Anonymous Redditor Dumps Logins of 33K US Govt Employees

https://www.reddit.com/r/pwned/comments/4fsxse/us_government_data/

by chatmasta • 10 years ago

90 39 10 years ago

Haven't looked, but most likely a dump from a 3rd party service where user's used government email as credentials, then isolated out to look like a bigger hack than it is?

33k is a lot though, and nothing to scoff at. But given the breath of scope in the addresses here, this looks less like a breach of a government agency and more like some social network, etc.

koolba• 10 years ago

Bold is the man that tests leaked credentials against .mil domains.

rdudek• 10 years ago

Even behind a proxy, using TOR on some public/compromised wifi?

runchberries• 10 years ago

When the stakes are treason and/or Guantanamo Bay, you are still bold no matter how many precautions you take or maybe just stupid.

nubianwarrior• 10 years ago

Play stupid games, win stupid prizes.

alexbock3• 10 years ago

It's just not worth tickling the dragon's tail. What would be the motivation for anyone to even try (except for maybe government-sponsored hackers in China who are probably safe from extradition and personal blame)?

Even if you bought a laptop from someone in another state on Craigslist with cash and connected to public Wi-Fi (without a cellphone on your person, of course)... I still would not feel confident that NSA couldn't track you down if you gave them a good reason to.

dogma11382• 10 years ago

You need a smart card to access those applications.

ryan-c• 10 years ago

Interesting. The hashes seem to be sha512crypt ($6$) in two flavors: One specifying 5000 rounds and using a fixed salt of 'usesomesillystri', and the other is... odd. It's in the format of '$6$rounds=50$....', which I think means that rounds=50 will be interpreted as a salt, but I'm not sure. Most of them are the latter format.

alexbock3• 10 years ago

Does anyone know the origin of "usesomesillystri" as a salt? Googling that string found more results than I expected, but most of them are from password files with no explanation.

I found some PHP example code that tries to use "usesomesillystringforsalt" as a salt, is this just the aftermath of people writing real websites based on online examples? It seems a bit more pervasive in password dumps across the internet than I would expect unless it's in a really high profile example somewhere.

edit: It appears to be used in the official PHP documentation for crypt[0].

[0] http://php.net/manual/en/function.crypt.php

jharger• 10 years ago

I guess they missed this part of that example:

  /* These salts are examples only, and should not be used verbatim in your code.
    You should generate a distinct, correctly-formatted salt for each password.
  */

dogma11382• 10 years ago

Copy paste. I had a fun exercise with a client that said they don't need a process to control the take in, audit and validation of 3rd party (mainly open source) code in their SDLC process because they strictly prohibit it in their coding policy.

I ran a code plagiarism tool on the top 500 github repos and on some list of the top most common code questions from stackoverflow and found 1000's of hits on only a small part of their code base with even comments copied directly from stack being not to uncommon.

In one particular instance it was a perfect storm of stupidity they had some code that was supposed to take user provided files and store them on S3 the example they copied from actually had a valid AWS access token of another company if that code was live the files which would be mainly their customers invoices and tax info could've ended up on some one else's server.

After that afternoon I never had a single pushback from neither their head of development nor their compliance guys ever again.

poooogles• 10 years ago

Link has been deleted, does anyone have a mirror?

Ianvdl2• 10 years ago

http://webcache.googleusercontent.com/search?q=cache:https:/...

toomuchtodo5• 10 years ago

Appears to have been reported to Google, Reddit, and the Internet Archive for removal.

pcl• 10 years ago

A comment in the Reddit thread says that the breach includes some .edu credentials as well:

alum.mit.edu stu.aii.edu student.monroecc.edu mail.mst.edu missouri.edu usnwc.edu jfsc.ndu.edu utsa.edu hsl.harvard.edu itt-tech.edu scad.edu gmu.edu ohsu.edu my.sinclair.edu

I haven't downloaded the file to confirm. But if you've got an account at one of the above domains, you should consider that password compromised and rotate it, there and anywhere else that uses the same value. (And consider not re-using passwords, if the latter case applies to you.)

cat-dev-null• 10 years ago

Top used domains:

       5823 gmail.com
       2339 yahoo.com
       1510 hotmail.com
       1078 gsa.gov
       800 navy.mil
       594 mail.mil
       571 usace.army.mil
       474 us.af.mil
       474 aol.com
       280 comcast.net
       227 sbcglobal.net
       208 msn.com
       202 va.gov
       158 us.army.mil
       153 verizon.net
       142 gilbaneco.com
       140 live.com
       138 cox.net
       124 usmc.mil
       120 nasa.gov
       113 earthlink.net
       111 outlook.com
       107 att.net
       103 nps.gov
       94 usc.edu
       87 mail.missouri.edu
       81 faa.gov
       77 me.com
       74 mac.com
       69 hdrinc.com
       69 fs.fed.us
       69 dla.mil

Anonymous Redditor Dumps Logins of 33K US Govt Employees

Related Stories