Slashdot Mirror
European Space Agency Records Leaked For Amusement, Attackers Say (csoonline.com)
itwbennett writes: A weekend data breach at the European Space Agency (ESA) by hackers calling themselves "Anonymous" has resulted in the release of 8,107 names, email addresses, and passwords of ESA supporters and researchers. "The leaked data highlights a troubling problem with regard to passwords used on the compromised domains," writes CSO's Steve Ragan. "Of the 8,107 passwords exposed, 39 percent (3,191) of them were just three characters long (e.g. 'esa', '469', '136', etc.)."
Three characters is not enough for my luggage.
And what about the users with high blood pressure?
Can I use your username as password?
Before you get all hysterical over weak passwords, please consider that three letter passwords are usually open secrets. In these cases security isn't desired, but because of policy, still needs to paid lip service. It happens at EVERY organization.
The question is whether the policy is reasonable and necessary.
I already use your username as my password.
If it is ever found on an unhashed password list, they'll simply think my password isn't on the list.
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
Perhaps more damaging is the claim it was done for amusement: "Claiming the name Anonymous, those responsible for a weekend data breach at the European Space Agency (ESA) said the act was one of pure amusement (lulz) and not part of a larger scheme or protest."
ISIS and Trump at least deserved some sort of mass attack.
..were obviously not rocket scientists.
Oh, wait.....
Donte Alistair Anderson Roberts - hi son!
Karma: Chameleon
But after paying the cost of the printout, the student went bankrupt and had to quit his studies
If your password is "esa", "469" or "123", even the best salt/hash. Script kiddies could crack these in seconds, and that's if you use really strong crypto. With a reasonable hash/salt scheme and advanced attackers, you can get down to microseconds.
Not if you take the time to read my real name.
The student submitted his algorithm and the resulting printout in text files on a floppy disk. No trees were sacrifice for this academic exercise.
The characters didn't repeat, which narrows down the number of possibilities. Thanks for reminding me. The algorithm and printout were submitted as text files on a floppy disk.
European Space Agency Records Leaked For Amusement, Attackers Say
Bruce Wayne: Targeting me won't get their money back. I knew the mob wouldn't go down without a fight, but this is different. They crossed the line.
Alfred Pennyworth: You crossed the line first, sir. You squeezed them, you hammered them to the point of desperation. And in their desperation, they turned to a man they didn't fully understand.
Bruce Wayne: Criminals aren't complicated, Alfred. Just have to figure out what he's after.
Alfred Pennyworth: With respect Master Wayne, perhaps this is a man that *you* don't fully understand, either. A long time ago, I was in Burma. My friends and I were working for the local government. They were trying to buy the loyalty of tribal leaders by bribing them with precious stones. But their caravans were being raided in a forest north of Rangoon by a bandit. So, we went looking for the stones. But in six months, we never met anybody who traded with him. One day, I saw a child playing with a ruby the size of a tangerine. The bandit had been throwing them away.
Bruce Wayne: So why steal them?
Alfred Pennyworth: Well, because he thought it was good sport. Because some men aren't looking for anything logical, like money. They can't be bought, bullied, reasoned, or negotiated with. Some men just want to watch the world burn.
And the fact that the leak contains so many 3 character passwords is probably a sign that this is exactly what happened.
The hackers probably got access to a database containing salted passwords.
The leak is just the output of a password cracker applied to that database.
What I find more problematic is that people where authorized to use a password with only 3 characters.
Any system I worked on during the last 20 years would never allow that.
From TFA: "Based on the posted list, an unfortunate detail becomes rather clear; either the passwords were poorly secured and easily reversed, or they were stored in clear text inside the database."
Use nonces instead of salts for less sodium?
Hardly! 25^26 = 2.2e+36 is only a bit smaller than 26^26 = 6.1e+36
If all characters were different then the number of possibilities would still be in the range of 26! ~= 4e26
This is quite smaller but still too large to fit on a floppy or on a modern HD (or even on the whole internet)
A program running on a 10Ghz CPU that would enumerate one solution per cycle would need 1.26 billion years to complete.
So there was probably more restrictions.
That probably explains why only one student ever attempted to write the algorithm.
To be fair, salted hashes provide no additional benefit if the password is 3 characters long. A brute force would still get them pretty much instantly.
I think you were sold a bill of goods. My guess? Your instructor lied about the attempt to trick his math-challenged students in to wasting a lot of time.
Required reading for internet skeptics
You're probably right. Most of those math-challenged students became Java programmers.
Does anyone have some more examples of three letter passwords? I'm having trouble understanding the concept.
They wouldn't find the generated 24-char ones.
Either the passwords were stored in plaintext or easily crackable crypt (unlikely), or the hackers hijacked the login system and collected the passwords as they were used for login.
45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
You're probably right. Most of those math-challenged students became Java programmers.
The rest post on /.
The cesspool just got a check and balance.
I've used 4 digit passwords on sites that store nothing besides my email, name, corp address and nothing of true significance. On the otherhand I'll use the maximum allowed digits for banking and commerce sites. What blows my mind, is a site that doesn't allow unicode character set and more than 12 digits.
Yeah even netflix requires 4 characters. You can even use 0000 as a password if you want.
Minimum threshold fixed. Thanks!
It speaks of a slightly worrying degree of optimism about human nature, but nothing worse than that.
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"