[deleted]
Twin brothers wipe 96 government databases minutes after being fired
281–290 of 463 posts
Re: Twin brothers wipe 96 government databases minutes after being fired
#282> At 4:58 pm, he wiped out a Department of Homeland Security database using the command “DROP DATABASE dhsproddb.” This article is hilarious. The two bickering brothers remind me of the guys in the Oceans movies played by Casey Affleck and Scott Caan. It’s amazing they got this close to sensitive data.
Are you a man?
Yes, 19.
Are you alive?
Yes, 18!
Evel Knievel.
—
They also come off as a little bit rosencrantz and guildenstern imo
Re: Twin brothers wipe 96 government databases minutes after being fired
#283Earlier quoted context omitted.
Terminating access and rotating passwords (if needed) while the person is in the meeting but has not yet found out they are being let go has been SOP for at least the last 20 years
Heh, a place where I worked some guy who left kept committing code for months (he went to work for a company we were a vendor for). Some of my teammates knew and just thought it was no big deal, he was fixing bugs and adding features. The color the director turned when he found out!! Oh man.
This story deserves a movie, or at least a long video essay!
Haven’t laughed this hard in a long time.
Re: Twin brothers wipe 96 government databases minutes after being fired
#284I wonder if their stellar academic record is due to the same shenanigans? Given that they were caught manipulating logs and deleting evidence to cover their tracks in 2025, that they did the same to their academic records is technically plausible.
In 2011, university systems like George Mason’s were significantly more vulnerable to the exact type of SQL injection and credential theft they were using in their early criminal years.
Re: Twin brothers wipe 96 government databases minutes after being fired
#285Earlier quoted context omitted.
We are not disagreeing, but I am not getting my answer: how is client side hashing really helping, what are the circumstances it helps with if you do have the basics right? In your enumeration, what is breached for this to be meaningfully impactful for other services where customers might be reusing credentials?
As opposed to what? Your question seems unclear to me. I already answered you that if you assume full MITM of the frontend then it is physically impossible to prevent gradual credential harvesting. Did you have a different scenario in mind? > how is client side hashing really helping Compared to what? Server side hashing? It prevents the plaintext from ever hitting your infra which minimizes to the greatest extent po…
There is certainly good reason to do server-side hashing: you do not keep a persistent record of the customer's secret, yet keep the ability for them to authenticate with it.
If you are never logging a clear-text secret and storing a hashes version to validate against, and using TLS between client and server, client-side hashing does not bring much benefit other than protecting customers' reused passwords against people who have sufficient access to the infrastructure to MITM the client but no ability to modify the client side code where they could extract the password directly.
When IT has write access to code, client side hashing protects only against accidental log leakage and similar.
Re: Twin brothers wipe 96 government databases minutes after being fired
#286Earlier quoted context omitted.
If you're talking about Oracle, the large round previous to that they did had individual meetings with employee, manager, and HR. With so many layoffs it took a week+ to do, effectively torturing an entire set of employees who had no idea if they'd have a job by the end of the hour, let alone week. I'm not sure there's any good way to lay off large amounts of staff (besides not getting yourself into the situation in…
>I'm not sure there's any good way to lay off large amounts of staff Someone on HN once wrote that after the dot.com bust, Yahoo! HR had 1-1 meetings with every single employee that was part of the mass layoffs back then, and they did this for hundreds of workers. Boy what I wouldn't give to go back to such state of affairs, even though I wasn't yet part of the workforce back then. An older family friend of mine who…
How you handle employees after the layoff announcement is a much easier conversation: Give them a lot of dedicated resources to navigate it and give them a good parting offer.
Nobody ever seems happy about how the announcement part is done though. "Wait for everyone to have 1:1" and the problem is the mass panic that starts to roll through the workday as employees wonder if they are next. "Mass announce and then engage after" makes another group upset they were told by a generic mass email. I've been at places which have gone each way and I'd honestly rather hear from the mass email myself.
Re: Twin brothers wipe 96 government databases minutes after being fired
#287In my company there were layoffs recently. People had access to production database due to support requests, as we're a young company, so no least-privilege rules were applied yet. Nobody did anything bad. People knew what was going to happen, but no retaliation happened. First, I guess, to not have any problem with law, to pursue the next job without burdens. Things are traceable. Second, why? Why should I destroy my colleagues' work?
Re: Twin brothers wipe 96 government databases minutes after being fired
#288Earlier quoted context omitted.
Annecdata: 1996-1999 was super easy, one round start next Monday. 2000-2003 difficult. Easy again until 2008. Hard till 2013. No data since then. What I hear about today seems crazy hard.
Late '90s were crazy easy compared to anything since. If you could demonstrate any amount of technical skill you were in.
I got my first job by meeting someone on a train Thursday night and starting on Monday morning! (1998)
Re: Twin brothers wipe 96 government databases minutes after being fired
#289Earlier quoted context omitted.
Uhh... The guy in charge of the whole thing does things a foreign adversary would do. Has for years and he's back for round two. He even tried to overthrow the government once.
He wasn’t hired, he was elected.
That's a bit pedantic. There's really not much of a difference there.
He can be fired too, but the current shitheads in charge would never do that.
Re: Twin brothers wipe 96 government databases minutes after being fired
#290Earlier quoted context omitted.
Looking at it from Europe, this definitely also happens. It depends on the situation. I know of ppl who were kept bcs the parting was in good faith (which was less a firing and more an agreement that parting is in everyone's interest), but I also know of ppl who had their access revoked before firing bcs it wasn't. The latter had unilateral system access as well, which added to it. It's not about humane or inhumane,…
> It's part of the reason why Europe is falling behind on everything. I read a news article that Orange Telecom in France was being sued by a woman they had on payroll for the last 20 years doing nothing, because due to a medical condition she suffered, she became unable to do her job, and since they couldn't fire her due to France unions and labor laws, nor did they have any available job that could fit her current…
The anomaly there is that France Télécom was a public company at the time of the hiring, and through privatisation public servant benefits were upheld for existing employees, which blocked most unpythonesque solutions.
If she had been hired after, it would have taken time but she would have been found unfit for work (she had epilepsy and hemiplegia), her contract terminated, and she would have most likely received a handicap pension instead.