6 ms·

Allegedly, Orange Spain's RIPE password was "ripeadmin", with no 2FA: https://twitter.com/Ms_Snow_OwO/status/1742666456058470739 https://twitter.com/Ms_Snow_OwO

Allegedly, Orange Spain's RIPE password was "ripeadmin", with no 2FA: https://twitter.com/Ms_Snow_OwO/status/1742666456058470739 https://twitter.com/Ms_Snow_OwO/status/1742666456058470739

justinclift 3y ago
https://nitter.net/Ms_Snow_OwO/status/1742666456058470739 https://nitter.net/Ms_Snow_OwO/status/1742666456058470739
zamadatix 3y ago
That's pretty loose protection on 10s of millions of dollars of asset.
- mixdup 3y ago
  if it's true, it's ridiculous BUT the cost is just the cost of downtime. is anyone under the impression that they'd actually be out these IP addresses permanently? obviously RIPE would fix the issue and get the IPs returned
  - zamadatix 3y ago
    I didn't mention cost for that reason. It's just silly to put so much into assets and then not even put basic protections on them being accessed by others instead.
  - gbil 3y ago
    Yes and no, while RIPE can help they can only up to a point. For example, the assets are transferred to someone , up to that point RIPE can help but if another transaction has followed then sorry but they can't do much
    - kortilla 3y ago
      This isn’t the blockchain. All of that can be easily reversed
      - gbil 3y ago
        Talking from experience in such a case, malicious actor transfers IP range from entity A to intermediate entity B and then entity B sells that range to entity C. Entity C obtained the asset on a perfectly legal way as they don't know and care how entity B got the asset. Nothing entity A can do then when they discover it, they can't get assets back plus RIPE also can't do anything since they only offer the tool for tracking such transactions they don't take part on them . If you want follow any legal process you want to be reimbursed from entity B and the malicious actor but you are not getting your IP range back
        pmontra 3y ago
        A legal process can give them back the IP range but it's going to take a long time. They'll have to find other IP addresses until it's settled.
        mixdup 3y ago
        I don't know the legal system in Spain or the wider EU, but in the US for example stolen goods are stolen goods no matter how many hands they pass through. Washing them through a fence doesn't suddenly make them legitimate
        kortilla 3y ago
        “I didn’t know it was stolen” doesn’t hold up well in court.
  - wongarsu 3y ago
    If this really lead to an entire country losing access to GitHub, Twitter, Canva, etc for four hours, I wager that's a pretty substantial economic loss. Of course Orange doesn't suffer this cost directly, but the downtime and the surrounding revelations/rumours about their security posture might cost them a lot of business in the medium term (even outside Spain).
    - KAMSPioneer 3y ago
      I mean, it didn't affect the _entire_ country. I am in Spain and didn't notice (neither did anyone I know) until I saw the news. Logically it should only affect Orange customers, maybe transiting traffic from other ISPs?
TacticalCoder 3y ago
> ... Orange Spain's RIPE password was "ripeadmin" if it's a thing at Orange Spain and they're reusing that excellent scheme for several services (the excellent scheme being adding "admin" after the name), they're in for a world of hurt...
ok_dad 3y ago
A company I worked for had “servername_db” as that DB server’s internal domain, then the credentials for the server were “servername_db_user” and “servername_db_password”. The argument was that it was behind a VPN and bastion server. My argument was that it was almost as easy to have a bitwarden account with 2fa and generate passwords that would never be cracked, and it would look really bad if the company was broken into and we couldn’t spend two extra seconds per login to secure it better and lose customer data.

Allegedly, Orange Spain's RIPE password was "ripeadmin", with no 2FA: https://twitter.com/Ms_Snow_OwO/status/1742666456058470739 https://twitter.com/Ms_Snow_OwO/status/1742666456058470739

justinclift 3y ago

https://nitter.net/Ms_Snow_OwO/status/1742666456058470739 https://nitter.net/Ms_Snow_OwO/status/1742666456058470739

zamadatix 3y ago

That's pretty loose protection on 10s of millions of dollars of asset.

mixdup 3y ago
if it's true, it's ridiculous BUT the cost is just the cost of downtime. is anyone under the impression that they'd actually be out these IP addresses permanently? obviously RIPE would fix the issue and get the IPs returned
- zamadatix 3y ago
  I didn't mention cost for that reason. It's just silly to put so much into assets and then not even put basic protections on them being accessed by others instead.
- gbil 3y ago
  Yes and no, while RIPE can help they can only up to a point. For example, the assets are transferred to someone , up to that point RIPE can help but if another transaction has followed then sorry but they can't do much
  - kortilla 3y ago
    This isn’t the blockchain. All of that can be easily reversed
    - gbil 3y ago
      Talking from experience in such a case, malicious actor transfers IP range from entity A to intermediate entity B and then entity B sells that range to entity C. Entity C obtained the asset on a perfectly legal way as they don't know and care how entity B got the asset. Nothing entity A can do then when they discover it, they can't get assets back plus RIPE also can't do anything since they only offer the tool for tracking such transactions they don't take part on them . If you want follow any legal process you want to be reimbursed from entity B and the malicious actor but you are not getting your IP range back
      - pmontra 3y ago
        A legal process can give them back the IP range but it's going to take a long time. They'll have to find other IP addresses until it's settled.
      - mixdup 3y ago
        I don't know the legal system in Spain or the wider EU, but in the US for example stolen goods are stolen goods no matter how many hands they pass through. Washing them through a fence doesn't suddenly make them legitimate
      - kortilla 3y ago
        “I didn’t know it was stolen” doesn’t hold up well in court.
- wongarsu 3y ago
  If this really lead to an entire country losing access to GitHub, Twitter, Canva, etc for four hours, I wager that's a pretty substantial economic loss. Of course Orange doesn't suffer this cost directly, but the downtime and the surrounding revelations/rumours about their security posture might cost them a lot of business in the medium term (even outside Spain).
  - KAMSPioneer 3y ago
    I mean, it didn't affect the _entire_ country. I am in Spain and didn't notice (neither did anyone I know) until I saw the news. Logically it should only affect Orange customers, maybe transiting traffic from other ISPs?

TacticalCoder 3y ago

> ... Orange Spain's RIPE password was "ripeadmin" if it's a thing at Orange Spain and they're reusing that excellent scheme for several services (the excellent scheme being adding "admin" after the name), they're in for a world of hurt...

ok_dad 3y ago

A company I worked for had “servername_db” as that DB server’s internal domain, then the credentials for the server were “servername_db_user” and “servername_db_password”. The argument was that it was behind a VPN and bastion server. My argument was that it was almost as easy to have a bitwarden account with 2fa and generate passwords that would never be cracked, and it would look really bad if the company was broken into and we couldn’t spend two extra seconds per login to secure it better and lose customer data.