Slashdot Mirror
Hacker Steals Military Docs Because Someone Didn't Change a Default FTP Password (bleepingcomputer.com)
New submitter secwatcher shares a report: A hacker is selling sensitive military documents on online hacking forums, a security firm has discovered. Some of the sensitive documents put up for sale include maintenance course books for servicing MQ-9 Reaper drones, and various training manuals describing comment deployment tactics for improvised explosive device (IED), an M1 ABRAMS tank operation manual, a crewman training and survival manual, and a document detailing tank platoon tactics. US-based threat intelligence firm Recorded Future discovered the documents for sale online. They say the hacker was selling the data for a price between $150 and $200, a very low asking price for such data. Recorded Future says it engaged the hacker online and discovered that he used Shodan to hunt down specific types of Netgear routers that use a known default FTP password. The hacker used this FTP password to gain access to some of these routers, some of which were located in military facilities, he said.
Netgear routers is one thing - using them as NAS servers for sensitive data is a whole other special kind of stupid.
A Netgear consumer router is being used as a firewall for networks containing military secrets? Not what I would have expected, I usually use more robust firewalls on network I maintain. A default password was left in place for a router on a secure network....FTP configuration from outside was left enabled on router...Against most acceptable security practices for any network The USAF didn't do regular nmap scans and pentests of their networks from various points around the world that would have found this opening...They didn't regularly check sites like Shodan to see what shows for their networks... I do these regularly for networks I maintain...
Hacker Steals Military Docs Because Someone Didn't Change a Default FTP Password
Should read Hacker Steals military docs because she's a sleazeball
The lack of a proper password helped her commit the crime, it didn't compel it, she could of instead just told the authorities about the screwup
Nullius in verba
Well, Trump said he'd run the government like a business. He just didn't mention that the business was Equifax.
You are welcome on my lawn.