Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twin brothers wipe 96 government databases minutes after being fired

arstechnica.com

Post reply on HN
Print view View original

221–230 of 463 posts

Re: Twin brothers wipe 96 government databases minutes after being fired

#221

Post by jyscao »

tradertef wrote: post #190
zuzululu wrote: post #164

I'm just amused how these people were even hired to begin with ? They don't seem to be Americans? How were they even allowed to work on sensitive systems? Why was this even allowed? So many questions. At 4:58 pm, he wiped out a Department of Homeland Security database using the command “DROP DATABASE dhsproddb.” At 4:59 pm, he asked an AI tool, “How do i clear system logs from SQL servers after deleting databases?” H…

>> They don't seem to be Americans? How did you conclude that? Just their names?

[flagged]

Re: Twin brothers wipe 96 government databases minutes after being fired

#222

Post by jyscao »

ImPostingOnHN wrote: post #157
htx80nerd wrote: post #147

Earlier quoted context omitted.

[dead]

if they did terrible things, why are you ignoring that and focusing exclusively on their ancestry?

If positive correlations exist between people who do bad things, and their ethnic backgrounds, then it's a pattern worth looking into.

Re: Twin brothers wipe 96 government databases minutes after being fired

#223

Post by nullorempty »

About 25 years ago we had layoff at a company I worked for. One of the DBA's got fired along with others. Back in the day they didn't revoke access and you had your work computer available until the end of the day. Most, who were fired, just packed and went on their way.

The fired DBA however, stayed behind and finished backing up the databases he was assigned to backup.

Once the job was done, he packed and left.

True story!

Re: Twin brothers wipe 96 government databases minutes after being fired

#224

Post by khazhoux »

dullcrisp wrote: post #102
beAbU wrote: post #94

Earlier quoted context omitted.

Having people with that level of access without some form of two-person-control is already a sign of incompetence.

Twins can defeat two-person control (okay I know one of them was locked out).

TFA: Twins Fucking Authenticate!

Re: Twin brothers wipe 96 government databases minutes after being fired

#225

Post by necovek »

fc417fc802 wrote: post #216
necovek wrote: post #200

Earlier quoted context omitted.

My question still stands: how do you disallow cleartext password extraction if you are breached, assuming all your IT infrastructure and code is now accessible to an attacker? I am talking about not logging them ever, using internal TLS and strong hashing in general, and wondering what exact value is added on top with client side hashing.

There are substantial differences between database access, snooping the logs, internal (no TLS) wiretap, and full MITM of the frontend. Hashing client side minimizes the risk of any blast radius exceeding the bounds of your own service. There's obviously no way to prevent an adversary who achieves full MITM from gradually harvesting credentials over time. The only solution there is to use keys instead of passwords.

We are not disagreeing, but I am not getting my answer: how is client side hashing really helping, what are the circumstances it helps with if you do have the basics right?

In your enumeration, what is breached for this to be meaningfully impactful for other services where customers might be reusing credentials?

Re: Twin brothers wipe 96 government databases minutes after being fired

#226

Post by hirvi74 »

tempaccount5050 wrote: post #45
scottlamb wrote: post #39

> [Opexus] said that “the individuals responsible for hiring the twins are no longer employed by Opexus.” Getting close to the classic Monty Python line: "Those responsible for sacking the people who have just been sacked, have been sacked." Jokes aside, stuff like this sucks because I suspect many employers will take from it the most extreme, dehumanizing lessons, e.g.: (a) make firings [edit: including lay-offs] as…

When you are talking about access like they had "make firings as abrupt as possible including terminating all access immediately" not doing this is incompetence. This is absolutely a standard and has to be for these kinds of positions. I've never worked anywhere where it wasn't for the majority of IT staff. You meet with HR, someone clears your desk, and security walks you out.

I work in government. If you think that is incompetence, then I have stories that could make your skin crawl.

Re: Twin brothers wipe 96 government databases minutes after being fired

#227

Post by jmull »

necovek wrote: post #195
jmull wrote: post #145

Earlier quoted context omitted.

People shouldn't be downvoting this... Hashing client-side is a good idea. You must also hash server-side, for storage/comparison. Otherwise, an insider may be able to harvest the original password, from logs, proxies, load balancers, etc. that requests pass through after the end of the TLS connection, on the way to the db. They can then try the credentials on other, perhaps more lucrative sites. That's what the brot…

I wonder how common are setups where an internal person has access to the TLS private key part of the certificate or access to a network equipment that all traffic passes through, yet they cannot access the inputs required for hashing/encryption client-side? This seems to mostly prevent accidental logging and is thus a matter of defense in depth, stopping malicious actors from exploiting it later — but an actively ma…

> This seems to mostly prevent accidental logging

Yes, and that's not uncommon, IME. There's generally a lot of logging that's at least potentially available, and it gets turned on, and the logs shared when there's a problem that needs to be fixed (especially when it needs to be fixed quickly, which is usual).

This is going to make more sense for "enterprise"-type deployments, where there's a significant distinction between the people who might have access to request logs at times, and the people who can push code to production.

Re: Twin brothers wipe 96 government databases minutes after being fired

#228

Post by calgarymicro »

charonn0 wrote: post #27
AlexB138 wrote: post #20

Earlier quoted context omitted.

I had the same questions. Apparently discovery of the prior conviction is what lead to them being fired: > When the company discovered Sohaib Akhter’s felony conviction, it terminated both brothers’ employment during an online remote meeting on Feb. 18, 2025 from https://www.justice.gov/opa/pr/federal-jury-convicts-virgina... which is a better source on this. That prompts the question of why background checks are so…

The company involved here is apparently based in Washington, DC, which has a "Ban the Box" ordinance that limits employment background checks for most kinds of jobs. And apparently DC's version of the law is particularly strict.

The prevents them from asking before extending an offer, but it seems they could (and should) have checked after.[0]

> However, an employer may ask about criminal conviction(s) after extending a conditional offer of employment (the employer can never ask about arrests or criminal acusations that aren't pending). An employer who properly asks about a criminal conviction can only withdraw the offer or take adverse action against the applicant for a legitimate business reason that is reasonable under the six factors* listed in the Act.

One of the six factors is "Fitness or ability of the person to perform one or more job duties or responsibilities given the offense"[1], which they probably could have invoked after asking (though they never checked or didn't check thoroughly enough, so I guess it's moot).

[0]https://ohr.dc.gov/page/returning-citizens-and-employment

[1]https://ohr.dc.gov/sites/default/files/dc/sites/ohr/publicat...

Re: Twin brothers wipe 96 government databases minutes after being fired

#229

Post by [deleted] »

jyscao wrote: post #222
ImPostingOnHN wrote: post #157

Earlier quoted context omitted.

if they did terrible things, why are you ignoring that and focusing exclusively on their ancestry?

If positive correlations exist between people who do bad things, and their ethnic backgrounds, then it's a pattern worth looking into.

[deleted]

Re: Twin brothers wipe 96 government databases minutes after being fired

#230

Post by ImPostingOnHN »

jyscao wrote: post #222
ImPostingOnHN wrote: post #157

Earlier quoted context omitted.

if they did terrible things, why are you ignoring that and focusing exclusively on their ancestry?

If positive correlations exist between people who do bad things, and their ethnic backgrounds, then it's a pattern worth looking into.

if you personally believe there is a positive correlation between having an ethnic background (mexican or middle eastern or whatever) and doing bad things, I can't control your beliefs

still pretty gross of you though

Post reply on HN