Swede Hacks Embassy Account Information From Around the World 92
paulraps writes "A Swedish IT consultant has caused a stir in diplomatic circles after publishing a list of secret log-in details belonging to 100 embassies, public authorities and political parties around the world. Dan Egerstad said he wasn't trying to earn money, gain publicity or get a name for himself in hacking circles. Instead he claimed that publishing the list was easier than contacting the organizations individually — and that if he had handed it to the Swedish authorities then that would have been spying."
When best intentions go wrong (Score:5, Funny)
Re: (Score:2)
Re: (Score:3, Interesting)
wtf, so it is easier to make a post and leave 100+ embassies open to the world or to send mails..
I suppose there are ethics here that I am missing.. saying he was supposedly doing these people a "favor" by publishing this..
I guess at least he didn't try to blackmail them.
Re: (Score:1)
Re: (Score:1)
Not after fame, eh? (Score:5, Insightful)
Because.... (Score:2, Insightful)
Re:Because.... (Score:5, Insightful)
I don't see how having a random strangers name attached to the list makes the data published any more or less accurate.
Re:Because.... (Score:4, Insightful)
I don't see how having a random strangers name attached to the list makes the data published any more or less accurate.
It doesn't, obviously. Publishing anonymously makes it easier for governments to simply SAY the published information is inaccurate. Having someone that's standing behind that statement makes it more difficult to play that game. People don't tend to trust anonymous sources. Look no further than slashdot for evidence of that (where anonymous is different from a pseudonym).
Re: (Score:2, Funny)
There is Moral Argument Here... (Score:2, Interesting)
"Dan Egerstad said he wasn't trying to earn money, gain publicity or get a name for himself in hacking circles..."
and has the technical ability and the altruistic motives doesn't make it right. Yet if the powers that be (pick you favorite governmental agency) can do this at will, that doesn't make it wrong either.
Competent hacker, poor social engineer (Score:5, Insightful)
Re: (Score:3, Insightful)
Re: (Score:2)
Re: (Score:2)
I think that this course of action, whilst not the best was probably taken to ensure that he wasn't seen as a spy, or a terrorist. Moreover I assume that once he had this information he had a hell of a time figuring out who he would be able to trust with it. If you don't know who to trust, don't want to start contacting the g
Re: (Score:2)
Re:Competent hacker, poor social engineer (Score:4, Informative)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
This info can be validated by anyone in 3 minutes. Sigh.
First of all, No, it can't. Investigative journalists are trained to do only two things:
They can't examine scientific claims or medical breakthroughs or stories about computer technologies. When they are forced to do this, they call a bunch of experts and see what their opinions are, which is basically employing skill #1.
If you can validate this story in 3 minutes, you are a better than average
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Good intentions? (Score:4, Insightful)
Maybe this guy just doesn't have the same sense of self preservation that I do, but in my work I tend to avoid doing things that have the potential to cause a major international incident.
Re: (Score:3, Funny)
Yeah, you'd think that a guy who is so 1337 that he "accidentally" ran a cracker against 6 different embassies (it's 100 people, not embassies, despite what the submitter and Zonk wrote) wouldn't have trouble cc'ing them. My coworkers don't seem to have any trouble cc'ing a lot more people than that.
Re: (Score:2)
Re: (Score:3, Interesting)
At any rate, I'd be curious what this guy did that caused these passwords to "accidentally" fall out.
Re:Good intentions? (Score:5, Insightful)
Thats basically what he did. It doesn't sound like this list is very public. Its just making its way around the so-called "diplomatic" circles.
Let's look at this from another angle. He quietly published this list, and probably notified all the affected embassies. Then, at least some of the embassies, and a few news outlets, verify the list. Then, at least some of the embassies change the passwords. Then, those news outlets are able to get comments from the embassies and the guy, and then, publish a story on it. All this happened before YOU found out about it.
I say its a little early to fault the guy, since what he did is working just fine. Had he contacted each embassy individually, he would have had to convince each one over several emails or phone conversations. This way, he probably only had to talk to a few news outlets / embassies. Had he published the list in a local paper (i laughed out loud at this one) as another slasher suggested, the general public would probably have read copies of the emails in the affected accounts before the embassies ever knew there was a problem.
Re: (Score:2)
The real truth (Score:5, Informative)
Re:The real truth (Score:5, Informative)
"This rescues me from the shit," he said.
Re: (Score:3, Insightful)
Sure it does. Let's watch and learn... I'm not Sweedish, but I feel safe in speculating that even there, hacking someone's email and reading it is illegal.
Typical hacker, thinks the authorities are really interested fixing this sort of thing, if only they knew. I'll bet they did know, and now they're more pissed off than ever since their spy agencies can no longer
Uh, email is open not private (Score:2)
Confidentiality of email does NOT exist. It might exist in some alternate universe but it doesn't exist on this planet.
Thinking that it does gets people in deep do-doo (or even killed [depends who's doing the asking.])
Re: (Score:3, Informative)
This has nothing to do with the Confidentiality of email, and everything to do with accessing other people's email accounts without authorization.
Re: (Score:2)
This has nothing to do with the Confidentiality of email, and everything to do with accessing other people's email accounts without authorization.
Oh, by the way, the US isn't alone in the universe, and in Uruguay at least, it's a crime to read other people's e-mail accounts without permission, punishable with prison, so that might be the law in Sweden too
That law's a bit too strong, and it isn't enforced too often, but it does exist.
Trying to confirm this I came across an article on electronic crime in Argentina where it states that "It will be punishable by up to six months of prision to whomever opens without permission an e-mail or other epis
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
He said he had published the list because it would have been too time-consuming to contact all 100 organizations named. Had he handed the list to the Swedish Security Service (Säpo), he would have been guilty of spying. He claimed that by publishing the list he saved himself trouble
"This rescues me from the shit," he said.
Well, I can see how that - huh???
The publicity makes disappearing in the night conspicuous. He's probably hoping that deters Governments from attempting to prosecute him for blackmail. If he mailed them individually they might indeed take it as a attempt to black mail them.
Re: (Score:2)
Now instead of the government accusing him of spying, he'll have a bunch of foreign governments pressuring his government to lock him up for spying. I don't think this guy really thought things through here.
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Insightful)
The Swedes don't persecute their citizens. And they don't let other countries like the US persecute them either. So he's quite correct that he's safe.
If this had happened in the US, you would be scared to do anything. What a country! This is what you can do if you're free, but you can't do it in the land of the free!
He wants room and board (Score:3, Interesting)
In the local jail. Why else would anyone do something so boneheaded?
Honestly, I can't think of any better way to get jailed than to embarrass and irritate the high-level diplomats of 100 countries.
Yes, it was easier than turning the list over to authorities, or contacting each of the embassies. So what? It could easily be argued that he had a duty of confidentiality with his client that he failed to observe.
Furthermore, he has actually made security worse by disclosing in this matter. Who knows how many embassies were already aware of the problem, and were in the process of tightening security? It is also likely that at least some of the embassies would have discovered the vulnerabilities independently of this consultant through internal audits, and would have fixed them silently.
Now, while this guy has stirred up a hornet's nest, he hadn't really done anything to improve the security of these embassies. Sure, they have to fix it now, but they might have done it anyway.
And what if the Swedes were aware of this and using this information for intel gathering? I don't think anyone is happy he did this.
Re: (Score:1)
It's a case of all animals are equal, but some are more equal than others...
Re: (Score:2)
Re: (Score:2, Interesting)
Yes, they'll tighten up their security, but it is possible that they were going to do it silently, anyway.
I mean, if you're going to do research in this area - that is, expend effort looking at security - it's really a cop out to claim that you can't be bothered to contact the embassies individually. You were neither required, nor asked, to evaluate their security. Instead, you take it upon yourself to expend the effort to do the research, and then claim that you can't expend the additional effort to
Re: (Score:2)
Client? What client?
Re: (Score:2)
The one that doesn't have polonium.
Re: (Score:2)
It's also a good way to see 100 countries over your lifetime. However Gary McKinnon [wikipedia.org] recommends leaving the US until last. That stop takes quite a long time.
According to the Swedish Hacker (Score:5, Funny)
Re: (Score:2)
Re: (Score:1)
----
Signed,
Ze sweedish Chef
Bruce Schneier is still right (Score:1)
Safety of the limelight (Score:5, Interesting)
The reason is simple: When you're in the limelight, it doesn't go unnoticed when you suddenly "vanish". Post it anonymously and they will dig you up. Hand it to some journalist and the same will happen (just that one more person goes with you). You can't simply make someone disappear when he's in the center of attention. Unless you're Copperfield and want to vanish, but that's a different matter.
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Insightful)
You can make them really and verifiably dead, however; perhaps under suspicious circumstances, but you can make it difficult to prove anything and discover or invent material to discredit anyone peddling "conspiracy theories" connecting you to it. Which, ultimately, acheives the same result as the whole disappearing thing.
Re: (Score:1)
So what happened to him? Someone simply waited till he dropped out of the headlines and then gave him one of the most interesting deaths [wikipedia.org] money can buy.
You
Re:Cue Borat Joke Here (Score:5, Funny)
Kazakhstan is the greatest country in the world, all other countries are run by little girls. Kazakhstan is number one exporter of internet security, Other Central Asian countries have inferior internet security.
High Five!
Re: (Score:2)
Assholes Uzbekistan.
I get computer, Uzbekistan gets computer
I get gmail, Uzbekistan get gmail
I get access to naughty website with Pamela, Uzbekistan cannot afford!
Great success!
More Details and Actual addresses (Score:1, Interesting)
A more detailed look by Indian express here [indianexpress.com].
Looks like the newspaperguys took due dilligence a bit too far...
from the article
"The email account of the Indian Ambassador to China contained details of a visit by Rajya Sabha member Arjun Sengupta to Beijing earlier this month for an ILO conference. There was also a transcript of a meeting this evening which a senior Indian official had with the Chinese Foreign Minister. Similarly, accounts of NDA and DRD
Exactly the Right approach (Score:2)
This way, media in the affected countries will be asking pointed questions, politicians will be asking questions in parliament, and many countries will improve their security policies at all their embassies worldwide, rather than just at the one with the known exposure.
Why, though, do all recent articles seem to be click-throughs to other articles scant on details,
In the orginal Swedish (Score:2)
Re: (Score:2)
Which hole? (Score:2)
Re: (Score:1)
the tip of a much bigger iceberg (Score:1)
Govt security is a joke (Score:2)
I also