bugtraq - Re: Major hack attack on the U.S. Senate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <40118B35.7020209@oracle.com>
Date: Fri, 23 Jan 2004 12:59:33 -0800
From: Kevin Reardon <Kevin.Reardon@...cle.com>
To: BUGTRAQ@...urityfocus.com
Subject: Re: Major hack attack on the U.S. Senate


Actually what they did was illegal regardless of the cause.  Hopefully 
they realized that storing anything on a shared piece of hardware will 
subject it to the possibility of attacks due to human failure.  Human 
failure is a major contributor to computer exploits and the one constant 
in the considerations for computer security.

---K

Brian C. Lane wrote:

>On Thu, 2004-01-22 at 09:25, Richard M. Smith wrote:
>  
>
>>http://www.boston.com/news/nation/articles/2004/01/22/infiltration_of_files_
>>seen_as_extensive?mode=PF
>> 
>>Infiltration of files seen as extensive
>>Senate panel's GOP staff pried on Democrats
>>By Charlie Savage, Globe Staff, 1/22/2004
>>
>>WASHINGTON -- Republican staff members of the US Senate Judiciary Commitee
>>infiltrated opposition computer files for a year, monitoring secret strategy
>>memos and periodically passing on copies to the media, Senate officials told
>>The Globe.
>>
>>    
>>
>
>[snip]
>
>You left off the most important fact in your snip. The final paragraph
>pretty well sums it up:
>
>"A technician hired by the new judiciary chairman, Patrick Leahy,
>Democrat of Vermont, apparently made a mistake that allowed anyone to
>access newly created accounts on a Judiciary Committee server shared by
>both parties -- even though the accounts were supposed to restrict
>access only to those with the right password."
>
>I sure wouldn't call this a major hack attack. Someone goofed. Someone
>else took advantage of the goof (and according to some reports even
>reported it to the bonehead technician).
>
>One one hand you really shouldn't look at someone else's files. On the
>other hand if you're cooking up dirty tricks you darn well ought to make
>sure your memos are protected, not stored in the clear on a shared
>system.
>
>And these are the jokers who want to dictate to us how to secure the
>Internet and stop SPAM? Heh!
>
>Brian
>
>---[Office 71.6F]--[Fridge 38.4F]---[Fozzy 88.8F]--[Coaster 71.7F]---
>Linux Software Developer http://www.brianlane.com
>  
>