4 ms·
http://digg.com/2015/ashley-madison-hack http://digg.com/2015/ashley-madison-hack Not a complete answer, but: "MOTHERBOARD: How did you hack Avid Life Media?
by smtddr 11y ago
http://digg.com/2015/ashley-madison-hack http://digg.com/2015/ashley-madison-hack
Not a complete answer, but:
"MOTHERBOARD: How did you hack Avid Life Media? Was it hard?
The Impact Team: We worked hard to make fully undetectable attack, then got in and found nothing to bypass.
MOTHERBOARD: What was their security like?
The Impact Team: Bad. Nobody was watching. No security. Only thing was segmented network. You could use Pass1234 from the internet to VPN to root on all servers."
- graycat 11y agoWow! It's easy to make jokes, but actually this is serious -- a lot of people are going to be hurt, and so far already two have died. Sounds like AM's computing was all f__ked up! In US Army terminology, FUBAR. Or SNAFU. Gads. Wonder how AM paid, maybe I should say, compensated, their server farm system administration staff? Their server farm security was wide open? Should the users have expected something else?
- shitsandwich 11y agoit's an internet dating site, did you really expect more?
- sbierwagen 11y ago1.) They could be lying. 2.) My read is that, instead of no security, (or else AM would be have been compromised instantly by script kiddies) they used manufacturer default passwords on internal firewall appliances.
- jaredandrews 11y agoI googled "Pass1234" assuming it was some sort of exploit tool but didn't find anything. Can anyone explain what this answer means?
- untog 11y agoI assume they mean that they used it as a password.
- orionblastar 11y agoIt is one of many passwords used to reset a password for someone who forgot their password. Popular password resets: password passme abcdefg pass1234 reset changeme late4work I am sure there are others, once the password is changed to one of these easy passwords, someone who owns the account is support to change it to a harder password. I used to work as a federal contractor and in IT departments and handled password resets. One time as a federal contractor someone phoned in from Florida to pretend to be me or someone in my group to get our account password changed to one of the above. They used social engineering and might have been someone who worked there but retired. When you have a weak password, people can easily break in.