Chinese Hackers Infiltrate New York Times Computers
1–10 of 183 posts
Re: Chinese Hackers Infiltrate New York Times Computers
#2"Security experts found evidence that the hackers stole the corporate passwords for every Times employee and used those to gain access to the personal computers of 53 employees"
Does this mean the NYTimes is storing passwords in plaintext?
Re: Chinese Hackers Infiltrate New York Times Computers
#3"Security experts found evidence that the hackers stole the corporate passwords for every Times employee and used those to gain access to the personal computers of 53 employees" Does this mean the NYTimes is storing passwords in plaintext?
I think if they have the ability to steal the passwords, even if they weren't plain text, they didn't do the proper precautions of encrypting with a salt. So either way, they failed.
Re: Chinese Hackers Infiltrate New York Times Computers
#4"Security experts found evidence that the hackers stole the corporate passwords for every Times employee and used those to gain access to the personal computers of 53 employees" Does this mean the NYTimes is storing passwords in plaintext?
I think if they have the ability to steal the passwords, even if they weren't plain text, they didn't do the proper precautions of encrypting with a salt. So either way, they failed.
At this point, passwords should be considered obsolete when it comes to securing things. We should be using smartcards and cryptographic techniques; humans are just not good enough at generating or remembering random strings for passwords to be considered a good idea.
Re: Chinese Hackers Infiltrate New York Times Computers
#5"Security experts found evidence that the hackers stole the corporate passwords for every Times employee and used those to gain access to the personal computers of 53 employees" Does this mean the NYTimes is storing passwords in plaintext?
not sure, I think the article was careful to not disclose how their passwords are stored, but the article did make mention of encryped passwords and the use of rainbow tables to crack them.
Re: Chinese Hackers Infiltrate New York Times Computers
#6"Security experts found evidence that the hackers stole the corporate passwords for every Times employee and used those to gain access to the personal computers of 53 employees" Does this mean the NYTimes is storing passwords in plaintext?
Keep reading....
"From there they snooped around The Times’s systems for at least two weeks before they identified the domain controller that contains user names and hashed, or scrambled, passwords for every Times employee."
Re: Chinese Hackers Infiltrate New York Times Computers
#7"Security experts found evidence that the hackers stole the corporate passwords for every Times employee and used those to gain access to the personal computers of 53 employees" Does this mean the NYTimes is storing passwords in plaintext?
Not necessarily. All we know is that they stole the password files. We don't know if the passwords were encrypted (but I'm assuming they were), and we don't know if the thieves were able to decrypt the passwords (they probably did for some fraction >0 and <= 100%).
Re: Chinese Hackers Infiltrate New York Times Computers
#8"Security experts found evidence that the hackers stole the corporate passwords for every Times employee and used those to gain access to the personal computers of 53 employees" Does this mean the NYTimes is storing passwords in plaintext?
I hope all the NYT employees didn't reuse those passwords anywhere else...I think if you work at a big political target like the NYT, you just have to treat it as sacrosanct as your personal email and bank accounts, even if the corporate account is just a formality (I.e. you forward all your emails to your gmail account...which is not a good idea if you're a reporter, but I know several who do it for the convenience)
Re: Chinese Hackers Infiltrate New York Times Computers
#9There's a couple surreal quotes in here. Like asking the Chinese Ministry of Defense to comment.
"A Symantec spokesman said that, as a matter of policy, the company does not comment on its customers."
Uh huh. Even when it's the customer doing the asking? Way to hide behind the policy.
Re: Chinese Hackers Infiltrate New York Times Computers
#10"Security experts found evidence that the hackers stole the corporate passwords for every Times employee and used those to gain access to the personal computers of 53 employees" Does this mean the NYTimes is storing passwords in plaintext?
That means that the hackers pivoted from one system to the Domain Controller (with an account they cracked previously, or the results of a pass-the-hash attack), and got access to all of the account hashes (which they then would crack offline).
The passwords aren't stored in plaintext, but with the computational power available to anyone (or substituting that, time), you start getting actual passwords in a couple of minutes (the worst ones), and maybe 90% in a few hours.