DNC Hack Serves As Cautionary Tale For IT Pros

About Us

Advertise

Newest First | Oldest First | Threaded View

[close this box]

<< < Page 2 / 3 > >>

100%

TerryB,
User Rank: Ninja
8/1/2016 | 12:33:00 PM

Re: Who Hacked the DNC?

@Faye, do you know for sure if it was Exchange? Like you, I'm always perturbed about how little info you ever see on a hack.

Unless they phished an admin level password, and then were able to breach firewall to gain server access, not sure how they gained access to all emails. We use Lotus Notes, that's what it would take to do that here. Knowing my email password would only get you my emails. And Notes has no web browser admin, you need a Notes client with access to server. If you had Notes admin account with access to all mail files, then this hack would be possible. But I have little experience wih Exchange, curious how that would differ?

Reply | Post Message | Messages List | Start a Board

50%

Joe Stanganelli,
User Rank: Author
8/1/2016 | 7:23:03 AM

Re: Hack 'n sack knack

@Faye: You're very welcome!

Personally, I usually prefer new comments first, but sometimes I prefer to go into threaded view to follow particular conversations.

Reply | Post Message | Messages List | Start a Board

50%

Joe Stanganelli,
User Rank: Author
8/1/2016 | 7:21:53 AM

Re: email matters

@Michelle: Additionally, even without that actively anti-IT but still laissez-faire culture, if someone does cross the IT line and then something bad happens (e.g., keeping proprietary business information on a personal device -- which then becomes lost, stolen, or otherwise compromised), the employee in many organizations is placed between a rock and a hard place: the employee could report the incident and risk getting in trouble, or the employee could say nothing -- putting the business at risk.

The answer, again, though, comes down to culture -- as I observed here: enterprisenetworkingplanet.com/netsysm/minimize-shadow-it-damage-by-encouraging-self-reporting.html

Reply | Post Message | Messages List | Start a Board

50%

Faye___Kane,
User Rank: Strategist
8/1/2016 | 12:58:23 AM

Re: Hack 'n sack knack

@joe

thank you! ♥

Reply | Post Message | Messages List | Start a Board

100%

Joe Stanganelli,
User Rank: Author
7/31/2016 | 9:15:13 PM

Re: Hack 'n sack knack

@Faye: Newest comments first is the default, but you can get threaded view. At the top of the comments section page, you have the option to click Newest First, Oldest First, or Threaded View.

Reply | Post Message | Messages List | Start a Board

50%

Michelle,
User Rank: Ninja
7/30/2016 | 5:14:06 PM

Re: email matters

@Joe agreed. I've seen the same thing happen in places I've worked. A culture of IT vs everyone else develops and nobody is happy.

Reply | Post Message | Messages List | Start a Board

100%

Faye___Kane,
User Rank: Strategist
7/30/2016 | 5:01:38 PM

Re: Who Hacked the DNC?

@jastroff

> "Who did it? Local? The Russians? "

Microsoft did it, with Exchange.

Reply | Post Message | Messages List | Start a Board

100%

Faye___Kane,
User Rank: Strategist
7/30/2016 | 4:53:12 PM

Re: Breeches and Delusions of Security

@joe

> "when Sony sued that kid -- a hacker -- for IP infringement just for tinkering with his PlayStation, they absolutely should have expected to get slammed the way they did for months by hacktivists."

Tell that to the smug, arrogant, stupid, finger-pointing suits.

Sony will do the exact same thing next time.

Reply | Post Message | Messages List | Start a Board

100%

Faye___Kane,
User Rank: Strategist
7/30/2016 | 4:43:05 PM

Hack 'n sack knack

[ How come these comments aren't threaded? This is a reply to a post by @michelle on page 2 ]

> "So often, email is taken for granted and secured with weak or shared passwords"

True, yeah, but they didn't just acquire a user pw with a phish. They obtained cleartext access to the entire email DB.

Sure, that could mean a weak admin pw, in which case, someone should be spanked. But it sounds more like non-updated s/w.

HOWEVER, since this was a state action approved by Putin himself, it's more likely that the russians decompiled Exchange Server long ago and found all the bugs MS gifted to us because they couldn't be bothered to delay the release cycle with rigorous programming and code auditing.

The Washington Post said that the NSA has a big list of bugs that can crack Windows, but they'd rather let other countries find them than tell MS. And it's just as likely MS wouldn't bother fixing them anyway (see the Google bug-report debacle a couple of years ago).

PS:

I still haven't seen a description of how they broke in. Anyone know (or a link)?

Reply | Post Message | Messages List | Start a Board

100%

Joe Stanganelli,
User Rank: Author
7/28/2016 | 10:42:30 AM

Re: Breeches and Delusions of Security

@Technocrati: ...Which leads to an important lesson that many security professionals don't think of: Don't be a target.

And this goes to the whole business -- not just security. For example: A few years back, when Sony sued that kid -- a hacker -- for IP infringement just for tinkering with his PlayStation, they absolutely should have expected to get slammed the way they did for months by hacktivists.

Anticipating hacking/breach fallout is now a part of regular risk analysis for business decisions. The CISO needs to have a seat at the table like a "big-boy" C-suiter.

Reply | Post Message | Messages List | Start a Board

<< < Page 2 / 3 > >>

Reports

The State of Cloud Computing - Fall 2020

Download this report to compare how cloud usage and spending patterns have changed in 2020, and how respondents think they'll evolve over the next two years.

Download Now!

More Reports