7 ms·
Anonymous hacks Booz Allen Hamilton, US military contractor, 90k logins dumped
- wccrawford 15y ago4 hours? Cripes! I hope they're kidding about how long that took them. I knew security was bad out there, but that's ridiculous.
- JonnieCache 15y agoUnsalted MD5 as well. And looking at the list of people apparently in their employ, this could lead to some serious drama. Seriously though, unsalted MD5? Again? Like they say in the release, anonymous can't be any more explicit. Their slogan is "expect us." That should be a clue.
- diogenescynic 15y agoAt this point, I think these guys should be given a job. If they can exploit these vulnerabilities then it's almost certain that our enemies already are exploiting them.
- someone13 15y agoSadly, exploitation is often much easier than protection. They only need to find one hole - the defender must secure everything. Oh, and it's probably not good to encourage this kind of thing either.
- ZeSmith 15y agoYeah, "defender's advantage" does not apply in the wacky world of computer security.
- lawnchair_larry 15y agoBut it's worse to hide and ignore the problem. The other poster hit the nail on the head. This stuff is happening on a much larger scale - it's only because of lulzsec/anonymous that anyone even has a clue how bad the situation really is.
- killerswan 15y agoDue to the anonymous nature of these things, some of these recent attacks could easily be from within the USA's govt, just like the anthrax letters were. It does seem clear, though, that we all have a lot to learn about protecting information...
- someone13 15y agoActually, I don't disagree with you - it's a good thing (for a certain value of "good" - in a perfect world, things would all be secure, and we'd ride unicorns everywhere) that this kind of stuff is exposed. What I disagree with is the "giving them a job" bit. I don't think that rewarding these kinds of people with employment is right - part of working in computer security is having a certain code of ethics. Whereas I'd much prefer that this kind of stuff be made public, giving them a job is similar to rewarding a thief with a job as a cop. People are free to disagree, of course :P
- diogenescynic 15y agoI'm not encouraging the act, I'm just saying the companies should respond pro-actively not just pretend the problem(s) don't exist. Doing nothing is the absolute worst option.
- d0m 15y agoIt's not always about exploits and vulnerabilities, social engineering can also be extremely dangerous.
- diogenescynic 15y agoComputer disks and USB sticks were dropped in parking lots of government buildings and private contractors, and 60% of the people who picked them up plugged the devices into office computers. And if the drive or CD had an official logo on it, 90% were installed: http://thenextweb.com/industry/2011/06/28/us-govt-plant-usb-sticks-in-security-study-60-of-subjects-take-the-bait/ http://thenextweb.com/industry/2011/06/28/us-govt-plant-usb-...
- pavel_lishin 15y ago> At this point, I think these guys should be given a job. Who says they haven't been offered some?
- hack_edu 15y agoOr already have one and these are their Weekend Projects.
- pavel_lishin 15y agoFunny, but I imagine that this would be a really really good way to be fired and blacklisted in the security penetration community. Somewhat akin to having a day job installing security systems, and by night, breaking into houses secured by your competitors.
- Locke1689 15y agoNo, they're probably infosec and just don't go around blabbing about their night activities.
- helmut_hed 15y agoOr, even more frightening, what if this is their job?
- hack_edu 15y agoTheir habits show that they would not be interested in a job at the targets of their hacks, and a good portion of them are likely employed in the infosec industry already. These aren't kids.
- r00fus 15y agoRemember when Anonymous broke into HBGary and consequently, rootkit.org? Releasing the emails was just one outcome. The other was that any dangerous knowledge (or digital weaponry) lying around there were ready for the taking.
- BoppreH 15y agoEvery time I see the term "digital weaponry" or a synonym, I think of a bleak future where citizens are jailed for possession of "military grade encryption systems". I don't know if it's because I'm inside the industry, if software is inherently easier to create and duplicate, or if the damage is somewhat smaller, but I really can't see any software as a weapon. A tool used in war? Sure. But a weapon? Hardly.
- knieveltech 15y agoGiven Stuxnet's alleged potential, I think classifying certain software as a weapon is a lot more credible now than even a couple years ago.
- sbarre 15y agoHave you heard of Stuxnet? Malware that specifically targeted (inadequately protected) control systems for critical infrastructure (think power/water/transport) would not be unlike an EMP bomb in my opinion. A weapon is just a type of tool used with intent to harm.
- slowpoke 15y ago>A weapon is just a type of tool used with intent to harm. While that is correct, it can be extended to pretty much everything. In the end, weapons don't kill people, people kill people. And while this will probably will get me labeled as conspiracy theorist, I still think that a lot about stuxnet was way too fishy, and it was way too conveniently timed for all the security facists that are raving about "Cyber War".
- 15y ago
- gojomo 15y agoI'd prefer if HN only got followup articles about such breaches, which have some analysis. Voting the actual raw data-dumps up emphasizes the other meaning of 'hacker' and almost looks like cheerleading.
- wxs 15y agoI'm not sure if I agree. One thing that's nice about HN is that I so often get the story early, otherwise I would use one of the weekly/daily best-of aggregators anyway. The front-page is big enough that I can handle there being one post for the original raw-data, and a subsequent post for the Ars analysis. Your other point about "cheerleading" is well taken, It is easy to get caught up in the David vs. Goliath sentiment.
- rdl 15y agoWe had this discussion about ~12 years ago with the attrition.org defacements gallery.
- bmelton 15y agoI haven't seen this (yet) in any local media, and it's at least given me the opportunity to email all the Booz employees I know and urge them to at least change their passwords. Having the information quickly is advantageous to both sides.
- mcantelon 15y agoI'd say it's newsworthy and interesting, so I don't see a problem with it.
- leon_ 15y agoIf you can live with all that business bullshit on "hacker" news you certainly can live with some security related data dumps.
- redthrowaway 15y agoIf we're waiting for Ars Technica to do an in-depth article, we'll be as late to the table as everyone else. I like learning about these things as they happen.
- lhnz 15y agoI hope that none of those military contractors re-use their passwords. But let's be honest with ourselves...
- SoftwareMaven 15y agoI wonder if we are seeing the beginnings of a new revolutionary movement that transcends borders, yet has the ability to cause drastic change within borders. This has the potential to get very interesting for people like me who think the government has overstepped its bounds in the electronic age. Anonymous may become catalyst, if nothing else.
- trotsky 15y agoSeems like a real stretch to me. HBGary like _targeted_intrusions_ with corresponding broad private information disclosures might have a bit of claim to that theory. But as far as I can tell you just saw a couple of script kiddies run automated scans against whoever & whatever, happen to see a flaw at BAH, get in a dump a SQL database and then brag about how awesome they are. Big fucking deal? Disclosing password hashes isn't going to bring down shit. It's like the hacker equivalent of the special olympics.
- travem 15y agoWith the password hashes being unsalted MD5 and estimates of password reuse averaging from 12% this is valuable information that could be used to gain access to more sensitive systems. Sure it may be as simple as running an automated scan, but if a script kiddie could do that and get this information it's likely this information may well have been compromised before now, we just haven't heard of it. [1] "A large-scale study of web password habits" http://portal.acm.org/citation.cfm?id=1242572.1242661 http://portal.acm.org/citation.cfm?id=1242572.1242661 via http://www.lightbluetouchpaper.org/2011/02/09/measuring-password-re-use-empirically/ http://www.lightbluetouchpaper.org/2011/02/09/measuring-pass...
- DanHulton 15y agoFor what it's worth, I just started a service based on the high password reuse you mentioned: http://www.emailambush.com http://www.emailambush.com I figure finding out the moment your email account is compromised is worth investing in, especially in these most recent days of hackers running wild.
- jpulgarin 15y agoI'm adding the compromised emails to www.hacknotifier.com - you can check if you're part of the release there.
- 8dot5by11 15y agoSucks to be BAH. Yet another consultancy that doesn't practice what it preaches about security
- amalag 15y agoLooks like they grabbed some sort of online course system's DB. I am guessing it isn't as secure as some of their other servers and it has independent authentication. So it isn't their main user/password database, but looks like people using their email address to login.
- guelo 15y agoYea, the data is not very interesting at all. Looks like it might be the DB for this site http://jko.jfcom.mil/ http://jko.jfcom.mil/ The app is definitely over-engineered with 613 tables and few users. I bet Booze Allen charged millions of dollars for building that garbage.
- deleted 15y ago[deleted]
- rdtsc 15y agoAh Booz|Allen|Hamilton ... or also known in the govt. contracting world as "we put warm bodies in seats and charge you tens of millions for it". Anonymous rant about them is essentially correct, it is just a un-official wing of the government that shelters yesterdays' generals and other big figures from government institutions. If it weren't for the ol'govt'boys network and for all the nepotism and favoritism, there would be a large opportunity for small startups to undercut these large, wasteful, stupid and taxpayer moneysucking behemoths.
- callahad 15y agoIf it weren't for the ol'govt'boys network and for all the nepotism and favoritism, there would be a large opportunity for small startups to undercut these large, wasteful, stupid and taxpayer moneysucking behemoths. That concern is exactly why the U.S. Small Business Administration exists. The federal government actively works to award ~23% of prime federal contracts to small businesses each year. Moreover, that quota contains specific goals for awarding contracts to Women-Owned Small Businesses (WOSB), Service-Disabled Veteran-Owned (SDVO) small businesses, other "small disadvantaged businesses," and businesses in "Historically Underutilized Business Zones" (HUBZones). If you actually try to "undercut these large, wasteful, stupid and taxpayer moneysucking behemoths," you'll have federal policy at your back. Furthermore, "[f]or all procurement actions expected to exceed the $150,000 simplified acquisition threshold, prime contractors are required to make a "best effort' attempt to make use of small disadvantaged businesses, SDVOs, and WOSBs as subcontractors if the opportunity exists under the contract. For procurement actions expected to exceed $650,000 ($1.5 million for construction), the winning contractor is required to provide the agency contracting officer with a written plan that establishes a small business subcontracting goal. The plan details how the winning contractor will make use of small business in each subcontract category and provide for timely payments." [0] [0]: http://www.sba.gov/content/about-government-contracting http://www.sba.gov/content/about-government-contracting
- MarkPNeyer 15y ago"[f]or all procurement actions expected to exceed the $150,000 simplified acquisition threshold, prime contractors are required to make a "best effort' attempt to make use of small disadvantaged businesses, SDVOs, and WOSBs as subcontractors if the opportunity exists under the contract" My dad has a small software company that sells statistical analysis software. He told me that he often gets buyers from minority owned businesses that exist solely to exploit that regulation. Say BigCorp wants to score a sweet government contract, and they need to use my dad's software. The CEO of BigCorp talks to his buddy at IAmAMinorityCorp and says "We want the Neyer-D Optimal Test Suite from Neyer Software." IAmAMinorityCorp buys the software, then resells it to BigCorp for 2x what they paid, pocketing the difference. The system is heavily broken. Anyone who thinks otherwise needs to get their head out of the sand or their hands out of my wallet, preferrably both.
- KevBurnsJr 15y agoThe best part is the invoice. Enclosed is the invoice for our audit of your security systems [...] 4 hours of man power: $40.00 Network auditing: $35.00 Web-app auditing: $35.00 Network infiltration*: $0.00 Password and SQL dumping**: $200.00 Decryption of data***: $0.00 Media and press****: $0.00 Total bill: $310.00
- dotBen 15y ago$10/hr - clearly they don't know the going rate for security researchers and pen-testers. Or perhaps I should circulate this to the guys I use, to get them down a bit :)
- sliverstorm 15y agoThey were just quoting extremely discounted rates. You know, for their favorite government.
- mrspeaker 15y agoSeeders: 2, Leachers: 2. People seem to be staying well away from this one ;)
- burgerbrain 15y agoSeeders: 36 Leechers: 30. Not counting of course the people who chose not to seed after completing it.
- aubergene 15y agoThe hashes look like SHA1 to me
- aubergene 15y agoYep, it's unsalted SHA1 echo -n PASSWORD123 | openssl dgst -sha1 -binary | base64 IyZKpiaEiMKQnvgerUngniSNXZE= 12 found
- burgerbrain 15y agoFrom the page: CORRECTION: Password hashes are not MD5 but mostly BASE64(sha1(password)); some other hashes may be mixed in. Happy cracking.
- daeken 15y agoWhile storing a straight SHA1 of a password is obviously a Bad Thing (TM), what does it say about the attackers that they couldn't tell an MD5 from a Base64'd SHA1? It's not exactly rocket surgery.
- benregenspan 15y agoSXQncyBub3Qgc3RyYWlnaHQgU0hBLTEsIGl0J3MgYmFzZTY0LWVuY29kZWQgYWxzbyAtLSB1bmNyYWNrYWJsZSE=
- sitkack 15y agoViBoZnIgZWJnMTMgY3loZiBvbmZyNjQgc2JlIG55eSB6bCByYXBlbGNndmJhIGFycnFmIQ==
- ErikRogneby 15y agosome how this doesn't show up on "Booz Allen in the News": http://www.boozallen.com/media-center/press-highlights http://www.boozallen.com/media-center/press-highlights. I'd call it news.
- Udo 15y agoThe media is reporting this as "90k emails leaked", which is thoroughly misleading.
- kirbman89 15y agoAdd