Risk
7/28/2008
02:23 PM
Keith Ferrell
Keith Ferrell
Commentary
50%
50%

Password Security: With Prosecutors Like This, Who Needs Rogue Administrators?

So the San Francisco District Attorney, building a case against the rogue administrator who shut down city network access, decided to include actual passwords as evidence. Bonehead decisions may not get much more boneheaded than this.

So the San Francisco District Attorney, building a case against the rogue administrator who shut down city network access, decided to include actual passwords as evidence. Bonehead decisions may not get much more boneheaded than this.The San Francisco network lockout case has prompted much good and necessary thinking about just who has top-level access to and control of your networks.

Now it's raising questions of just how much we should expect legal officials to understand about digital evidence -- and how much more they need to understand.

Those questions flow from the decision of the San Francisco District Attorney's office to list 150 passwords as Exhibit A in the case against former (rogue) admin Terry Childs.

To be fair, the passwords listed are said to be part of two-step access system, relatively valueless on their own. I'd question that; if nothing else their listing gives observers the chance to glimpse the password creation strategies of 150 or so people.

But it's equally fair to ask: what are the prosecutors thinking? Even if every one of the 150 passwords is long-since changed, their listing -- the decision to list them -- reflects an insufficient (at minimum) understanding of digital security and confidence in digital privacy that's distressing.

Look at it this way -- would the DA's office have considered the valuelessness of the passwords in question if it had been Terry Childs who posted them instead of its own evidence-producing officers?

Don't think so. Same way I don't think the DA's office thought much about this at all.

And if you don't think that a list of changed or "valueless" passwords isn't a trove of possibility for crooks, take a look at this good bMighty article on password cracking techniques.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5211
Published: 2015-01-27
Stack-based buffer overflow in the Attachmate Reflection FTP Client before 14.1.433 allows remote FTP servers to execute arbitrary code via a large PWD response.

CVE-2014-8154
Published: 2015-01-27
The Gst.MapInfo function in Vala 0.26.0 and 0.26.1 uses an incorrect buffer length declaration for the Gstreamer bindings, which allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors, which trigger a heap-based buffer overf...

CVE-2014-9197
Published: 2015-01-27
The Schneider Electric ETG3000 FactoryCast HMI Gateway with firmware before 1.60 IR 04 stores rde.jar under the web root with insufficient access control, which allows remote attackers to obtain sensitive setup and configuration information via a direct request.

CVE-2014-9198
Published: 2015-01-27
The FTP server on the Schneider Electric ETG3000 FactoryCast HMI Gateway with firmware through 1.60 IR 04 has hardcoded credentials, which makes it easier for remote attackers to obtain access via an FTP session.

CVE-2014-9646
Published: 2015-01-27
Unquoted Windows search path vulnerability in the GoogleChromeDistribution::DoPostUninstallOperations function in installer/util/google_chrome_distribution.cc in the uninstall-survey feature in Google Chrome before 40.0.2214.91 allows local users to gain privileges via a Trojan horse program in the ...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.