Slashdot Log In
Swede Hacks Embassy Account Information From Around the World
Posted by
Zonk
on Fri Aug 31, 2007 09:33 AM
from the around-the-world-in-an-address-book dept.
from the around-the-world-in-an-address-book dept.
paulraps writes "A Swedish IT consultant has caused a stir in diplomatic circles after publishing a list of secret log-in details belonging to 100 embassies, public authorities and political parties around the world. Dan Egerstad said he wasn't trying to earn money, gain publicity or get a name for himself in hacking circles. Instead he claimed that publishing the list was easier than contacting the organizations individually — and that if he had handed it to the Swedish authorities then that would have been spying."
Related Stories
[+]
Tor Used To Collect Embassy Email Passwords 99 comments
Several readers wrote in to inform us that Swedish security researcher Dan Egerstad has revealed how he collected 100 passwords from embassies and governments worldwide, without hacking into anything: he sniffed Tor exit routers. Both Ars and heise have writeups on Egerstad's blog post, but neither adds much to the original. It's not news that unencrypted traffic exits the Tor network unencrypted, but Egerstad correctly perceived, and called attention to, the lack of appreciation for this fact in organizations worldwide.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
When best intentions go wrong (Score:5, Funny)
Re: (Score:2)
Re: (Score:3, Interesting)
wtf, so it is easier to make a post and leave 100+ embassies open to the world or to send mails..
I suppose there are ethics here that I am missing.. saying he was supposedly doing these people a "favor" by publishing this..
I guess at least he didn't try to blackmail them.
Not after fame, eh? (Score:5, Insightful)
Because.... (Score:2, Insightful)
Re:Because.... (Score:5, Insightful)
I don't see how having a random strangers name attached to the list makes the data published any more or less accurate.
Parent
Re:Because.... (Score:4, Insightful)
I don't see how having a random strangers name attached to the list makes the data published any more or less accurate.
It doesn't, obviously. Publishing anonymously makes it easier for governments to simply SAY the published information is inaccurate. Having someone that's standing behind that statement makes it more difficult to play that game. People don't tend to trust anonymous sources. Look no further than slashdot for evidence of that (where anonymous is different from a pseudonym).
Parent
Re: (Score:2, Funny)
Competent hacker, poor social engineer (Score:5, Insightful)
Re: (Score:3, Insightful)
Re: (Score:2)
Re: (Score:2)
I think that this course of action, whilst not the best was probably taken to ensure that he wasn't seen as a spy, or a terrorist. Moreover I assume that once he had this information he had a hell of a time figuring out who he would be able to trust with it. If you don't know who to trust, don't want to start contacting the g
Re: (Score:2)
Re:Competent hacker, poor social engineer (Score:4, Informative)
Parent
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
This info can be validated by anyone in 3 minutes. Sigh.
First of all, No, it can't. Investigative journalists are trained to do only two things:
They can't examine scientific claims or medical breakthroughs or stories about computer technologies. When they are forced to do this, they call a bunch of experts and see what their opinions are, which is basically employing skill #1.
If you can validate this story in 3 minutes, you are a better than average
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Good intentions? (Score:4, Insightful)
Maybe this guy just doesn't have the same sense of self preservation that I do, but in my work I tend to avoid doing things that have the potential to cause a major international incident.
Re: (Score:3, Funny)
Yeah, you'd think that a guy who is so 1337 that he "accidentally" ran a cracker against 6 different embassies (it's 100 people, not embassies, despite what the submitter and Zonk wrote) wouldn't have trouble cc'ing them. My coworkers don't seem to have any trouble cc'ing a lot more people than that.
Re: (Score:2)
Re: (Score:3, Interesting)
At any rate, I'd be curious what this guy did that caused these passwords to "accidentally" fall out.
Re:Good intentions? (Score:5, Insightful)
Thats basically what he did. It doesn't sound like this list is very public. Its just making its way around the so-called "diplomatic" circles.
Let's look at this from another angle. He quietly published this list, and probably notified all the affected embassies. Then, at least some of the embassies, and a few news outlets, verify the list. Then, at least some of the embassies change the passwords. Then, those news outlets are able to get comments from the embassies and the guy, and then, publish a story on it. All this happened before YOU found out about it.
I say its a little early to fault the guy, since what he did is working just fine. Had he contacted each embassy individually, he would have had to convince each one over several emails or phone conversations. This way, he probably only had to talk to a few news outlets / embassies. Had he published the list in a local paper (i laughed out loud at this one) as another slasher suggested, the general public would probably have read copies of the emails in the affected accounts before the embassies ever knew there was a problem.
Parent
Re: (Score:2)
The real truth (Score:5, Informative)
Re:The real truth (Score:5, Informative)
"This rescues me from the shit," he said.
Parent
Re: (Score:3, Insightful)
Sure it does. Let's watch and learn... I'm not Sweedish, but I feel safe in speculating that even there, hacking someone's email and reading it is illegal.
Typical hacker, thinks the authorities are really interested fixing this sort of thing, if only they knew. I'll bet they did know, and now they're more pissed off than ever since their spy agencies can no longer
Uh, email is open not private (Score:2)
Confidentiality of email does NOT exist. It might exist in some alternate universe but it doesn't exist on this planet.
Thinking that it does gets people in deep do-doo (or even killed [depends who's doing the asking.])
Re: (Score:3, Informative)
This has nothing to do with the Confidentiality of email, and everything to do with accessing other people's email accounts without authorization.
Re: (Score:2)
He said he had published the list because it would have been too time-consuming to contact all 100 organizations named. Had he handed the list to the Swedish Security Service (Säpo), he would have been guilty of spying. He claimed that by publishing the list he saved himself trouble
"This rescues me from the shit," he said.
Well, I can see how that - huh???
The publicity makes disappearing in the night conspicuous. He's probably hoping that deters Governments from attempting to prosecute him for blackmail. If he mailed them individually they might indeed take it as a attempt to black mail them.
Re: (Score:2)
Now instead of the government accusing him of spying, he'll have a bunch of foreign governments pressuring his government to lock him up for spying. I don't think this guy really thought things through here.
Re: (Score:2)
Re: (Score:3, Insightful)
The Swedes don't persecute their citizens. And they don't let other countries like the US persecute them either. So he's quite correct that he's safe.
If this had happened in the US, you would be scared to do anything. What a country! This is what you can do if you're free, but you can't do it in the land of the free!
He wants room and board (Score:3, Interesting)
In the local jail. Why else would anyone do something so boneheaded?
Honestly, I can't think of any better way to get jailed than to embarrass and irritate the high-level diplomats of 100 countries.
Yes, it was easier than turning the list over to authorities, or contacting each of the embassies. So what? It could easily be argued that he had a duty of confidentiality with his client that he failed to observe.
Furthermore, he has actually made security worse by disclosing in this matter. Who knows how many embassies were already aware of the problem, and were in the process of tightening security? It is also likely that at least some of the embassies would have discovered the vulnerabilities independently of this consultant through internal audits, and would have fixed them silently.
Now, while this guy has stirred up a hornet's nest, he hadn't really done anything to improve the security of these embassies. Sure, they have to fix it now, but they might have done it anyway.
And what if the Swedes were aware of this and using this information for intel gathering? I don't think anyone is happy he did this.
Re: (Score:2)
Client? What client?
Re: (Score:2)
It's also a good way to see 100 countries over your lifetime. However Gary McKinnon [wikipedia.org] recommends leaving the US until last. That stop takes quite a long time.
Re: (Score:2, Interesting)
Yes, they'll tighten up their security, but it is possible that they were going to do it silently, anyway.
I mean, if you're going to do research in this area - that is, expend effort looking at security - it's really a cop out to claim that you can't be bothered to contact the embassies individually. You were neither required, nor asked, to evaluate their security. Instead, you take it upon yourself to expend the effort to do the research, and then claim that you can't expend the additional effort to
According to the Swedish Hacker (Score:5, Funny)
Re: (Score:2)
Safety of the limelight (Score:5, Interesting)
The reason is simple: When you're in the limelight, it doesn't go unnoticed when you suddenly "vanish". Post it anonymously and they will dig you up. Hand it to some journalist and the same will happen (just that one more person goes with you). You can't simply make someone disappear when he's in the center of attention. Unless you're Copperfield and want to vanish, but that's a different matter.
Re: (Score:2)
Re: (Score:3, Insightful)
You can make them really and verifiably dead, however; perhaps under suspicious circumstances, but you can make it difficult to prove anything and discover or invent material to discredit anyone peddling "conspiracy theories" connecting you to it. Which, ultimately, acheives the same result as the whole disappearing thing.
Exactly the Right approach (Score:2)
This way, media in the affected countries will be asking pointed questions, politicians will be asking questions in parliament, and many countries will improve their security policies at all their embassies worldwide, rather than just at the one with the known exposure.
Why, though, do all recent articles seem to be click-throughs to other articles scant on details,
In the orginal Swedish (Score:2)
Which hole? (Score:2)
There is Moral Argument Here... (Score:2, Interesting)
"Dan Egerstad said he wasn't trying to earn money, gain publicity or get a name for himself in hacking circles..."
and has the technical ability and the altruistic motives doesn't make it right. Yet if the powers that be (pick you favorite governmental agency) can do this at will, that doesn't make it wrong either.
Re:Cue Borat Joke Here (Score:5, Funny)
Kazakhstan is the greatest country in the world, all other countries are run by little girls. Kazakhstan is number one exporter of internet security, Other Central Asian countries have inferior internet security.
High Five!
Parent
Re: (Score:2)
Assholes Uzbekistan.
I get computer, Uzbekistan gets computer
I get gmail, Uzbekistan get gmail
I get access to naughty website with Pamela, Uzbekistan cannot afford!
Great success!