Slashdot Mirror
Russian Spy Ring Needed Some Serious IT Help
coondoggie writes "The Russian ring charged this week with spying on the United States faced some of the common security problems that plague many companies — misconfigured wireless networks, users writing passwords on slips of paper, and laptop help desk issues that take months to resolve."
They encrypted everything using ROT13, TWICE! How much better security can you get?
Tequila: It's not just for breakfast anymore!
http://news.cnet.com/Microsoft-security-guru-Jot-down-your-passwords/2100-7355_3-5716590.html
Of course, the rules are a bit different when you're a spy :)
Nothing wrong with writing down your long complex passwords..... UNLESS YOU LEAVE IT LAYING AROUND
The complaint read like a spy novel.... A ready-made Bourne script!
Self Defense - A Human Right www.a-human-right.com
the incompetent can be easily caught. Perhaps these were even decoys for the competent operation still running.
Did you ever wake up in the morning, with a Zombie Woof behind your eyes? -- FZ
Yes. iSpy: with my little i. (Wonder if applescript would actually accept it).
I read TFA and all I got was this lousy cookie
Passwords are the wrong solution. Trying to make people remember a short string with high entropy is hard, so people write them down. The other way around is much better - long passphrases with less of the tedious entropy. Quotations, lyrics, names, whatever. They're much easier to remember and much harder to brute-force. Sprinkle in some punctuation and you're golden.
they were just make it look like you standard network, so they do not arouse suspicion ..... ;-)
to code or not to code, that is the question.
But what if it is true? Likely, it is, actually. Every country spies on other countries. I don't really see the US getting completely bent out of shape over it, it was a 10 year investigation. What was more important was tracking them and finding out who in the US was helping them. But spies come and go, but spying is a constant.
Tequila: It's not just for breakfast anymore!
they put on the bare minimum effort to convince the kgb they're still on the team (so they don't get any polonium in their tea)
then they dig up their free bags of money in sullivan county, and get on with their average suburban wannabe lives. when the kgb calls, they find a paranoid schizophrenic's blog and rivet their kgb bosses with useless tales of intrigue from the wild west. this spy ring is a joke
if you want to talk about modern life destroying cherished traditions, add this to your list: comfortable suburban living killed james bond
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Makes me think that Russia had already abandoned these people. They knew the FBI were on to them and cut down on support to limit damage to other parts of their network.
http://michaelsmith.id.au
Sounds similar to a lot of corporate America: Using OS that locks up, poor password security, need to send laptops to corporate for assistance, ...
Keep Doing Good.
nobody can remember a 26 character password
abcdefghijklmnopqrstuvwxyz. If preschoolers can learn an arbitrary sequence of meaningless symbols totaling 26, then I think it's possible.
Plus, your sentence is longer than 26 characters and so is this one.
Unlike typical spies with foreign diplomatic cover, these alleged "illegals" cannot just be summarily expelled back to their home countries. Any act against them requires due process, the first step of which is pressing charges.
The lack of diplomatic cover also means they are not protected from any charges that may stick. Spying without diplomatic cover is a very risky game. It makes this case all the more interesting.
And if so, is that good or bad?
The United States gets very offended by espionage activity, because we would never do it to anyone else. They promise. Not a single satellite. No high altitude spy planes. No high altitude long range supersonic spy planes (we retired all of these, we promise). No remote control spy planes. No flock of agencies with covert operations world wide. Nope, not the US. Keep your spies out of our country, we don't do it to you.
Excuse me, there are a couple nice men in black suits knocking at my door that just want to ask me a few questions.
Serious? Seriousness is well above my pay grade.
I have little to no hope that the corporate world ever will.
./ and I can't really expose my name / UID in this particular case.
I'm an IT director at a mid-sized company in the US. I've worked hard to educate top executives on security issues, and to encourage them (it's hard to force a CEO or CFO to do anything) to use best practices. I've experienced a lot of resistance.
Most companies think of IT, and security in particular, as an afterthought, if at all. Our CEO, who is responsible for active contracts that are worth tens of millions of dollars, and who has very sensitive financial data and intellectual property on his laptop, balked when I told him I did not want to know his password. He'd ask me to fix a problem with his machine, and be bothered by the fact that I would ask him to type in his password himself when I needed it. Eventually I gave in and started typing it in myself. Apparently it's an open secret from middle-management up. He uses the same password for everything, and all of the privileged managers know what it is. What if one of us quits or is fired? I imagine he uses the same password for his online banking as well. It's a big risk. He travels internationally on a regular basis. Having 20 people that know the password to all of your accounts. . . well, that scares the shit out of me, but it doesn't seem to bother him.
And I get the sense that most people, whether they work in espionage or in the private sector, see security as more of an annoyance than anything else. That is, until a breach happens. When that happens, the IT department is blamed.
In those situations, "I told you so," is not an acceptable response. When bad things happen, heads roll. I'm afraid that despite my most strenuous efforts to encourage best practices for top executives, my head will one day be on the chopping block for one of their mistakes.
Sorry to post anonymously (it's the first time I have!), but other folks in my department read
"Your password has expired"
"Your password is too similar to your last password"
"Your password much be entirely different than the previous 50 passwords"
Why try to beat US security at their own game? go low tech. it works for el-qaeda. If they used the good old mail services they would have gone unnoticed for another 10 years.
Unless it's a randomly generated password, omit some letters. You shouldn't need the whole password to remind yourself what it was.
That is indeed the least of their problems. I've heard their computers were themselves full of
(puts on sunglasses)
spyware.
If they had just called themselves a business intelligence and consulting service for foreign investors, they wouldn't have any problems.
And if you call yourself a lobbyist you can even funnel money from foreign governments into your congressman's pocket.
Hmmm, you bring up a good point. The Russians should have just hired a bunch of Mexicans. Then, even after we find out they are illegal, we still couldn't touch them!
You laugh and mock, but the last head of IT we had, had us on 14 day rotating passwords. After 2 months he got canned.
Om, nomnomnom...
http://en.wikipedia.org/wiki/Poisoning_of_Alexander_Litvinenko
if they have no problem doing it on british soil, what would stop them from doing it on american soil?
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Use a memorable quote, a poem a song lyric, whatever phrase you can remember easily. Use the first letter or two from each word, swapping case and substituting punctuation marks/numbers as needed. Finally, a use for 1337-5p34k!
Example -
Whose woods these are I think I know.
His house is in the village though;
Becomes - wh wo ar th i th i kn ki ho i i th vi th
...and this is why I don't like this technique - you didn't even get it right in your example!
wh wo th ar i th i kn hi ho i i th vi th
That would be fine, but then having to learn a new one every 12 weeks because of a password expiration cycle--that's when it gets impossible. You are always recalling fragments of the old password...
I'm surprised he didn't get assaulted in the parking lot after a month.
My blog. Good stuff (when I remember to update it). Read it.