Hackers could use leaked Gawker info to attack government workers
'Bet on it,' says security expert, as hackers exploit password re-use
Computerworld - Passwords used by people employed by U.S. federal, state and local governments were among those disclosed by the Gawker hack over the weekend, according to a report by PBS NewsHour on Monday.
If the passwords published online by the Gnosis hacker group were also used by those people for their work e-mail accounts, the passwords could be used in future targeted attacks against government employees to plant malware or steal other information.
PBS NewsHour has identified a subset of the 1.3 million accounts accessed in the Gawker hack that included an unknown number of accounts with the .gov domain, including ones from the Department of Defense, NASA, National Institute of Health and the U.S. Postal Inspection Service.
Employees at agencies in several states, ranging from Idaho to Virginia, were also among those whose addresses and passwords were harvested.
Gnosis' list of compromised e-mail addresses and passwords has been published on the Internet, and is readily available to anyone, other hackers included, via a BitTorrent download.
A message on a chat room used by Anonymous -- the hacker group responsible for several distributed denial-of-service (DDoS) attacks last week against companies that terminated services to WikiLeaks for disclosing thousands of U.S. diplomatic messages -- indicated that the addresses and passwords would be used to compromise accounts to obtain more information.
"If the people in this dump have admin/mod rights there maybe [sic] other sensitive information worth disclosing to the Internet," the chat room message quoted by PBS NewsHour said. "Scrape any and all information you can and dont [sic] be XXXXing stupid, these are government officials, use many layers of proxies and report back any lulz [laughter at someone else's expense] to (REDACTED)."
On Sunday, Gawker Media, which operates several popular technology sites, including Gizmodo and Lifehacker, confirmed that its servers had been hacked, and that hundreds of thousands of registered users' e-mail addresses and passwords had been accessed. A group calling itself "Gnosis" claimed credit for the attack, and said it had obtained information associated with more than 1.3 million accounts.
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Tablets in the Enterprise: A Checklist for Successful Deployment How can you enterprise manage and secure tablets in order to protect corporate data while providing access to the information and applications employees...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- Enterprise File Sync & Share Checklist File sync and share has changed the way people work and collaborate in today's tech-savvy world. Gone are the email roadblocks, clunky FTP...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts