7 ms·

Prince William photos accidentally reveal RAF password

63 points by Garbage 14y ago

gushie 14y ago
".. if you are being photographed or filmed at your place of work, it may be sensible to remove any passwords which could appear in the background.. " I've got some better advice. Don't stick passwords to the wall (or monitor) in the first place!
- stephengillie 14y ago
  Even with the actual document photochopped out, the credentials could still show in a mirror or monitor. Or maybe soon we'll be able to recreate missing parts of images by analyzing the ambient light distributions in the rest of the photo...
  - mertd 14y ago
    Second option is rather unlikely, given how many unknowns you would be solving against (geometry of the seen, geometry of the not seen, incident light sources, camera response curve etc) from comparatively very little data (a continuous signal that is sampled and heavily quantized to just 8 bits per channel).
    - stephengillie 14y ago
      Good point. We could reduce some of those unknowns by getting the original photograph (would have camera data in its metadata), and we could assume at least some of the light sources in the ceiling and through windows.
      - mertd 14y ago
        Yes you can limit the problem until we can get something useful out of the other end but it is very very hard. Here is one of the latest works on the topic: "Accidental pinhole and pinspeck cameras: revealing the scene outside the picture" (Torralba & Freeman). http://people.csail.mit.edu/torralba/publications/shadows.pdf http://people.csail.mit.edu/torralba/publications/shadows.pd...
  - lshepstone 14y ago
    It's actually a very clever way to seed access to their honeypot.
- scott_s 14y ago
  I see no problem with it. Securing a room is a known problem, and relatively easy to do, particularly in a military base. You have physical locks and guards. If you know that the people who have access to the room should also be able to access that part of the network, the physical security secures the network. The username and password, then, keep out people who don't have access to that room.
  - lostnet 14y ago
    Well yes, securing the world is a known problem. Look at the other wall.
gavinjoyce 14y ago
Probably another victim of ill-thought-out complex password requirements. If it's too complex to remember, it will probably end up on a post-it note.
- kuring 14y ago
  Reminds me of http://xkcd.com/936/ http://xkcd.com/936/
- Tomdarkness 14y ago
  It says in the article that the password was obvious and easy to guess so I doubt this is the reason.
  - manaskarekar 14y ago
    What if your netadmin makes you change it every three weeks? Edit: Whoever downvoted me obviously undermines how quickly 'password lag' builds up if you're made to change your passwords often and forced to not use the last 3 or 5 passwords again.
    - nmcfarl 14y ago
      Particularly for sites you only log into every few months. One time passwords, with a 6 week lag between use require a password manager. Memory will not cut it. And if you are nontechnical that means paper. I consulted a decade ago with a team that had ~5 systems like this. The office was awash in sticky notes. Sometimes security policies are a menace to actual security.
- meaty 14y ago
  Having worked for the MoD in the past, shit like this gets punished big time. They have quite stringent rules for managing credentials. Whoever printed that out will probably be fired pretty much straight away.
  - hellweaver666 14y ago
antihero 14y ago
Fantastic OpSec, there.
mseebach2 14y ago
There is a certain chance that this is not, in fact, an example of bad password management. This service ("MilFlip") could be an internal service on an internal, secure network (the kind of networks that, if someone was to penetrate it, you have bigger fish to fry than keeping them out of "MilFlip") that just doesn't have a good way of turning passwords off - and, to be "secure", requires a non-simple password.
andrewcooke 14y ago
the manual for the service in question is here - http://www.google.cl/url?sa=t&rct=j&q=milflip&source=web&cd=3&cad=rja&ved=0CCUQjBAwAg&url=https%3A%2F%2Fwww.aidu.mod.uk%2FMilflip%2Fhelp.pdf&ei=99-sUKbgAe_H0AHByoB4&usg=AFQjCNH5PXHjHOcLeF0irEwcY1sfGv3maw http://www.google.cl/url?sa=t&rct=j&q=milflip&so... (from a google search of "milflip"). it seems to be a web site of charts (not terribly secret).
jnazario 14y ago
why is no one else commenting that it's 2012 and we still rely on passwords?
- rymith 14y ago
  What else would you use? Biometrics are expensive, and far less secure than passwords in most instances. Besides, once you have that information, it will get converted to a hash (same as a password) so you're really stuck with the same problem from a hacking point of view. And once somebody figures out the rainbow table for your retina, what are you supposed to do, change your retina? Two factor auth is really the best way, and although it's kludgy, it provides the best protection. And it includes a password.
  - jnazario 14y ago
    you do realize this is the ministry of defense, right? they have budget and need. a clear cut case for better security needs than almost anyone. and they also have a history of saying "damn the usability" in the pursuit of their security goals. some open source projects have better security, it seems, than the MOD. wtf? talk about an asymmetric world.
    - rymith 14y ago
      I realize that, but you didn't answer my question. What do you propose they do instead?
      - jnazario 14y ago
        hardware tokens and/or biometrics (depending on the system they need access to). soft tokens (e.g. mobile devices) for low-sensitivity systems. widely available COTS laptops have fingerprint scanners, ffs. given the nature of the work the system shouldn't be comprisable if a picture of a password gets out, which is suggested in this case. (the fact that it was written down suggests other failings, yes, in all sorts of areas.) your objections (cost, usability, etc), in this case, are pretty weak when you consider the sensitivity of the assets being protected. soft token-based two factor auth is a growing commodity. key-based auth is commonplace now, and is recognized as strong. finally USB-tokens are also COTS at this point. given that a major government agency which supposedly knows a lot about security got hosed by this, i would expect the market to lag, not lead, security practices.
PaulHoule 14y ago
I've made mistakes like this before so I tend to go over office pictures with a photo editor before I post them.
iuguy 14y ago
Whomever put that up will be breached, which is not a pleasant experience. The level of dressing down will be aligned with the sensitivity of the environment the account is used for. In the case of MilFLIP, it's an Internet facing resource so there's nothing too serious. Milflip's an Internet-based web site for military flight information, primarily approach processes for different places. If it's the same milflip it won't be too serious. The user guide is publicly available online[1], as is the site. [1] - https://www.aidu.mod.uk/Milflip/help.pdf https://www.aidu.mod.uk/Milflip/help.pdf
- haberman 14y ago
  Is "breached" a British word for "fired?"
  - untog 14y ago
    It is (AFAIK) more of a military-specific term, and means being disciplined rather than fired. I believe it stems from a "breach of discipline".
    - blahedo 14y ago
      Is it a synonym for, or just a milder version of, what Americans refer to as "court-martial"?
      - elemeno 14y ago
        I would imagine that it covers the sort of disciplinary offences where one's commanding officer can impose some form of punishment or official reprimand without there needing to be a court martial. The US equivalent would be, I think, a Nonjudicial Punishment or Article 15. Purely as an FYI, what Americans would refer to as a court-martial would also be a court-martial in the UK.
      - pc86 14y ago
        I would think it'd be closer to a mast/NJP (non-judicial punishment) where you basically get yelled at, get some sort of grunt duty (cleaning the latrine for a month?), maybe have a note in your file if the CO deems it severe enough.
jread 14y ago
As an aviator in the US military, I'm not surprised. This is common practice. The system in question is for public domain UK aviation charts and pubs. Many of the unclassified systems I use have the user and password taped to the monitor.
- astrodust 14y ago
  Why don't they either use a password manager, of which there are hundreds, or simply bolt on a "LOGIN" button on the keyboard? You'd think, at least, that it could be in a binder hanging on the wall.
  - jread 14y ago
    US military unclassified systems are a mess... a spaghetti bowl of disjoint networks, operating systems, hardware, desktop and Internet applications designed by a multitude of lowest bid government contractors with little sense for usability and often very poor technical skills.
purephase 14y ago
Why don't they provide two-factor auth fobs in the military? It seems like the easiest solution to me. It's not like the technology is new.
- cs02rm0 14y ago
  They do, for systems which require greater security.
spyder 14y ago
There is a similar risk for "real" keys: http://www.guardian.co.uk/science/2008/nov/14/key-photograph-key-cutting http://www.guardian.co.uk/science/2008/nov/14/key-photograph...

63 points by Garbage 14y ago

".. if you are being photographed or filmed at your place of work, it may be sensible to remove any passwords which could appear in the background.. " I've got some better advice. Don't stick passwords to the wall (or monitor) in the first place!

stephengillie 14y ago
Even with the actual document photochopped out, the credentials could still show in a mirror or monitor. Or maybe soon we'll be able to recreate missing parts of images by analyzing the ambient light distributions in the rest of the photo...
- mertd 14y ago
  Second option is rather unlikely, given how many unknowns you would be solving against (geometry of the seen, geometry of the not seen, incident light sources, camera response curve etc) from comparatively very little data (a continuous signal that is sampled and heavily quantized to just 8 bits per channel).
  - stephengillie 14y ago
    Good point. We could reduce some of those unknowns by getting the original photograph (would have camera data in its metadata), and we could assume at least some of the light sources in the ceiling and through windows.
    - mertd 14y ago
      Yes you can limit the problem until we can get something useful out of the other end but it is very very hard. Here is one of the latest works on the topic: "Accidental pinhole and pinspeck cameras: revealing the scene outside the picture" (Torralba & Freeman). http://people.csail.mit.edu/torralba/publications/shadows.pdf http://people.csail.mit.edu/torralba/publications/shadows.pd...
- lshepstone 14y ago
  It's actually a very clever way to seed access to their honeypot.
scott_s 14y ago
I see no problem with it. Securing a room is a known problem, and relatively easy to do, particularly in a military base. You have physical locks and guards. If you know that the people who have access to the room should also be able to access that part of the network, the physical security secures the network. The username and password, then, keep out people who don't have access to that room.
- lostnet 14y ago
  Well yes, securing the world is a known problem. Look at the other wall.

gavinjoyce 14y ago

Probably another victim of ill-thought-out complex password requirements. If it's too complex to remember, it will probably end up on a post-it note.

kuring 14y ago
Reminds me of http://xkcd.com/936/ http://xkcd.com/936/
Tomdarkness 14y ago
It says in the article that the password was obvious and easy to guess so I doubt this is the reason.
- manaskarekar 14y ago
  What if your netadmin makes you change it every three weeks? Edit: Whoever downvoted me obviously undermines how quickly 'password lag' builds up if you're made to change your passwords often and forced to not use the last 3 or 5 passwords again.
  - nmcfarl 14y ago
    Particularly for sites you only log into every few months. One time passwords, with a 6 week lag between use require a password manager. Memory will not cut it. And if you are nontechnical that means paper. I consulted a decade ago with a team that had ~5 systems like this. The office was awash in sticky notes. Sometimes security policies are a menace to actual security.
meaty 14y ago
Having worked for the MoD in the past, shit like this gets punished big time. They have quite stringent rules for managing credentials. Whoever printed that out will probably be fired pretty much straight away.
- hellweaver666 14y ago

antihero 14y ago

Fantastic OpSec, there.

mseebach2 14y ago

There is a certain chance that this is not, in fact, an example of bad password management. This service ("MilFlip") could be an internal service on an internal, secure network (the kind of networks that, if someone was to penetrate it, you have bigger fish to fry than keeping them out of "MilFlip") that just doesn't have a good way of turning passwords off - and, to be "secure", requires a non-simple password.

andrewcooke 14y ago

the manual for the service in question is here - http://www.google.cl/url?sa=t&rct=j&q=milflip&source=web&cd=3&cad=rja&ved=0CCUQjBAwAg&url=https%3A%2F%2Fwww.aidu.mod.uk%2FMilflip%2Fhelp.pdf&ei=99-sUKbgAe_H0AHByoB4&usg=AFQjCNH5PXHjHOcLeF0irEwcY1sfGv3maw http://www.google.cl/url?sa=t&rct=j&q=milflip&so... (from a google search of "milflip"). it seems to be a web site of charts (not terribly secret).

jnazario 14y ago

why is no one else commenting that it's 2012 and we still rely on passwords?

rymith 14y ago
What else would you use? Biometrics are expensive, and far less secure than passwords in most instances. Besides, once you have that information, it will get converted to a hash (same as a password) so you're really stuck with the same problem from a hacking point of view. And once somebody figures out the rainbow table for your retina, what are you supposed to do, change your retina? Two factor auth is really the best way, and although it's kludgy, it provides the best protection. And it includes a password.
- jnazario 14y ago
  you do realize this is the ministry of defense, right? they have budget and need. a clear cut case for better security needs than almost anyone. and they also have a history of saying "damn the usability" in the pursuit of their security goals. some open source projects have better security, it seems, than the MOD. wtf? talk about an asymmetric world.
  - rymith 14y ago
    I realize that, but you didn't answer my question. What do you propose they do instead?
    - jnazario 14y ago
      hardware tokens and/or biometrics (depending on the system they need access to). soft tokens (e.g. mobile devices) for low-sensitivity systems. widely available COTS laptops have fingerprint scanners, ffs. given the nature of the work the system shouldn't be comprisable if a picture of a password gets out, which is suggested in this case. (the fact that it was written down suggests other failings, yes, in all sorts of areas.) your objections (cost, usability, etc), in this case, are pretty weak when you consider the sensitivity of the assets being protected. soft token-based two factor auth is a growing commodity. key-based auth is commonplace now, and is recognized as strong. finally USB-tokens are also COTS at this point. given that a major government agency which supposedly knows a lot about security got hosed by this, i would expect the market to lag, not lead, security practices.

PaulHoule 14y ago

I've made mistakes like this before so I tend to go over office pictures with a photo editor before I post them.

iuguy 14y ago

Whomever put that up will be breached, which is not a pleasant experience. The level of dressing down will be aligned with the sensitivity of the environment the account is used for. In the case of MilFLIP, it's an Internet facing resource so there's nothing too serious. Milflip's an Internet-based web site for military flight information, primarily approach processes for different places. If it's the same milflip it won't be too serious. The user guide is publicly available online[1], as is the site. [1] - https://www.aidu.mod.uk/Milflip/help.pdf https://www.aidu.mod.uk/Milflip/help.pdf

haberman 14y ago
Is "breached" a British word for "fired?"
- untog 14y ago
  It is (AFAIK) more of a military-specific term, and means being disciplined rather than fired. I believe it stems from a "breach of discipline".
  - blahedo 14y ago
    Is it a synonym for, or just a milder version of, what Americans refer to as "court-martial"?
    - elemeno 14y ago
      I would imagine that it covers the sort of disciplinary offences where one's commanding officer can impose some form of punishment or official reprimand without there needing to be a court martial. The US equivalent would be, I think, a Nonjudicial Punishment or Article 15. Purely as an FYI, what Americans would refer to as a court-martial would also be a court-martial in the UK.
    - pc86 14y ago
      I would think it'd be closer to a mast/NJP (non-judicial punishment) where you basically get yelled at, get some sort of grunt duty (cleaning the latrine for a month?), maybe have a note in your file if the CO deems it severe enough.

jread 14y ago

As an aviator in the US military, I'm not surprised. This is common practice. The system in question is for public domain UK aviation charts and pubs. Many of the unclassified systems I use have the user and password taped to the monitor.

astrodust 14y ago
Why don't they either use a password manager, of which there are hundreds, or simply bolt on a "LOGIN" button on the keyboard? You'd think, at least, that it could be in a binder hanging on the wall.
- jread 14y ago
  US military unclassified systems are a mess... a spaghetti bowl of disjoint networks, operating systems, hardware, desktop and Internet applications designed by a multitude of lowest bid government contractors with little sense for usability and often very poor technical skills.

purephase 14y ago

Why don't they provide two-factor auth fobs in the military? It seems like the easiest solution to me. It's not like the technology is new.

cs02rm0 14y ago
They do, for systems which require greater security.

spyder 14y ago

There is a similar risk for "real" keys: http://www.guardian.co.uk/science/2008/nov/14/key-photograph-key-cutting http://www.guardian.co.uk/science/2008/nov/14/key-photograph...