Slashdot Mirror
Hacked Syrian Officials Used '12345' As Email Password
Nominei writes "The Israeli newspaper Haaretz reports that the Syrian President, aides and staffers had their email hacked by Anonymous, who leaked hundreds of emails online. Reportedly, many of the accounts used the password '12345' (which their IT department probably warned them to change when the accounts got set up, of course)."
I've got the same combination on my luggage!
No zero, sorry
Muchas Gracias, Señor Edward Snowden !
I thought that everyone knew to use at least 123456 as their password. After all that increases its security by an order of magnitude!
"To prevent this day from getting any worse, I'll just read ERROR as GOOD THING" 1GJU8xLuDKDxEs4KLf8fAGyptoDsqvEsBT
then the IT guy got taken into the alley and shot in the head for his impudence.
Seriously? People that use such easy to guess (and therefore pointless) shouldn't even have access to anything that needs protection...
Every time I go to pastebin.com and look at the hacked sites the passwords are always weak, extremely weak, virtually no one uses strong passwords.
"If any question why we died, Tell them because our fathers lied."
Really, Why weren't these accounts configured to expire on the first login, like most default passwords? If they were, why didn't they have some sort of policy in place in the system to stop people from using incrementing/decrementing numbers?
...Anonymous posted this themselves.
Israelis use FUD frequently--no anti-semitism here. Anonymous is THE perfect scapegoat for false-flags, and (observation here) after this point, is poking a sleeping beast that has an anti-semetic bent already.
Lemme go check the *chan(s)....
Is this really 'hacking' when you guess the password?
Reminds me of the script-kiddie who 'hacked' into Sarah Palin's email account once he successfully guessed her password was 'popcorn'...
Wonder how he's doing in prison?
Ken
Jesus, as if killing your own people isn't bad enough, you also use one of the worst passwords of all time for (multiple) government passwords. Maybe he wasn't so far off in his Barbara Walters interview; "No government in the world kills its people, unless it’s led by a crazy person” - Assad
When people use such stupid passwords, is it really even considered hacking anymore?
Conversely, does calling this hacking diminish the skills of those who actually know their security inside and out?
If a bunch of kids could hack into Syran government email by typing "12345", you'd imagine that at least one of the big cyberwarfare or intelligence units out there- the U.S., Israel, or China- would have thought of the same trick and has already been monitoring their communications for a while. At least you'd hope so. I'd hate to think that right now there are of a couple of NSA agents looking at each other and saying, "12345... hey, why didn't we think of that?"
I count three prior to your post.
You either need to type faster or reload the page before deciding to comment.
The Syrians stole my password for everything! Now I'll have to come up with a new one.
It was just the dept staff. Looked like it was hacked through the webmail portal of mopa.gov.sy. The only thing of note was the exchange re the Barbara Walters visit. The Ministry of Presidential Affairs is basically his marketing department. Whilst one would hope they busted into this despots email, the truth is they did no such thing.
No, 12345 is actually a very complex password for Bashar al-Assad.
Slashdot, fix the reply notifications... You won't get away with it...
I'm curious to know how many hacker just go around typing 12345 and 1qaz into every account out there just to see what they can get.
Oh shit. There goes the planet.
"I disapprove of what you say, but I will defend to the death your right to say it." - Evelyn Beatrice Hall, re Voltaire
Or a couple of NSA agents looking at each other and saying "shit, I've got to go change my password."
Just in case no one bothered to go find it. http://pastebin.com/uaYDfCz0
* And by "change" I mean "shoot."
Perhaps they did. Do you seriously think that: 1. they'd let /. know and that B. they'd tell Syria when they have a free pass?
I agree and since the people they are supposed to be governing clearly need protection....
Or a couple of NSA agents looking at each other and saying "shit, now we can't read their email"
I had thoroughly convinced myself that the days of people using passwords this stupid was behind us, left to rot in the dark ages of the internet. $faithInHumanity--
Comment removed based on user account deletion
...apparently the launch keys for each and every silo-based ICBM were/are all "0000000000" (ten zeroes). Scary.
Operation Guillotine is in effect.
Apparently nobody bothered to read the IT guy's meticulously prepared memo.
Dudes, He's a DICTATOR. If he doesn't want to change his password, what do you think will happen if you tell him "Mr. Assad, you can't log on until you change your password." a) He says "Oh, yes, thank you for helping me to remember how to protect the information of the Syria Arab Republic. You're a hero of the Republic. Here's your million dollars." b) He says "Screw you, who's the President here, you or me?" And then you find yourself as a street cleaner in Homs wearing safety orange.
As the hacker saw much to his horror that the Syrian President's e-mail password was indeed 12345 he tried to break the connection but it was too late. Word had spread and all knew that his most important hack was one that a five year old could have bested. A week later the hacker was found with a gun in his mouth and the numbers "12345" scrawled across his walls. His last e-mail was a simple "Who uses 12345 as a password!" Other hackers said that it was a tragedy that he would be remembered for one lame hack. Word came later that day that the Syrian President had beefed up security by using his son's name as his current password. Hackers world wide turned away in disgust and refused to stoop to hacking some one that lacked even basic internet skills.
Some turned their attention to hacking President Obama's e-mail until it was found he used the password "Romneysucksballs". No hacker would dignify such a password with a hack. Later that day it was revealed that Bill Gates used "stevejobsisaweiner" as his password but most knew this was the case since the late 90s.
The thing about, say, the CIA or Mosad, they would hack, but not reveal they had and just keep reading the emails as they came in.
The world's burning. Moped Jesus spotted on I50. Details at 11.
Man I wish I hadn't already frivolously burnt the mod points I had earlier today. That one made me laugh out loud.
I find users change their passwords when I give them difficult passwords :).
Governments will go to extreme lengths to avoid revealing when they have access to information that the "enemy" thinks is secure. The allies went to very extreme measures to avoid tipping the Germans off that they had access to all the communications that went out on the Enigma machine. This included letting their own troops be ambushed and killed and massive use of resources and manpower to cover up when they did use the information, such as flying a hundred aerial survey missions to cover up knowing the travel path of a sea convoy.
Comment removed based on user account deletion
are now the primary suspect of breaking into Syria's government networks. You obviously have access to privileged information. Prepare to be arrested...
http://xkcd.com/936/
I know it's preaching to the converted with the above two posters, but it's worth looking at.
The passwords I give users from permutations of a word list make them laugh but they can remember them.
The "default password" should be 30 characters of mumbo-jumbo, so that it's secure by default, but changing it actually makes life easier.
The password doesn't matter if your account is at a place where everything is already readable by the Man.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
The Papal and Italian agencies turn to their roots for cipher strength: IIIIIIIVV
On most web site including some email account i use as a throw away, my password is something like julie. very weak, because I don't care. But on some stuff like online banking my password is more like Sushi-tAbLe#722915;DeadPan (not the real password, but same similar structure). I have to wonder from those study you are speaking of, if they took into account how much importance the user gave to the service/data protected behind the password.
C. Sagan : A demon haunted world:
http://www.amazon.com/gp/product/0345409469/
visit randi.org
Nice tip but if you are an idiot and use a dumb password like 12345 you should not only be hacked but kidnapped and tortured!! Internet 101 never use your name, birth date, address, child's name bla bla... Always use random numbers and small cap + Large cap letters for "secure" (nothing is secure on the internet tho) passwords. This news article is funny how big of ass can you be?? I want to be the exec of a business now if this is all it takes!!!!!!!!!!!!!!!!
They claim they have never allowed an ambush to cover up codebreaking in WWII, just the difficulty in diffusing this information in a covert way meant it did not always get to who needed it in time. From this, it can slowly snowball in retelling to generals and spies sending men into ambushes to cover their efforts, which is stragegically retarded since it is not realistic for the enemy to notice something is amiss just because they don't get lucky in ambushes. However I think people just like the weight of the supposed situation: *movie trailer voice* "the ultimate sacrifice, to protect the ultimate secret".
When Argumentum ad Hominem falls short, try Argumentum ad Matrem
Or this approach for secure passwords. You must make it hard to guess by other people or brute force approachs, not hard to remember .
That's true... and, of course, policies should prevent it being changed to 12345.
Can you call the access to an account which password is "12345" hacking? To make an analogy, can you call yourself a lock-picker if you open an unlocked door?
So say we all
My current IT department use month of arrival as the default password for a new account. So someone starting today would get a password of "Feb12". So every time they type it in, you get reminded of how long they haven't changed it. Certainly better than 12345.
Consciousness is an illusion caused by an excess of self consciousness.
Bashar Assad is a trained ophthalmologist. So he can count as far as glasses strengths go.
Consciousness is an illusion caused by an excess of self consciousness.
Even Slashdot has given up on trying to save the word "hacking"...
correct-horse-battery-staple
Maybe 12345 is really complicated in Arabic. Like MMMMMMMMMMMMCCCXLV.
"The cost of freedom is eternal vigilance." -Thomas Jefferson
The above policy is made of FAIL.
The above policies lead people to the sort of passwords that get written on yellow sticky-notes and put underneath monitors and keyboards, or written on the back of a business card in the purse or wallet.
Requiring "8 characters, at least one each of UPPER and lower case alphabet and at least 1 numeric character, to be then compared against a blacklist of common or easily exploited passwords" is the best way to go.
When reinstalling machines for clients, or machines to sell, i usually go with lowercase-number-UPPERCASE.
"snow86FALL" is quite a bit easier to remember than "J&Ff54$3(jG4D" and provides sufficient entropy for most uses.
And the 3-month expiry is right out. Short-term expiry policies are the sort of smoke and mirrors that management types use to pretend that they are "Doing Something About Security(TM)".
I actually try that xkcd password now on any word list I use. First...;-)
That approach is Diceware, BTW,
http://world.std.com/~reinhold/diceware.html
http://happycattech.com/book/security-applications-0 (MS Excel and OpenOffice Calc implementations)
Bashar Assad is a trained ophthalmologist.
So why wasn't his password EFPTOZ?
#naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
The most important part of that comic is that you use a passphrase, not a password. Passwords are insecure, and trying to make them secure requires using lots of special characters, which as pointed out are hard to remember. Unfortunately, most of the web doesn't allow passphrases, they have pretty short limits on character length. 25 Characters? Good luck finding websites that allow that.
*sigh*, we could make everything more secure, AND easier to remember, but we're too busy trying to force grandma to use 1337 in her password. Smart.
GCS/MU/P d- s:- a-- C++++$ UL++ P+ L++ E+ W++ N o K- w--- O M+ V- PS+++ PE Y+ PGP t+ 5- X R++ tv+ b++ DI++ D++ G+ e++ h-
I can't find any reference in the article, but from the formulation in the summary it sounds like the IT department set up new accounts to have the 12345-password as default (without expiration), and then asked the users to change the password.
If that's the case it sounds like a terrible idea to me. Better to generate default-passwords as complex random strings. Then it'll be in the users' interest to change their passwords because they're hard to remember and type. And if they don't, even better!
So every time they type it in, you get reminded ...
Every time they log in you get a message containing their cleartext password? Doesn't sound secure to me. Unless you're looking over their shoulders, which doesn't sound good either.
Noob. Once you go to the pass phrase there is no need to complicate things with extraneous caps and numbers. .... Fuck it.
There. Now you have been schooled by
Why is it so hard to only have politicians for a few years, then have them go away?
The reason password lengths were limited is because people were retarded and storing the password in a database. Now, good policy dictates that you never store a password, only its hash and salt. The only reasons to limit length is to limit the bandwidth required in case someone decides to use the unabridged works of Shakespeare as his pass phrase.
If the IT department was simply handing that out rather than an initial random password, they are just as wrong. I particularly love how my 401K access was initially first initial, last name, last 4 of the sssn.
With the enormous amount of passwords and logins we must remember, I feel that passwords are a technical solution to a social problem.
The problem is that the majority (if not all) IT people look at it as if their system is the only one that needs to be protected. So they will implement a very secure system. They leave out only one not so unimportant element: human behavior.
Don't fight for your country, if your country does not fight for you.
Or a couple of NSA agents glad they know the sekrit windows backdoor and snickering between themselves.
Look, I like XKCD, but do we have to post a comic in every goddamn thread?
We are eternal, all this pain is an illusion.
The German air raid that almost destroyed Coventry was an example of this, The Brits knew it was coming but they also knew that the Germans were beginning to get suspicious. As a result, the British government felt that they had to let this air raid occur even though they knew many people would be killed.
Yes, I believe you have happened over a bit of sarcasm. Note the distinguishing language, such as the use of 'of course'
Yes.
Any other questions?
Ignorance killed the cat. Curiosity was framed.
correcthorsebatterystaple
correct_horse_battery_staple
Something tells me "hi this is IT, we just finished creating your account. We set the password to 63SHhe737EHS#&7sh#77s73773. You should change it." might actually result in people changing their passwords. Of course the only security it would improve is job security, since they would put in stupid passwords, but at least they are completely culpable at that point.
Someone had to do it.
I'm sure that phrase already was added to all password cracking tools :-)
The Tao of math: The numbers you can count are not the real numbers.