Slashdot Mirror
Council Sells Security Hole On Ebay
Barence writes "A security expert was stunned to discover a VPN device he'd bought on Ebay automatically connected to a local council's confidential servers. Bought for just 99p for use at work, when plugged in it automatically connected with the login details which had been carelessly left on the device. 'The whole selling point of the device was that it was extremely easy to configure. It's pretty horrific really,' says the intrusion-detection professional. The council says it is 'deeply concerned' by the news, but is confident that 'multiple layers of security have prevented access to systems and data.'"
Am I the only one who cringes when hearing the phrase "multiple layers of security". It is like a process where you have five people proof read something to check for mistakes, but none of the five bears any responsibility if a typo goes through. Invariably, 80% of the mistakes make it to print.
See my journal for slashdot ID's by year. Mine created in 2005. http://slashdot.org/journal/289875/slashdot-ids-by-year
The council says it is "deeply concerned" by the news, but is confident that "multiple layers of security have prevented access to systems and data.""
but is confident that "multiple layers of security have prevented the council from knowing if anyone has had or does have access to systems and data.""
There.. that's better
Support NYCountryLawyer RIAA vs People
Once someone has a VPN tunnel directly into your network, any protection from outside attacks is automatically bypassed. What's left? A collection of passwords?
It's been a long time.
While this was a security fuckup, if your network is designed right someone having VPN access is not the end of the world. You should never be assuming traffic coming from the LAN side is "safe" anyways, and require additional authentication every step of the way. Lots of orgs give their home employees/remote offices VPN access and these machines can generally be easily compromised. TFA is short on details but if the admins have been doing their job he probably would not have been able to compromise anything more then some network printers. That said, their disposal department needs a good slapping, wiping configs from Cisco devices is ussually very easy.
the fact is that the guy already had access to the systems.
Access to a normally inaccessible private network is not the same as access to systems on that private network.
Although with IT staff this incompetent, I'd expect any next step(s) to be trivial with a real hacker behind the steering wheel (as opposed to a white hat guy like in this case).
Actually, I'm suprised that this so-called "Security Expert" plugged it into his network and allowed it to do that without first looking at what went on when he started it up in isolation.
Your lock/alarm analogy is fair. In this case however, it seems that they have locks they don't lock because of the alarm system. And they have an alarm system they don't turn on because of the locks.
See my journal for slashdot ID's by year. Mine created in 2005. http://slashdot.org/journal/289875/slashdot-ids-by-year
wanna bet that the username and password that got him into the vpn in the first place is a valid username and password in the domain?
Anyone else wonder why the fuck a so called "security expert" plugged a device blindly into his network?
I mean, really now. I haven't done any security work in a long time now, but still... Buying something for around 2 to 3 dollars (a security device, no less) off EBay then just "plugging it in" to a production network should cost this idiot his job.
And posting it to Slashdot should cost him his professional reputation.
Stupidity at it's finest.
--Toll_Free
Well, given how carelessly they treat their first layer of defense (VPN access) I wouldn't put much confidence in their other layers (if any) either. This whole story just screams INCOMPETENCE in bold and all caps. I doubt very much that the same people who are stupid enough to sell critical hardware on eBay are in any way capable of maintaining a secure network, even if their life depended on it.
But usually the VPN password and the server password are the same.
In reality security is a process and their processes are obviously broken. No person (no matter whether it is the one who set up their network or not) should be allowed to just go pick up a router and sell it on eBay. If they feel a need to cash in on their old hardware then there must be a clear process for that which includes "make really sure that all sensitive data is wiped from any device you intend to sell".
Of course it's a process, but it's a human process. Mistakes are made. Repeat mistakes of this nature should absolutely be a grounds for termination. Yet for some reason, commentators on Internet forums insist on dehumanizing the entire process and calling for the head of anyone who slips up.
Want to know what probably happened? A bunch of equipment was being replaced, and the rest trashed. Someone knew this and grabbed some of it to sell on eBay, hoping to make a quick quid. The devices were probably already off of inventory by this time, so no one was the wiser, but the guy (or girl) who took the equipment didn't know about the security procedure.
I base that off of my understanding of Cisco contracts. A friend works for a company which uses Cisco gear. In the contract, they are supposed to destroy most of the gear they get from Cisco (after it's no longer in use), and in return, they get discounts on replacements. They're subject to various financial penalties (not the least of which is the cessation of the discount) if any employees are found to have sold equipment on the secondary market. The idea is that Cisco doesn't want to flood the market with old gear that's still perfectly serviceable, but they don't want to take the time to refurbish it or destroy it themselves.
I could easily see something similar being the case here.