13 ms·

Millenials and GenZ may have no idea who Mudge is. I, however, almost lost my first job out of college at a bank because I ran l0phtcrack against our Windows NT

Millenials and GenZ may have no idea who Mudge is. I, however, almost lost my first job out of college at a bank because I ran l0phtcrack against our Windows NT 4 server to see if it could crack passwords. I showed my boss, and he pulled me aside into another room and tore my head off for irresponsibly running this tool against a production server. He said I could have been fired if this got out, but he covered my ass, sent out an email requesting everyone reset their passwords, and let me continue working. I learned a good lesson because even though my intentions were good, and it did expose security issues, it was a bit immature and should have been done in a more controlled manner along with the proper clearances. Mudge knows the implications of "whistleblowing". He has been a security consultant and even testified to Congress. He's not some noob that doesn't understand security or how systems work together to provide services like disclosure to FTC. The idea that Twitter PR can pooh-pooh away his concerns is shockingly stupid. I think Twitter is in real trouble here.

last_responder 4y ago
Ah yes, Lopht Heavy Industries. Indispensable tools at the time.
- bombcar 4y ago
  Always been a fan of "Heavy Industries".
  - Syonyk 4y ago
    Yup. I've used that with my normal "last name backwards" company name before. I tend to send Christmas and Birthday gifts to siblings with the company field filled in. "Kinetics," "Orbital Bombardment Division," "Relativistic Research," and assorted other things have made their way in, but "Heavy Industries" just has such a nice ring to it.
    - bombcar 4y ago
      I love that Wikipedia says it covers "large and heavy products" and/or "large and heavy equipment". Such a 5-year old boy way of naming things.
  - exmadscientist 4y ago
    I thought I was the only one!
- sbf501 4y ago
  It's a 0, not an 'o'.
dogman144 4y ago
I agree. I grant It’s possible Mudge is A) an old hand and doesn’t know how to run a security program with the tech today B) a strong tech hire who can’t lead a program. But Mudge is still… Mudge, and he’s also proven his ability to collaborate so if he was a bull in a china shop a twitter, that would be surprising. There’s also a broader trend here of well known security leads that originate from that time working at social media and leaving quickly, like Alex Stamos, who also u-turned out of Facebook. So are the odds higher that Mudge did a bad job, or this set of companies are not great internally and old guard security leads are pointing it out? The twitter CEO letter framing him as a bad employee doesn’t address this context.
- time_to_smile 4y ago
  > B) a strong tech hire who can’t lead a program. I worked with Mudge (not super close, but enough to see how he worked across teams etc) and can certainly say this is not the case. At least when I saw him Mudge was excellent at the program leadership aspect of his role. At one point he ended up a DARPA PM. You can't go from L0pht to DARPA without getting really good at working with other people and leading projects. While he was always a notable presence, he was also never prone to drama, and very good at having ego when it was important but never letting it get in the way. Additionally all of the details sound like every KPI chasing consumer facing tech company I've ever worked with. I think we all know a few very competent people who have stood up to leadership at insane tech companies and ultimately gotten fired for it.
  - latchkey 4y ago
    Even 20 years ago, extremely well spoken and has worked at high political levels... https://www.cnn.com/videos/business/2022/08/23/peiter-mudge-zatko-2000-vault-orig.cnn https://www.cnn.com/videos/business/2022/08/23/peiter-mudge-...
  - AtlasBarfed 4y ago
    The subject of security consultants, security departments, and whistleblowing seems to me to be of particular concern. I mean, if an auditor publicly reports an audit finding that is ignored by the company and his ethics demand its reporting, is he branded a "whistleblower"? I do not think so, instead it is an "auditor finding". Why does that not apply here? It kind of dovetails with how pathetically organized IT in general is from a professional standpoint. Lawyers, Doctors, ... ?Accountants? and the like have centuries-codified procedures, principles, and the like for ethics. You generally don't get to hire one of those and tell them how to breach ethics (now, there are a lot of corrupt lawyers and a lot of corrupt accountants see: Arthur Andersen). The exploit industry has the 0day and x days of forewarning process, so there is that, but the fact a security consultant/professional gets accused of whistleblowing when... um, isn't that sort of the point? You hire a security consultant kind of like an auditor. And if auditors find major failings and they aren't addressed, aren't they supposed to report them? I'm pretty sure the security IT industry does not have even accountant levels of professional conduct and organizations. As IT subsumes and infiltrates, now to the point that fundamental bill of rights / human rights are dependent on secure and functioning IT systems, it gets... a bit more important. Arguably more important than the ethics around accountants and doctors. Lawyers, because they deal with the law, are probably more important still, but it shows that IT security may be rising in import to that level.
dboreham 4y ago
I may be _too old_ to know who Mudge is, but I know one of the previous Twitter CISOs, and I believe he quit Twitter, which is a canary sign to me.
rvz 4y ago
Twitter Inc. is indeed in very serious trouble if you have someone like Mudge whistleblowing. Now looking at the chaos, damage control and the PR disaster that is happening at Twitter HQ after this, I have zero confidence in whatever Twitter HQ and the CEO is saying other than admitting their total incompetency towards how they handle information security at the company. All attempts to make this disaster disappear will not only fail, but will eventually backfire. So what else was Twitter lying about?
- winternett 4y ago
  Well, it's not even trending on Twitter, which is not really surprising. There is nothing more evident about the fatal flaws in social media than when news concerning a platform is suppressed on the cited platform. It highlights the failure of democracy they always purport, and it shows that they really shouldn't display a social "trending" page, because it is subject constantly to the politics and profit making of each platform. Twitter's trending timeline had long been regarded as an accurate beacon of real life trends, but that really needs to be reevaluated by everyone as the company has regularly displayed "somewhat questionable" behavior in how they manage timelines alone. There is no real way this wouldn't trend somehow on Twitter in my opinion, as it's been on the front page of CNN and many other sites for a long time now. The security breaches are factual, they have published many incidences of it themselves over years... Their actual reputation for lax security is what works against them most, but it's all on record.
  - wpietri 4y ago
    > There is nothing more evident about the fatal flaws in social media than when news concerning a platform is suppressed on the cited platform. I just looked at the Trending panel and "Mudge" is #12 for me, with 4333 tweets. #11 is "Taco Tuesday", with 4172 tweets. #7 is "Virgo" with 98,500 tweets. So I'm not seeing a lot of evidence of suppression. I think it's just a pretty niche story. I think the allegations are important and worth investigating, but the specific nature of them looks way more interesting to tech insiders than general-audience users.
    - 4y ago
shadowgovt 4y ago
I don't because I'm not seeing an organization that will hold them accountable. - This Congress is ill-equipped to understand tech, much less hold it accountable. As long as the people are happy, Congress is happy. - Lord knows the people are ill-equipped to get how bad this is. They already watched this company allow a rogue employee to shut off the account of the President of the United States (before they chose to do it as policy; https://www.washingtonpost.com/news/the-switch/wp/2017/11/02/trumps-twitter-account-was-temporarily-deactivated-due-to-human-error/ https://www.washingtonpost.com/news/the-switch/wp/2017/11/02...) and watched this company deploy a username-to-telephone lookup service publicly where they'd intended to deploy a security protocol (https://www.ghacks.net/2022/08/08/twitter-confirms-that-a-data-breach-leaked-email-addresses-and-phone-numbers-of-users/ https://www.ghacks.net/2022/08/08/twitter-confirms-that-a-da...). The public doesn't understand why they should care. - The only group who could really hold Twitter accountable are shareholders, but why should they care if the public and Congress don't? The money will roll in either way. Unless they've managed to commit an SEC violation (in which case, slap on the wrist incoming), there are no consequences for this kind of bad behavior until someone powerful gets seriously hurt. I'm glad Mudge is doing the right thing, but extremely pessimistic much will come of it. My recommendation is to shed Twitter as a user.
- dcow 4y ago
  > My recommendation is to shed Twitter as a user. I never understood why tech people have such a strange enamor towards Twitter. Can’t be an industry power dev without it. Can’t start a company without it. Having a healthy Twitter following is often more important than having actual users—even to investors. Twitter is digital hype. I agree. It’s time to replace Twitter. The only question is what exactly is it that anchors people to the platform? Even though it’s hard to imagine, we know that news motivates people (it happened with the WhatsApp -> Signal exodus). Where’s the “Signal for Twitter” we can all migrate to? If the key is not just creating a social platform, but also a hype engine, maybe what a competitor needs to realize is that hype doesn’t happen in a vacuum. You have to do silly algorithmic things so that content can go viral. Maybe the secret is to be open about how you manufacture hype rather than do it behind closed doors? Maybe in a way that people can verify it was done fairly?
deleted 4y ago
[deleted]
datavirtue 4y ago
It's Twitter. What possible serious security implications could possibly warrant everyone in Washington getting into a frenzy? All you do is make public comments that have zero value. And if this is indeed serious, where the fuck have we landed?
- enraged_camel 4y ago
  >> It's Twitter. What possible serious security implications could possibly warrant everyone in Washington getting into a frenzy? Considering how widely used Twitter is, at this point we can comfortably assume that most politicians and political operatives, even high profile ones, must have very sensitive information in their Twitter DM inboxes.
  - raxxorraxor 4y ago
    > must have very sensitive information in their Twitter DM inboxes. I doubt that, and if they really do, they should be either trained or exposed pronto. Twitter is an entertainment platform.
    - jcims 4y ago
      You've described the way it ostensibly should be. My guess is that the reality is almost perfectly in opposition to what you've described. Anything that introduces plausible deniability is going to be of a major benefit.
  - wiz21c 4y ago
    ah ah ah so they trust twitter ? the situation is improving at minus light speed...
    - smsm42 4y ago
      I won't be surprised that they do. Most politicians are very thoroughly technically ignorant, and have little time or patience to spend on learning technically complex things, and really safe communication means aren't usually very user-friendly.
ChrisArchitect 4y ago
l0phtcrack? "Now that's a name I've not heard in a long time." Wow I thought the name Mudge seemed slightly familiar.
webdoodle 4y ago
> I ran l0phtcrack against our Windows NT 4 server to see if it could crack passwords. Lol, did the same thing for a government entity I was working for, also without prior permission. It showed 1/4 of the people used the name of the entity as there password, including 2 users with domain admin credentials. Both of the domain admins weren't even IT people, there were the director and his assistant, who demanded to be admins, because they were 'admin' within the org. In my case, I didn't get scolding, but probably should have. As you're prior boss said, it was not good to do it on a running production server. Now a restored backup running on a private network...
shagie 4y ago
I think it was '96? I was working at Taos Mountain at the time. At that time, Taos had a reasonably close relation to Randal Schwartz ( https://www.oreilly.com/library/view/learning-perl-6th/9781449311063/pr02.html https://www.oreilly.com/library/view/learning-perl-6th/97814... ) and he gave a talk for contractors which was titled "Just Another (convicted) Perl Hacker". In that talk he told of his time at Intel and running crack on a shiny new sparc and all the problems that caused. The focus of it was a "how not to get into trouble as a contractor". Somewhere, I've still got my pink camel book with duct taped edges (for durability) with his signature on the inside title page.
melony 4y ago
There's a simpler explanation. He is doing this for profit. I don't buy all the speculation that he approached the SEC out of some professional obligation or simply to spite the Twitter leadership. As a former executive he most likely still holds stock and having the price plunge is not exactly in his interest unless the pay-off from whistleblowing is high enough. Given his high profile, he just burned all bridges career-wise at big tech. The expected whistleblower payout here must be enormous.
- nr2x 4y ago
  You don’t understand the value of reputation.
  - melony 4y ago
    I don't think you understand what it means to burn all bridges. He is literally unhireable right now in any corporate context. You are naive if you believe he is doing this out of some hacker ethos.
    - zenlf 4y ago
      You talk like part of the problem.
    - strictnein 4y ago
      The idea that he is "unhireable" in the security space because of this is rather amusing.
      - nr2x 4y ago
        It’s honestly really hilarious. Oh no, a literal God of Security is gonna have to beg for entry level employment.
        melony 4y ago
        In the private sector he is not going to find employment any time soon at a major corporation. You can downvote as much as you want but any management who hires whistleblowers deserve to be immediately fired by the board. It's basic corporate governance 101.
zeruch 4y ago
I met Mudge once in my career early on (I was at VA Linux systems circa 1999ish) and I found him intense, an apex intellect, but absolutely affable and self-aware. He never struck me then, or in any interview or write up since, that he's impulsive, or prone to taking actions like what he's done to Twitter, in a cavalier way. He saw something bad and thinks something should be done to address it. He likely made that decision because the culture at Twitter is as bolloxed as he states (maybe worse), and that it's one thing to fire a guy, but to do so to hide damning truths, and expect that person to just accept their fate AND let you get away with it without a cost is in this day and age, a farcical hope. Your "Mudge knows the implications of "whistleblowing". He has been a security consultant and even testified to Congress. He's not some noob that doesn't understand security or how systems work together to provide services like disclosure to FTC. The idea that Twitter PR can pooh-pooh away his concerns is shockingly stupid." is spot-on.
- gonehome 4y ago
  Yeah - comparing mudge's history with the email the Twitter CEO sent to internal employees and the situation seems crazy? Always hard to know from the outside, but this paired with Jack leaving seemingly frustrated with the board looks really bad. I know people have thought Twitter was mismanaged for a while, but seems like it's a lot worse than I thought it was (and the CEO seems more vindictively bad than I would have guessed). Plus the total lack of principles around speech and just doing whatever Russia, India, or KSA wants? Including hiring foreign agents? Also covering up bad security issues in reporting? It'll be interesting to see what happens from here as more comes out. The internal Twitter email: https://twitter.com/austen/status/1562150058727919616?s=21&t=DlN4DzvIMUMG89rFsK9t4A https://twitter.com/austen/status/1562150058727919616?s=21&t...
  - zeruch 4y ago
    Yeah, I think we're in lockstep here. I'm no fan of Musk (he's truly worked very hard to be the most provacatively pustulent punkass of tech) but that doesn't mean that Twitter leadership is any better. Just not as well PR'd. Dorsey himself was mostly an imbecile who drank too much of his own Kool Aid. Twitter has for years been the standard bearer for the most opaque, and incoherent content management; from user feedback to bots, just a village with only idiots. It was eventually going to catch up to them, the question now is to whom does the bulk of the suffering land on, not whether it lands or not.
smsm42 4y ago
In any case your own chief of security coming out and saying your security is crap would be devastating for any company. But when it's a person with credentials list like Mudge's - one can be quite sure he's not just doing it because some disagreement about salary and vacation days, and it would be impossible to dismiss this as "disgruntled employee issue". Twitter would probably try anyway, but it won't work. Twitter is going to be in a lot of hot water now, and I can't imagine Musk isn't going to milk this to the last drop.
gjs278 4y ago
icelancer 4y ago
Yeah I kinda glossed over the headline and figured, whatever. Then I clicked through and saw it was Mudge. Ah jeez.
choppaface 4y ago
Actions speak louder than words. For him to file this complaint now, after Musk pulled out of his Twitter purchase, makes any truthful statements pretty low value to Musk’s case. Does Twitter need better security? Yeah. Will Twitter get embarrassed? Yeah? Will this testimony show Musk completely miffed his due diligence while building up a huge loan package that would have sent most of Twitter’s revenue to debt service? The timeline is what matters.
- fordsmith 4y ago
  This is incorrect. The complaint was filed _before_ musk even showed interest in Twitter
Consultant32452 4y ago
That's a funny story. I have a similar anecdote where I was asked to crack a zip file in a saga related to a dispute with a vendor who gave us a password protected zip file with the deliverables but not the password. Those were wild times.
b06timmer 4y ago
I did the same thing on a server for a major department store chain in the '90s. I booted a Linux diskette and copied the SAM file to it. I also ran l0phtcrack, or John the Ripper on a 486 (?) PC in my apartment. I think I bought a rainbow table and something else to expand the iterations it would use on the hashes. I let it run for over a week and had a couple of thousand clear passwords. This was for every store west of the Mississippi and included most of the "big-wigs" in our chain. I was going to send the information to our security people in another state but decided it probably wouldn't be a wise thing to do. I come across the HDD where I have this stuff archived every now and then and it makes me smile. This was also in the "Free Kevin" days.
- KennyBlanken 4y ago
  So you copied the auth file off company servers and cracked it on personal systems and you kept the files and cracked passwords? Not just kept around, but archived? Dude.
  - mrelectric 4y ago
    I think most of us in sec do that.

last_responder 4y ago

Ah yes, Lopht Heavy Industries. Indispensable tools at the time.

bombcar 4y ago
Always been a fan of "Heavy Industries".
- Syonyk 4y ago
  Yup. I've used that with my normal "last name backwards" company name before. I tend to send Christmas and Birthday gifts to siblings with the company field filled in. "Kinetics," "Orbital Bombardment Division," "Relativistic Research," and assorted other things have made their way in, but "Heavy Industries" just has such a nice ring to it.
  - bombcar 4y ago
    I love that Wikipedia says it covers "large and heavy products" and/or "large and heavy equipment". Such a 5-year old boy way of naming things.
- exmadscientist 4y ago
  I thought I was the only one!
sbf501 4y ago
It's a 0, not an 'o'.

dogman144 4y ago

I agree. I grant It’s possible Mudge is A) an old hand and doesn’t know how to run a security program with the tech today B) a strong tech hire who can’t lead a program. But Mudge is still… Mudge, and he’s also proven his ability to collaborate so if he was a bull in a china shop a twitter, that would be surprising. There’s also a broader trend here of well known security leads that originate from that time working at social media and leaving quickly, like Alex Stamos, who also u-turned out of Facebook. So are the odds higher that Mudge did a bad job, or this set of companies are not great internally and old guard security leads are pointing it out? The twitter CEO letter framing him as a bad employee doesn’t address this context.

time_to_smile 4y ago
> B) a strong tech hire who can’t lead a program. I worked with Mudge (not super close, but enough to see how he worked across teams etc) and can certainly say this is not the case. At least when I saw him Mudge was excellent at the program leadership aspect of his role. At one point he ended up a DARPA PM. You can't go from L0pht to DARPA without getting really good at working with other people and leading projects. While he was always a notable presence, he was also never prone to drama, and very good at having ego when it was important but never letting it get in the way. Additionally all of the details sound like every KPI chasing consumer facing tech company I've ever worked with. I think we all know a few very competent people who have stood up to leadership at insane tech companies and ultimately gotten fired for it.
- latchkey 4y ago
  Even 20 years ago, extremely well spoken and has worked at high political levels... https://www.cnn.com/videos/business/2022/08/23/peiter-mudge-zatko-2000-vault-orig.cnn https://www.cnn.com/videos/business/2022/08/23/peiter-mudge-...
- AtlasBarfed 4y ago
  The subject of security consultants, security departments, and whistleblowing seems to me to be of particular concern. I mean, if an auditor publicly reports an audit finding that is ignored by the company and his ethics demand its reporting, is he branded a "whistleblower"? I do not think so, instead it is an "auditor finding". Why does that not apply here? It kind of dovetails with how pathetically organized IT in general is from a professional standpoint. Lawyers, Doctors, ... ?Accountants? and the like have centuries-codified procedures, principles, and the like for ethics. You generally don't get to hire one of those and tell them how to breach ethics (now, there are a lot of corrupt lawyers and a lot of corrupt accountants see: Arthur Andersen). The exploit industry has the 0day and x days of forewarning process, so there is that, but the fact a security consultant/professional gets accused of whistleblowing when... um, isn't that sort of the point? You hire a security consultant kind of like an auditor. And if auditors find major failings and they aren't addressed, aren't they supposed to report them? I'm pretty sure the security IT industry does not have even accountant levels of professional conduct and organizations. As IT subsumes and infiltrates, now to the point that fundamental bill of rights / human rights are dependent on secure and functioning IT systems, it gets... a bit more important. Arguably more important than the ethics around accountants and doctors. Lawyers, because they deal with the law, are probably more important still, but it shows that IT security may be rising in import to that level.

dboreham 4y ago

I may be _too old_ to know who Mudge is, but I know one of the previous Twitter CISOs, and I believe he quit Twitter, which is a canary sign to me.

rvz 4y ago

Twitter Inc. is indeed in very serious trouble if you have someone like Mudge whistleblowing. Now looking at the chaos, damage control and the PR disaster that is happening at Twitter HQ after this, I have zero confidence in whatever Twitter HQ and the CEO is saying other than admitting their total incompetency towards how they handle information security at the company. All attempts to make this disaster disappear will not only fail, but will eventually backfire. So what else was Twitter lying about?

winternett 4y ago
Well, it's not even trending on Twitter, which is not really surprising. There is nothing more evident about the fatal flaws in social media than when news concerning a platform is suppressed on the cited platform. It highlights the failure of democracy they always purport, and it shows that they really shouldn't display a social "trending" page, because it is subject constantly to the politics and profit making of each platform. Twitter's trending timeline had long been regarded as an accurate beacon of real life trends, but that really needs to be reevaluated by everyone as the company has regularly displayed "somewhat questionable" behavior in how they manage timelines alone. There is no real way this wouldn't trend somehow on Twitter in my opinion, as it's been on the front page of CNN and many other sites for a long time now. The security breaches are factual, they have published many incidences of it themselves over years... Their actual reputation for lax security is what works against them most, but it's all on record.
- wpietri 4y ago
  > There is nothing more evident about the fatal flaws in social media than when news concerning a platform is suppressed on the cited platform. I just looked at the Trending panel and "Mudge" is #12 for me, with 4333 tweets. #11 is "Taco Tuesday", with 4172 tweets. #7 is "Virgo" with 98,500 tweets. So I'm not seeing a lot of evidence of suppression. I think it's just a pretty niche story. I think the allegations are important and worth investigating, but the specific nature of them looks way more interesting to tech insiders than general-audience users.
  - 4y ago

shadowgovt 4y ago

I don't because I'm not seeing an organization that will hold them accountable. - This Congress is ill-equipped to understand tech, much less hold it accountable. As long as the people are happy, Congress is happy. - Lord knows the people are ill-equipped to get how bad this is. They already watched this company allow a rogue employee to shut off the account of the President of the United States (before they chose to do it as policy; https://www.washingtonpost.com/news/the-switch/wp/2017/11/02/trumps-twitter-account-was-temporarily-deactivated-due-to-human-error/ https://www.washingtonpost.com/news/the-switch/wp/2017/11/02...) and watched this company deploy a username-to-telephone lookup service publicly where they'd intended to deploy a security protocol (https://www.ghacks.net/2022/08/08/twitter-confirms-that-a-data-breach-leaked-email-addresses-and-phone-numbers-of-users/ https://www.ghacks.net/2022/08/08/twitter-confirms-that-a-da...). The public doesn't understand why they should care. - The only group who could really hold Twitter accountable are shareholders, but why should they care if the public and Congress don't? The money will roll in either way. Unless they've managed to commit an SEC violation (in which case, slap on the wrist incoming), there are no consequences for this kind of bad behavior until someone powerful gets seriously hurt. I'm glad Mudge is doing the right thing, but extremely pessimistic much will come of it. My recommendation is to shed Twitter as a user.

dcow 4y ago
> My recommendation is to shed Twitter as a user. I never understood why tech people have such a strange enamor towards Twitter. Can’t be an industry power dev without it. Can’t start a company without it. Having a healthy Twitter following is often more important than having actual users—even to investors. Twitter is digital hype. I agree. It’s time to replace Twitter. The only question is what exactly is it that anchors people to the platform? Even though it’s hard to imagine, we know that news motivates people (it happened with the WhatsApp -> Signal exodus). Where’s the “Signal for Twitter” we can all migrate to? If the key is not just creating a social platform, but also a hype engine, maybe what a competitor needs to realize is that hype doesn’t happen in a vacuum. You have to do silly algorithmic things so that content can go viral. Maybe the secret is to be open about how you manufacture hype rather than do it behind closed doors? Maybe in a way that people can verify it was done fairly?

deleted 4y ago

[deleted]

datavirtue 4y ago

It's Twitter. What possible serious security implications could possibly warrant everyone in Washington getting into a frenzy? All you do is make public comments that have zero value. And if this is indeed serious, where the fuck have we landed?

enraged_camel 4y ago
>> It's Twitter. What possible serious security implications could possibly warrant everyone in Washington getting into a frenzy? Considering how widely used Twitter is, at this point we can comfortably assume that most politicians and political operatives, even high profile ones, must have very sensitive information in their Twitter DM inboxes.
- raxxorraxor 4y ago
  > must have very sensitive information in their Twitter DM inboxes. I doubt that, and if they really do, they should be either trained or exposed pronto. Twitter is an entertainment platform.
  - jcims 4y ago
    You've described the way it ostensibly should be. My guess is that the reality is almost perfectly in opposition to what you've described. Anything that introduces plausible deniability is going to be of a major benefit.
- wiz21c 4y ago
  ah ah ah so they trust twitter ? the situation is improving at minus light speed...
  - smsm42 4y ago
    I won't be surprised that they do. Most politicians are very thoroughly technically ignorant, and have little time or patience to spend on learning technically complex things, and really safe communication means aren't usually very user-friendly.

ChrisArchitect 4y ago

l0phtcrack? "Now that's a name I've not heard in a long time." Wow I thought the name Mudge seemed slightly familiar.

webdoodle 4y ago

> I ran l0phtcrack against our Windows NT 4 server to see if it could crack passwords. Lol, did the same thing for a government entity I was working for, also without prior permission. It showed 1/4 of the people used the name of the entity as there password, including 2 users with domain admin credentials. Both of the domain admins weren't even IT people, there were the director and his assistant, who demanded to be admins, because they were 'admin' within the org. In my case, I didn't get scolding, but probably should have. As you're prior boss said, it was not good to do it on a running production server. Now a restored backup running on a private network...

shagie 4y ago

I think it was '96? I was working at Taos Mountain at the time. At that time, Taos had a reasonably close relation to Randal Schwartz ( https://www.oreilly.com/library/view/learning-perl-6th/9781449311063/pr02.html https://www.oreilly.com/library/view/learning-perl-6th/97814... ) and he gave a talk for contractors which was titled "Just Another (convicted) Perl Hacker". In that talk he told of his time at Intel and running crack on a shiny new sparc and all the problems that caused. The focus of it was a "how not to get into trouble as a contractor". Somewhere, I've still got my pink camel book with duct taped edges (for durability) with his signature on the inside title page.

melony 4y ago

There's a simpler explanation. He is doing this for profit. I don't buy all the speculation that he approached the SEC out of some professional obligation or simply to spite the Twitter leadership. As a former executive he most likely still holds stock and having the price plunge is not exactly in his interest unless the pay-off from whistleblowing is high enough. Given his high profile, he just burned all bridges career-wise at big tech. The expected whistleblower payout here must be enormous.

nr2x 4y ago
You don’t understand the value of reputation.
- melony 4y ago
  I don't think you understand what it means to burn all bridges. He is literally unhireable right now in any corporate context. You are naive if you believe he is doing this out of some hacker ethos.
  - zenlf 4y ago
    You talk like part of the problem.
  - strictnein 4y ago
    The idea that he is "unhireable" in the security space because of this is rather amusing.
    - nr2x 4y ago
      It’s honestly really hilarious. Oh no, a literal God of Security is gonna have to beg for entry level employment.
      - melony 4y ago
        In the private sector he is not going to find employment any time soon at a major corporation. You can downvote as much as you want but any management who hires whistleblowers deserve to be immediately fired by the board. It's basic corporate governance 101.

zeruch 4y ago

I met Mudge once in my career early on (I was at VA Linux systems circa 1999ish) and I found him intense, an apex intellect, but absolutely affable and self-aware. He never struck me then, or in any interview or write up since, that he's impulsive, or prone to taking actions like what he's done to Twitter, in a cavalier way. He saw something bad and thinks something should be done to address it. He likely made that decision because the culture at Twitter is as bolloxed as he states (maybe worse), and that it's one thing to fire a guy, but to do so to hide damning truths, and expect that person to just accept their fate AND let you get away with it without a cost is in this day and age, a farcical hope. Your "Mudge knows the implications of "whistleblowing". He has been a security consultant and even testified to Congress. He's not some noob that doesn't understand security or how systems work together to provide services like disclosure to FTC. The idea that Twitter PR can pooh-pooh away his concerns is shockingly stupid." is spot-on.

gonehome 4y ago
Yeah - comparing mudge's history with the email the Twitter CEO sent to internal employees and the situation seems crazy? Always hard to know from the outside, but this paired with Jack leaving seemingly frustrated with the board looks really bad. I know people have thought Twitter was mismanaged for a while, but seems like it's a lot worse than I thought it was (and the CEO seems more vindictively bad than I would have guessed). Plus the total lack of principles around speech and just doing whatever Russia, India, or KSA wants? Including hiring foreign agents? Also covering up bad security issues in reporting? It'll be interesting to see what happens from here as more comes out. The internal Twitter email: https://twitter.com/austen/status/1562150058727919616?s=21&t=DlN4DzvIMUMG89rFsK9t4A https://twitter.com/austen/status/1562150058727919616?s=21&t...
- zeruch 4y ago
  Yeah, I think we're in lockstep here. I'm no fan of Musk (he's truly worked very hard to be the most provacatively pustulent punkass of tech) but that doesn't mean that Twitter leadership is any better. Just not as well PR'd. Dorsey himself was mostly an imbecile who drank too much of his own Kool Aid. Twitter has for years been the standard bearer for the most opaque, and incoherent content management; from user feedback to bots, just a village with only idiots. It was eventually going to catch up to them, the question now is to whom does the bulk of the suffering land on, not whether it lands or not.

smsm42 4y ago

In any case your own chief of security coming out and saying your security is crap would be devastating for any company. But when it's a person with credentials list like Mudge's - one can be quite sure he's not just doing it because some disagreement about salary and vacation days, and it would be impossible to dismiss this as "disgruntled employee issue". Twitter would probably try anyway, but it won't work. Twitter is going to be in a lot of hot water now, and I can't imagine Musk isn't going to milk this to the last drop.

gjs278 4y ago

icelancer 4y ago

Yeah I kinda glossed over the headline and figured, whatever. Then I clicked through and saw it was Mudge. Ah jeez.

choppaface 4y ago

Actions speak louder than words. For him to file this complaint now, after Musk pulled out of his Twitter purchase, makes any truthful statements pretty low value to Musk’s case. Does Twitter need better security? Yeah. Will Twitter get embarrassed? Yeah? Will this testimony show Musk completely miffed his due diligence while building up a huge loan package that would have sent most of Twitter’s revenue to debt service? The timeline is what matters.

fordsmith 4y ago
This is incorrect. The complaint was filed _before_ musk even showed interest in Twitter

Consultant32452 4y ago

That's a funny story. I have a similar anecdote where I was asked to crack a zip file in a saga related to a dispute with a vendor who gave us a password protected zip file with the deliverables but not the password. Those were wild times.

b06timmer 4y ago

I did the same thing on a server for a major department store chain in the '90s. I booted a Linux diskette and copied the SAM file to it. I also ran l0phtcrack, or John the Ripper on a 486 (?) PC in my apartment. I think I bought a rainbow table and something else to expand the iterations it would use on the hashes. I let it run for over a week and had a couple of thousand clear passwords. This was for every store west of the Mississippi and included most of the "big-wigs" in our chain. I was going to send the information to our security people in another state but decided it probably wouldn't be a wise thing to do. I come across the HDD where I have this stuff archived every now and then and it makes me smile. This was also in the "Free Kevin" days.

KennyBlanken 4y ago
So you copied the auth file off company servers and cracked it on personal systems and you kept the files and cracked passwords? Not just kept around, but archived? Dude.
- mrelectric 4y ago
  I think most of us in sec do that.