Hacker Makes Infiltrating FBI Database Seem All Too Easy

[Master Disaster]

Apparently a "hacker" managed to breach the FBI computer system and pulled off a huge number of employee records

 

The team of geniuses on CBS's action-drama show Scorpion routinely make it look simple to hack into government systems, and while it's not supposed to be that way in real life, a hacker who wishes to remain anonymous didn't have much trouble plucking personal details of 20,000 Federal Bureau of Investigation agents and 9,000 Department of Homeland Security employees. How so?

According to Motherboard, who's been in contact with the hacker, it all began with a compromised Department of Justice email account. The hacker didn't say how he sabotaged the email account, but once he had the login details, he tried accessing the DoJ's web portal. When that didn't work, he simply called up the department.

 

He used what I would call social engineering to trick them into giving him a login token

 

"I called up, told them I was new and I didn't understand how to get past [the portal]. They asked if I had a token code. I said 'No', they said 'That's fine, just use our one'."

After that, he logged in, clicked on a link to a PC that directed him to an online virtual machine, entered in the DoJ's email login details, and then had access to three computers, including the one belonging to the DoJ employee he initially hacked. According to the hacker, once he clicked on that PC, he had full access to it, and from there he pulled documents on the DoJ's intranet containing details of tens of thousands of employees—some 200GB worth (he had access to 1TB).

 

Some of the data went beyond employee records too...

The hacker said that some of the data contained military emails and credit card numbers, though it's not clear if he swiped that as well or just peeked at it while he was in the system. Either way, he didn't provide those details to Motherboard, just the aforementioned accounts.

Motherboard was able to confirm that the data was accurate by randomly calling some of the numbers the hacker provided. The numbers led to various FBI agents and employees, one of which told the site this was the first they heard of the data breach.

The hacker has already dumped the data containing details of the 9,000 DHS employees through Twitter accompanied by a pro-Palestinian message. He also plans to dump the remaining data, but hasn't done so yet.

 

Lmao, so yeah. It sounds like he did hack the email account but beyond that all he really did was phish the login token. It does highlight a huge flaw in the system though.

 

Thoughts and opinions?

[Master Disaster]

Source - http://www.maximumpc.com/hacker-makes-infiltrating-fbi-database-seem-all-too-easy/

 

Can't edit on my tablet.

[givingtnt]

source ?

[givingtnt]

3 minutes ago, Master Disaster said:

Source - http://www.maximumpc.com/hacker-makes-infiltrating-fbi-database-seem-all-too-easy/

 

Can't edit on my tablet.

screenshot of the can't edit ?  (

[Master Disaster]

Just now, givingtnt said:

screenshot of the can't edit ?  ( @colonel_mortis )

Nothing to screenshot and I've reported it but he cannot replicate it. I click edit, make changes then the save button just doesn't work no matter how much I press it.

[vanished]

Thoughts?  Yup, very broken system.  "Social engineering", if that's what we're calling this now, is/has gotten too many people into things they shouldn't have, and will continue to make all of the best digital security worthless if a person can be tricked into bypassing it.  Shows we need better ways of making sure the right people can always get at their stuff, and the wrong people can not.

[Sidiox]

And keep in mind these people are  the ones in charge of all the data they collect on us. With massive databases full of very sensitive data. 

 

Also: that guy must have thought, you snoop on me, I will snoop back on you. 

[vanished]

You know, I understand how this kind of thing can happen at other places (companies), but this is the FBI - they should be able to (and frankly require) much more proof of identity before giving up credentials.  Since they're the government there should be no issue in asking for stuff no other site would dare, like drivers license, etc.

[kelvindeschutter]

somebody is about to get fired

[KraftDinner]

That's a fucking shame on the FBI the first thing any companies IT should do is educate the end user on any social engineering tactics... especially if you're the FBI. You'd be surprised about how many people don't realize that banks don't send you emails, so if you get an email from your so called bank it probably isn't them lmao

[Trik'Stari]

And yet, they still want a back door into everything that's encrypted.

 

And these are the people we entrust with our "national security".

 

Can we please colonize mars already?

[Lethal Seraph]

6 minutes ago, Trik'Stari said:

And yet, they still want a back door into everything that's encrypted.

And these are the people we entrust with our "national security".

 

It's the same thing with Politicians... those old folks wanted some ruling over something they don't even understand or use. 

[Daegun]

Ah, the weakest link in any security system, people, strike again. This definitely inspires faith in the government.

[Albatross]

The government mines data on us and can't even keep it safe...disgusting but not surprising. I hope they catch this guy and thrown him in such a deep hole he can't see the light of day ever again.

[vanished]

1 minute ago, Albatross said:

The government mines data on us and can't even keep it safe...disgusting but not surprising. I hope they catch this guy and thrown him in such a deep hole he can't see the light of day ever again.

Personally, I'd have more bad will against the incompetent FBI workers than the guy who just wanted to see if it could be done

[Albatross]

3 hours ago, Ryan_Vickers said:

Personally, I'd have more bad will against the incompetent FBI workers than the guy who just wanted to see if it could be done

 

He dumped people's private information on the internet, and will dump more. The scumbag needs to pay.

[azurezeed]

Now the FBI knows a little how we feel.

[Flashport]

7 hours ago, Albatross said:

The government mines data on us and can't even keep it safe...disgusting but not surprising. I hope they catch this guy and thrown him in such a deep hole he can't see the light of day ever again.

Guantanamo?

or.. Isolation?

 

either one is horrible. you really want someone like that, a tech junkie, bunched up with murderers and serial rapists?

but maybe they go easy on him and put him with the white-collar criminals. ofc they won't lol.

 

idk how anyone is supposed to forget their criminal ways after spending half their life in a cell with "bob"; bob killed a family of 6 and now spends his time watching Family Guy and reading Deadpool comics. Do not touch bob's things. bob doesn't like it when you touch his things. lmao.

[Stadin6]

9 hours ago, Albatross said:

The government mines data on us and can't even keep it safe...disgusting but not surprising. I hope they catch this guy and thrown him in such a deep hole he can't see the light of day ever again.

I have to admit it was kinda bad that he dumped the data. I would just send the data to the FBI and say "look what i have" or something like that. But i am more disappointed with the FBI than the hacker.

[ChineseChef]

8 hours ago, Stadin6 said:

I have to admit it was kinda bad that he dumped the data. I would just send the data to the FBI and say "look what i have" or something like that. But i am more disappointed with the FBI than the hacker.

 

Eh, usually any contact like that gets ignored.  And the person who found the flaws gets punished for even trying to find flaws.  And as we have seen in the news over and over and over, nothing changes until there is a huge PR incident.  Unless it goes public, unless lots and lots of people get hurt, the companies or gov't agencies don't do or change anything.  And even then, they only do it because there is a huge incident.  Every other year the gov't loses millions of peoples gov't records data, and just says "oops".  Remember when those 20+ million security clearance records were stolen?  Remember how many changes the gov't made after that?  (hint: nothing of substance)

 

Public destruction of large groups of people is the only way to make organizations care.  Because they risk loss of profits in the corporate world, or they risk loss of votes in the political/gov't world.

[Albatross]

18 hours ago, Flashport said:

Guantanamo?

or.. Isolation?

 

either one is horrible. you really want someone like that, a tech junkie, bunched up with murderers and serial rapists?

but maybe they go easy on him and put him with the white-collar criminals. ofc they won't lol.

 

idk how anyone is supposed to forget their criminal ways after spending half their life in a cell with "bob"; bob killed a family of 6 and now spends his time watching Family Guy and reading Deadpool comics. Do not touch bob's things. bob doesn't like it when you touch his things. lmao.

That "tech junkie" stole personal data (which contained credit card numbers and the like) and then posted it on the internet for the world to see (and will post more) who will or can do whatever they want with it. He is a pathetic criminal that needs to be punished as severely as possible for his crimes. So yes, stick him where the sun don't shine—I don't care where that might be. So while you have more concern for this man than the people he screwed over—which isn't surprising really—I do not care for Liberal ideals that do not work in reality. A man can't learn his lesson unless he is given the consequences of his actions.

 

[Flashport]

1 hour ago, Albatross said:

That "tech junkie" stole personal data (which contained credit card numbers and the like) and then posted it on the internet for the world to see (and will post more) who will or can do whatever they want with it. He is a pathetic criminal that needs to be punished as severely as possible for his crimes. So yes, stick him where the sun don't shine—I don't care where that might be. So while you have more concern for this man than the people he screwed over—which isn't surprising really—I do not care for Liberal ideals that do not work in reality. A man can't learn his lesson unless he is given the consequences of his actions.

 

woahh there buddy, slow your role. I do not have more sympathy for this man than his victims. I am however, against punishment that does not fit the crime. that is my stance. Yes, punish him for his crimes. but do not go all totalitarian on the guy just to make him an example. thats fucked. Have you ever been to prison? (minimum, medium, or maximum security?) I have, here in the states and in Dominican Republic (for minor things) and while in Dominican Republic they locked me up and threw away the key (over a raid on a party, I got unlucky) I was in there with some serious offenders. we're talking rape, murder, all sorts of sexual assault towards people, ranging from kids to seniors. what the hell man. my crime was being at a party after 2AM. I was saved by my family; guys at the party let them know officers took me. or else, I would still be in there. (no phone calls)

 

"liberal ideals"

you need perspective, ffs.

[Albatross]

3 hours ago, Flashport said:

woahh there buddy, slow your role. I do not have more sympathy for this man than his victims. I am however, against punishment that does not fit the crime. that is my stance. Yes, punish him for his crimes. but do not go all totalitarian on the guy just to make him an example. thats fucked. Have you ever been to prison? (minimum, medium, or maximum security?) I have, here in the states and in Dominican Republic (for minor things) and while in Dominican Republic they locked me up and threw away the key (over a raid on a party, I got unlucky) I was in there with some serious offenders. we're talking rape, murder, all sorts of sexual assault towards people, ranging from kids to seniors. what the hell man. my crime was being at a party after 2AM. I was saved by my family; guys at the party let them know officers took me. or else, I probably would still be in there. (no phone calls)

 

"liberal ideals"

you need perspective, ffs.

No sympathy? Okay then. It does suck that a man who smoked a little weed or did a little drugs has to be locked up with a man who went on a murdering spree or ate a dozen women, I give you that as I never even argued it.

 

And your assumption was that I wanted him in with murderers and rapists or to be treated the same as such simply because I wished him to be punished severely, and I am the one who has to "slow my role"? And no, it isn't "going totalitarian" because I think he should be punished severely for his crimes, which was very serious. And his crimes may not be murder or rape, but he stole the security and privacy of many people and all but sold that information to strangers who can do innocent families severe harm. For that, he should be locked up in a dark cell. It doesn't have to be murders or rapists like you jumped the gun to, but other pathetic scum like him or just all by himself. I don't which so long as it happens because he deserves it.

 

Oh yes, I certainly need perspective.

 

[Flashport]

1 hour ago, Albatross said:

-snip-

"Guantanamo?

or.. Isolation?"

 

I asked a question. a legitimate one. then, I added my opinion " either one is horrible." [insert example].

 

was it implied?

 

but you said " thrown him in such a deep hole he can't see the light of day ever again. " death is better than isolation. should we just execute him then?

[Albatross]

3 hours ago, Flashport said:

"Guantanamo?

or.. Isolation?"

 

I asked a question. a legitimate one. then, I added my opinion " either one is horrible." [insert example].

 

was it implied?

 

but you said " thrown him in such a deep hole he can't see the light of day ever again. " death is better than isolation. should we just execute him then?

 

Oh wow, that's quite a jump. But sure. Let's just execute him and get it over with.