Slashdot Mirror

← Back to Stories (view on slashdot.org)

FBI Password Database Compromised by Consultant

Posted by ryuzaki0 on from the this-is-the-beg-forgiveness-part dept.

LackThereof writes "An IT consultant for the FBI, hired to work on their new 'Trilogy' computer system, apparently got hold of the username and password hash databases for the FBI's network. He then used a common dictionary attack to get usable passwords out of the hashes, including that of FBI director Robert Muller, making him able to access virtually any data stored electronically at the FBI, including Witness Protection program records. The consultant, Joseph Thomas Colon, claims he used the passwords to avoid bureaucratic obstacles, and that his actions were condoned by the FBI agents he was working with at the agency." (More below.) "He has pleaded guilty to 4 counts of 'intentionally accessing a computer while exceeding authorized access and obtaining information from any department of the United States.' He initally gained access to the hash database by borrowing an agent's username and password; he then re-downloaded and re-cracked it three more times to keep up with the FBI's 90-day password expiration policy. Lesson: Your users are your biggest security hole. Don't trust your users, especially if they're government agents."

6 of 373 comments (clear)

  1. Trilogy? by Pig+Hogger · · Score: 0, Offtopic
    Trilogy, you say?

    Are you sure it's not "Trinity", instead????

  2. oblig Beavis and Butthead by Fnord666 · · Score: 0, Offtopic
    FBI spokesman Paul Bresson declined to discuss the specifics of the Colon case.
    Heh heh heh He said colon.
    --
    'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
  3. comprise != compromise by Anonymous Coward · · Score: 0, Offtopic

    comprise, to be made up of. If the database is comprised of a consultant, that would be a person in a box who must respond to password queries very quickly.

    Compromise, to reach a middle state between two conflicting positions. Like secure, and wide f'n open. If your database was secure and someone compromised it, then it's not so secure any more.

    The title was more interesting when I thought we were boxing up consultants and replacing computers with them.

    -theed

  4. Re:Wow. by Duhavid · · Score: 0, Offtopic

    His mom missed the chance to name him Charles.

    And this family should definitely marry into
    ( hyphenated, of course ) the backslash-greaterthan
    family.

    --
    emt 377 emt 4
  5. I figured as much... by Mysticalfruit · · Score: 0, Offtopic

    Username: fmulder
    Password: uf0s4ever

    --
    Yes Francis, the world has gone crazy.
  6. Someone forgot to salt their passwords? by thecheatah · · Score: 0, Offtopic

    Hasn't this type of attack been taken care of by the introducion of salts and spices :-D. FBI needs to update their software!