Live data from Hacker News

Twin brothers wipe 96 government databases minutes after being fired

arstechnica.com

241–250 of 463 posts

Re: Twin brothers wipe 96 government databases minutes after being fired

#243
post #156

> [Opexus] said that “the individuals responsible for hiring the twins are no longer employed by Opexus.” Getting close to the classic Monty Python line: "Those responsible for sacking the people who have just been sacked, have been sacked." Jokes aside, stuff like this sucks because I suspect many employers will take from it the most extreme, dehumanizing lessons, e.g.: (a) make firings [edit: including lay-offs] as…

Terminating access and rotating passwords (if needed) while the person is in the meeting but has not yet found out they are being let go has been SOP for at least the last 20 years

There's the classic article by Matt Ringel and Tom Limoncelli back from 1999:

https://www.usenix.org/legacy/event/lisa99/full_papers/ringe...

Re: Twin brothers wipe 96 government databases minutes after being fired

#244
post #220

Earlier quoted context omitted.

>> They don't seem to be Americans? How did you conclude that? Just their names?

[flagged]

> "most Americans of their intelligence would be aware"

that would still leave up to 49% Americans not being aware. so how did you conclude that they were not Americans? Also, how did you measure their intelligence?

> "slightly more common among immigrant families than locals"

even if true, how did you conclude that these were not Americans?

> "Americans, on average, are more individualist and hesitate more when asked by family to do something criminal"

even if on average Americans are more so, how did you conclude that these were not Americans?

> "A lot of immigrants eventually adopt anglicised names"

from your sentence it seems a lot of them don't. so how did you conclude that these were not Americans?

It would be a disaster for immigrants in your area if you were ever hired into some kind of investigative/law enforcement role.

Re: Twin brothers wipe 96 government databases minutes after being fired

#245
post #156

> [Opexus] said that “the individuals responsible for hiring the twins are no longer employed by Opexus.” Getting close to the classic Monty Python line: "Those responsible for sacking the people who have just been sacked, have been sacked." Jokes aside, stuff like this sucks because I suspect many employers will take from it the most extreme, dehumanizing lessons, e.g.: (a) make firings [edit: including lay-offs] as…

Terminating access and rotating passwords (if needed) while the person is in the meeting but has not yet found out they are being let go has been SOP for at least the last 20 years

My first task at my last job was removing access to an employee being let go. I had just gone through onboarding so I knew every (documented) service we needed to handle. We live tested it on my own accounts, measured the time before I noticed, and then proceeded to successfully go through the checklist.

Except not everything was properly documented, and it turned out the employee had given admin rights on some resources to a contractor which proceeded to wreak havoc on their behalf (the 'rm -rf' kind). Eh!

Re: Twin brothers wipe 96 government databases minutes after being fired

#246
post #161

Earlier quoted context omitted.

My larger point is that nobody - nobody - defaults to telling us the coffee mug is unregulated, as AI allegedly ought to be. They always compare it to something much more commonly used as a weapon; something that, when asked to name a household object likely to be used as a weapon, the average person would guess.

Your point is that people make a stronger argument even when a weaker one would be sufficient?

Instead of comparing AI to any other tool, especially one closer to "useful with a computer", the common comparison is always a weapon of some kind.

If the design of tools are neutral, one tool should do as well as another in this common comparison. But the useful application of tools is inherent in their design.

If tools were neutral, as so many on this site claim, why is AI only ever compared to knives and hammers?

Parent has lots of links to other common objects causing harm, why are they never used as the example when tools are allegedly neutral? That would be a stronger argument opposing AI regulation - ethernet has less regulations that knives, but can still be used as a murder weapon

Re: Twin brothers wipe 96 government databases minutes after being fired

#247

I'm just amused how these people were even hired to begin with ? They don't seem to be Americans? How were they even allowed to work on sensitive systems? Why was this even allowed? So many questions. At 4:58 pm, he wiped out a Department of Homeland Security database using the command “DROP DATABASE dhsproddb.” At 4:59 pm, he asked an AI tool, “How do i clear system logs from SQL servers after deleting databases?” H…

[flagged]

Re: Twin brothers wipe 96 government databases minutes after being fired

#248

Earlier quoted context omitted.

From the article, it sounds like the passwords are indeed stored in cleartext: > On Feb. 1, 2025, Muneeb Akhter asked Sohaib Akhter for the plaintext password of an individual who submitted a complaint to the Equal Employment Opportunity Commission’s Public Portal, which was maintained by the Akhters’ employer. Sohaib Akhter conducted a database query on the EEOC database and then provided the password to Muneeb Akht…

It still blows my mind. Shouldn't the government audit their contracting companies for egregious issues like this? Seems extremely reckless not to.

I've been through a handful of SOC2 audits and they've never asked us to _prove_ that we aren't storing passwords in plaintext or with reversible encryption (we weren't).

This is why so much of vetting & compliance is toothless. You can have robust change management, physical security, network security, identity management, etc. policies but absolutely nobody wants to spend enough on audit & enforcement to make them meaningful.

The gov't will make you _claim_ that you do all of these things before awarding a contract, but they won't ever check.

Good actors will do the right thing regardless because they know the consequences of cutting corners.

Re: Twin brothers wipe 96 government databases minutes after being fired

#249
Asked for the plaintext password, and then his brother made a “ database query on the EEOC database and then provided the password”.

I wonder how many government dbs store passwords in plaintext…

Also, these guys sound like sociopaths. I bet some of their peers felt constant discomfort and threat just being near them.

Re: Twin brothers wipe 96 government databases minutes after being fired

#250
post #220

Earlier quoted context omitted.

[flagged]

> "most Americans of their intelligence would be aware" that would still leave up to 49% Americans not being aware. so how did you conclude that they were not Americans? Also, how did you measure their intelligence? > "slightly more common among immigrant families than locals" even if true, how did you conclude that these were not Americans? > "Americans, on average, are more individualist and hesitate more when aske…

[flagged]
Post reply on HN