San Francisco and the great password fiasco
It started when a rogue admin locked his bosses out of San Francisco’s Wireless network.
The office of San Francisco District Attorney Kamala Harris has made public close to 150 usernames and passwords used by various departments to connect to the city’s virtual private network. The passwords were filed this week as Exhibit A in a court document arguing against a reduction in $5million bail in the case of Terry Childs, who is accused of holding the city’s network hostage by refusing to give up administrative networking passwords. Childs was arrested July 12 on charges of computer tampering and is being held in the county jail.
Posting these passwords in public creates a security risk, although the passwords are not enough to give a criminal access to the city’s VPN. The passwords are so-called “phase one” passwords, and must be combined with a second password to access the network, the source said.
Erica Derryck, a spokeswoman for the DA’s office, declined to comment on the matter. The mayor’s office, which supervises DTIS, did not return messages seeking comment for this story
From black hats everywhere:
“Thank you for giving us half of the puzzle. Now we don’t have to work so hard.”
To fix this they need to reset the passwords on every computer that connects to the city’s vpn.
Childs, an engineer principal with DTIS who used the log-in Maggot617, had been engaged in a monthslong dispute with management, and held onto the passwords even after he was jailed.
He finally decided that the Mayor?? was the only person that could be trusted with the keys to the network.
He also seems to think that he was surrounded by incompetents.
It’s not hard to expire passwords and force a change, even en masse.
Since the city didn’t start resetting everybody’s passwords the second they got at least part of the admin passwords back we can only assume one of three things:
A: They are overconfident, which means they think all hackers are sitting there stupidly trying to manually guess the remaining passwords.
B: They’ve talked themselves into thinking the problem is more difficult than it is and are looking for the funding to bring in an expert.
Or C: He’s right and they’re incompetent.
Subscribe by Email