Slashdot Mirror
Russian Spy Ring Needed Some Serious IT Help
coondoggie writes "The Russian ring charged this week with spying on the United States faced some of the common security problems that plague many companies — misconfigured wireless networks, users writing passwords on slips of paper, and laptop help desk issues that take months to resolve."
They encrypted everything using ROT13, TWICE! How much better security can you get?
Tequila: It's not just for breakfast anymore!
Nothing wrong with writing down your long complex passwords..... UNLESS YOU LEAVE IT LAYING AROUND
The complaint read like a spy novel.... A ready-made Bourne script!
Self Defense - A Human Right www.a-human-right.com
the incompetent can be easily caught. Perhaps these were even decoys for the competent operation still running.
Did you ever wake up in the morning, with a Zombie Woof behind your eyes? -- FZ
Yes. iSpy: with my little i. (Wonder if applescript would actually accept it).
I read TFA and all I got was this lousy cookie
Passwords are the wrong solution. Trying to make people remember a short string with high entropy is hard, so people write them down. The other way around is much better - long passphrases with less of the tedious entropy. Quotations, lyrics, names, whatever. They're much easier to remember and much harder to brute-force. Sprinkle in some punctuation and you're golden.
they put on the bare minimum effort to convince the kgb they're still on the team (so they don't get any polonium in their tea)
then they dig up their free bags of money in sullivan county, and get on with their average suburban wannabe lives. when the kgb calls, they find a paranoid schizophrenic's blog and rivet their kgb bosses with useless tales of intrigue from the wild west. this spy ring is a joke
if you want to talk about modern life destroying cherished traditions, add this to your list: comfortable suburban living killed james bond
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Makes me think that Russia had already abandoned these people. They knew the FBI were on to them and cut down on support to limit damage to other parts of their network.
http://michaelsmith.id.au
Unlike typical spies with foreign diplomatic cover, these alleged "illegals" cannot just be summarily expelled back to their home countries. Any act against them requires due process, the first step of which is pressing charges.
The lack of diplomatic cover also means they are not protected from any charges that may stick. Spying without diplomatic cover is a very risky game. It makes this case all the more interesting.
And if so, is that good or bad?
The United States gets very offended by espionage activity, because we would never do it to anyone else. They promise. Not a single satellite. No high altitude spy planes. No high altitude long range supersonic spy planes (we retired all of these, we promise). No remote control spy planes. No flock of agencies with covert operations world wide. Nope, not the US. Keep your spies out of our country, we don't do it to you.
Excuse me, there are a couple nice men in black suits knocking at my door that just want to ask me a few questions.
Serious? Seriousness is well above my pay grade.
I have little to no hope that the corporate world ever will.
./ and I can't really expose my name / UID in this particular case.
I'm an IT director at a mid-sized company in the US. I've worked hard to educate top executives on security issues, and to encourage them (it's hard to force a CEO or CFO to do anything) to use best practices. I've experienced a lot of resistance.
Most companies think of IT, and security in particular, as an afterthought, if at all. Our CEO, who is responsible for active contracts that are worth tens of millions of dollars, and who has very sensitive financial data and intellectual property on his laptop, balked when I told him I did not want to know his password. He'd ask me to fix a problem with his machine, and be bothered by the fact that I would ask him to type in his password himself when I needed it. Eventually I gave in and started typing it in myself. Apparently it's an open secret from middle-management up. He uses the same password for everything, and all of the privileged managers know what it is. What if one of us quits or is fired? I imagine he uses the same password for his online banking as well. It's a big risk. He travels internationally on a regular basis. Having 20 people that know the password to all of your accounts. . . well, that scares the shit out of me, but it doesn't seem to bother him.
And I get the sense that most people, whether they work in espionage or in the private sector, see security as more of an annoyance than anything else. That is, until a breach happens. When that happens, the IT department is blamed.
In those situations, "I told you so," is not an acceptable response. When bad things happen, heads roll. I'm afraid that despite my most strenuous efforts to encourage best practices for top executives, my head will one day be on the chopping block for one of their mistakes.
Sorry to post anonymously (it's the first time I have!), but other folks in my department read
"Your password has expired"
"Your password is too similar to your last password"
"Your password much be entirely different than the previous 50 passwords"
That is indeed the least of their problems. I've heard their computers were themselves full of
(puts on sunglasses)
spyware.
You laugh and mock, but the last head of IT we had, had us on 14 day rotating passwords. After 2 months he got canned.
Om, nomnomnom...
http://en.wikipedia.org/wiki/Poisoning_of_Alexander_Litvinenko
if they have no problem doing it on british soil, what would stop them from doing it on american soil?
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it