Slashdot Mirror
FBI Password Database Compromised by Consultant
LackThereof writes "An IT consultant for the FBI, hired to work on their new 'Trilogy' computer system, apparently got hold of the username and password hash databases for the FBI's network. He then used a common dictionary attack to get usable passwords out of the hashes, including that of FBI director Robert Muller, making him able to access virtually any data stored electronically at the FBI, including Witness Protection program records. The consultant, Joseph Thomas Colon, claims he used the passwords to avoid bureaucratic obstacles, and that his actions were condoned by the FBI agents he was working with at the agency." (More below.)
"He has pleaded guilty to 4 counts of 'intentionally accessing a computer while exceeding authorized access and obtaining information from any department of the United States.' He initally gained access to the hash database by borrowing an agent's username and password; he then re-downloaded and re-cracked it three more times to keep up with the FBI's 90-day password expiration policy. Lesson: Your users are your biggest security hole. Don't trust your users, especially if they're government agents."
These are the people protecting me from terrorists? Scary, very scary.
So we charge the consultant, send him through the legal system, etc. Are we also going to do something to prevent this from happening again, like educating agents not to give out their username/password or allowing the kind of access this guy was able to get?
The FBI's Trilogy program cost more than $535 million but failed to produce a usable case-management system for agents because of cost overruns and technical problems, according to the Government Accountability Office. While Trilogy led to successful hardware upgrades and thousands of new PCs for bureau workers and agents, the final phase -- a software system called the Virtual Case File -- was abandoned last year. The FBI announced in March that it would spend an additional $425 million in an attempt to finish the job. The new system would be called "Sentinel."
I need to check the Government Accountability Office more often. It's good to know we're spending 1 billion dollars to found a, most likely, failed attempt at secure computing for the FBI. Doh.
Geeze, my sister could even run l0phtcrack. Can't give him much credit here.
Really, seriously, you do not crack passwords to get your work done. You crack passwords to ensure site security if it is part of your job description, but you do not use those accounts to get work done. Cripes.
-- dieman - Scott Dier
Employers need to be more careful about whom they hire and what their employees are doing. Even the members of
Information wants a fueled airplane waiting at the hangar and no one gets hurt.
Coming soon.. laws outlawing common dictionary password cracking tools and similiar security tools.
I can't believe that they don't even have some sort of verification that the passwords aren't common things. Heck even here, when you try to change your passwords everywhere there are so many restrictions that it can't be a dictionary word or easy to guess. Simple rules - at least 1 CAP letter (means at least 1 letter) - at least one symbol (@#.,& etc.) - at least 1 number - at least 8 chars long How hard is it to enforce this.
Or better yet, use a biometric system. It's amazing to think that the FBI, which was always on the cutting edge of technology back from its inception in order to better get ahead of the bad guys, is now foundering in the Internet age. Is it any wonder data sharing and coordination is such a problem?
GetOuttaMySpace - The Anti-Social Network
even have access to much of that data. Just cause he is top dog does not in any way mean he should have access to the witness protection records. He doesnt need to know that information, and if he does he should have to go through the proper channels. This is exactly why.
In many cases, the higher upthe person, the LESS data they need from the computer systems.
The phrase "more better" is acceptable English. suck it grammar Nazis
Good thing this guy pleaded guilty. Otherwise, someone might ask uncomfortable questions, like why FBI agents were active participants in this criminal act. The whole problem would have been averted if someone didn't give their username and password to this guy.
Of course, the whole thing could have also been averted if normal users didn't have access to the password file. The Unix world figured out that shadow password files are a good idea a long time ago. Too bad the wisdom there hasn't caught on.
One thing everyone should know when working for a large organization is that they have policies for everything because they assume everyone is dumber than paste. The up side of this as a consultant is that you can bill a week for 30 minutes of work because there's a week of paperwork needed before you can perform any task. This guy tried to get things done more efficiently by sidestepping the boundaries. Small companies can respect that kind of attitude, but not the government. That kind of behavior results in lower billings to the government, and that is unamerican.
Jumping through hoops, as silly as they may be, is an important part of any technical job within a large organization.
Colon claimed that he did this because he was tired of having to seek bureaucratic authorization for every last task, including adding printers. Having worked with government agencies before, I can say I understand his frustration. But his later justification was priceless:
Okay, so: getting authorization was onerous, so he asked for permission from agents in the Springfield office to forge their superiors' credentials in order to speed up the process. And they gave it to him.
Did you get that? I was originally gonna boldface the best parts, but I couldn't decide where to start.
1. The contractor, fed up with an onerous and ridiculous authorization process,
2. asked for permission from FBI officials to crack their superiors' passwords,
3. and the FBI officials in question said yes.
Okay, so, Colon is in court. What happened to the FBI staffers who gave him the go-ahead?
Been charged with illegal access? He apparently used a brute force cracking script to compromise
the database he had tenative acccess to. If he needed greater acces, he would have had it. The
article is , at best, lacking in solid information. At least to me it is.
Regular access audits would have picked this up much sooner. End of story. By hanging this poor bastard out to dry, they've basically exposed even more lack of security.
I call for this every time something like this gets published , and I'll call for it again :
We need (real) IT professionals in Congress, they need to form an oversight committee, and they need to have pretty much unrestricted access to most systems so they can be effective.
These holes have *got* to get plugged. Its not only embarrassing, its media porn and its going to encourage hacks that *do* result in something bad happening.
Nimrods.
What, like due-process, warrants, and legal considerations?
So FBI agents just stand around while he illegally accesses everything he's not supposed to so it can make their jobs easier? If there were actual agents standing around thinking this was good, we're in deep doo-doo, because they have now taken the stance that if they subcontract the illegal stuff, they're all good.
Yikes!
Lost at C:>. Found at C.
So one hash file gives him access to all FBI records, including the most sensitive? No offense, but why aren't the most sensitive of services protected by isolating them in a separate system? Compromising the witness protection program could endanger the lives of everyone protected by it, and just the ideas that it might be compromised could reduce the chances of people helping the FBI and testifying.
Isn't witness protection data Need To Know? Why would the FBI director Need To Know anything at all at a moment's notice from his desktop PC? It would make much more sense to have a separate system, and have him walk down the hall, ask someone to retrieve what he needs, and maybe get ONE record made available for a limited time.
I'm not trolling or anything. Seriously, can someone suggest scenarios whereby immediate, free access to that data is valuable, especially by people who don't already know whether you or I are in the program?
It doesn't hurt to be nice.
The problem with a biometric system is that when someone manages to fool it and impersonate someone, you can't change their access token. At least if my password is compromised I can change it; not so with my thumbprint.
It's official. Most of you are morons.
Surely this proves that 90 day password expiration policies encourage users to pick weaker passwords they can remember because they are having to change them all the time?
Surely this really proves that the IT department wasn't enforcing strong passwords and that's about all it proves. Having strong passwords that change every 90 days is NOT an unreasonable policy and is easy to enforce with any OS.
The IT department should be on trial along with the consultant.
Good judgment comes from experience, and a lot of that comes from bad judgment.
Forcing one's boss to do something is terribly difficult. You generally need support from your boss' boss. When they're both high-level political appointees, it's that much harder. Not saying you're wrong, just saying that it's not always possible. Generally easier (and better, imho) to teach him, give him some sort of appreciation of the pile of excrement he can wind up in if he doesn't.
As for two-factor, I know VA is moving towards it (and was before the whole laptop debacle). Might be fed-wide. Hopefully this will light a fire under it.
Dare to Hope. Prepare to be Disappointed.
This guy not only cracked his employer's passwords (many of whom probably have high security clearance), but he actually logged into them routinely and used them as part of his workflow for nearly a year. Hello?
Compare that to the clearly less harmful actions of Randal Schwartz, who went gray-hat (one time, without using the logins, as a security warning). Three felony convictions and a rather severe sentence.
While I agree with the parent (and the existing siblings to this post) that unless it is your job to "put stress on the system" and "test the limits" (officially) then it's unethical to do so (even if you "have the approval of your coworkers/peers", etc.), this is a prime opportunity to point out to businesses the value of periodically taking the proverbial step back and critically evaluating their procedures and policies for inefficient, obsolete, conflicting, or downright counterproductive practices and directives. Human nature being what it is, if a policy or practice doesn't seem to have any value (or, worse yet, it seems to "cost" an employee "more" to follow it than to circumvent it) sooner or later someone will figure out a way to cut that corner for reasons that range from collecting the "brownie points" awarded for being the "guru" who figured out how to "streamline" the process all the way to the guy who legitimately believes (correctly or otherwise) that his job really does depend on getting that extra little thing done. I've seen it. We've all seen it.
Situation: Contractor entrusted with compiling "the numbers" on "that important account" is involved in an accident (yup, you guessed it) the morning of "the big presentation." Oh, but all her work is (by company policy) safe and sound on the server instead of on her (now smashed) laptop. Great! Just one little problem: nobody knows her password, and (also by company policy) access to anyone's server-side account other than the person to whom that account is assigned is strictly verboten! No "emergency plan" exists to cover such a contingency, and the critical hour (minute) fast approaches.
Solution: A quick call to IT (from the contractor's manager's phone) went something like this: "Hey, Suzy Q's password needs to be reset; her account's locked out. You want me to just tell her the password is 'password' and she needs to change it the first time she logs in? No problem. Yeah, and I'll see to it the password-reset form gets done and drop it off to you ASAP; I know you gotta cover things on your end. Thanks!" Almost five whole minutes, and the "company policy" that was no doubt pored-over for hour upon hour by some of the finest administrative (and legal) minds in the company's employ was artfully dodged by "just some dude." I think one of us asked the guy if he felt bad about lying to the person in IT, and his response was that he didn't lie; the account was locked-out (after he had tried to guess the password three times...) so the password did need to be reset and as soon as he saw "Suzy Q" he would be sure to tell her what her new password was! Unethical? Yup. Sneaky? Yup. Effective? Yup. The presentation was retrieved, the account was saved, and the world continued to revolve. A simplistic example, sure, but [insert "slippery-slope" analogy here]...
I'm not saying I condone it and I'm not saying I'd do it, I'm just saying you've got to be stupid to think you can throw obstacles in front of motivated people and they won't figure a way to avoid them, and it's wise to occassionally evaluate whether or not we're doing just that.
This space intentionally left (almost) blank.
This may seem obvious, but shouldn't they be using a three piece access system?
1 - biometric (fingerprint, voice, retina, etc.)
2 - item (SecureID card, etc.)
3 - password
If biometric fails, the cracker still doesn't have the item or password. If the item is stolen, the cracker doesn't have a fingerprint or password. If the doofus tells someone his password, the cracker doesn't have the fingerprint or item.
jfs
The only thing worse than a Democrat is a Republican.
Password expiration policies are great, but only when the users use them properly. For example, it becomes pointless/useless if the user just increments a digit, usually the last digit, in their password during the end of each period.
... etc. etc.
I.E.
User sets inititial password to "MyP@ssw0rd1"
90-day expiration comes, user sets their password to "MyP@ssw0rd2"
90-day expiration comes, user sets their password to "MyP@ssw0rd3"
Once a hacker cracks a user's password (the hard part?), they can continue to use it just by incrementing a digit in the user's password after each 90-day period, therefore, rendering any password expiration policies useless.
As we all know the net upshot of forcing users to change passwords every 90 day easy to remember passwords and/or writing them down. In this case I think its an even worse policy. If an FBI password is compremised the worst damage is going to happen within a day or two.