Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers shoveled snow for company, were rewarded with network admin access

theregister.com

Post reply on HN
Print view View original

21–30 of 81 posts

Re: Hackers shoveled snow for company, were rewarded with network admin access

#21

Post by kg »

James_K wrote: post #17
mikestew wrote: post #2

”Finally, the company should have enforced a strong password policy that would have prevented our heroes from finding dozens of accounts with “winter2023!” as the password.” Capitalize that “w”, and you’ve got a password that will pass most PWD policies. Why do they think it was “winter2023!” to begin with? In 90 days when the PWD expires, well, it will be spring of the next year, so… The better idea is to require pa…

Letting users pick their own passwords has always been a mistake. If passwords are needed, the system should choose them.

As a person with memory issues, this is a recipe for me writing a password down where somebody else can probably find it.

Re: Hackers shoveled snow for company, were rewarded with network admin access

#22

Post by NopIdoN »

raffraffraff wrote: post #8
Xeoncross wrote: post #3

Earlier quoted context omitted.

1. Open a web browser and do a search 2. Read until you find a sentence that you like. 3. Use it as your password

How about mixing up band names? Take the end of "Florence and the machine" and mix it with the start of "Rage against the machine" and you now have the totally unguessable "Rage sharing the machine". It's a different machine see?! Nobody would know that!

The The but the first The is from The Who

Re: Hackers shoveled snow for company, were rewarded with network admin access

#23

Post by lnsru »

z3ugma wrote: post #10

What always gets me about these red team attacks is the same thing that gets me about internal phishing test emails. My company sent an internal phishing test last week. Several people immediately reported it to a cybersecurity engineer, posted about it in Slack, saying they were surprised that such a sophisticated phishing attack was happening. I too was surprised - Google is usually much better about catching these…

Imaginary country called Nicha can’t buy lithography machine from imaginary company called SAML. Nicha can kidnap some scientists and torture them to get all the secrets. But it’s not elegant. Nicha can pay a lot for hacking and get the result in anonymous way. I guess 8 figures can be paid easily for these secrets. With that money “red team” can launch very nice multifaceted social hacking attack.

Re: Hackers shoveled snow for company, were rewarded with network admin access

#24

Post by alt227 »

mikestew wrote: post #2

”Finally, the company should have enforced a strong password policy that would have prevented our heroes from finding dozens of accounts with “winter2023!” as the password.” Capitalize that “w”, and you’ve got a password that will pass most PWD policies. Why do they think it was “winter2023!” to begin with? In 90 days when the PWD expires, well, it will be spring of the next year, so… The better idea is to require pa…

Expiring passwords are one of my biggest gripes, and I still see them everywhere

Re: Hackers shoveled snow for company, were rewarded with network admin access

#25

Post by onraglanroad »

Symbiote wrote: post #14
lima wrote: post #6

The company also should have restricted network access to the port in the conference room so that an unknown device like a Raspberry Pi could not make an Ethernet connection from that spot Bad take - the actual problem is that there was a trusted network in the first place. This kind of network access control is trivial to bypass, and trusted devices can get compromised.

It's not my field, but at least at my work the network can somehow tell the difference between an authorized user and not. It is not simply using the MAC address. A guest device connected to the ethernet port in the conference room has the same access as a device connected to the guest wifi, a staff laptop has it's usual access.

Probably a RADIUS server setup.

Basically staff machines get a certificate to present to the server and the server controls the network.

So, if your machine does nothing, it's on the guest vlan and has limited access. If it presents a valid certificate that network port is reassigned to the staff vlan and you get full access.

If someone leaves, you just revoke the certificate and they have guest access again.

Not rocket science once you know it :)

Re: Hackers shoveled snow for company, were rewarded with network admin access

#26

Post by Volundr »

Xeoncross wrote: post #18
chopin wrote: post #11

Earlier quoted context omitted.

I loathe two things in password requirements: special characters and not allowing spaces. C'mon, it's 2026. Require 20 characters and call it a day.

"password is to long, max length..." (╯°□°）╯︵ ┻━┻

I couldn't decide which sentence of Alice in Wonderland was my favorite, so I just used the full text.

Re: Hackers shoveled snow for company, were rewarded with network admin access

#27

Post by Volundr »

UnfitFootprint wrote: post #20

Being overly suspicious of everyone is a terrible way to live. Maintenance should have the autonomy to do as they did here - and security correctly followed up. The right response should only be technical imo. A meeting room should not lead to this level of network access.

> Maintenance should have the autonomy to do as they did

Really? We're talking about letting strangers in through the literal back door.

Re: Hackers shoveled snow for company, were rewarded with network admin access

#28

Post by grg0 »

alt227 wrote: post #24
mikestew wrote: post #2

”Finally, the company should have enforced a strong password policy that would have prevented our heroes from finding dozens of accounts with “winter2023!” as the password.” Capitalize that “w”, and you’ve got a password that will pass most PWD policies. Why do they think it was “winter2023!” to begin with? In 90 days when the PWD expires, well, it will be spring of the next year, so… The better idea is to require pa…

Expiring passwords are one of my biggest gripes, and I still see them everywhere

Expiring passwords and length limits. Why can't my password be a 5KB long? My password manager has no limits. Are people storing them in plain text in 2026?

Re: Hackers shoveled snow for company, were rewarded with network admin access

#29

Post by wpm »

alt227 wrote: post #24
mikestew wrote: post #2

”Finally, the company should have enforced a strong password policy that would have prevented our heroes from finding dozens of accounts with “winter2023!” as the password.” Capitalize that “w”, and you’ve got a password that will pass most PWD policies. Why do they think it was “winter2023!” to begin with? In 90 days when the PWD expires, well, it will be spring of the next year, so… The better idea is to require pa…

Expiring passwords are one of my biggest gripes, and I still see them everywhere

My company does it to our phone passcodes. 90 days.

Re: Hackers shoveled snow for company, were rewarded with network admin access

#30

Post by Volundr »

z3ugma wrote: post #10

What always gets me about these red team attacks is the same thing that gets me about internal phishing test emails. My company sent an internal phishing test last week. Several people immediately reported it to a cybersecurity engineer, posted about it in Slack, saying they were surprised that such a sophisticated phishing attack was happening. I too was surprised - Google is usually much better about catching these…

> But who would go to all that trouble?

I mean, a company I worked at had a significant amount of money stolen after the attackers spent 6 months sitting on their access waiting for the right moment to fake an (expected) reply to an email exchange. The original breach (or at least the breach of this executives account) involved a very targeted phish. When the potential payout is millions it justifies a lot of effort.

Post reply on HN