9 ms·
Cardinals Face F.B.I. Inquiry in Hacking of Astros’ Network
- bradleyankrom 11y agoIt'll be very interesting to see how the Commissioner's Office responds to the FBI's findings. While I don't believe espionage is new to MLB, this is the first case of it reaching the public (and federal government) that I can think of.
- jessaustin 11y agoIt's lucky for them that Bill DeWitt Jr. chaired the search committee who hired the new commissioner. (Shades of Goldman Sachs' perennial association with the Treasury Department...) However, if the Cardinals are as smart (and perhaps as ethical?) as they previously seemed, they'll get out in front of this, and voluntarily give up their 2013 pennant, as well as fire whoever was involved in this harebrained scheme.
- vaadu 11y agoGive up a 2013 pennant? Let me guess, you're a Dodgers fan. Until there are details on what was done and by whom the Cards should do nothing more than fully cooperate with the investigation. Then and only then should the Cards and MLB decide how to respond.
- jessaustin 11y agoHaha as might be clear from my myriad other posts on this topic, inasmuch as I am a fan of anything baseball-related, I am a Cardinals fan, as generations of my family have been. Because I've lived in Los Angeles, I have especially enjoyed their regular poundings of the Dodgers. I'm not saying that the Dodgers should get the pennant by default. (Would they even want it?) Rather, it should simply not exist. Fanhood notwithstanding, this is really bad. Unless the FBI finds that someone planted a device on the network of the house that originated the ill-advised logins, someone has to burn for this. (I guarantee that Mike Matheny feels the same way.) It's not quite at the level of Pete Rose (who really ought to be forgiven by now) or the Black Sox, but like those cases it completely undermines the integrity of the sport. I used to be impressed by the Cardinals' great farm system, and I felt it indicated something about Midwestern thrift, practicality, and eccentricity. I don't feel that way anymore.
- dionidium 11y agoI used to be impressed by the Cardinals' great farm system, and I felt it indicated something about Midwestern thrift, practicality, and eccentricity. I don't feel that way anymore. Well, ironically, that system was built by Luhnow, so I think you're allowed to continue feeling that way :)
- dionidium 11y agovoluntarily give up their 2013 pennant I'm a Cardinals fan, I admit it, but that's basically an insane suggestion. It's not going to happen and it's not smart. Why in the world do you think that would be smart?
- jessaustin 11y agoFor one thing, they've got a better team this year, and it's possible they'll be forced to skip the playoffs this year. Then they don't get to sell those tickets, they don't get that chance at a World Series, etc.
- bdcravens 11y agoSince they're no longer in the same division as the Astros, it's a bit less of a penalty, but I'd say every game since the initial breach against the Astros should be forfeited. Additionally, any draft picks during that time should be awarded to the Astros. (not the actual players, but that means they owe the Astros N first round picks, etc) Probably not going to go down like that, but it's a matter of punishment, as well as compensating the team that was the victim. (I'm from Houston, so probably biased)
- jessaustin 11y agoDude should have used a password manager. Or maybe just a new password. Also, the Cards staff probably shouldn't have logged in from home. Also, how on Earth is this a valid use of the FBI's resources? Fix your broken crap yourselves, Astros.
- bradleyankrom 11y agoJust because it's sports doesn't make it any less illegal.
- jessaustin 11y agoIt does make it much less important. Nobody is going to die because the Cardinals know what the Astros think about some high school pitcher. With this and the FIFA thing, it seems as if the FBI is interested mostly in sports. Meanwhile, murderers are on the loose, there has still been no meaningful investigation of the financial shenanigans for which we've all paid, there has been no examination of the FBI's own adventures in illegal surveillance and parallel construction, etc. It's clear, too, that the Astros' staff brought this on themselves. When one is hired away to a competing organization, start using new passwords! Sheesh.
- raldi 11y agoNo one would die if Google or Facebook or Apple or, well, 99% of other companies were infiltrated for the theft of highly-valuable corporate secrets. That doesn't make it outside the purview of the FBI.
- thaumasiotes 11y agoSo, the whole idea of patents is that we don't approve of corporate secrets. What's the idea of also giving legal protection to trade secrets?
- raldi 11y ago
- s0uthPaw88 11y agoHere's how they did it: "Investigators believe Cardinals officials, concerned that Mr. Luhnow had taken their idea and proprietary baseball information to the Astros, examined a master list of passwords used by Mr. Luhnow and the other officials who had joined the Astros when they worked for the Cardinals. The Cardinals officials are believed to have used those passwords to gain access to the Astros’ network, law enforcement officials said."
- carsonreinke 11y agoWhere does one get a master list?
- timboslice 11y agoLot's of companies keep passwords in an unprotected Excel sheet :/
- carsonreinke 11y agoPlease no
- mikeryan 11y agoWritten on a whiteboard?
- nissimk 11y agoAnd this is how they got caught: "Believing that the Astros’ network had been compromised by a rogue hacker, Major League Baseball notified the F.B.I., and the authorities in Houston opened an investigation. Agents soon found that the Astros’ network had been entered from a computer at a home that some Cardinals officials had lived in. The agents then turned their attention to the team’s front office."
- timboslice 11y agoTL;DR: a member of the Cardinals' staff left for the Astros a few years ago. Both teams had an internal system to track recruiting efforts etc. He used the SAME password in the new org, the Astros. Someone from the Cardinals org checked his master password list and was able to enter the Astros system with his old creds
- Fuxy 11y agoWait does that mean they kept unhashed passwords? That's a big security no no and there's absolutely no reason they should have it like that.
- jessaustin 11y agoThat's a big security no no... It's a no-no when the provider has a duty to the user, such as when the user is a paying customer. It's probably OK when the provider is the employer and the user is merely an employee? I say this because employers regularly do much worse stuff, like running MitM proxies that log bank passwords...
- task_queue 11y agoContext independent, having a store of usernames/ids/emails and plaintext passwords is Bad because it can be cross referenced with a store that actually matters.
- superuser2 11y agoNo. Every action on a network must be directly attributable to exactly one real person. Every person should have permissions to the data/systems they need under their own account. If that includes subordinates' email inboxes and home directories, so be it. In some cases it may be necessary to see the application from another user's perspective. In this case you build a function analogous to "sudo -i -u user" which lets the privileged employee use his own account to get a session under another user's account, while generating an audit trail. However this is usually not the right answer. Google Apps does not provide an "impersonate" function, but API endpoints which let you dump all mail to your own archiving system (where your company can search it for investigations, legal discovery, etc.) This is more efficient anyway, and doesn't require the disclosure of user passwords. You can also do this crudely by resetting the password in the database, gathering whatever you need to, and then changing the password back by replacing the old hash directly in the database. Then at least the impersonation is evident in your MySQL logs. If there is an Excel sheet of passwords shared among managers, and someone does something nasty from an account whose password is on that sheet, good luck figuring out whether the perpetrator is the account owner, one of the n managers with access to the passwords list, or someone else entirely.
- zekevermillion 11y agoCould someone please get the NYT to drop the paywall on hackernews links?
- pcl 11y agoThat's a really good idea. Are there any NYT folks here? Is there a procedure in place for doing this sort of thing? I imagine that news.ycombinator.com is a more common Referer than news.google.com in the development community; it'd be nice to have the same treatment from media organizations.
- smeyer 11y ago>I imagine that news.ycombinator.com is a more common Referer than news.google.com in the development community Really? I'd suspect it to be the other way around. For reference, here are some HN stats: https://news.ycombinator.com/item?id=9219581 https://news.ycombinator.com/item?id=9219581 .
- dragonwriter 11y ago> I imagine that news.ycombinator.com is a more common Referer than news.google.com in the development community I wouldn't be so sure of that; considering my own pattern, even when my reading is being driven by HN, I usually do several google searches for related content, including frequently Google News searches for related news items from other sources, for each page I go to directly from HN. And not all of my reading -- even related to development/startup things -- is driven by HN.
- dangrossman 11y agoYou can't show Googlebot one thing (the article) and real people another (the paywall) without being penalized and losing your free search traffic. That's why visits referred from Google see the full article. It's not because someone at NYT decided they don't want people from certain sites to become paid customers; if they could paywall Google-referred traffic without losing that traffic they would.
- asquabventured 11y ago
- alan_cx 11y ago"The attack represents the first known case of corporate espionage in which a professional sports team has hacked the network of another team." Im pretty sure that in F1 one team hacked another for design details. That said, I cant find a source. IIRC, it was Renault hacking Ferrari, but Im not sure.
- bradleyankrom 11y agoThis? http://www.autosport.com/news/report.php/id/15417 http://www.autosport.com/news/report.php/id/15417
- josefresco 11y ago"hacked the network" Hardly. I'm sure there are countless examples of employees improperly using access given to them by their previous employer.
- ghughes 11y agoThat distinction seems somewhat dubious. The end result is the same.
- CONTRARlAN 11y agoGuessing you're talking about this: https://en.wikipedia.org/wiki/2007_Formula_One_espionage_controversy https://en.wikipedia.org/wiki/2007_Formula_One_espionage_con...
- Kevin_S 11y agoThis is shocking, I followed this closely last year as I am a die-hard Astros fan but never thought it would be another team. I definitely doubt the Cardinals endorsed this, it was just some dudes that had access. These guys will be fired (if they haven't already) and there will be fines. Nothing too crazy will happen. Though if the FBI finds that the GM/high level execs knew about the activity... this will be unprecedented. The penalties would be staggering as MLB would want to crack down extremely hard to deter future bad behavior.
- remarkEon 11y agoReally interested to see how Bud Selig responds to this. Looks like this is the same guy (Luhnow) who SI did a pretty good thing last year about, reference how the Astros were doing a Ctrl+Alt+Dlt[1]. The cynical side of me says that Selig and MLB will try to maybe milk this for some rating or something, considering the meme going around that baseball is dying. (full disclosure, Twins fan here, so I'm gonna be cynical about anything that Selig does) [1] http://www.si.com/longform/astros/ http://www.si.com/longform/astros/ Edit: Guess I missed that Selig retired in January. Damn you, work!
- kolbe 11y agoWe don't know the details, but I think it's safe to say that if the allegations are true, the Cardinals engaged in a form of cheating. It could be that their cheating had very deep and nefarious implications, but I doubt it. If anything, they may have stolen some secrets that gave the Cards an advantage over the Astros in player acquisition strategy. What I cannot get over is how absurd is it that the Federal Government has been able to insert itself so deeply into a problem that doesn't warrant FBI involvement in the slightest. Athletic teams have been cheating for centuries. Sometimes that cheating involves ruined careers for both the cheater and the cheated, and sometimes they involve teams losing money. But what they rarely involve is the FBI. And the only times I can think of when they have involved law enforcement have been narcotics or gang related. To me, this sounds no worse than various other advantages that teams unethically gain for themselves. That our legal system allows for this particular type of cheating to potentially be a federal crime is frightening. Let MLB handle this internally, and play ball. [edit: holy shit. I get it. The FBI is acting within its legal right (and duty). This is a moral statement about the law that they are tasked with enforcing.]
- remarkEon 11y ago-> Believing that the Astros’ network had been compromised by a rogue hacker, Major League Baseball notified the F.B.I., and the authorities in Houston opened an investigation. Agents soon found that the Astros’ network had been entered from a computer at a home that some Cardinals officials had lived in. The agents then turned their attention to the team’s front office. So it looks like the Astros/MLB were unable to determine internally how their network was compromised and then contacted the FBI. This seems perfectly reasonable to me.
- kolbe 11y agoI like that aspect, which is using the FBI's resources to help solve a problem. But, to me, it's fucked up that once you call the FBI, they take over, and often bring absurdly punitive charges with them. We saw this with Aaron Schwartz and Sergey Aleynikov.
- 11y ago
- netik 11y agoThis really sounds like more of a "Astros suck at employee off-boarding" problem. They failed to lock out users of the previous system long after they left the company. Regardless of their weak password storage scheme (which must be fixed), a simple set of changes (like disabling public access to their system, disabling VPN for terminated users, and changing passwords) would have stopped this from ever occurring.
- jessaustin 11y agoNo this was on-boarded employees using the same passwords at their new job that they had used at the old job. I bet the Cardinals were at least savvy enough to disable Luhnow's old accounts.
- deleted 11y ago[deleted]
- paulsutter 11y agoLet's see if the penalties are as severe when a major sports team is caught hacking as opposed when a nerdy computer guy is caught hacking.