5 ms·
That's crazy, how was security so lax that a physical connection was enough to access state systems? Surely you'd require some kind of staff login.
by jorblumesea 10y ago
That's crazy, how was security so lax that a physical connection was enough to access state systems? Surely you'd require some kind of staff login.
- 2arrs2ells 10y ago> When they checked the login being used, they discovered an employee's credentials were being used on days he wasn't scheduled to work.
- kazagistar 10y agoThat's what happens when you don't have layered security. MAC address whitelisting, crytographic hardware tokens, 2fa, etc all would have stopped it dead in its tracks, but someone decided a login screen would be "enough".
- walrus01 10y agoOr even just 802.1x on LAN ports.
- amelius 10y agoYes, but it's easy to find effective countermeasures after the fact.
- kazagistar 10y agoThe point is that if you have multiple layers of countermeasures, then as long as one of them works you are OK. Too often are people willing to just rely on their one defensive layer.
- walrus01 10y agoIf it's a state government running the LAN at the prison they've failed to implement really basic standard LAN security measures like keeping ports down until they're actually in use by a known desktop PC or WAP, 802.1x, etc.
- rusk 10y agoI wonder were they using WISPr [0] ... this is notorious for its security issues and is in widespread use. It's the "Captive Portal" [1] thing you see when you're logging in to public hotspots. All authentication activities happen in the clear - very easy to sniff with a NIC in promiscuous mode. [0] https://en.wikipedia.org/wiki/WISPr [1] https://en.wikipedia.org/wiki/Captive_portal