for them. Its scary how much you can do to a person if you know the last four digits of their credit card.
This is yet another example where things like S/MIME would have helped, but apparently we're all content with completely unencrypted emails. I suspect guys like Brennan prefer email unencrypted anyway, except when things like this happen to him personally.
If you read that article you'll see this is more of a social engineering hack on Verizon than AOL. Verizon gave up all sorts of information about him which made answering AOL's password reset questions easy for them. Its scary how much you can do to a person if you know the last four digits of their credit card.
This is yet another example where things like S/MIME would have helped, but apparently we're all content with completely unencrypted emails. I suspect guys like Brennan prefer email unencrypted anyway, except when things like this happen to him personally.
> Is it worse than any other free email provider?
Not really, but they are definitely on the bottom of the trusted list. That being said, the WTFs in this story would be the same if it was yahoo, gmail, etc. The problem is that the emails were forwarded out from his work network.
Not really, but they are definitely on the bottom of the trusted list. That being said, the WTFs in this story would be the same if it was yahoo, gmail, etc. The problem is that the emails were forwarded out from his work network.
Who is trusted? Federal law applies equally too all American companies. Google can't say no to a warrant the same way AOL can't.
AOL doesn't support 2-factor authentication for email sign-in. If they did, then this entire debacle would [edit- replace "would" with "could"] have been stopped before it even started.
I'm also surprised that the government doesn't have more stringent guidelines about the private email use of its top officials.
I'm also surprised that the government doesn't have more stringent guidelines about the private email use of its top officials.
It doesn't stop it, but it does raise the bar.
Since these guys knew how verizon works internally I wouldn't be surprised if they could forward his cell # somewhere else. Some 2FA systems require a PIN for auth, but they have his verizon one already, which is probably re-used everywhere.
Since these guys knew how verizon works internally I wouldn't be surprised if they could forward his cell # somewhere else. Some 2FA systems require a PIN for auth, but they have his verizon one already, which is probably re-used everywhere.
This is why SMS- or phone-based 2FA is not a good idea. HOTP/TOTP is the right way to implement 2-factor auth.
https://en.wikipedia.org/wiki/HMAC-based_One-time_Password_Algorithm
https://en.wikipedia.org/wiki/Time-based_One-time_Password_AlgorithmAnd totally impractical for most people...
Google Authenticator is pretty easy to use, as are the alternatives. Also really easy to provision. Not sure how SMS is more practical than an offline code generator.
First notice how "pretty easy" isn't the same as straightforward. Good luck getting my mom to figure it out.
If you lose your phone, upgrade to a new one, or erase and restore it you lose all your authenticator credentials. That doesn't happen with SMS.
If you're in a situation where security is paramount, then physical cards or authenticator are a better way to go. If you're 99.9% of the population, Sms is a far better solution.
If you lose your phone, upgrade to a new one, or erase and restore it you lose all your authenticator credentials. That doesn't happen with SMS.
If you're in a situation where security is paramount, then physical cards or authenticator are a better way to go. If you're 99.9% of the population, Sms is a far better solution.
Just because a service offers 2-factor authentication doesn't mean people will use it.
You're right, I should have clarified that in my comment.
Not even offering it is a serious oversight on AOL's part for exactly this type of scenario- it makes it extremely easy for a motivated person to socially hack someone's email. However even if it is offered it has to be turned on to work, so then we'd be back where we started if it was off by default.
Not even offering it is a serious oversight on AOL's part for exactly this type of scenario- it makes it extremely easy for a motivated person to socially hack someone's email. However even if it is offered it has to be turned on to work, so then we'd be back where we started if it was off by default.
Is there a term for this kind of response?
Its kind of obvious that not everyone will use it. However, not offering it when its somewhat trivial to do so seems like a no-brainer.
Its kind of obvious that not everyone will use it. However, not offering it when its somewhat trivial to do so seems like a no-brainer.
I agree that AOL and most other services should offer 2fa. However, I disagree with the parent that the situation would not have occurred if AOL did offer 2fa because the subject in question would still be unlikely to use it.
> I'm also surprised that the government doesn't have more stringent guidelines about the private email use of its top officials.
It does. Guidelines don't stop people from doing things, especially when they're at the level where they think they're above such policies.
It does. Guidelines don't stop people from doing things, especially when they're at the level where they think they're above such policies.
Even 2FA will have some mechanism for resetting the password without the second factor, because people lose their 2FA device (usually a phone) all the time. There has to be a way to recover from losing your 2FA device - given how easily the social engineering was shown to be here, I doubt that would help much.
How do you design a system that's hardened against social engineering but not hardened against innocent mistakes, like losing your password? It seems like the easiest way to access public systems like this is through social engineering techniques around password recovery or phishing.
Of course there are well-known answers that are used to mitigate these problems somewhat, TFA solutions, login images, etc. But I still feel as if social engineering attacks hit a really vulnerable weak spot in many systems.
(On a mostly unrelated note, can we get rid of security questions forever? I've taken to just giving nonsense answers for them and storing my answers somewhere secure. I sure don't want my passwords being reset because somebody knows my mom's maiden name...)
Of course there are well-known answers that are used to mitigate these problems somewhat, TFA solutions, login images, etc. But I still feel as if social engineering attacks hit a really vulnerable weak spot in many systems.
(On a mostly unrelated note, can we get rid of security questions forever? I've taken to just giving nonsense answers for them and storing my answers somewhere secure. I sure don't want my passwords being reset because somebody knows my mom's maiden name...)
> I sure don't want my passwords being reset because somebody knows my mom's maiden name...
Not only that, any site that used that question and all those that got hacked know your mom's maiden name if that question was ever answered seriously. That's the main reason such 'secret questions' suck because there apparently is a fairly small set of commonly used questions like that (first school, first pet, favorite pet, moms maiden name, street where you were born and so on).
Not only that, any site that used that question and all those that got hacked know your mom's maiden name if that question was ever answered seriously. That's the main reason such 'secret questions' suck because there apparently is a fairly small set of commonly used questions like that (first school, first pet, favorite pet, moms maiden name, street where you were born and so on).
Yup. I end up just storing the questions in my password vault along with the generated answers I used for them. Not exactly helpful.
Yet another reason to not be facebook friends with relatives.
Much is being made of him using AOL for work emails. Seems like a fairly minor issue. The worst part was the spreadsheet with ~20 people's info on it. Otherwise, he forwarded emails to himself that he wanted to permanently have possession of, like his own clearance application and a letter from the Senate on torture. I'm more interested in this letter--sent in 2009. Who knew what and when?
(Edit) the letter -- https://twitter.com/phphax/status/653665742987100163
(Edit) the letter -- https://twitter.com/phphax/status/653665742987100163
What do you want?
> We said ‘2 trillion dollars hahhaa'
Ok, I can work with that
> They told Brennan “We just want Palestine to be free and for you to stop killing innocent people.”
Sorry, can't do that
> We said ‘2 trillion dollars hahhaa'
Ok, I can work with that
> They told Brennan “We just want Palestine to be free and for you to stop killing innocent people.”
Sorry, can't do that
Or as Sneakers (1992) did it:
Whistler: I want peace on earth and goodwill toward man.
Bernard Abbott: Oh, this is ridiculous.
Martin Bishop: He's serious.
Whistler: I want peace on earth and goodwill toward men.
Bernard Abbott: We are the United States Government! We don't do that sort of thing.
Whistler: I want peace on earth and goodwill toward man.
Bernard Abbott: Oh, this is ridiculous.
Martin Bishop: He's serious.
Whistler: I want peace on earth and goodwill toward men.
Bernard Abbott: We are the United States Government! We don't do that sort of thing.
I really hope these kids have not destroyed the rest of their lives just to make a (very good) Dr. Evil joke [1]:
'So they called Brennan’s mobile number, using VoIP, and told him he’d been hacked. The conversation was brief.
“[I]t was like ‘Hey,…. its CWA.’ He was like ‘What do you want?’ We said ‘2 trillion dollars hahhaa, just joking,'” the hacker recounted to WIRED.'
[1] https://www.youtube.com/watch?v=l91ISfcuzDw
'So they called Brennan’s mobile number, using VoIP, and told him he’d been hacked. The conversation was brief.
“[I]t was like ‘Hey,…. its CWA.’ He was like ‘What do you want?’ We said ‘2 trillion dollars hahhaa, just joking,'” the hacker recounted to WIRED.'
[1] https://www.youtube.com/watch?v=l91ISfcuzDw
> Brennan, the hacker says, replied, “How much do you really want?”
Could be an embellishment, but it sounds like he really was willing to pay something. Perhaps more for his personal privacy than out of fear of national secrets leaking, though.
Could be an embellishment, but it sounds like he really was willing to pay something. Perhaps more for his personal privacy than out of fear of national secrets leaking, though.
Doubt it. Sounds to me like he was fishing for information so he could find out who they were. If they'd said, "Sure, we want $X million!" then they'd have to hash out a delivery method, all of a sudden they're on USGov's turf.
True. They could have tried bitcoin. Receiving is the easy part -- spending it and remaining free might have been a problem, though...
They also said they want Palestine to be free and to stop killing innocent people. I hope he hears that message!
There was a story within the past year or two I remember that was in a similar vein: where the hackers were able to obtain some address info from Apple support, which led to CC info from Amazon tech support, which led to interception of the users phone number and then bypassing of 2FA, which led to primary email takeover. I felt then, as I do now, that there should be a standardized process for identifying user information across all companies that doesn't allow for this patchwork gathering of info and incorporates a type of 2FA.
I remembered this thought again recently when dealing with major banks over the phone. All I needed to identify who I am was confirmation of my home address, and last 4 digits of my social. That is hardly secure! A single data breach for SSN, cross referencing an email to social media or DNS if you don't use private registration and boom, you can pretend to be me as far as some banks are concerned.
The SSN is the most abused number in the ID world. It's a de-facto federal ID number and it's simply not meant for the task. Everyone gets all upidy about having some type of federal ID number whenever I mention it, but I feel like some type of public key cryptographic federal ID number plus cross-signing, changeable password, AND a 2+FA should be used to truly identify who you are.
I remembered this thought again recently when dealing with major banks over the phone. All I needed to identify who I am was confirmation of my home address, and last 4 digits of my social. That is hardly secure! A single data breach for SSN, cross referencing an email to social media or DNS if you don't use private registration and boom, you can pretend to be me as far as some banks are concerned.
The SSN is the most abused number in the ID world. It's a de-facto federal ID number and it's simply not meant for the task. Everyone gets all upidy about having some type of federal ID number whenever I mention it, but I feel like some type of public key cryptographic federal ID number plus cross-signing, changeable password, AND a 2+FA should be used to truly identify who you are.
People seem to forget that hacking personal accounts is not difficult, even for novice hackers. The reason most people don't get hacked is either 1. they weren't a funny/interesting target, or 2. nobody wanted to get caught.
Also, the CWA's twitter account was suspended, but thanks be to The Internet Archive we have a mirror:
https://web.archive.org/web/20151019192351/https:/twitter.co...
The Twitter pictures aren't archived, but they also haven't been taken down from Twitter's site.
Also, the CWA's twitter account was suspended, but thanks be to The Internet Archive we have a mirror:
https://web.archive.org/web/20151019192351/https:/twitter.co...
The Twitter pictures aren't archived, but they also haven't been taken down from Twitter's site.
Shouldn't there be like a department in the CIA that scraps all of that stuff for agency employees?
I know that some other agencies, and even private corporation do that.
I know that some other agencies, and even private corporation do that.
It's crazy to me that as a society we celebrate the digital equivalent of smashing a window in with a brick and climbing in through the jagged glass.
This wasn't a skillful attack. It was a messy, shitty social engineering exploit that very many people could have done.
This wasn't a skillful attack. It was a messy, shitty social engineering exploit that very many people could have done.
How did the attackers know that Brennan had an AOL address?
Let's not take the attackers at face value. They could have had help or be employed by anyone, including those either interested in Brennan's AOL email or in embarassing him.
Let's not take the attackers at face value. They could have had help or be employed by anyone, including those either interested in Brennan's AOL email or in embarassing him.
The article says they got the AOL address from Verizon via pretexting.
Two things.
1) This kid just got at least one person fired from his job (though he may deserve it).
2) This kid WILL be caught and regret it the rest of his life.
1) This kid just got at least one person fired from his job (though he may deserve it).
2) This kid WILL be caught and regret it the rest of his life.
The vast majority of hackers are never caught. If the individual makes a habit of doing this without proper opsec, maybe.
It's a lot easier to get away with hacking than most people make it out to be. When I was 14 years old I hacked one of the largest banks in the UK on a laugh with friends in high school using SQL injection. I didn't steal anything, but I did get access to very sensitive information about many members' accounts. It wouldn't have been difficult to do so and get away with it on a compartmentalized burner laptop with a VPN. Most banks write off relatively "small amounts" and simply eat the loss for the customer.
Young kids who have an aptitude for it pull off immature, amateur hacks like this all the time. Based purely on anecdote I'd say there is likely at least one adolescent in virtually every high school in America who has committed some sort of serious computer fraud.
Now I work in the security industry and just yesterday, I found a vulnerability in a website allowing you to use another user's payment because of an insecure direct object reference combined with clearly sequential payment IDs in the database. The methods evolve, but the core systems have stayed more or less the same and it would not be difficult to exploit this one and get away with it either.
People think this stuff is hard to get away with because of the sensationalized mystique surrounding it in the media. Unless you're very loud, incompetent or a big enough target, it just doesn't usually happen. I've personally spoken to "blackhat" groups that have cleared a few million dollars in a year, allowing each member a roughly top-1% income after laundering for a few hours of "work" per week. They're still around.
It's a lot easier to get away with hacking than most people make it out to be. When I was 14 years old I hacked one of the largest banks in the UK on a laugh with friends in high school using SQL injection. I didn't steal anything, but I did get access to very sensitive information about many members' accounts. It wouldn't have been difficult to do so and get away with it on a compartmentalized burner laptop with a VPN. Most banks write off relatively "small amounts" and simply eat the loss for the customer.
Young kids who have an aptitude for it pull off immature, amateur hacks like this all the time. Based purely on anecdote I'd say there is likely at least one adolescent in virtually every high school in America who has committed some sort of serious computer fraud.
Now I work in the security industry and just yesterday, I found a vulnerability in a website allowing you to use another user's payment because of an insecure direct object reference combined with clearly sequential payment IDs in the database. The methods evolve, but the core systems have stayed more or less the same and it would not be difficult to exploit this one and get away with it either.
People think this stuff is hard to get away with because of the sensationalized mystique surrounding it in the media. Unless you're very loud, incompetent or a big enough target, it just doesn't usually happen. I've personally spoken to "blackhat" groups that have cleared a few million dollars in a year, allowing each member a roughly top-1% income after laundering for a few hours of "work" per week. They're still around.
I have a suspicion that the CIA knew the identity of this kid and his associates within a few minutes of this Brennan guy figuring out his email had been hacked.
Well I have a [conspiracy] theory that they knew his identity before the hack - perfect way for the director to leak information without being brought to book, send it to an account that can be easily accessed with social engineering.
Or we can go deeper, the CIA director was preparing to do this so the subject-to-be of the docs he wished to leak had his account hacked to expose the flaw and prevent the leak-to-be.
Or we can go deeper, the CIA director was preparing to do this so the subject-to-be of the docs he wished to leak had his account hacked to expose the flaw and prevent the leak-to-be.
>Unless you're very loud, incompetent or a big enough target
The very description of this kid. At least the loud part. His age may make him other things.
The very description of this kid. At least the loud part. His age may make him other things.
[deleted]
Now the kid is going to be hunted. Blacklist. You know. Anything, hacking someone's account is wrong regardless. just because he's the Director of CIA.
>Teen Who Hacked...
>The hacker, who says he’s under 20 years old
20 years old is a teen? What a terrible headline.
>The hacker, who says he’s under 20 years old
20 years old is a teen? What a terrible headline.
The text you quoted says "under 20 years old".
Not only did you nitpick the least important part of the article, but you were also wrong.
If you're gonna be pedantic, at least be correct.
If you're gonna be pedantic, at least be correct.
[deleted]
Why is this even a story?
Has there been any confirmation that this account even actually belonged to the CIA director? If yes, has there been any evidence that there was actually anything sensitive on the account? (I seriously doubt the latter)
If there was nothing on the account how is this different from any of the other tens of thousands of aols that have been hijacked since the 90s?
Has there been any confirmation that this account even actually belonged to the CIA director? If yes, has there been any evidence that there was actually anything sensitive on the account? (I seriously doubt the latter)
If there was nothing on the account how is this different from any of the other tens of thousands of aols that have been hijacked since the 90s?
"as there been any evidence that there was actually anything sensitive on the account?"
Wikileaks is publishing all of the supposed files, so they do exist and have been leaked.
http://www.theverge.com/2015/10/21/9583464/wikileaks-cia-ema...
Wikileaks is publishing all of the supposed files, so they do exist and have been leaked.
http://www.theverge.com/2015/10/21/9583464/wikileaks-cia-ema...
The sensitivity of any of that is really questionable.
> Has there been any confirmation that this account even actually belonged to the CIA director?
Yes
> If yes, has there been any evidence that there was actually anything sensitive on the account?
Yes
Go Google for 5 minutes.
Yes
> If yes, has there been any evidence that there was actually anything sensitive on the account?
Yes
Go Google for 5 minutes.
Googling for 5 minutes didn't return anything supporting the second claim.
It appears you couldn't have Googled for more than 2-3 minutes.
How so?
Your response was between two and three minutes after the comment telling you to Google for five minutes.
This topic was on HN a few days ago: https://news.ycombinator.com/item?id=10413563
In that article the hacker claims he found sensitive material, and even flagrantly taunted the CIA director with it...
In that article the hacker claims he found sensitive material, and even flagrantly taunted the CIA director with it...
Yes and there is zero evidence of any sensitive material.
>Yes and there is zero evidence of any sensitive material.
A ton of info. was posted on his twitter account that is now suspended. For DHS and FBI to investigate, they must have solid evidence of a breach to do so.
A ton of info. was posted on his twitter account that is now suspended. For DHS and FBI to investigate, they must have solid evidence of a breach to do so.
The most "sensitive" info I saw was his own SSN, which anyone can buy off of ssndob...
This was posted on the guys twitter page: https://twitter.com/phphax/status/656152792453795840/photo/1
A list of names?
I don't see anything there that wouldn't be publicly available on the internet.
I don't see anything there that wouldn't be publicly available on the internet.
Also he thought it was Ok to forward Sensitive Govt. Docs to a non-secured commercial e-mail address.
The amount of almost un-restrained power that these people have vs the very low quality of their InfoSec is truly appalling.