How was someone able to walk in and swipe what appears to be the company's entire cache of corporate data?
The company used weak passwords.
To recap: Hacking Team creates spyware and malware programs for law enforcement and intelligence agencies around the world, including the US. But data leaked from the company suggests its services were offered to oppressive regimes, likely in breach of sanctions. A day after the attack, the company confirmed it had been breached. On Tuesday, a person came forward claiming responsibility for the hack.
It didn't take long for those sifting through scores of the documents to discover how the hack might have happened.
The root passwords for Hacking Team's servers were inexplicably weak for their purpose. One of the passwords was simply "P4ssword," which would've taken any advanced password cracker just minutes to crack.
Other passwords grabbed from Hacking Team founder Christian Pozzi included "wolverine" and "universo," and other variations of dictionary words like "Passw0rd".
In cybersecurity circles, it's generally accepted that humans are the weakest link in the chain. The most common slip-up is using a poor password that can be easily guessed by a dictionary or brute-force attack.
As the company cleans up its systems and tries to rebuild, its malware samples are in the wild, making it significantly easier to counter ongoing or future surveillance. Hacking Team, for all intents and purposes, is ruined.
Or should we say, "ruin3d."
Source: ZDNET
