FBI Password Database Compromised by Consultant

LackThereof writes "An IT consultant for the FBI, hired to work on their new 'Trilogy' computer system, apparently got hold of the username and password hash databases for the FBI's network. He then used a common dictionary attack to get usable passwords out of the hashes, including that of FBI director Robert Muller, making him able to access virtually any data stored electronically at the FBI, including Witness Protection program records. The consultant, Joseph Thomas Colon, claims he used the passwords to avoid bureaucratic obstacles, and that his actions were condoned by the FBI agents he was working with at the agency." (More below.) "He has pleaded guilty to 4 counts of 'intentionally accessing a computer while exceeding authorized access and obtaining information from any department of the United States.' He initally gained access to the hash database by borrowing an agent's username and password; he then re-downloaded and re-cracked it three more times to keep up with the FBI's 90-day password expiration policy. Lesson: Your users are your biggest security hole. Don't trust your users, especially if they're government agents."

Comments

scary

[rolyatknarf]

These are the people protecting me from terrorists? Scary, very scary.

Re:scary

[955301]

No. No they are not. The person protecting you from "terrorist" or anyone else trying to hurt you is yourself. Not cops, not the government, and often times your parents can end up the worst of your enemies (despite good intentions).

Rely on yourself for survival - rely on others to grow.

Re:scary

[hackstraw]

These are the people protecting me from terrorists? Scary, very scary.

Huh?

What ever gave you that idea? What evidence is there? Next, people will believe that "Homeland Security" is... Or the war in Iraq was...

Re:scary

[ray-auch]

The people at the top have to know so they can they leak the info when politically necessary.

[ Same answer as "why does the whitehouse need to know who every undercover CIA agent is ?" ]

Re:scary

[Intron]

Right. Cops and FBI should investigate crimes after they have been committed, or when they have evidence a crime is going to be committed. Asking them to prevent terrorist acts in advance is equivalent to asking for a police state. I personally feel that there should have been no blame cast on the intelligence community for 9/11. I certainly do not feel any safer since the creation of DHS. Another layer of bureaucracy is not going to make information flow better. The opposite, if anything.

And we're going to fix this...

[richdun]

So we charge the consultant, send him through the legal system, etc. Are we also going to do something to prevent this from happening again, like educating agents not to give out their username/password or allowing the kind of access this guy was able to get?

Re:And we're going to fix this...

[Lumpy]

How about FORCING the morons that end up as department heads and executives to use secure passwords?

A dictionary attack.... OMFG!

If the director had a secure password then it would not have been a big deal.

Listen kids, Big98Boob$-311 as your password is pretty damned secure and makes a dictionaty attack useless against it.

Next question, WTF is the feds doing not using securID on all of their logins to eliminate such a problem??

Re:And we're going to fix this...

[qwijibo]

Why should they do that? They fixed the glitch. The guy pleaded guilty, so there's no reason for any government agent who acted carelessly and facilitated the crime to be reprimanded. From a management perspective, the problem isn't the access he had, but the egg on their face resulting from the access he had. He's got fired and will likely go to jail, so from the management perspective, the problem has been solved. It may be a stupid viewpoint, but it's a very common one when the alternative is taking responsibility for ones own actions.

Re:And we're going to fix this...

[J.R. Random]

The policy of forcing people to change their passwords on a regular basis is in direct conflict with requiring the password to be obscure and full of funny characters. If I'm forced to change my password every two months I'll use passwords like "january", "march", "may", etc. If I'm forced to to change my password every two months and have it be obscure, I'll write the damn thing on a post-it note and attach it to the back of my monitor. If you want me to remember an obscure password like Big98Boob$-311 without writing it down I better be able to keep it.

Re:And we're going to fix this...

[hey!]

Well, this is one of those situations where you just throw up your hands.

It's not that the higher ups are idiots for choosing crackable passwords. It's that passwords don't work. Not well enough to do what we want them to do.

They can be made less dysfunctiona by checking for things like dictionary attacks, but a password that is strong enough to be used for something like tracking terrorists or launching nuclear missiles is too strong for a human to remember.

And there have been solutions for this around forever. Lotus Notes has had two factor security with strong crypto for twenty years now. RSA and other vendors have been selling solutions that work for basically forever.

This guy was foolish to do what he did. Not because it was wrong, but because the results to himself were predictable. The FBI reaction in this case reminds me of the Catholic Church's reaction to priest pedophilia. The Church has a rule that it is wrong to bring the Church into disrepute. But instead of interpreting this rule as "don't do anything that is shameful", it became "don't let the truth about shameful things get out."

So, what we have here is a geek who just wanted to get his job done, up against the slowness of the bureacracy. Why is the bureacracy slow? Because slow is safe. Decisions that don't get made don't leave anybody responsible. But bureacracies are still jealous of their rights to make decisions, even if they are put off indefinitely. Making things happen fast, and along the way exposing weaknesses that attach to individuals, that's almost unimaginably evil from that point of view.

The only thing interesting to me is the pricetag.

[a_karbon_devel_005]

The FBI's Trilogy program cost more than $535 million but failed to produce a usable case-management system for agents because of cost overruns and technical problems, according to the Government Accountability Office. While Trilogy led to successful hardware upgrades and thousands of new PCs for bureau workers and agents, the final phase -- a software system called the Virtual Case File -- was abandoned last year. The FBI announced in March that it would spend an additional $425 million in an attempt to finish the job. The new system would be called "Sentinel."

I need to check the Government Accountability Office more often. It's good to know we're spending 1 billion dollars to found a, most likely, failed attempt at secure computing for the FBI. Doh.

A hacker?

[Rick Zeman]

Geeze, my sister could even run l0phtcrack. Can't give him much credit here.

Unqualfied moron

[dieman]

Really, seriously, you do not crack passwords to get your work done. You crack passwords to ensure site security if it is part of your job description, but you do not use those accounts to get work done. Cripes.

Employees suck!

[andrewman327]

There is incredible effort focused on keeping bad people out of networks. Where I currently work I need to use three different passwords that must be changed regularly in order to access a large database. The problem is that there is nothing stopping an employee of any company who has legitimate access to any data from using it for nefarious ends. I seem to remember employees of a credit card company stealing numbers a while back. Also, the Department of Vetrans' Affairs and many other companies and agencies have lately had data breaches that were the direct result of employees either intentionally or accidentally removing data from the network and allowing it to be potentially misused.

Employers need to be more careful about whom they hire and what their employees are doing. Even the members of /. should agree that not all information should be free.

Re:Employees suck!

[99BottlesOfBeerInMyF]

Employers need to be more careful about whom they hire and what their employees are doing.

In the U.S. the workplace has developed an adversarial relationship between employers and employees. The mantra, "nothing personal, this is just business" has removed the major factor stopping employees from screwing over their employer. If it is just business when an employer lies to the employees, fires them when they need a boost in the numbers, outsources their job, cancels benefits, or takes other action that affects the employees negatively then it is also just business when the employee lies to the employer, walks off with equipment, moves to another job at a bad time without giving any notice, or loots the database for info they can sell.

You see, it was not the law that prevented this sort of behavior, it was an ethical motivation. People, in general, don't like to hurt or even disappoint others. They want to do right by them. When they are treated unethically in turn, that motivation disappears. Do you want your employees to be loyal and honest? I certainly recommend checking up on each one, but more importantly, treat them well and with concern. Make sure they know, even if they screw up they won't be fired. Make sure they know you're doing the best you can to provide them with a reasonable income, friendly workplace, and what they need to be happy. Make sure you reward their good works. Make sure that if they run into money troubles you're the first person they talk to. Make sure they know you respect them. This is not only ethical, it is good business.

Re:Employees suck!

[mjeffers]

You see, it was not the law that prevented this sort of behavior, it was an ethical motivation. People, in general, don't like to hurt or even disappoint others. They want to do right by them. When they are treated unethically in turn, that motivation disappears.

While I agree that the qualities you've listed make for a better business, both in terms of a better workplace as well as a business that is concerned more with the next 10 years than the next quarter, I have to disagree with the above statement. It makes it sound like your average worker is one bad meeting or one lousy review away from ripping you off. In my experience that's not the case. Most people I've worked with at least try to act honestly and fairly with others (if I've got enough anecdotes it proves something -- right?).

To tweak your point slightly I'd say that there's always a certain small percentage of the workforce that, if given the opportunity, will act unethically in order to achieve some larger (either personal or corporate) goal. The change in the U.S. workplace environment just gave those people the bad example they needed to justify their behavior. After all, if major business can crap all over their employees and enjoy record profits and AT&T can sell your information to the feds who cares if I crack my bosses password to make things a little easier (or to see the results of my review a few weeks early).

I think the key distinction though is that these employees were already the type of people that would do whatever they could get away with (and they've just seen the bar for "what you can get away with" ascend into the stratosphere) and not your typical office worker.

Disaster averted!

[qwijibo]

Good thing this guy pleaded guilty. Otherwise, someone might ask uncomfortable questions, like why FBI agents were active participants in this criminal act. The whole problem would have been averted if someone didn't give their username and password to this guy.

Of course, the whole thing could have also been averted if normal users didn't have access to the password file. The Unix world figured out that shadow password files are a good idea a long time ago. Too bad the wisdom there hasn't caught on.

One thing everyone should know when working for a large organization is that they have policies for everything because they assume everyone is dumber than paste. The up side of this as a consultant is that you can bill a week for 30 minutes of work because there's a week of paperwork needed before you can perform any task. This guy tried to get things done more efficiently by sidestepping the boundaries. Small companies can respect that kind of attitude, but not the government. That kind of behavior results in lower billings to the government, and that is unamerican.

Jumping through hoops, as silly as they may be, is an important part of any technical job within a large organization.

And the FBI agreed to this?

[sammy baby]

Talk about losing sight of the forest due to the trees...

Colon claimed that he did this because he was tired of having to seek bureaucratic authorization for every last task, including adding printers. Having worked with government agencies before, I can say I understand his frustration. But his later justification was priceless:

Colon's lawyer said in a court filing that his client was hired to work on the FBI's "Trilogy" computer system but became frustrated over "bureaucratic" obstacles, such as obtaining a written authorization from the FBI's Washington headquarters for "routine" matters such as adding a printer or moving a new computer onto the system. He said Colon used the hacked user names and passwords to bypass the authorization process and speed up the work.

Colon's lawyers said FBI officials in the Springfield office approved of what he was doing, and that one agent even gave Colon his own password, enabling him to get to the encrypted database in March 2004. Because FBI employees are required to change their passwords every 90 days, Colon hacked into the system on three later occasions to update his password list.

Okay, so: getting authorization was onerous, so he asked for permission from agents in the Springfield office to forge their superiors' credentials in order to speed up the process. And they gave it to him.

Did you get that? I was originally gonna boldface the best parts, but I couldn't decide where to start.

1. The contractor, fed up with an onerous and ridiculous authorization process,
2. asked for permission from FBI officials to crack their superiors' passwords,
3. and the FBI officials in question said yes.

Okay, so, Colon is in court. What happened to the FBI staffers who gave him the go-ahead?

Re:And the FBI agreed to this?

[P3NIS_CLEAVER]

The flip side to the dumb arbitraryness of govt work is that you will never get in trouble if you follow the rules. This guy should of just billed the extra time to set up printers and been happy he had a job. What an idiot.

Has the 'consultant'

[zoomshorts]

Been charged with illegal access? He apparently used a brute force cracking script to compromise
the database he had tenative acccess to. If he needed greater acces, he would have had it. The
article is , at best, lacking in solid information. At least to me it is.

Re:Has the 'consultant'

[Foobar of Borg]

Why is Parent modded Flamebait? It is a very valid point. Even if you are insane enough to trust the government not to abuse your information (and in this regard I don't care if it is a Bush, a Clinton, or a Coleman in office - even Gary Coleman would abuse your personal information), the fact that they can't keep it safe means that any number of scumbags can target you for ID theft, stalking, or whatever else they get into their theiving/warped/addled heads.

Well, we now know the FBI doesn't audit.

[tinkertim]

Regular access audits would have picked this up much sooner. End of story. By hanging this poor bastard out to dry, they've basically exposed even more lack of security.

I call for this every time something like this gets published , and I'll call for it again :

We need (real) IT professionals in Congress, they need to form an oversight committee, and they need to have pretty much unrestricted access to most systems so they can be effective.

These holes have *got* to get plugged. Its not only embarrassing, its media porn and its going to encourage hacks that *do* result in something bad happening.

Nimrods.

Witness Protection Info on shared database?

[SydShamino]

So one hash file gives him access to all FBI records, including the most sensitive? No offense, but why aren't the most sensitive of services protected by isolating them in a separate system? Compromising the witness protection program could endanger the lives of everyone protected by it, and just the ideas that it might be compromised could reduce the chances of people helping the FBI and testifying.

Isn't witness protection data Need To Know? Why would the FBI director Need To Know anything at all at a moment's notice from his desktop PC? It would make much more sense to have a separate system, and have him walk down the hall, ask someone to retrieve what he needs, and maybe get ONE record made available for a limited time.

I'm not trolling or anything. Seriously, can someone suggest scenarios whereby immediate, free access to that data is valuable, especially by people who don't already know whether you or I are in the program?

Re:Forced password expirations

[Tim C]

The problem with a biometric system is that when someone manages to fool it and impersonate someone, you can't change their access token. At least if my password is compromised I can change it; not so with my thumbprint.

Would that it were that easy.

[Divide By Zero]

Forcing one's boss to do something is terribly difficult. You generally need support from your boss' boss. When they're both high-level political appointees, it's that much harder. Not saying you're wrong, just saying that it's not always possible. Generally easier (and better, imho) to teach him, give him some sort of appreciation of the pile of excrement he can wind up in if he doesn't.

As for two-factor, I know VA is moving towards it (and was before the whole laptop debacle). Might be fed-wide. Hopefully this will light a fire under it.

Way worse than what Merlyn did

[frankie]

This guy not only cracked his employer's passwords (many of whom probably have high security clearance), but he actually logged into them routinely and used them as part of his workflow for nearly a year. Hello?

Compare that to the clearly less harmful actions of Randal Schwartz, who went gray-hat (one time, without using the logins, as a security warning). Three felony convictions and a rather severe sentence.

Re:Forced password expirations

[Princeofcups]

This may seem obvious, but shouldn't they be using a three piece access system?

1 - biometric (fingerprint, voice, retina, etc.)
2 - item (SecureID card, etc.)
3 - password

If biometric fails, the cracker still doesn't have the item or password. If the item is stolen, the cracker doesn't have a fingerprint or password. If the doofus tells someone his password, the cracker doesn't have the fingerprint or item.

jfs