[33230] in bugtraq
Re: Major hack attack on the U.S. Senate
daemon@ATHENA.MIT.EDU (Kevin Reardon)
Sat Jan 24 14:05:27 2004
Message-ID: <40118B35.7020209@oracle.com>
Date: Fri, 23 Jan 2004 12:59:33 -0800
From: Kevin Reardon <Kevin.Reardon@oracle.com>
MIME-Version: 1.0
To: BUGTRAQ@securityfocus.com
In-Reply-To: <1074871703.5128.9.camel@marvin.home>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Actually what they did was illegal regardless of the cause. Hopefully
they realized that storing anything on a shared piece of hardware will
subject it to the possibility of attacks due to human failure. Human
failure is a major contributor to computer exploits and the one constant
in the considerations for computer security.
---K
Brian C. Lane wrote:
>On Thu, 2004-01-22 at 09:25, Richard M. Smith wrote:
>
>
>>http://www.boston.com/news/nation/articles/2004/01/22/infiltration_of_files_
>>seen_as_extensive?mode=PF
>>
>>Infiltration of files seen as extensive
>>Senate panel's GOP staff pried on Democrats
>>By Charlie Savage, Globe Staff, 1/22/2004
>>
>>WASHINGTON -- Republican staff members of the US Senate Judiciary Commitee
>>infiltrated opposition computer files for a year, monitoring secret strategy
>>memos and periodically passing on copies to the media, Senate officials told
>>The Globe.
>>
>>
>>
>
>[snip]
>
>You left off the most important fact in your snip. The final paragraph
>pretty well sums it up:
>
>"A technician hired by the new judiciary chairman, Patrick Leahy,
>Democrat of Vermont, apparently made a mistake that allowed anyone to
>access newly created accounts on a Judiciary Committee server shared by
>both parties -- even though the accounts were supposed to restrict
>access only to those with the right password."
>
>I sure wouldn't call this a major hack attack. Someone goofed. Someone
>else took advantage of the goof (and according to some reports even
>reported it to the bonehead technician).
>
>One one hand you really shouldn't look at someone else's files. On the
>other hand if you're cooking up dirty tricks you darn well ought to make
>sure your memos are protected, not stored in the clear on a shared
>system.
>
>And these are the jokers who want to dictate to us how to secure the
>Internet and stop SPAM? Heh!
>
>Brian
>
>---[Office 71.6F]--[Fridge 38.4F]---[Fozzy 88.8F]--[Coaster 71.7F]---
>Linux Software Developer http://www.brianlane.com
>
>
