6 ms·
Cool. I wrote the AOLserver flap library and the whaops backend, and the ugly version of the front end (someone took my ugly stuff and made it nicer). The vecto
by lanstin 5y ago
Cool. I wrote the AOLserver flap library and the whaops backend, and the ugly version of the front end (someone took my ugly stuff and made it nicer). The vector was the AOLserver ops team had a well known admin password that granted access in the default configuration to exec shel commands on the host. They fortunately did not notice that I had an undocumented command to send arbitrary msgs to arbitrary queues in the topology. We switched to two factor authentication for prod logins a few months later. And the person that got the AOLserver password was arrested.
- 7773777 5y agotwo factor authentication in 2005?
- lanstin 5y agoYeah physical tokens from RSA (I think) We even rigged up CVSD so you couldn’t push code without the rsa token for each push. (Not actually sure anymore that CVS commit to remote was called push).
- terinjokes 5y agoI had a family member working for an AOL call center around that time, the physical token they had was from RSA. At least at the time, it was required for nearly anything, including logging into the customer desktop application.
- hunter2_ 5y agoI didn't use it myself, but I've heard "check in" used colloquially for what seems to be `cvs release`.
- lanstin 5y agoAll I remember is having to look at each file and figuring out if the diff between 1.13.0.4 and 1.13.0.5 should be applied to 1.16 and then for the next file it was 1.15.1.2 and 1.15.1.4 and so on for each file. That was after AOL had slowed down to the point where you didn’t just release each change but batched they up into releases called QARs (QA Requests where you documented all the changes and stuff to test etc.). So earlier, merging from released point fixes back to the latest version wasn’t common and cvs wasn’t good at it. Later it was more common and what now is a two minute git pull —rebase was a half day. Also by then, the super genius software folks started getting replaced by MBAs who would rather developers be idle than work on stuff that wasn’t prioritized.
- toast0 5y agoTwo factor auth (password + RSA token) was used for vpn/ssh from home and to access high security stuff (which I never got access to) at Yahoo when I joined in 2004. If AOL was having trouble with security, requiring it for admin tools would have been reasonable and feasible in 2005.
- dboreham 5y agoNetscape used RSA SecurID tokens when I joined in 1996. I still have kine, but the battery long since expired.
- 7773777 5y agoPresumably you can get a new watch battery for it, non?
- toast0 5y agoThe tokens are not intended to be servicable. Even if you replaced the battery, you couldn't set the time, so I don't think you could sync your token and your verifier. And I don't know if these things had protections against being opened anyway.
- wendythehacker 5y agomy bank used 2FA (auth codes or so called "transaction codes" send in physical mail to approve transactions) in the late 90s early 2000s. so 2fa isn't some new invention, funny how it took basically 2.5 decades until it become quite mainstream... now that i think of it, it's actually quite concerning that 2fa didn't have widespread adoption earlier - as soon as smart phones became common.
- technion 5y agoWorld of Warcraft players were using it in 2008.
- 7773777 5y agoI do remember that. Little key fobs with one time codes. But that's still 3 years later. But apparently according to some of these comments large tech places were using 2FA in 2000 and as early as '98 or '99 which still surprises me, not really having seen it become ubiquitous until recently, and really only around things for banking and purchasing.
- userbinator 5y agoBesides RSA tokens which sibling comments have already mentioned, smartcards were also used for 2FA back then.
- jcims 5y agoThe worst part about doing operations with the RSA tokens is that you can only use each code one time and it takes a full minute to get a new code. Waiting for the code to roll to get through a couple jumphosts is pretty excruciating.
- techrat 5y agoThe old style tokens were widely in use in the late 90s through to the early 2000s. https://en.wikipedia.org/wiki/RSA_SecurID https://en.wikipedia.org/wiki/RSA_SecurID
- ThePadawan 5y agoMy bank even had me use one of those until 2009 or 2010!
- throwthere 5y agoDefinitely used one up to 2013 and only stopped because I left the company.
- dspillett 5y agoEarlier than that (at least as far back as 2003, my memory is hazy but it might have been 2001) I was using RSA based tokens for TFA to access on-prem systems at a couple of our clients for product support purposes. At least one of those was significantly smaller than AOL would have been in 2005. So the tech was readily available and had been for some time, AOL had the resources to scale it out to their key infrastructure, and after a significant hack I can believe that even in those relatively naive days there would have been plenty enough management impetus to Make It Happen.
- Yoric 5y agoI've used 2FA in the 90s.
- 7773777 5y agoWhat did you use it for? Work?
- op00to 5y agoI had RSA two factor at an .edu in 2000, and they were there for a while. We called em “enigma cards”.
- bluedino 5y agoBack in 2000 or so, it seemed a status symbol of how many RSA tokens you had on your keychain. The more you had, the more important systems you had access too. Don't forget that PayPal's original idea was a Palm Pilot app that replaced all those pesky hardware tokens.
- exikyut 5y agoHa, cool. How many tokens did you ever see at once? :D Presumably PayPal were intending to do an app + hardware module - or was this essentially "LeT's MaNaGe RSA KeYs UsInG NoN MeMoRy PrOtEcTeD CoMmOdItY HaRdWaRe RuNnInG a NoN SaNdBoXeD KeRnEl"?
- bluedino 5y agoAccording to _Founders at Work_, they just reverse-engineered the keys and emulated them on a Palm Pilot
- FDSGSG 5y ago> "LeT's MaNaGe RSA KeYs UsInG NoN MeMoRy PrOtEcTeD CoMmOdItY HaRdWaRe RuNnInG a NoN SaNdBoXeD KeRnEl" In retrospect, this would have been at least as good as the real securid dongles.
- dogman144 5y agowas common in some parts of finance also, as i recall this pre-2008. folks had pager-looking things that flashed OTPs. i think bloomberg terminals were partially responsible for driving the use of 2fa.
- risk 5y agothey had 2fa before most orgs and even launched a beta for the public called "AOL PASSCODE". aim had 2fa i remember host guide something with the password "pepper" had it in 2002.
- tyoma 5y agoRe: AOLServer, Are you thinking of Jay Satiro (Ref: http://justinakapaste.com/from-o0o-of-aol-files/ http://justinakapaste.com/from-o0o-of-aol-files/) ? The author implies that the whaops hackers had their own malware, written in Delphi, to do the on-lan redirection.
- lanstin 5y agoOh yeah you are right no jumped to conclusions. Nice link there, the AOLserver tho was just a web server, not the whole server framework or OS. https://github.com/aolserver/aolserver https://github.com/aolserver/aolserver It was written by some company that we bought. It was also the basis for Greenspun’s excellent book on database backed web sites. Yeah, and on rereading the original article, the hack was just guessing the passwords to admin AIM accounts. I hope it wasn’t mine! From my perspective that is “works as designed”. I don’t think the TFA was ever put into AIM login, but it was all a while ago. But anyways, nice to seem one of the dumb names I came up with in the press. I also wrote wam (web authentication module), Hermes (messenger of the Gods - like buddy list but where users could add data sources to the list, with filters or alarms), Ewoks (“external web Oscar knowledge server”, an http server that allowed for easy integration into the server message framework we used) and re-wrote morf “master Oscar registration facility”. The original was a custom written no-SQL DB and we moved it to Sybase with sharding.). All C. All event loop based. All really solid infrastructure written by people doing it for the third time. Fun times. Had an actual agile process and brought the coolness of the internet to many people for the first time.
- risk 5y agopaste did not hack anything he is just an archivist of aol lore. my pr0gz are on there i found them while searching for {s gotmail to add to my phone alert notifications. we follow each other on twitter and he's just a wholesome dude with no sketchy background other than writing vb pr0gz with the rest of us in aol://2719-2-2-vb
- tyoma 5y agoI was referencing the content of the post and its discussion of Jay Satiro’s felony convictions. The domain looks to be a great archive of old AOL things.
- risk 5y agoyou're talking about cameron "cam0" lacroix who got that and a default ssh key. he was raided on frederick street for that at age 14, but being a minor and a legend at opssec he was not charged or arrested - just raided for good measure by bill zaleski (sp) at 703.265.4040 :)