Hackers could use leaked Gawker info to attack government workers
'Bet on it,' says security expert, as hackers exploit password re-use
Computerworld - Passwords used by people employed by U.S. federal, state and local governments were among those disclosed by the Gawker hack over the weekend, according to a report by PBS NewsHour on Monday.
If the passwords published online by the Gnosis hacker group were also used by those people for their work e-mail accounts, the passwords could be used in future targeted attacks against government employees to plant malware or steal other information.
PBS NewsHour has identified a subset of the 1.3 million accounts accessed in the Gawker hack that included an unknown number of accounts with the .gov domain, including ones from the Department of Defense, NASA, National Institute of Health and the U.S. Postal Inspection Service.
Employees at agencies in several states, ranging from Idaho to Virginia, were also among those whose addresses and passwords were harvested.
Gnosis' list of compromised e-mail addresses and passwords has been published on the Internet, and is readily available to anyone, other hackers included, via a BitTorrent download.
A message on a chat room used by Anonymous -- the hacker group responsible for several distributed denial-of-service (DDoS) attacks last week against companies that terminated services to WikiLeaks for disclosing thousands of U.S. diplomatic messages -- indicated that the addresses and passwords would be used to compromise accounts to obtain more information.
"If the people in this dump have admin/mod rights there maybe [sic] other sensitive information worth disclosing to the Internet," the chat room message quoted by PBS NewsHour said. "Scrape any and all information you can and dont [sic] be XXXXing stupid, these are government officials, use many layers of proxies and report back any lulz [laughter at someone else's expense] to (REDACTED)."
On Sunday, Gawker Media, which operates several popular technology sites, including Gizmodo and Lifehacker, confirmed that its servers had been hacked, and that hundreds of thousands of registered users' e-mail addresses and passwords had been accessed. A group calling itself "Gnosis" claimed credit for the attack, and said it had obtained information associated with more than 1.3 million accounts.
- Troubleshooting Common Issues in VoIP Learn more about Voice over Internet Protocol (VoIP), including common VoIP metrics used, best practices in VoIP management and tips and tricks for...
- 2013 Network Management Software (NMS) Buyers Guide This white paper contains an independent comparison study of six different network management solutions and provides guidance on how you can choose the...
- Rightsizing Your Network Performance Management Solution: 4 Case Studies This white paper discusses challenges encountered as organizations search for the most cost-effective network performance management solution.
- Global Growing Pains: Tapping into B2B Integration Services to Overcome Global Expansion Challenges A recent survey by IDG Research explored both the challenges and pain points companies face when growing globally, as well as the capabilities...
- E-Signature RFP Checklist Webcast If your organization is looking to adopt e-signatures, you may be overwhelmed by the number of providers that offer seemingly similar solutions. How...
- Cloud and Collaboration: Driving Your Business Value Mission Critical Cloud from Peer 1 Hosting is enterprise-grade. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!