Slashdot Log In
San Francisco DA Discloses City's Passwords
Posted by
Soulskill
on Fri Jul 25, 2008 06:59 PM
from the you-sure-showed-him dept.
from the you-sure-showed-him dept.
snydeq writes "The office of San Francisco District Attorney Kamala Harris has made public close to 150 usernames and passwords used by various departments to connect to the city's VPN. The passwords were filed this week as Exhibit A in a court document arguing against a reduction in $5 million bail in the case against Terry Childs. Though they placed the passwords in the public record, city prosecutors do seem to think that they are sensitive. InfoWorld's Paul Venezia, who has been following the case closely, provides further analysis of the technical details in the city's case. 'By themselves, [the passwords] would not be enough to allow anyone to access the network via VPN,' Venezia writes, 'but the fact that the city entered them into evidence is quite shocking. At the very least, they'll have to shut down their VPN access for awhile until they've changed them all and modified the configurations of some large number of VPN clients.'"
Related Stories
[+]
News: The Inside Story On the San Francisco Network Hijacking 471 comments
snydeq writes "A source with direct knowledge of San Francisco's IT infrastructure has tipped off Paul Venezia to the real story behind Terry Childs' lockout of San Francisco's network, providing a detailed account of the city's FiberWAN, interdepartmental politics, and Terry Childs himself. Childs pleaded not guilty to charges of tampering yesterday and is being held on $5 million bail. According to the source, Childs' purview was limited to the city's FiberWAN — a network he himself built and, believing no one competent enough to touch the network but himself, guarded religiously, sharing details with no one, including routing configuration and log-in information. Childs was so concerned about the network's security that he refused even to write router and switch configurations to flash. But what may prove difficult for the prosecution in its case against Childs is that his restricted access to the network was widely known and accepted among managers and the city's other network engineers. Venezia, who has been suspicious of the official story from the start, suspects that the Childs case may be that 'of an overprotective admin who believed he was protecting the network — and by extension, the city — from other administrators whom he considered inferior, and perhaps even dangerous.' Further evidence is that fact that the network, from what Venezia understands, has been running smoothly since Childs' arrest."
[+]
IT: SF Admin Gives Up Keys To Hijacked City Network 581 comments
snydeq writes "Jailed IT admin Terry Childs relinquished his hold over San Francisco's multimillion-dollar FiberWAN, handing his administrative passwords over to San Francisco Mayor Gavin Newsom, who was 'the only person he felt he could trust.' Childs is still being held on $5 million bail for his lockout of the city's FiberWAN, a case that has been called into question since an insider came forward with details about both the network and Childs himself. The case hinges on No Service Password Recovery commands Childs allegedly configured onto several Cisco devices, as well as dial-up and DSL modems the SFPD has discovered that would allow unauthorized connections to the FiberWAN. Childs intends to 'expose the utter mismanagement, negligence, and corruption at DTIS, which if left unchecked, will in fact place the City of San Francisco in danger,' according to his motion. The Department of Telecom and IS has cut 200 of its 350 IT positions since 2000 — pressure that may have contributed to Childs' actions, according to interviews with current and former DTIS staffers. Newsom secured the passwords without first telling the DTIS that he was meeting with Childs."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Ah HA! (Score:5, Insightful)
Re:Ah HA! (Score:5, Interesting)
Why did the DA even have access to these passwords? Why were they not in hash form? Did Child's have anything to do with that part?
Parent
Re:Ah HA! (Score:5, Insightful)
My first thought. Whenever a password is stored in a form that it could be retrieved (rather than only reset), the users should be notified beforehand, otherwise it's just unethical IMO...not to mention the security issues.
Parent
RTFA (Score:5, Informative)
From the article:
So, in answer to your questions: probably because the police found them as a result of their investigation, because Childs allegedly kept them in plaintext, and yes, allegedly, Childs had plenty to do with it.
Do you have any other questions? Perhaps the article answers them.
Parent
Re:RTFA (Score:5, Insightful)
Parent
The reason for password disclosure (Score:5, Informative)
The username/password combos were apparently functioning sets. The DA is saying they found them on Child's own computer. The DA is all in a tizzy because Child's could then use these accounts to sneak into the system and cause mischief without getting tracked back.
Right. The only guy in the world with God level access to this network needs fake usernames/passwords so he can 'cause mischief'?
Give me a fucking break. I can think of many reasons for him to have those combos on his personal system.
Apparently the less than brilliant DA's office is unaware that the GOD level admin has the ability to do anything at all on the network and REMOVE ALL TRACES IN THE LOGS afterwards. It's trivial, when you're the one who runs the tattletales.
Dear DA office: IF YOU LOOK HARD YOU'LL UNDOUBTEDLY FIND EVIDENCE TRACY EAVESDROPPING ON THE NETWORK SNIFFING AND ATTEMPTING TO ILLEGALLY PENETRATE THE SYSTEM. IT'S PART OF HIS JOB, MORONS. IF YOU KEEP BRINGING THIS CRAP UP, YOU'LL ONLY LOOK STUPIDER.
Keep this up, and Nifong will have company in the 'worlds dumbest DA's club'
Parent
Dang! (Score:5, Insightful)
AH HA! See, Childs was right , he is the only competent one!
Dang! You beat me to posting about it.
Wasn't part of Childs' point that password security in the S.F. government was lax and that divulging the big one in a way that would spread it around was dangerous to the network?
Given that the configurations on the routers weren't saved, the first guy to use that password on them had better be DARNED careful to get them recorded before changing anything or he's likely to break the network big time. So handing it to an administrator, who will hand it to several people, any of whom might leak it, could cause the net to come crashing down.
If all they'll let him do for a handoff is hand off the passwords, I can see how a prima donna BOFH would want to hand the big one directly to his successor, who would then spend the next week carefully recording the configs as-running before making changes or sharing the password with less-skilled delegates.
Not that it's right. But looks to me like the city is making his point for him - which his lawyer should use in a counter-argument at the bail hearing. B-)
Parent
Re:Ah HA! (Score:5, Interesting)
If you have any other opinions you'd really like entered into the public record, have at it. I'd say there's a very good chance that this discussion will be entered as evidence by the defense.:)
If anyone is counting, add my vote for the VPN passwords' disclosure being hard evidence that the IT admin was perfectly correct.
That and the fact that the SF network stayed up while the world's hackers KNEW that the network was completely unsupervised.
Frankly, if I were looking to hire somebody, I'd be chipping into this guy's defense fund. Speaking as a real-world IT manager, I'd say this guys judgement is spot on, and his admin skills are amazing.
In my own humble opinion, then SF DA's office is full of idiots.
hanzie.
Parent
Re:Ah HA! (Score:5, Insightful)
Childs' defense attorney has got to be happy about this.
"Your Honor.. I would like to direct the Court's attention to Exhibit A; the mere existence of which proves our case..."
Parent
Re:Ah HA! (Score:5, Insightful)
Bad IT policy, or bad users? IT is sadly not as much a dictatorship as we'd like. If enough users whine, it ends up being policy that passwords get lax. These users "are too important to have to come up with complex passwords incorporating at least 3 different character types in 8 or more characters"
Make password policies too complex, users just write them down. Frying pan, fire...welcome to IT.
Parent
Suddenly Childs seems quite normal (Score:5, Funny)
Re:Suddenly Childs seems quite normal (Score:5, Insightful)
> ...he didn't really have the authority to do that...
You don't know what he did. You only know what the aforementioned "fuckwits" allege that he did.
Parent
Re:Suddenly Childs seems quite normal (Score:5, Insightful)
But his supervisors and everyone in his department knew he was the only one -the 'go to' guy- that really had the in-depth knowledge to figure out problems and make stuff work. If they let him do that without objection or questioning his reasons, they gave their tacit approval to allow him to operate in the fashion that he did.
Parent
Being paranoid doesn't mean you're wrong (Score:5, Insightful)
This is the tip of the iceberg (Score:5, Interesting)
This is unfortunately par for our fine DA. Kamala Harris has proven herself to be an incompetent tool more often that I'd like to hear.
She has angered many San Franciscans by refusing to prosecute violent criminals, and lately, found to have been lax towards the city's worst crime of the year...the murder of a father and his two sons in the Mission by a suspected illegal alien due to the city's stupid sanctuary law.
She should be dragged out, tarred, whipped and ejected from the city, never to return.
Another interesting thing came out in the filing. (Score:5, Insightful)
According TFA, the thing about his not saving the configs to flash is a CLAIM by the city, not something confirmed by Childs.
So how do they KNOW that, if they don't have the passwords? Did they try rebooting some network boxes and have them not come up? (If so, how is it that the net is still running...)
This is looking more and more like a pointy-haired-boss SNAFU than logic-bomb job-insurance/revenge sabotage.
Re:Another interesting thing came out in the filin (Score:5, Informative)
Not having the config in flash need not make the device a brick.
Parent
These are group passwords in IPSEC profiles (Score:5, Informative)
From the referenced article - "The passwords are so-called "phase one" passwords, and must be combined with a second password to access the network, the source said. " 99% chance they are using some form of Cisco device as their VPN concentrator (most like a VPN3030, ASA or 7200 series router). If they are these passwords (one per group) are in what is called a pcf file in every employees computer that is allowed to connect. Heck, if you use a Cisco vpn it is on your computer in the following location - C:\Program Files\Cisco Systems\VPN Client\Profiles . The group pass is encrypted with weak encryption that is commonly cracked to allow linux laptops to connect using vpnc. You can do it on the web here - http://www.unix-ag.uni-kl.de/~massar/bin/cisco-decode [uni-kl.de]
The thing is, this group password's primary use is to segregate users into different buckets. E.G contractors may have on password, with different authentication methods, while permanent employees are in a different bucket, with their own authentication methods. The key thing, is that once this first password is provided, the end user still has to provide a unique username and password to gain access. So in effect, having the group password alone is meaningless.
On top of that, I frankly would not be surprised or peeved if a network engineer had possession of PCF files for the network he is responsible for. What is next? Is the DA going to try to prosecute him for having diagrams and configs of the network he is managing on his laptop?
For everyone who thinks Childs was right (Score:5, Interesting)
Someone at the the DA's office is the incompetent person in this case, but that does not validate his locking out of everyone competent enough to take care of the system (the people that would have replaced him at the IT department.)
Passwords can be TOO strong. (Score:5, Interesting)
He started his speech by asking the audience, "Passwords and policies should be made as strong and secure as possible, right?"
A show of many hands.
He said, "Wrong! It is possible for a password policy to be TOO secure. Let me give you an example. It is possible to set up a security policy in NT that requires a password of at least 8 characters, which must also be mixed case, have at least one numerical digit, and at least one non-alphanumeric character, and which will require a change of password every week."
"As soon as you implement that policy, users will write their password on a post-it note, stick it to their monitor, and replace it with a new one every week. So you see, a password policy CAN be too secure for your own good."
Parent
Re:An idiot playing a semantic game. (Score:5, Informative)
Parent
Re:Then the users will change them right back (Score:5, Funny)
Parent
Re:Then the users will change them right back (Score:5, Funny)
It was perhaps the only time in my life I actually knew what it meant to "be at a loss for words"
I can believe it. I imagine I would have stared at him blankly for just long enough to realize he wasn't kidding before I had an aneurysm.
Parent
Re:Then the users will change them right back (Score:5, Interesting)
Are you sure this guy hadn't called support to have his password reset? Because "password" sounds like something they might reset it to, and unlikely for someone to forget.
Parent
Re:NEVERMIND! (Score:5, Interesting)
It's government. To think like government in implementing something like VPN you have to conceive a solution that involves the user not having to do anything (other than maybe push a button) and this includes anything other than a standard login box. Second you have to implement this in a way that the user themselves can go home and implement this solution without any site help from anyone and zero technical knowledge. (you don't send an IT person to a State Employees home, that's asking from some kind of lawsuit). Fourth the solution must be as expensive as possible, support some local business (preferable if the business owner is connected politically with one of the local leaders) and require very few extra hours from the already overworked staff.
What does that result in? Hardware VPN boxes plugged into the network router, with the users computer plugged directly into the VPN box. Costs a lot, requires pre-configuration of the box but should require no site visits, idiots can usually successfully plug in boxes with phone support only and any reconfiguration likey requires the box to be brought back into the office as the VPN keys on the boxes are likely hard coded into a configuration on the VPN device. Likely a turn key solution so you have a hefty support contract and the vendor would likely assist with deployment and any reconfiguration resulting in a nice contract fee for reprogramming all the boxes.
My guess is some VPN box provider is going to be doing a service call on every box and netting themselves some nice profit under their support agreement.
Parent