FBI got Hacked, Reveals Hundreds of Passwords | Hacker News Reader

FBI got Hacked, Reveals Hundreds of Passwords

pastebin.com

130 pointsspoiledtechie94 comments

Open articleView on HN

joseph.mcqueen@ic.fbi.gov - passwords123

> Joseph McQueen III, chief of the FBI personnel recruitment unit according to [0].

daniel.clegg@ic.fbi.gov - clegg.passwd

> is an FBI supervisory agent

Some others

laura.eimiller@ic.fbi.gov - passwored12

William.So@ic.fbi.gov - cutelilyian191

tammy.mchugh@ic.fbi.gov - passwords123456

Rich.Ernst@osd.mil - ernst.richard

celkins@vertizontalinc.com - celkins.vertizon

joseph.herold@us.af.mil - 128482joshqwerty

joseph.s.dufresne@uscg.mil - qwerty9876

IC_Complaints@ic.fbi.gov - JulianICcomplaints

gavin.edward@bdsus.mod.uk - eduardopassword123

IC_Complaints@ic.fbi.gov - JulianICcomplaint

ronald.menold@ic.fbi.gov - password111111

[0] http://www.diversitycareers.com/articles/pro/09-augsep/dia_f...

I wish you had not done this. I did not want to see anybody's passwords, or create any sort of record that I myself downloaded the password list (which i did not.) Perhaps this is my fault for even clicking on the comments thread of this article. And of course there are many reasons to call me paranoid. Nonetheless, well, I will be moving on now!

Not only did you click on the comments but you created a much more permanent record by posting...maybe you're just trolling?

This is definitely fake! I did some simple googling and found this : http://leakster.net/leaks/fbimail

It seems someone else already did this hack and these guys simply copy-pasted the passwords to make it look like their hack. Apparently, these copy-pasters are The Hackers Army from Pakistan.

And this: http://leakster.net/leaks/fbivuln

This link on Hackernews is nothing but a publicity stunt by THA. Waste of few minutes of my life.

A lot of these are good. Some not so much...

    passwords123
    passwored12
    password$qwerty
    qwertylol@me
    passwords123456
    password123
    password111111

This is a fake news dude. Check this out: http://news.ycombinator.com/item?id=4678064

Not a single sentence, can it be that they allow characters like ( and % but not whitespace? Boggles my mind that people don't use more sentences.

Personally I don't like spaces because every now and then I find a service that doesn't accept them - ex: you can't have spaces in your IRC password. ASCII printable characters are enough for me.

Look at the difference in time when using a simple 'helloworld' password with and without spaces. https://www.grc.com/haystack.htm

Also, for some more reading on why using spaces will make it infinitely more difficult for hackers to try and gain access: http://www.baekdal.com/insights/password-security-usability

There's one ilovemydaughternancy with no spaces. Why would you want spaces?

There's also lovenancy18. Someone will have a long talk with his daughter.

Sentences are easier to remember. Yet grammatically correct sentences can give you things like capital letter, whitespaces and even periods.

Unfortunately, they also cut down on the search space quite a bit.

I find that typing a bunch of words with spaces is faster than with words. I guess my brain is wired by now to automatically press the spacebar between words.

Deleted comment

Wouldn't it make it harder to remember which places accept a password with spaces and which don't? I already have trouble remembering which sites require long passwords and which require shorter ones.

to make it more natural to type a passphrase

What's wrong with 3 and 4?

It appears that, in general, the FBI staff are setting reasonable passwords. There are a few passwordNNN types but the majority are adequate and, in my opinion, would hold up well against a brute force vector, which is the primary purpose of password complexity.

The fact that some of those passwords appear very strong also means they weren't bruteforced and therefore most likely stored in plaintext. I guess even the FBI have sloppy programmers...

They say on the pastebin that one connexion sent passwords in clear text (through asipx-webadmin), so they probably were read there. At least it was probably an entry point.

3 and 4 would not take long to be brute forced by a dictionary attack, I think. Too many people use qwerty on their password, so it's probably high rated on a dictionary attack.

3 and 4 are weak because we have pretty good heuristics on how passwords are composed so it wouldn't take much longer to brute-force them than it would to do password123.

I'd be interested to see if either 3 or 4 appear on existing password dictionaries.

This one made me giggle:

> ctsecuritiesfraud@ic.fbi.gov - fraudadmin

I was also quite amused by: 12345678987654321

I'm sure this comment will be heavily downvoted but I read several times that FBI and similar agencies were 7 years ahead in terms of technology including security of systems.

I didn't believe in those quotes and every time a situation like this happens I'm more convinced that they are no more advanced than the big companies (Microsoft, Mozilla...) and depend heavily on the updates released by those companies every week... Just my 5 cents...

Just the statement that one's organization is "seven years ahead in terms of computer security" implies a fair amount of technological ignorance.

How can an organization be seven years ahead of everyone else? Do they have Norton Antivirus 17.0, whereas the rest of us are using 10.0?

Well, they could for example invent RSA years before the public knows about it. (British intelligence did this). Or they could invent differential cryptanalysis before the public knows about it. (NSA did this.)

Yes, in fact, it implies technological illiteracy. But I can imagine what kinds of people would say that.

If my experience having worked closely with local government IT, also applies to the FBI (I would bet it does). Then they, just like any technology in the public sector, is usually 10 years behind in technology compared to the private sector. They're just mostly bored undertrained people, with no real incentives to do a good job. Who would rather play office politics to raise chances of getting promotion, than to learn the heck is this php injection thingy.

As opposed to the Hollywood scenes of ultra high tech rooms with floating transparent screens, shiny lights everywhere, and super advanced systems that can listen to your voice commands and instantly solve complex cases just by saying "enhance!". Which is probably the vision this person who talked to you had. Reality is more like windows xp and programs that compile even when the unit tests fail.

How would you know if a unit test fails, if the program doesn't compile?

Hashing passwords (so you can never get back to the original password) has been used for decades.

Well I would think that the FBI would really be the wrong agency for this to apply to has they are really no more than just normal police officers on the federal level.

I think people that say things like that are just terrified that no one has any idea what is going on. :)

These passwords look a bit suspect.. it seems like some are forced to have very complicated passwords while others do not. Interesting to note, Timothy Lauster is on this list and was a person associated with the FBI call anonymous leaked.

See: http://www.pcmag.com/article2/0,2817,2399817,00.asp

This is what you get for encouraging just one type of password strength (i.e. character set) while almost ignoring another (i.e. length).

For example I bet this wouldn't pass the FBI's requirements:

- Clowns with clown makeup

But this would:

- password123

Why do you think there were such requirements?

Amongs the passwords I see: marklevett, looskwoooish or even qwertylolqwerty.

Browsing the list the only think I could think they enforced was a minimum character count. I see no whitespace or underscores either.

So I guess Clowns.with.clown.makeup would've worked.

Anyway, the real issue is: why were those passwords stored as plaintext?

Maybe they weren't stored in plaintext, they could have been reversed from the hash. A lot of legacy systems still store passwords in something like 3DES which is trivial to reverse.

PS - "reverse" just means using either rainbow tables or generating the entire set for a given hash(n).

haha, this is the best password.

All these people with "password123" as their password (and there's a bunch similar to that) should be fired. Sidney MacArthur, you work for the Navy and you have that as a password?

I more so blame the administrator who allowed them to have these passwords (and of course whoever was storing them in plaintext).

The reality is that employees can't be trusted to manage password strength. But it's trivial to implement a validation scheme that forces employees to be over a minimum length, use special characters, etc. Of course this is also not great -- and inevitably we'd see Pa$$word123 -- but it's at least a starting point.

fired? seriously?

I don't know if i agree with fired but if you work for the fbi, you probably have some access to non-public information, some people have classified or high clearance levels. If you can't manage to have a password that matches patterns that people warn you to avoid for your facebook let alone your fbi password maybe your supervisor should reevaluate what level of trust you should be given

Since it's just the FBI then I would make it a retraining issue. And the sysadmin with such pathetic password policy should get some ass chewing.

Whoever wrote the code that stored these values in plaintext (if that is indeed the case) should definitely get the boot.

If this was the NSA or CIA I would fire them all and shoot the person who coded it. :o)

Would we be surprised if someone got fired from Google or Microsoft for making internal information readily available to the first idiot who tried?

Google and Microsoft build systems that don't allow weak passwords. Security is a process, not a person.

Or whoever is in charge of tech security, yes. I think the whole Wikileaks-State-Dept. episode showed how a global system can be undermined by the weakest link.

Rough estimate, about a 1/3 of the passwords can be easily cracked.

Of the rest, some are human inputted for sure but some seem randomly generated.

Can I venture guess that some weak accounts are pretty trivial and the important one's are using randomly generated passwords? Yes it's still bad practice, weak link and all that. I'm not condoning such practice.

I don't like this being listed on ycombinator. I have now just gone to a site with all the passwords on, I was expecting an article about it. I do not like the fact that I have just browsed that page!

This is Hacker News...I appreciate the direct source of the leak. Not some shitty article that someone wrote about what happened. If you don't like it, don't click it.

The title is "FBI got Hacked, Reveals Hundreds of Passwords" and while it does point to pastebin, the title reads like the title of an article. So it's hard to know not to click it until you click it. If the title did a better job indicating what the content was, you could both be happy.

Maybe I'm very naive but I have a hard time imagining one would get into trouble by browsing such a list now that it's in the open. Thousands of people are browsing this list right now....

It's half principle and I think that I would worry about things like that. I have no idea what kind of monitoring tools and methods the FBI have and I don't want any attention because someone linked a load of passwords to ycombinator and I went to it expecting a fairly inocent article :)

>I don't want any attention

So you make a post about it?

Agencies deflect blame from the sources by harassing the messengers and recipients.

I agree actually. I have no reason to actually want to see their private information. I do want to know what happened.

Exactly, and that is how it normally is on ycombinator. If there's a link to the actual data on the article, then whoever wants to go to that, go ahead, but I stay away.

It's linked to a pastebin... should be obvious what's likely to be there.

I haven't used pastebin...

fair enough then.

Dude its a fake article. http://news.ycombinator.com/item?id=4678064

Don't worry, citizen, you'll have plenty of time to explain it to the proper authorities.

I think my favorite has to be this one: "$$$$$$$$$$$$$"

That's a lot of dollar signs. It would be hard to keep track how many I'd typed each time I log in.

What about counting while typing them? :)

Cha ching!

So where do we sign in to validate this works? Purely for research purposes. Not saying I want to sign in another person's account, but just out of curiosity, where do we sign in?

The chances of them still working are pretty slim...

The chances of these people using the same password elsewhere however...

Facebook, banks, etc. I'd venture that some of these people's personal accounts are compromised by the leak.

The link is in the leak. It's currently timing out.

Were these passwords stored as plain text? Is there more info on how the hackers got hold of these?

I very much doubt that any of the complex passwords were bruteforced.

yes they were.

Any actual, verifiable proof?

Do you live outside the US and can you go to an Internet Cafe?

I would hope by now they have locked out all those accounts and pulled the server.. but on the other hand its a government agency we are talking about =)

Was posted on a Thursday Afternoon. Govt works dead slow.. So don't expect them to be locked out till Wednesday?

How can pastebin still be in business?

I see some email addresses referring to recent cases in there, i.e. findwhitey@ic.fbi gov. I wonder if these guys just tipped off mobsters still under investigation... or even read some of those case mailing lists (presuming that's what they are).

It's interesting to see that, for the most part, there appears to be a lot of randomly generated passwords. Of course, it's also worrying to see that there's passwords as insecure as "passwords123" for an organisation where security is paramount.

I love reading through leaked password lists - so interesting to see what sort of passwords people are using.

Some of my favourites:

    $$$$$$$$$$$$$
    bebrian.nerd
    ilovemydaughternancy
    sallymylove1981
    lisa.grossman

This looks pretty fishy to me. There are a lot of super-simple passwords like firstname.lastname and then stuff like )(^!@tyukjas or )(klhkdgkajst2.

The simple passwords are too simple [ali@ic.fbi.gov - noentryplease1897182 - really?] and the complicated ones are way too complicated [I assume they don't use tools like 1Password and such].

Also most of the emails are firstname.lastname@... and every 3rd of 4th is Firstname@... and some of them are really weird, like SCAM@ic.fbi.gov - juyt8&81igasd, Bogdan@ic.fbi.gov - 19127gasdg8991872

Perhaps this is the wrong place for this kind of discussion, but don't these kind of leaks seem careless? I'm all for transparency, but how does exposing this kind of information help anyone?

Fake news...http://news.ycombinator.com/item?id=4678064

Well at least I am surprised how many of them had strong passwords.

Things like "recruits.membership" for the recruits maybe not so much.

These could be honeypot combinations.

Or at least should be now.

Am I the only one surprised that 8.8.8.8 is also Google's Public DNS address?

That's something I noticed too, but that is probably just a reference to the DNS-servers they used to resolve the data (ie. not the target).

i doubt it. 8.8.8.8 is google's dns. or there is global conspiracy going on...

Could you expand on what you mean by this?

At last.

Reply on news.ycombinator.com