Computerworld - Passwords used by people employed by U.S. federal, state and local governments were among those disclosed by the Gawker hack over the weekend, according to a report by PBS NewsHour on Monday.
If the passwords published online by the Gnosis hacker group were also used by those people for their work e-mail accounts, the passwords could be used in future targeted attacks against government employees to plant malware or steal other information.
PBS NewsHour has identified a subset of the 1.3 million accounts accessed in the Gawker hack that included an unknown number of accounts with the .gov domain, including ones from the Department of Defense, NASA, National Institute of Health and the U.S. Postal Inspection Service.
Employees at agencies in several states, ranging from Idaho to Virginia, were also among those whose addresses and passwords were harvested.
Gnosis' list of compromised e-mail addresses and passwords has been published on the Internet, and is readily available to anyone, other hackers included, via a BitTorrent download.
A message on a chat room used by Anonymous -- the hacker group responsible for several distributed denial-of-service (DDoS) attacks last week against companies that terminated services to WikiLeaks for disclosing thousands of U.S. diplomatic messages -- indicated that the addresses and passwords would be used to compromise accounts to obtain more information.
"If the people in this dump have admin/mod rights there maybe [sic] other sensitive information worth disclosing to the Internet," the chat room message quoted by PBS NewsHour said. "Scrape any and all information you can and dont [sic] be XXXXing stupid, these are government officials, use many layers of proxies and report back any lulz [laughter at someone else's expense] to (REDACTED)."
On Sunday, Gawker Media, which operates several popular technology sites, including Gizmodo and Lifehacker, confirmed that its servers had been hacked, and that hundreds of thousands of registered users' e-mail addresses and passwords had been accessed. A group calling itself "Gnosis" claimed credit for the attack, and said it had obtained information associated with more than 1.3 million accounts.
Free Insider GuideCopyright © 1994 - 2013 Computerworld Inc. All rights reserved. Reproduction in whole or in part in any form or medium without express written permission of Computerworld Inc. is prohibited. Computerworld and Computerworld.com and the respective logos are trademarks of International Data Group Inc.
