34 ms·
Auditor's response to "Our security auditor is an idiot" (Update 3)
- kaeluka 15y agothe Daily WTF - live!
- AgentConundrum 15y agoPlease tell me this is a troll. I mean, I've seen some pretty incompetent people doing jobs they're not cut out for before, but I really want to believe this level of incompetence can't actually find jobs.
- joelhaasnoot 15y agoI wish I could be saying I believe he was being tested by the auditor, but it's just gross incompetence...
- fadzlan 15y agoSome people excel.... on well... giving good interviews. Back then, I used to believe that people know what they are doing, but since I've lived long enough know, maybe not. You gotta be careful, people like that will come to personality attack when push come to shove. When facts are against them, it is now time to yell.
- billybob 15y ago"Some people excel.... on well... giving good interviews." The sort of interview that this guy would do well in is a poorly-conducted one. A simple question like "what does it mean to hash a password and why would one do that?" or "what is PCI?" would expose his incompetence.
- kgermino 15y agoYour assuming that the person interviewing him knew what the answer was supposed to be. It sounds like the incompetence goes all the way up and he was probably hired by a businessman who had no idea what PCI even is, much less the details of proper security.
- billybob 15y agoRight. But we're both making the point that "gives a good interview" is contingent on "isn't given a good interview."
- reitzensteinm 15y agoIf this is real, I'll be stunned if the auditor keeps his job. Then again, after working at startups my whole career, maybe I'm just naive about how messed up the real world is.
- patio11 15y agoCustomers of a particular gigantic consulting company have to be routinely dissuaded from "passwords similar to any old passwords should not be allowed", which is often in bid documents. To a man, when told the requirement is unsound, they suggest infinite retention of passwords in plaintext plus Levenstein distance and ask the consultancy why their engineers couldn't come up with that obvious solution themselves. The reason for this requirement to repeatedly pop up in bid documents is misapplication of a poorly drafted standard by people who are theoretically experts at enforcing it's normative intent. I would love to throw in an additional anecdote here, but it would violate a confidence. Pretend that $500k had been allocated to produce a list of plain text passwords and a combination of bureaucratic inertia, competence issues, and internal politics made that requirement an unstoppable freight train. That gives you the flavor of it.
- reitzensteinm 15y agoWhile that is an absolutely ridiculous requirement, couldn't it be satisfied securely by creating on the order of 1-10k modifications of each password when created, and hashing those? That would be enough to add numbers to the end, switch case, reverse, randomly change letters etc. It's a lot of trouble to go through just because of the ignorance of a client, but it would be enough to check that magic box on the requirements list and be done with it, rather than having to go to all of the trouble of trying to educate the client and risk them going elsewhere.
- jmah 15y agoIt's 3am and I've been drinking, but this seems feasible: When the user changes their password, encrypt the old password with a key derived from the new one (you have both in plaintext at this point, when entering old/new passwords). Then hash the new one as usual. Then when the user goes to change their password again, you have the plaintext of the current one, which unlocks the previous password, and so on back in the chain. You can then compare the new password with previous passwords for similarity.
- dasil003 15y agoI can't help but feel there is some kind of social experiment going on here. I mean I know there are a lot of incompetent people out there, but a security auditor asking for a list of plaintext passwords is not something that should take more than an email or two to resolve even in Bizarro world. "Techies" exhibiting this kind of willful ignorance are usually a bit better and hiding under their rock.
- InclinedPlane 15y agoI take it you've never worked with someone who was truly incompetent. Often such people have some sort of defense mechanism that allows them to cover up their incompetence with some degree of effectiveness. But sometimes it shines right through, and then you end up gobsmacked that it's even possible for someone to be that ignorant/illogical. But it does happen, I've seen it too many times.
- dasil003 15y agoSure, but such people can not remain the lynchpin of a PCI auditing operation. I mean how many WTFs from anyone who has half a clue have to be sent to the brass at this company and the ones they are auditing on behalf of before someone thinks "holy shit our entire reputation and business is being flushed down the toiler on a daily basis?" It just doesn't pass the smell test for me. I don't know what it is, but something is missing from this story.
- InclinedPlane 15y agoMaybe not forever, but long enough to cause pain in your life? Sure. Perhaps the company was bought or created by someone with too much money and not much domain expertise and then they gave their incompetent relative a position without much oversight. Wouldn't be the first or last time that happened.
- dasil003 15y agoYes, but if your payment gateway is going to shut you off based on this nonsense you call them up and explain the situation to them and then they investigate. There are too many parties involved for this kind of willful ignorance to be the last word. I dunno, maybe it's true, but for me the story still isn't adding up.
- JacobAldridge 15y agoWhen "I have been in this industry longer than anyone on that site" is a cornerstone of your defence, you've already lost. Also, I know the UK has really strict laws, but I doubt he'd be able to sue for "liable".
- almost 15y agoActually we do have ridicules libel laws here in the UK. If someone accuses you of libel the onus is on you to prove that you didn't.
- rmc 15y agoI think the point is that someone who can't spell libel correctly is not very scary.
- almost 15y agoStupid people can still cause huge amounts of trouble. With legal things like that maybe even more so than non-stupid people. Also, apparently I can't spell "ridiculous" :p
- dredmorbius 15y agoInconceivable! Very good point on idiots causing huge amounts of trouble. Ouch, thanks for reminding me.
- VladRussian 15y agobeing that ignorant and having important hi-tech industry job - he's already won.
- arethuza 15y agoNitpick: there are no such things as "UK libel laws" - England and Wales have one system, Scotland has a completely different set of laws.
- keithpeter 15y agoAs I live and work in Birmingham, UK, I hope this is all an elaborate hoax.
- yaix 15y agoThe auditor was actually serious. Wow. I really thought he just wanted to check the reaction of the admin, to see if he'd actually hand over sensitive stuff.
- astrodust 15y agoThe auditor has a hugely inflated ego, something that might be a sign you're dealing with a narcissist. It's a pretty huge claim to make that you've "been in the industry longer" than anyone else, but that's the sort of thing you'd say when you're that kind of person. Everything they said is surely made up, and if you challenge them on their facts, they'll attack you in return.
- cstross 15y agoYup. Sounds like a fairly classic case of workplace sociopathy -- the sociopath who gets promoted because they tell lies and bully the folks below them into obedience. (Not the kind of -- much rarer -- sociopath who is violent or robs banks, but still a royal pain in the ass to run across in a business context because any attempt you make to deal with them technically will result in manipulative social retaliation rather than "oh, my bad".)
- antihero 15y agoIf it's in the UK they may be liable under the Data Protection Act, too.
- sunchild 15y agoI like the auditor's take on this: "I see no data protection issues for these requests, data protection only applies to consumers not businesses so there should be no issues with this information." The Data Protection Act applies to individuals within the EEA trusted circle nations, full stop. Whether or not the information being requested requires individual consent under the DPA is a different point altogether.
- marcamillion 15y agoAt first, I thought that this was a bogus post...but it seems to be real - or this guy is keeping up with the story.
- jarin 15y agoIncompetent people in the security field really need to be called out like this. Incompetent developers generally only hurt the company; incompetent security professionals hurt every single customer as well.
- Auguste 15y agoThat security auditor could give a lot of the guys featured on The Daily WTF a good run for their money.
- iuguy 15y agoA colleague of mine once had to stand one foot on top of the other and chew his own lip when an SI's "security expert" introduced himself as an 'old-school CISSP' just to stop laughing out loud at him. There are many idiots in the information security industry (I should know, I are one) - we're doing our best to get rid, but more keep showing up.
- __rkaup__ 15y agoCan you explain? I have no idea what a CISSP is.
- iuguy 15y agoIt's full name is the Certified Information Systems Security Professional. There's a good writeup of the problems with CISSP here: https://infosecisland.com/blogview/15450-My-Canons-on-ISC-Ethics-Such-as-They-Are.html https://infosecisland.com/blogview/15450-My-Canons-on-ISC-Et... and here: http://erratasec.blogspot.com/2011/07/ethical-problems-of-cissp-and-isc2.html http://erratasec.blogspot.com/2011/07/ethical-problems-of-ci... It's often described as 'a mile wide and an inch deep'. However, it's not really the example of broad security knowledge it sets out to be and is considered a joke certification in my niche (technical security).
- pnathan 15y agoInteresting. I've been considering working towards it, but if competent security professionals think it's a joke.... :-)
- Confusion 15y agoWhat's interesting is that the PCI standard seems to be unclear in this respect. He quotes from the standard: 8.4 Render all passwords unreadable during transmission and storage on all system components using strong cryptography. This seems to leave room for passwords to be encrypted instead of hashed. I'd even say it suggests they should be encrypted instead of hashed, by not distinguishing between 'during transmission' and 'during storage'. At the very least, quoting this isn't going to convince someone that passwords should not be decryptable.
- Terretta 15y agoIt's not unclear, and you're right. It has to be encrypted on the wire and in storage. This paragraph does not say you must hash, or must not be able to get the plaintext passwords back.
- pyre 15y agoThat may be, but even if PCI doesn't require you to have the passwords unrecoverable, I'm pretty sure that transferring all of them in bulk to someone else via email should violate some part of PCI. Even if that person is an auditor. The potential for abuse is too high.
- mckoss 15y agoActually, hashed password ARE recoverable, technically. Though it would take a VERY long time to brute force the original passwords.
- dkokelley 15y agoBut would you consider that 'recovery' or 'discovery'. To me, recovering passwords means applying an operation to reverse encryption. Brute-forcing passwords is simply guessing, which makes it a discovery.
- Confusion 15y agoIn theory, there are infinitely many passwords that map to the same hash, so not all passwords are recoverable. In practice most passwords will be recoverable (given enough computing power), because there will only be a single 'reasonable' match (you will probably find only one for passwords of reasonable length).
- hermannj314 15y agoFrom the perspective portrayed in this article, the auditor seems misinformed about fundamentals in his industry and his response to being called on this seemed superficial and borderline childish. It must be difficult to be ridiculed in a public form of your own profession. Not to mention being called stupid and ignorant for misunderstanding something. I hope I always have the humility to admit when I'm wrong, but also have the patience and understanding when other people don't.
- motters 15y agoArgument from authority. Nice try.
- 16s 15y agoQuite a few managers and auditors really don't understand the difference between a password hash and a password. I expect the auditor was asking for password hashes, although he was using the phrase "plaintext passwords". Who knows, but that part of the story may just be a wording misunderstanding. Not everyone speaks geek, and it's important to know when you're talking to someone who does not ;) Edit: Not sure why this is being down voted as it is a true statement. I've had to explain what a password hash is on several occasions. And even after that, there was still some misunderstanding/confusion.
- dpark 15y agoThe auditor specifically said "plaintext". He's clearly a moron, but there's no evidence that he somehow thinks plaintext and hashed are the same thing. He specifically said that the passwords should be stored in a "recoverable format for later use". He wants plaintext.
- sdkmvx 15y agoThere's still the question of why he would need the password hashes. Assuming he wanted the plaintext passwords to see if they are 'complex' and 'strong,' he would have a hard time telling that from the hashes. 5f4dcc3b5aa765d61d8327deb882cf99 and 05b28d17a7b6e7024b6e5d8cc43a8bf7: Which is a dictionary word and which is a string of punctuation? (I didn't salt :))
- 16s 15y agoPlease. 16Crack broke these in less than 5 seconds. Plain md5. 05b28d17a7b6e7024b6e5d8cc43a8bf7 = !@#$%^&*() 5f4dcc3b5aa765d61d8327deb882cf99 = password
- sdkmvx 15y agoYep. But they are hex strings that look like (are) hashes, and that's all I need to make the point. Next time I'll use /dev/urandom for that :) In a real scenarios, use PBKDF2 or bcrypt!
- 15y ago
- codeglomeration 15y agoThis sounds more like social engineering to me. My first thought was this was a hacker who took control of an email address from the security firm, and just tried to exploit the weakest link in order to get plaintext passwords.
- blahblahblah 15y agoApparently, neither of these guys paid attention in high school civics class. Slander involves oral, not written, communication. Libel (not "liable") is the term for a tort involving false and damaging written communication.
- techiferous 15y ago"any inventive suggestions for how to troll him [the security auditor] a bit?" Nothing productive could come of that. This situation is not for your entertainment. Just move along...
- dougws 15y agoI haven't been in the industry that long, but I've encountered a few "security professionals"--auditors, penetration testers, etc. All of them have been totally incompetent; they could tell you the definition of, say, a SQL injection attack but had no idea how to really analyze a system. On the other hand, all of the great programmers I've met have had a really good grasp of security. I'm starting to think that if you don't write code, you're not qualified to audit it.
- diminish 15y agoDreaming of a world without passwords... Any ideas?
- AppSec 15y agoThe problem with not having passwords is that it usually requires an authority to distribute keys (and not retain the initialization parameters for that key, cough RSA cough). And that could potentially require a third party having access to information a lot of people don't want. Or trusting the government to generate them -- which opens up another can of worms. Things like OAuth and/or federated login still rely on a password at some level. Pick your poison (personally, I wouldn't mind using an RSA Soft Token type technology with federated access requiring token + pin, but that's just me).