Slashdot Mirror
Arrests Made After Group Hacks CIA Director's AOL Account (washingtonpost.com)
Slashdot reader FullBandwidth writes:
U.S. authorities have arrested two North Carolina men accused of hacking into the private email accounts of high-ranking U.S. intelligence officials. [The men] will be extradited next week to Alexandria, where federal prosecutors for the Eastern District of Virginia have spent months building a case against a group that calls itself Crackas With Attitude... Authorities say the group included three teenage boys being investigated in the United Kingdom.
The group used social engineering to access the email accounts of John Brennan, the director of the CIA, as well as the Director of National Intelligence, and former FBI deputy director Mark Giuliano, according to the article. One exploit involved "posing as a Verizon technician and tricking the company's tech-support unit into revealing the CIA director's account number, password and other details." An FBI affidavit alleges that a British teenager named "Cracka" also began forwarding the calls of a former FBI deputy director "to a number associated with the Free Palestine Movement," while "D3F4ULT" paid for a campaign of harassing phone calls. In addition, "According to the affidavit, Cracka appears to have gotten into the law enforcement database simply by calling an FBI help desk and asking for Giuliano's password to be reset..."
"One member told CNN [In a video interview] that he smoked marijuana 'all day every day' and was 'probably' high when gaining access to high-level accounts."
The group used social engineering to access the email accounts of John Brennan, the director of the CIA, as well as the Director of National Intelligence, and former FBI deputy director Mark Giuliano, according to the article. One exploit involved "posing as a Verizon technician and tricking the company's tech-support unit into revealing the CIA director's account number, password and other details." An FBI affidavit alleges that a British teenager named "Cracka" also began forwarding the calls of a former FBI deputy director "to a number associated with the Free Palestine Movement," while "D3F4ULT" paid for a campaign of harassing phone calls. In addition, "According to the affidavit, Cracka appears to have gotten into the law enforcement database simply by calling an FBI help desk and asking for Giuliano's password to be reset..."
"One member told CNN [In a video interview] that he smoked marijuana 'all day every day' and was 'probably' high when gaining access to high-level accounts."
To divert attention away from Russia?
What's more concerning... That the director of the CIA had his account hacked, or that he has an AOL account.
While it is always worthwhile to prosecute the hacker, the real question is how is it possible that the Director of the CIA was hacked? Massive incompetence in the CIA is the only possible explanation.
[The men] will be extradited next week to Alexandria.
Holy crap, why are they sending them to Egypt?
I used to think that the only reason someone would want their own e-mail server would be to try to erase a central record of sent e-mails should the need arise, but after reading this summary I see that there is merit in not entrusting a third party's low level tech support person with the ability to either read or reset your password.
In other news, Verizon knows its users' passwords? Let me guess -- they're stored in plaintext.
... really?
What does it say about our intelligence community when the director of the CIA can be conned by a few kids?
Posing as a technician to get passwords - what?
Law enforcement database for managing private e-mail accounts - what?
I mean this shit could all just be made up to cover up the more embarrassing things they actually did, because if security were so lax as this story claims, every hostile nation would have pretty much everything on all high ranking intelligence officials.
Has an AOL account ?
Come on what does he use for personal information ? Myspace ?
While it is always worthwhile to prosecute the hacker, the real question is how is it possible that the Director of the CIA was hacked? Massive incompetence in the CIA is the only possible explanation.
This came up and was discussed on Schneier's security blog.
In this instance the CIA director did nothing wrong. He had a strong password, didn't let it out, and had no sensitive information on this particular personal account.
The hackers convinced AOL to to do everything on behalf of Brennan, without his knowledge or consent. All the security "best practices" in the world won't help if you can convince someone at the ISP to let you in.
To his credit, Brennan used this account for personal purposes, and apparently there was absolutely nothing of a sensitive nature there.
Lock them up for life. Hackers deserve neither respect nor justice.
> every hostile nation would have pretty much everything on all high ranking intelligence officials.
Would it be worth it to China to spend a million dollars trying all sorts of ways to get into the President's email, or the secretary of state? Of course it would. If the
SAME people who want to have access to everyones communications...
A bit ironic. And those poor hackers are gonna catch it.
They should've waited until they could work for the FBI to do this....
HAHAHAhahahaha (breath in ) HAHAHA hahahahaha!
really what a moron.
he should have his own email server in his basement.
ask Hillary about it, easy foolproof security.
and really what does a high level CIA person even need with a private email on a service NOT run by the agency.
sounds like a security risk to me.
I accidentally hit submit before I was done writing.
> every hostile nation would have pretty much everything on all high ranking intelligence officials.
Would it be worth it to China to spend a million dollars trying all sorts of ways to get into the President's email, or the secretary of state? Of course it would. If they tried hundreds or even thousands of different hacks, would they eventually get lucky? Sure, probably.
Therefore they probably have tried thousands of times, and eventually been successful. I would be suprised if after all that trying they never succeeded. Once they got a toehold, it's relatively easy to expand access.
When it took some intelligence to use a computer and created a bar to entrance.
10 year old AOL CDs to get online?
Interesting article but I'm not clicking those links to read it. Just asking to get super cookied.
He probably has bills to pay and family to keep up with like every other person out there.
1996 called ...
Has an AOL account? Jeeze, that just about says it all doesn't it?
09 F9 11 02 9D 74 E3 5B - D8 41 56 C5 63 56 88 C0 45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
Not sure why you were downvoted. You only speak the truth.
Calm the fuck down, Mr. Clapper. We'll get you a car. Just relax, will you? There are microphones around.
This sounds suspiciously like part of the story in Hackers.
pior é o pedro tentando casar o felipe com a filha do camaro 55
The article says there were sensitive files stolen from his personal email account. If true, he shouldn't have had them there.
Whoosh.
Probably because it was mostly the white countries that enslaved or "colonized" all of the non-white people from other countries over the last few hundred years. Ever wonder why there is "slavery" and "white slavery" - and somehow still now only the latter is somehow unthinkably barbaric to many people?
Sorry, I couldn't resist replying to myself here, since I knew no one else would by able to stroke my nuts like this.
He probably has bills to pay and family to keep up with like every other person out there.
And that's fine, but all of the sensitive attachments he forwarded from his government account to his AOL account are a pretty damn serious matter. Brennan was definitely not just using his AOL email account to pay bills and see if his brother wanted to play golf on Sunday.
This is a hacked account, for which the owner can not be held responsible.
The white countries did their best to drag the others out of the stone age. We should have just crushed the first one that rebelled to take the spirit out of the others. Long live Rhodesia.
}
"Probably because it was mostly the white countries that enslaved or "colonized" all of the non-white people from other countries over the last few hundred years.}
"
I guess you missed The Greater East Asia Co-Prosperity Sphere
They did plenty of conquering and enslaving in the 30's and 40'e
And they are still not 'diverse'
For a government official to use an AOL account for anything should be a criminal offense.
I really want to know why I should give any shits about some important guy having his personal email hacked. Convince me why, if they're not conducting any business related to their important positions, that it should matter at all.
From what I've heard there is precedent for this being a trivial matter not fit for punishment.
Hey, AOL is for serious work. Shut up!
- Colin P.
Table-ized A.I.
It's right up there on top. The sentence with "cia director" and "aol account". That's impossible.
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
I hope your history books didn't forget to show you that most African tribes were quite happy to enslave their enemies (also Africans) and sell them to the white people.
I said the same thing at first, but if you think about it, its brilliant. When the KGB tries to hack into his personal account, they see it is an AOL account and say, 'Neyt comrade, you are mistakekink. Thees coold not be direcktors account, only retarded child use AOL account. Must be, how you say, hunny pit? Ve keep lookikink elsever.'
These CIA guys, always throwing fucking curve balls. They are like, Inception deep.....
HA! I just wasted some of your bandwidth with a frivolous sig!
According to the affidavit, Cracka appears to have gotten into the law enforcement database simply by calling an FBI help desk and asking for Giuliano's password to be reset..."
"One member told CNN [In a video interview] that he smoked marijuana 'all day every day' and was 'probably' high when gaining access to high-level accounts."
See, any social engineering attack will succeed if you are relaxed and self-assured enough.
I work at a large finnish ISP. We employ a very simple method to avoid problems with impostors trying to reset account passwords and the like, we do not, under any circumstances, reset the password on the customer's behalf. The customer has to do it him/herself. In theory, we are not forbidden from resetting a password, but we are (under penalty of immediate termination) forbidden from giving up the new password to anyone via any form of communication. The customer has to do the resetting him/herself via the account management page.
If the customer has forgotten the credentials to the account management page, he can get into it using his standard 2-factor online banking authentication (in Finland, ALL banks are part of this system and many public and large private services utilise the provided auth API for authorisation), Yes, we understand older clients might find this inconvenient, but no amount of yelling and screaming is going to make any of our reps divulge a password directly. If the customer can't find the account management page or navigate it, we an offer a remote desktop connection to caller's computer and help them with that, but the caller still has to authenticate, we just show them what links to click and where.
I think the most "worrying" (I don't f* care :v ) thing is that the director of the CIA got 'Social Engineered', that alone says a lot xD
Shocking News just in......Let's go over to Micheal now.... This is Micheal Dewert reporting live from the scene of this most audacious and shocking crime. The director of the CIA John Brennan has admitted he has been using an email account with Assholes OnLine, the crummy ISP who believed their world view was to dominate the ISP markets in the early 90's, unfortunately only Assholes signed up for their limited and censored ISP network thus earning them the title of Asshoes OnLine (AOL). This shocking truth has just come out with the release of 2 arrests of hackers who managed to gain access to John Brennan's email account using the password "password", this is shocking news that comes from the the top man at the CIA, who job is to look after and protect the USA's intrests and security matters. Perhaps, his use of an Asshole OnLine email account was a security measure in it;s self as no foreign powers would of dreamed the major man at the CIA who use should a low unsosphiscated account. This is Micheal Dewert and now back to the studio....
Except that did not happen. There was no sensitive attachments. Not even OpSec breaches. Either you read that somewhere that invented it or your subconscious expected it.
All the same, it didn't happen in this case. Maybe you were confusing the CIA director with the Secretary of State.
How did the Dutch get African slaves in what is now Ghana?
A. They matched in land and grabbed Africans.
B. They setup a trading post on the coast and paid Africans for other Africans.
C. Whenever one tribal group beat another tribal group, the victors would drag the losers from in land areas to the coast. The losers were then sold as slaves to the Dutch.
Hint, the answer is B and C.
"You've got classified mail!"
CIA! Freeze!
And I couldn't figure out which.
Long ago, during the George W. Bush era, I read an article, in EE Times I think, about wom (write-once-media). The author mentioned in passing that the White House had such a system installed to insure a valid record of all of the email and that administration policy was to use AOL so as to bypass it.
I found it hard to believe.
Recently I saw Colin Powell interviewed saying that he told Hillary when she became Secretary of State that she should use AOL like he did.
Wow! Confirmation...
A long time ago during the George W. Bush administration I read an article about wom (write-once-media). I think it was in EE Times. The author mentioned in passing that the White House had such a system installed which recorded for posterity all of the administration emails and that as a result White House policy was to use AOL to bypass the record keeping.
At the time I found that shocking and unbelievable.
Recently I saw Colin Powell interviewed and he said that when Hillary succeeded him as Secretary of State that she should do what he did: use AOL.
Wow. Confirmation of something unbelievable. Now I just watch our propaganda machine rant about Hillary's much more secure private server and shake my head.
The group used social engineering to access the email accounts of John Brennan, the director of the CIA, as well as the Director of National Intelligence, and former FBI deputy director Mark Giuliano, according to the article. One exploit involved "posing as a Verizon technician and tricking the company's tech-support unit into revealing the CIA director's account number, password and other details.
That IT department (in CIA/FBI) should be fired. Everyone knows that there is no reason for Verizon to ask for any passwords. If they were that easily socially engineered, I'm seriously afraid for this country.
The day Microsoft creates a product that doesn't suck, it will be known as the Microsoft Vaccuum Cleaner!