Slashdot Mirror
Attackers Leak UN Usernames and Passwords
Orome1 writes "A group of hackers that go by the name of 'Teamp0ison' has apparently compromised one (or more) of UN's servers and dumped over 1000 email addresses, usernames, and passwords of their staff."
The BBC has a bit more, including a denial that anything of value was compromised.
1000+, I don't think so:
grep Password united_nations_hacked_by_trick_-_teamp0ison.txt | grep -v 000 | wc -l
584
I'm excluding the 000 passwords as being their actual passwords.
grep Password united_nations_hacked_by_trick_-_teamp0ison.txt | grep -v 000 | awk '{ if (length($4) < 6) { print $4; }
131
That's 131 of the passwords are less than 6 characters. I'm guessing these passwords are very old, before better security measures were put in place.
It's more a story of bad security practices than brilliant exploits by 12 year olds.
A feeling of having made the same mistake before: Deja Foobar
Judging by some of it's past inactions, it is arguable that 1,000+ UN accounts do not comprise anything of value.
Quick, someone log in with all of them, and announce World Peace!
http://pastebin.com/FEcE9WzJ
Look plaintext to me, but also look old.
If there is one thing that will result in the UN stepping in to places like Darfur, Rwanda, and Yugoslavia, clearly it is having email accounts and login credentials spread around. If only T3amP01s0n had been around in the 1940s they could have... um... published UN mailing addresses and lock combinations to prevent the creation of Israel and the disposition of the Palestinian people (? - did they mean dispossession, or do they mean that the UN creating Israel is responsible for Palestinians' bad dispositions?). Thank god for groups like TEAmpoiSON who are working to make the world a better place through releasing such incriminating information on a truly evil organization - clearly a blow for freedom!
I just don't understand the thinking behind actions like this, especially with respect to the groups stated reasons. The UN failed to step in to prevent genocide(s), so we are going to try to harm, embarrass, or destroy the institution... because then, there wouldn't be an institution failing to act in such circumstances, which is clearly a better alternative! And also, Israel!!
I used to work for a UN agency and spent a year specifically working on governance reform for IT. The idea that "the" UN has email systems is kind of funny. While some agencies have well-designed, well-run, consolidated communications & IT systems, those are more the exception than the rule. By and large, each agency has multiple divisions or programmes that run their own IT systems with little to no effective oversight. Disparate systems and dependence on abandonware are prevalent. Governance & policies are (*ahem*) lacking in most cases, and enforcement is by and large nonexistent. Tell a Deputy Director that he has to have a password of more than four characters or change it more than once a year? Good luck with that.
There is simply no framework or middle ground for getting an agency or multiple agencies to adopt best practices when their reality vacillates wildly between disasters/getting shot at/real work one day, and political fights/internal corruption/not having enough money to run simple services on the next. While seeing this on pastebin is disappointing, it's not the least bit surprising. It falls more in the category of "someone noticed the door was hanging open and put some mild effort into it" rather than "1337 h@xx0r broke into a fortress."
The sad part is that the likely outcome of this event is a long series of dreary Euro-proper weekly meetings at UNDP and other agencies, eventually resulting in a task force of a dozen people at the Secretariat charged with defining what "fix" means, followed by a slew of small teams at each affected agency to work on the perceived ICT policy, operation, and configuration problems. But no authority will be given to those teams to mandate changes to their respective ICT Chiefs. In 6-9 months a series of changes to security controls will be recommended, but they'll be overridden, redirected, and mangled by their respective IT orgs; in all probability the money & effort will be unrecognizable and the effects negligible. It's like The Office without the slightest hint of humor.
I think not...(*poof*)
You need to have something of value in order to compromise it. The UN is worthless,
Sure. But, just like Pinky and the Brain, they have a plan.
"Somebody has to do something. It's just incredibly pathetic it has to be us."
--- Jerry Garcia
Look plaintext to me, but also look old.
And a whole lot of stupid:
Email Address -: loh333@aemail4u.com
Password -: loh333
Username -: loh333
Email Address -: c.inayatullah@undp.org
Password -: inayat
Username -: Inayat
Email Address -: hamed.mobarek@undp.org
Password -: hm
Username -: Hamed 9
Email Address -: seyhan.aydinligil@undp.org
Password -: seyhan
Username -: seyhan
Email Address -: maryanne.kelly@ons.gov.uk
... I could (probably) go on. It looks like they mostly assumed a UN login ID was pretty much a throwaway ID (minimal security, at best). I'm sure their people out in the field would appreciate their monumental indifference.
Password -: 000
Username -: Maryanne Kelly
Explains a lot as to why this stuff was so easily cracked/hacked. Neither the UN nor its users cared, or maybe they just expected that it would eventually (inevitably?) be cracked.
"Tongue tied and twisted, just an Earth bound misfit