Slashdot Mirror
European Space Agency Records Leaked For Amusement, Attackers Say (csoonline.com)
itwbennett writes: A weekend data breach at the European Space Agency (ESA) by hackers calling themselves "Anonymous" has resulted in the release of 8,107 names, email addresses, and passwords of ESA supporters and researchers. "The leaked data highlights a troubling problem with regard to passwords used on the compromised domains," writes CSO's Steve Ragan. "Of the 8,107 passwords exposed, 39 percent (3,191) of them were just three characters long (e.g. 'esa', '469', '136', etc.)."
Three characters is not enough for my luggage.
There's no excuse in this day and age to store passwords. You only store salted hashes.
Before you get all hysterical over weak passwords, please consider that three letter passwords are usually open secrets. In these cases security isn't desired, but because of policy, still needs to paid lip service. It happens at EVERY organization.
The question is whether the policy is reasonable and necessary.
My college instructor for Linux Admin informed the class that the password to his Redhat Linux server was 26 characters long, doesn't start with the letter 'a' and doesn't end with the letter 'z'. Bonus points for creating an algorithm that prints out all the possible variations with permissible characters. Automatic expulsion if anyone attempts to login into server. During his ten years of teaching Linux, only one student took him up on the challenge to write an algorithm and his password was in the resulting printout.
Perhaps more damaging is the claim it was done for amusement: "Claiming the name Anonymous, those responsible for a weekend data breach at the European Space Agency (ESA) said the act was one of pure amusement (lulz) and not part of a larger scheme or protest."
ISIS and Trump at least deserved some sort of mass attack.
..were obviously not rocket scientists.
Oh, wait.....
Donte Alistair Anderson Roberts - hi son!
Karma: Chameleon
european space agency jokes rate right up there with french military prowess and "the english army just won the war".
European Space Agency Records Leaked For Amusement, Attackers Say
Bruce Wayne: Targeting me won't get their money back. I knew the mob wouldn't go down without a fight, but this is different. They crossed the line.
Alfred Pennyworth: You crossed the line first, sir. You squeezed them, you hammered them to the point of desperation. And in their desperation, they turned to a man they didn't fully understand.
Bruce Wayne: Criminals aren't complicated, Alfred. Just have to figure out what he's after.
Alfred Pennyworth: With respect Master Wayne, perhaps this is a man that *you* don't fully understand, either. A long time ago, I was in Burma. My friends and I were working for the local government. They were trying to buy the loyalty of tribal leaders by bribing them with precious stones. But their caravans were being raided in a forest north of Rangoon by a bandit. So, we went looking for the stones. But in six months, we never met anybody who traded with him. One day, I saw a child playing with a ruby the size of a tangerine. The bandit had been throwing them away.
Bruce Wayne: So why steal them?
Alfred Pennyworth: Well, because he thought it was good sport. Because some men aren't looking for anything logical, like money. They can't be bought, bullied, reasoned, or negotiated with. Some men just want to watch the world burn.
"Anonymous" is nothing if not a bunch of vandals, delinquents and terrorist sympathizers. They must be hunted down without mercy. It should not prove to be too difficult because they're also a bunch of pussies: every single time one is caught, he immediately snitches on anyone he knows. Time to police the Internet for good.
Does anyone have some more examples of three letter passwords? I'm having trouble understanding the concept.
I've used 4 digit passwords on sites that store nothing besides my email, name, corp address and nothing of true significance. On the otherhand I'll use the maximum allowed digits for banking and commerce sites. What blows my mind, is a site that doesn't allow unicode character set and more than 12 digits.
I work in IT security with them scientists: rather than about security they care about sharing.
They're like children (in a good way).
It speaks of a slightly worrying degree of optimism about human nature, but nothing worse than that.
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"