Security Tales: The Weak Link
Vladimir Bezmaly | 11/30/2017
The sunny morning beckoned to go for a walk, not to go to work. I just wanted to walk through the park, without thinking about anything, just rustle the leaves under my feet, bang nuts, enticing the local squirrels, go to the pond located in the center of the park, feed the swans that have not yet flown south... I wanted a lot of things. The main thing I didn't want was to go to work. But today is Friday, which means the weekend is ahead. So I need to go to work!
- Sophie, what's interesting in the morning, besides amazing coffee and almond cakes?
- Oh, boss! It's so... I don't even know how to say it. I understand that people can be stupid and careless. But I couldn't even imagine that they could work in the IT department of our security department. Well, I think they don't hire fools there. As it turns out, I was wrong!
- So, Sophie, invite Mark, Rita, Kurt to my place and come in yourself. We'll listen to your story.
— Chief, here's what happened. An intruder breached the Justice Department's network and stole more than 200 GB of data, including the names, phone numbers, and email addresses of 20,000 police department employees and 10,000 Department of Homeland Security employees.
- Wow!
— Moreover, the data was published by him in japan mobile database access on the website.
- And how did this happen?
— The attacker managed to hack the account of a police department employee, after which he contacted the operator of the Department of Internal Security and, posing as a legitimate user, gained access to the police department infrastructure.
- Wait, but how did he get access?
— This is the most interesting part. What helped us here was that all external phone calls are recorded. The attacker said that he had recently gotten a job. The operator asked if he had an access code to the data. The attacker said no, then the operator advised him to use their code!