Slashdot Mirror
Swede Hacks Embassy Account Information From Around the World
paulraps writes "A Swedish IT consultant has caused a stir in diplomatic circles after publishing a list of secret log-in details belonging to 100 embassies, public authorities and political parties around the world. Dan Egerstad said he wasn't trying to earn money, gain publicity or get a name for himself in hacking circles. Instead he claimed that publishing the list was easier than contacting the organizations individually — and that if he had handed it to the Swedish authorities then that would have been spying."
"Dan Egerstad said he wasn't trying to earn money, gain publicity or get a name for himself in hacking circles." ....whoops.
Then why not publish the list anonymously?
"The agriculture ministry is not in charge of Gundam" - Japanese ministry official.
Anonymously giving the list to a local newspaper would have achieved the stated objective.
I'm not sure what he was thinking when he decided that publishing the list would be the best way to draw the attention of the affected parties. Sure, calling 100 different embassies can be kind of a hassle, but he could just send out an email with a bunch of BCCs. I would assume he has an email address for each of them.
Maybe this guy just doesn't have the same sense of self preservation that I do, but in my work I tend to avoid doing things that have the potential to cause a major international incident.
If he DID publish the list anonymously, then the list could just as easily been dismissed (through political agreements) as completely inaccurate/wrong.
Here's a more detailed article on the subject, ending with a highly amusing quote from Dan Egerstad about his real reason for releasing the log-in info.
In the local jail. Why else would anyone do something so boneheaded?
Honestly, I can't think of any better way to get jailed than to embarrass and irritate the high-level diplomats of 100 countries.
Yes, it was easier than turning the list over to authorities, or contacting each of the embassies. So what? It could easily be argued that he had a duty of confidentiality with his client that he failed to observe.
Furthermore, he has actually made security worse by disclosing in this matter. Who knows how many embassies were already aware of the problem, and were in the process of tightening security? It is also likely that at least some of the embassies would have discovered the vulnerabilities independently of this consultant through internal audits, and would have fixed them silently.
Now, while this guy has stirred up a hornet's nest, he hadn't really done anything to improve the security of these embassies. Sure, they have to fix it now, but they might have done it anyway.
And what if the Swedes were aware of this and using this information for intel gathering? I don't think anyone is happy he did this.
The society for a thought-free internet welcomes you.
Their security is borked.
Slashdot Burying Stories About Slashdot Media Owned
The weakest link in computer security is still the humans operating within the system...
Honestly, should I dig up something like that, I will make it as public as possible, with as much of my name on it as possible as well.
The reason is simple: When you're in the limelight, it doesn't go unnoticed when you suddenly "vanish". Post it anonymously and they will dig you up. Hand it to some journalist and the same will happen (just that one more person goes with you). You can't simply make someone disappear when he's in the center of attention. Unless you're Copperfield and want to vanish, but that's a different matter.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Just because
"Dan Egerstad said he wasn't trying to earn money, gain publicity or get a name for himself in hacking circles..."
and has the technical ability and the altruistic motives doesn't make it right. Yet if the powers that be (pick you favorite governmental agency) can do this at will, that doesn't make it wrong either.
So half of the 100 accounts belong to underdeveloped former Soviet republics. It seems unsurprising that many of their staff would be unfamiliar with computer systems and computer security.
I had posted this yesterday as well for a story.
A more detailed look by Indian express here.
Looks like the newspaperguys took due dilligence a bit too far...
from the article
"The email account of the Indian Ambassador to China contained details of a visit by Rajya Sabha member Arjun Sengupta to Beijing earlier this month for an ILO conference. There was also a transcript of a meeting this evening which a senior Indian official had with the Chinese Foreign Minister. Similarly, accounts of NDA and DRDO officials reveal phone numbers, commercial documents, official correspondence and personal mails."
This is probably very illegal, even if the information has been posted for all to see actually using this info to access someone else's account should be a no-no.
Say he had contacted each embassy individually. Best case, a mid-level functionary would have fixed the one specific problem and not reported it.
This way, media in the affected countries will be asking pointed questions, politicians will be asking questions in parliament, and many countries will improve their security policies at all their embassies worldwide, rather than just at the one with the known exposure.
Why, though, do all recent articles seem to be click-throughs to other articles scant on details, ad infinitum. Would a link to the original article, rather than a pointer to another parrot really be so hard? WHERE'S THE BEEF?
Everybody's a libertarian 'till their neighbour's becomes a crack house.
No... Actually, I don't see..
"hacking someone's email and reading it is illegal" is not quite accurate since its possible to request emails (and its often done too,) and every sys-admin who's administering email servers know that.
Confidentiality of email does NOT exist. It might exist in some alternate universe but it doesn't exist on this planet.
Thinking that it does gets people in deep do-doo (or even killed [depends who's doing the asking.])
MSBPodcast.com The opinions expressed here are my own. If you don't like 'em... Think up your own stuff.
Guess the hacks in the US Gov get to spend labor Day working....(finally) or maybe not and just ignore it. It will go away eventually. He might need a good lawyer and and find one at http://www.militarylawsuits.com/
it might have gotten published, past precedent, a glaring one was the pentagon papers.
point #1: if he took the trouble to gather or swipe a list in the first place, it makes no sense that he wouldn't have notified them directly.
point #2: if it actually was a list of compromised email accounts, any IT consultant (regardless of nationality) should probably know how to copy and paste. he could have sent them each an email letting them know they'd been compromised.
point #3: not doing one of the above was rude and selfish. in short, he's an a$$hole. and a liar. (not out for fame, fortune, etc... bs.)
-Jamie
"A Svedeesh IT cunsooltunt hes coosed a stir in deeplumetic curcles effter poobleeshing a leest ooff secret lug-in deteeels belungeeng tu 100 imbesseees, poobleec oothureeties und puleeticel perties eruoond zee vurld. Dun Igersted seeed he-a vesn't tryeeng tu iern muney, geeen poobleecity oor get a neme-a fur heemselff in heckeeng curcles. Insteed he-a cleeemed thet poobleeshing zee leest ves ieseeer thun cuntecting zee oorguneezeshuns indeefidooelly -- und thet iff he-a hed hunded it tu zee Svedeesh oothureeties zeen thet vuoold hefe-a beee spyeeng."
Interested in a Flash-based MAME front end? Visit mame.danzbb.com
I'm curious as to which security hole or human weakness he used. I see from his site and Netcraft that a lot of sites were Windows Server 2003 or Windows 2000 running IIS, but there is also Apache on Linux.
These are some of the things molecules do...... given 4 billion years -Carl Sagan
It would appear this problem goes well beyond affecting embassies. According to an article I just posted for The Register, Egerstad was able to sniff out the login details thanks to the embassies' misuse of a common client-side security application that allows him to perform a man-in-the-middle attack. In all, he's been able to obtain credentials for more than 1,000 email accounts, at least one of which belonged to an employee of a very large company.
And the kids Emmanuel surrounds himself with get _porked_, what a coincidence, Lord 2600..
I have access to a (or let's say THE) server from the US Embassy in a certain country because I used to work at the datacenter that hosted them, I do have full administrator rights (still) because the datacenter doesn't ever change all the different passwords and more than once we create administrator accounts for testing purposes, on the other hand, the machine WAS secured and certified by DHS although they missed large portions of scripts and crap that can be ran through port 80 (the website part).
I also have the access to a web server for a fairly small (regional) bank because I programmed their website. Again, poor security practices and audits (actually it's the auditors that only test for external threats, not for inside jobs) make that I still have full access to the machines to the point where I could host a small website using their very own SSL certificates. They are also certified by some government agency and have top-of-the-line firewall with deep packet inspection.
Custom electronics and digital signage for your business: www.evcircuits.com
yay another social network......
for losers.