3 ms·

"Security experts found evidence that the hackers stole the corporate passwords for every Times employee and used those to gain access to the personal computers

"Security experts found evidence that the hackers stole the corporate passwords for every Times employee and used those to gain access to the personal computers of 53 employees" Does this mean the NYTimes is storing passwords in plaintext?

Hilyin 14y ago
I think if they have the ability to steal the passwords, even if they weren't plain text, they didn't do the proper precautions of encrypting with a salt. So either way, they failed.
- betterunix 14y ago
  At this point, passwords should be considered obsolete when it comes to securing things. We should be using smartcards and cryptographic techniques; humans are just not good enough at generating or remembering random strings for passwords to be considered a good idea.
  - amalag 14y ago
    Yes I personally like the Yubikey idea which integrates with AD. Keeping a physical token and just pushing a button is nice.
- tedunangst 14y ago
  The "Let's Set Up a Domain Controller" wizard doesn't ask how much salt you'd like to add to your passwords.
- brown9-2 14y ago
  A domain controller is a Microsoft server, not custom built software.
ImprovedSilence 14y ago
not sure, I think the article was careful to not disclose how their passwords are stored, but the article did make mention of encryped passwords and the use of rainbow tables to crack them.
albertsun 14y ago
Keep reading.... "From there they snooped around The Times’s systems for at least two weeks before they identified the domain controller that contains user names and hashed, or scrambled, passwords for every Times employee."
nonamegiven 14y ago
Not necessarily. All we know is that they stole the password files. We don't know if the passwords were encrypted (but I'm assuming they were), and we don't know if the thieves were able to decrypt the passwords (they probably did for some fraction >0 and <= 100%).
danso 14y ago
I hope all the NYT employees didn't reuse those passwords anywhere else...I think if you work at a big political target like the NYT, you just have to treat it as sacrosanct as your personal email and bank accounts, even if the corporate account is just a formality (I.e. you forward all your emails to your gmail account...which is not a good idea if you're a reporter, but I know several who do it for the convenience)
m0nastic 14y ago
That means that the hackers pivoted from one system to the Domain Controller (with an account they cracked previously, or the results of a pass-the-hash attack), and got access to all of the account hashes (which they then would crack offline). The passwords aren't stored in plaintext, but with the computational power available to anyone (or substituting that, time), you start getting actual passwords in a couple of minutes (the worst ones), and maybe 90% in a few hours.
deleted 14y ago
[deleted]
wes-exp 14y ago
No, it means they use Windows :)
blackman 14y ago
they probably found the place where windows stores the passwords. All 8 character passwords under the unsalted scheme (NTLM) used by Microsoft can be cracked within minutes via use of rainbow tables. Even easier if LANMAN passwords are enabled.

Hilyin 14y ago

I think if they have the ability to steal the passwords, even if they weren't plain text, they didn't do the proper precautions of encrypting with a salt. So either way, they failed.

betterunix 14y ago
At this point, passwords should be considered obsolete when it comes to securing things. We should be using smartcards and cryptographic techniques; humans are just not good enough at generating or remembering random strings for passwords to be considered a good idea.
- amalag 14y ago
  Yes I personally like the Yubikey idea which integrates with AD. Keeping a physical token and just pushing a button is nice.
tedunangst 14y ago
The "Let's Set Up a Domain Controller" wizard doesn't ask how much salt you'd like to add to your passwords.
brown9-2 14y ago
A domain controller is a Microsoft server, not custom built software.

ImprovedSilence 14y ago

not sure, I think the article was careful to not disclose how their passwords are stored, but the article did make mention of encryped passwords and the use of rainbow tables to crack them.

albertsun 14y ago

Keep reading.... "From there they snooped around The Times’s systems for at least two weeks before they identified the domain controller that contains user names and hashed, or scrambled, passwords for every Times employee."

nonamegiven 14y ago

Not necessarily. All we know is that they stole the password files. We don't know if the passwords were encrypted (but I'm assuming they were), and we don't know if the thieves were able to decrypt the passwords (they probably did for some fraction >0 and <= 100%).

danso 14y ago

I hope all the NYT employees didn't reuse those passwords anywhere else...I think if you work at a big political target like the NYT, you just have to treat it as sacrosanct as your personal email and bank accounts, even if the corporate account is just a formality (I.e. you forward all your emails to your gmail account...which is not a good idea if you're a reporter, but I know several who do it for the convenience)

m0nastic 14y ago

That means that the hackers pivoted from one system to the Domain Controller (with an account they cracked previously, or the results of a pass-the-hash attack), and got access to all of the account hashes (which they then would crack offline). The passwords aren't stored in plaintext, but with the computational power available to anyone (or substituting that, time), you start getting actual passwords in a couple of minutes (the worst ones), and maybe 90% in a few hours.

deleted 14y ago

[deleted]

wes-exp 14y ago

No, it means they use Windows :)

blackman 14y ago

they probably found the place where windows stores the passwords. All 8 character passwords under the unsalted scheme (NTLM) used by Microsoft can be cracked within minutes via use of rainbow tables. Even easier if LANMAN passwords are enabled.