Slashdot Mirror
Council Sells Security Hole On Ebay
Barence writes "A security expert was stunned to discover a VPN device he'd bought on Ebay automatically connected to a local council's confidential servers. Bought for just 99p for use at work, when plugged in it automatically connected with the login details which had been carelessly left on the device. 'The whole selling point of the device was that it was extremely easy to configure. It's pretty horrific really,' says the intrusion-detection professional. The council says it is 'deeply concerned' by the news, but is confident that 'multiple layers of security have prevented access to systems and data.'"
Am I the only one who cringes when hearing the phrase "multiple layers of security". It is like a process where you have five people proof read something to check for mistakes, but none of the five bears any responsibility if a typo goes through. Invariably, 80% of the mistakes make it to print.
See my journal for slashdot ID's by year. Mine created in 2005. http://slashdot.org/journal/289875/slashdot-ids-by-year
The council says it is "deeply concerned" by the news, but is confident that "multiple layers of security have prevented access to systems and data.""
but is confident that "multiple layers of security have prevented the council from knowing if anyone has had or does have access to systems and data.""
There.. that's better
Support NYCountryLawyer RIAA vs People
Once someone has a VPN tunnel directly into your network, any protection from outside attacks is automatically bypassed. What's left? A collection of passwords?
It's been a long time.
the count now reads -2 147 483 647
Only two things are infinite, the universe and human stupidity, and I'm not sure about the former. (Einstein)
While this was a security fuckup, if your network is designed right someone having VPN access is not the end of the world. You should never be assuming traffic coming from the LAN side is "safe" anyways, and require additional authentication every step of the way. Lots of orgs give their home employees/remote offices VPN access and these machines can generally be easily compromised. TFA is short on details but if the admins have been doing their job he probably would not have been able to compromise anything more then some network printers. That said, their disposal department needs a good slapping, wiping configs from Cisco devices is ussually very easy.
A colleague where I live bought a set of routers from Goodwill and found not only default programming but a sheet of paper stuck inside with passwords.
The passwords were for a Department of Energy facility with nuclear activities.
I bet someone here has heard of an even weirder event.
Never seen Casablanca, have you?
Captain Renault: I'm shocked, shocked to find that gambling is going on in here!
[a croupier hands Renault a pile of money]
Croupier: Your winnings, sir.
the fact is that the guy already had access to the systems.
Access to a normally inaccessible private network is not the same as access to systems on that private network.
Although with IT staff this incompetent, I'd expect any next step(s) to be trivial with a real hacker behind the steering wheel (as opposed to a white hat guy like in this case).
The problem is that this is a crypto box without a "zeroize" button.
A VPN device is, among other things, a crypto unit. Real crypto units are very explicit about key control. Sometimes, the key is in a removable and easy-to-destroy form. On units with internal key storage, there's a guarded "zeroize" button that clears all keys to zero.
Cisco didn't provide either a "zeroize" button or a removable key. So there's no easy way to scrub the thing before selling it, or to be sure it was scrubbed.
Actually, I'm suprised that this so-called "Security Expert" plugged it into his network and allowed it to do that without first looking at what went on when he started it up in isolation.
Shame they didn't think to advertise the stored login on the item's eBay description. They could probably have gotten more than 99p for it.
Slashdot Burying Stories About Slashdot Media Owned
Your lock/alarm analogy is fair. In this case however, it seems that they have locks they don't lock because of the alarm system. And they have an alarm system they don't turn on because of the locks.
See my journal for slashdot ID's by year. Mine created in 2005. http://slashdot.org/journal/289875/slashdot-ids-by-year
wanna bet that the username and password that got him into the vpn in the first place is a valid username and password in the domain?
Anyone else wonder why the fuck a so called "security expert" plugged a device blindly into his network?
I mean, really now. I haven't done any security work in a long time now, but still... Buying something for around 2 to 3 dollars (a security device, no less) off EBay then just "plugging it in" to a production network should cost this idiot his job.
And posting it to Slashdot should cost him his professional reputation.
Stupidity at it's finest.
--Toll_Free
Yay, I can hardly wait for the 64-bit port of this application!
[Nomenumbra] 0 bottles of beer on the wall, 0 bottles of beer, you take 1 down, pass it around, 4294967295 bottles of beer on the wall.
Yay, I can hardly wait for the 64-bit port of this application!
Hopefully it's open source, or I'm in trouble:
0 bottles of beer on the wall, 0 bottles of beer, you take 1 down, pass it around, 18446744073709551615 bottles of beer on the wall.
Well, given how carelessly they treat their first layer of defense (VPN access) I wouldn't put much confidence in their other layers (if any) either. This whole story just screams INCOMPETENCE in bold and all caps. I doubt very much that the same people who are stupid enough to sell critical hardware on eBay are in any way capable of maintaining a secure network, even if their life depended on it.
The incompetence of councils is limited, because they are overseen quite closely by central government, who can and do step in and roll heads if there are systemic failures. That said, most of the really egregious examples of corruption in the UK tend to come from local government.
[FUCK BETA]
I could really go for some shaved beaver right about now.
This being slashdot, finding beavers here is rare, shaved even more so, but an earlier post mentioned Bears. Perhaps they will do for you?
(I know we should not feed the trolls, but this one sounds really hungry)
How amazed would you be to suddenly find that you just forgot what I wrote and you needed to reread my post.... again.
But usually the VPN password and the server password are the same.
In reality security is a process and their processes are obviously broken. No person (no matter whether it is the one who set up their network or not) should be allowed to just go pick up a router and sell it on eBay. If they feel a need to cash in on their old hardware then there must be a clear process for that which includes "make really sure that all sensitive data is wiped from any device you intend to sell".
Of course it's a process, but it's a human process. Mistakes are made. Repeat mistakes of this nature should absolutely be a grounds for termination. Yet for some reason, commentators on Internet forums insist on dehumanizing the entire process and calling for the head of anyone who slips up.
Want to know what probably happened? A bunch of equipment was being replaced, and the rest trashed. Someone knew this and grabbed some of it to sell on eBay, hoping to make a quick quid. The devices were probably already off of inventory by this time, so no one was the wiser, but the guy (or girl) who took the equipment didn't know about the security procedure.
I base that off of my understanding of Cisco contracts. A friend works for a company which uses Cisco gear. In the contract, they are supposed to destroy most of the gear they get from Cisco (after it's no longer in use), and in return, they get discounts on replacements. They're subject to various financial penalties (not the least of which is the cessation of the discount) if any employees are found to have sold equipment on the secondary market. The idea is that Cisco doesn't want to flood the market with old gear that's still perfectly serviceable, but they don't want to take the time to refurbish it or destroy it themselves.
I could easily see something similar being the case here.