Anonymous Redditor Dumps Logins of 33K US Govt Employees
reddit.com
reddit.com
I found some PHP example code that tries to use "usesomesillystringforsalt" as a salt, is this just the aftermath of people writing real websites based on online examples? It seems a bit more pervasive in password dumps across the internet than I would expect unless it's in a really high profile example somewhere.
edit: It appears to be used in the official PHP documentation for crypt[0].
/* These salts are examples only, and should not be used verbatim in your code.
You should generate a distinct, correctly-formatted salt for each password.
*/I ran a code plagiarism tool on the top 500 github repos and on some list of the top most common code questions from stackoverflow and found 1000's of hits on only a small part of their code base with even comments copied directly from stack being not to uncommon.
In one particular instance it was a perfect storm of stupidity they had some code that was supposed to take user provided files and store them on S3 the example they copied from actually had a valid AWS access token of another company if that code was live the files which would be mainly their customers invoices and tax info could've ended up on some one else's server.
After that afternoon I never had a single pushback from neither their head of development nor their compliance guys ever again.
33k is a lot though, and nothing to scoff at. But given the breath of scope in the addresses here, this looks less like a breach of a government agency and more like some social network, etc.
Treason against the United States, shall consist only
in levying War against them, or in adhering to their
Enemies, giving them Aid and Comfort. No Person shall
be convicted of Treason unless on the Testimony of two
Witnesses to the same overt Act, or on Confession in
open Court.
edit: If you provided hacked information to a foreign power I could see that being considered giving aid to an enemy. My original question was more focused on the actual hacking itself than what you do with the information.
It could be considered "light treason" however...
In truth it'd be likely to fall under federal statutes governing systems access, and probably I'd guess the 1917 Espionage Act.
Even if you bought a laptop from someone in another state on Craigslist with cash and connected to public Wi-Fi (without a cellphone on your person, of course)... I still would not feel confident that NSA couldn't track you down if you gave them a good reason to.
For the lulz
Do you think there is a database that connects an identifying factor of all computers to their owners?
A computer vendor could maybe keep a list of device serial numbers/MAC addresses, along with non-cash payment methods, but how could law enforcement legally acquire such data, if not authorized in a specific case?
And if there is a specific case, what is the likelihood that an investigator could determine a device's serial number/MAC from over the internet(how is that even possible?) and then locate the original vendor then locate the original purchaser?
The crux of this seems to be somehow uniquely identifying a device over the internet. A vendor having a database of items sold + payment method seems more plausible.
Isn't an IP address the only identifying factor of a machine transmitted over the internet? And IP addresses aren't permanently tied to machines. Even if theoretically an IP address could somehow be used to acquire the connected MAC addresses, doesn't TOR prevent that?
I'm not an expert on this, if something is wrong here, or I'm missing something, I'd be happy to learn.
I expect the manufacturer to have a database correlating MAC address, serial number, date the device left the factory, and where (i.e. which retail store) it was shipped to.
I expect the retail store's inventory tracking system to know when the device with that serial number was sold, by which cashier, at which register.
If it doesn't know the (tokenized) credit card number and name on card directly, I expect the store to be able to find its copy of the receipts from that register at that time, which would contain the last 4 digits and name on card.
If the purchase was relatively recent, I expect video of the register at that time.
If the purchase was in cash but the video is still around, I'd also expect video of the purchaser walking out to his car, and (maybe separately) a shot of that car with good enough resolution to pick out the license plate.
I don't think Joe Credit Card Fraudster gets this kind of attention, but someone who is believed to be a credible national security threat... absolutely.
In reality, I would expect that one or more of those elements in the chain to be broken. Retailer lost their backups. Changed systems, threw out the old one. Doesn't keep records that far back. Etc.
I agree there is a possibility they could track all these steps, but it would require everything working perfectly (from the authorities' POV)
As an added level of security, a month after buying it make a post on craigslist to sell it as broken/not working. send an email to yourself from an internet cafe offering to buy it. Via email arrange a trade at a location without any CCTV. Plausible deniability if the police do ever show up at your door.
What can be done with those logins by someone NOT employed by the government to harm ME?
This is the kind of thing that needs to be brought up in arguments when politicians pine for safety and surveillance. The history shows us over and over that the information cannot be controlled.
5823 gmail.com
2339 yahoo.com
1510 hotmail.com
1078 gsa.gov
800 navy.mil
594 mail.mil
571 usace.army.mil
474 us.af.mil
474 aol.com
280 comcast.net
227 sbcglobal.net
208 msn.com
202 va.gov
158 us.army.mil
153 verizon.net
142 gilbaneco.com
140 live.com
138 cox.net
124 usmc.mil
120 nasa.gov
113 earthlink.net
111 outlook.com
107 att.net
103 nps.gov
94 usc.edu
87 mail.missouri.edu
81 faa.gov
77 me.com
74 mac.com
69 hdrinc.com
69 fs.fed.us
69 dla.milalum.mit.edu stu.aii.edu student.monroecc.edu mail.mst.edu missouri.edu usnwc.edu jfsc.ndu.edu utsa.edu hsl.harvard.edu itt-tech.edu scad.edu gmu.edu ohsu.edu my.sinclair.edu
I haven't downloaded the file to confirm. But if you've got an account at one of the above domains, you should consider that password compromised and rotate it, there and anywhere else that uses the same value. (And consider not re-using passwords, if the latter case applies to you.)
I mean, shitty people gonna be shitty. Not much you can do about that, except kick down their door if you're law enforcement.
You should consider the argument you'd make that downloading, possessing, and publishing (if seeding) US government employee credentials doesn't violate the Computer Fraud and Abuse Act.
Copyright violations are one thing. The US government has unending resources. And they've had no problems whatsoever extraditing people from countries all over the world (including Canada and Germany) for computer crimes: https://www.judiciary.senate.gov/imo/media/doc/2-4-14%20Rama...
As usual the rest of the world is not a place within the US. It's a shame some people keep overlooking that.
"Uploaded: 2016-04-20 13:55:48 GMT"
https://thepiratebay.se/torrent/14371033/US_Government_Data
(Found by googling magnet info hash)