from Hacker News

Teen Who Hacked CIA Director’s Email Tells How He Did It

by phesse14 on 10/21/15, 3:31 PM with 135 comments

• by suprgeek on 10/21/15, 7:15 PM

  I think the REAL story here is that the Direct of the Frickin CIA has an AOL e-mail address & AOL e-mail is not the first thing that comes to your mind when you think Security.

  Also he thought it was Ok to forward Sensitive Govt. Docs to a non-secured commercial e-mail address.

  The amount of almost un-restrained power that these people have vs the very low quality of their InfoSec is truly appalling.

• by cdubzzz on 10/21/15, 4:10 PM

  > After providing the Verizon employee with a fabricated employee Vcode—a unique code the he says Verizon assigns employees—they got the information they were seeking. This included Brennan’s account number, his four-digit PIN, the backup mobile number on the account, Brennan’s AOL email address and the last four digits on his bank card.

  There are obviously a _lot_ of wtf moments reading this article, but this one just strikes me as the most egregious - why in the world would a Verizon employee of any kind be able to obtain this information from anyone other than the account holder? The account number, ok maybe, but absolutely none of those other items should be communicated between employees. Absurd.

• by mkobit on 10/21/15, 3:51 PM

  > The hackers described how they were able to access sensitive government documents stored as attachments in Brennan’s personal account because the spy chief had forwarded them from his work email.

  How is this acceptable? Shouldn't he be held accountable for this kind of stuff?

• by fein on 10/21/15, 3:48 PM

  Social engineering is, and will always be, the fastest way to compromise a system.

  Computers are pretty good at security; humans, especially underpaid and overworked helpdesk jockeys, are not.

• by ChrisArchitect on 10/21/15, 7:01 PM

  Norman? This is Mr. Eddie Vedder, from Accounting.... My BLT Drive on my computer just went AWOL .... http://cyberdelianyc.tumblr.com/post/131628279720/hackers-ci...

• by WillPostForFood on 10/21/15, 8:11 PM

  Wikileaks has now published the emails:

  https://wikileaks.org/cia-emails/

• by ryandvm on 10/21/15, 3:48 PM

  The worst news here is that the director of the most powerful information gathering agency on the planet uses AOL.

• by sageabilly on 10/21/15, 3:51 PM

  AOL doesn't support 2-factor authentication for email sign-in. If they did, then this entire debacle would [edit- replace "would" with "could"] have been stopped before it even started.

  I'm also surprised that the government doesn't have more stringent guidelines about the private email use of its top officials.

• by freditup on 10/21/15, 3:52 PM

  How do you design a system that's hardened against social engineering but not hardened against innocent mistakes, like losing your password? It seems like the easiest way to access public systems like this is through social engineering techniques around password recovery or phishing.

  Of course there are well-known answers that are used to mitigate these problems somewhat, TFA solutions, login images, etc. But I still feel as if social engineering attacks hit a really vulnerable weak spot in many systems.

  (On a mostly unrelated note, can we get rid of security questions forever? I've taken to just giving nonsense answers for them and storing my answers somewhere secure. I sure don't want my passwords being reset because somebody knows my mom's maiden name...)

• by logn on 10/21/15, 4:10 PM

  Much is being made of him using AOL for work emails. Seems like a fairly minor issue. The worst part was the spreadsheet with ~20 people's info on it. Otherwise, he forwarded emails to himself that he wanted to permanently have possession of, like his own clearance application and a letter from the Senate on torture. I'm more interested in this letter--sent in 2009. Who knew what and when?

  (Edit) the letter -- https://twitter.com/phphax/status/653665742987100163

• by davotoula on 10/21/15, 4:19 PM

  What do you want?

  > We said ‘2 trillion dollars hahhaa'

  Ok, I can work with that

  > They told Brennan “We just want Palestine to be free and for you to stop killing innocent people.”

  Sorry, can't do that

• by dankohn1 on 10/21/15, 9:45 PM

  I really hope these kids have not destroyed the rest of their lives just to make a (very good) Dr. Evil joke [1]:

  'So they called Brennan’s mobile number, using VoIP, and told him he’d been hacked. The conversation was brief.

  “[I]t was like ‘Hey,…. its CWA.’ He was like ‘What do you want?’ We said ‘2 trillion dollars hahhaa, just joking,'” the hacker recounted to WIRED.'

  [1] https://www.youtube.com/watch?v=l91ISfcuzDw

• by brianclements on 10/21/15, 4:30 PM

  There was a story within the past year or two I remember that was in a similar vein: where the hackers were able to obtain some address info from Apple support, which led to CC info from Amazon tech support, which led to interception of the users phone number and then bypassing of 2FA, which led to primary email takeover. I felt then, as I do now, that there should be a standardized process for identifying user information across all companies that doesn't allow for this patchwork gathering of info and incorporates a type of 2FA.

  I remembered this thought again recently when dealing with major banks over the phone. All I needed to identify who I am was confirmation of my home address, and last 4 digits of my social. That is hardly secure! A single data breach for SSN, cross referencing an email to social media or DNS if you don't use private registration and boom, you can pretend to be me as far as some banks are concerned.

  The SSN is the most abused number in the ID world. It's a de-facto federal ID number and it's simply not meant for the task. Everyone gets all upidy about having some type of federal ID number whenever I mention it, but I feel like some type of public key cryptographic federal ID number plus cross-signing, changeable password, AND a 2+FA should be used to truly identify who you are.

• by peterwwillis on 10/21/15, 9:19 PM

  People seem to forget that hacking personal accounts is not difficult, even for novice hackers. The reason most people don't get hacked is either 1. they weren't a funny/interesting target, or 2. nobody wanted to get caught.

  Also, the CWA's twitter account was suspended, but thanks be to The Internet Archive we have a mirror:

  https://web.archive.org/web/20151019192351/https:/twitter.co...

  The Twitter pictures aren't archived, but they also haven't been taken down from Twitter's site.

• by dogma1138 on 10/21/15, 4:39 PM

  Shouldn't there be like a department in the CIA that scraps all of that stuff for agency employees?

  I know that some other agencies, and even private corporation do that.

• by barefoot on 10/22/15, 4:07 AM

  It's crazy to me that as a society we celebrate the digital equivalent of smashing a window in with a brick and climbing in through the jagged glass.

  This wasn't a skillful attack. It was a messy, shitty social engineering exploit that very many people could have done.

• by hackuser on 10/21/15, 9:02 PM

  How did the attackers know that Brennan had an AOL address?

  Let's not take the attackers at face value. They could have had help or be employed by anyone, including those either interested in Brennan's AOL email or in embarassing him.

• by gopowerranger on 10/21/15, 4:06 PM

  Two things.

  1) This kid just got at least one person fired from his job (though he may deserve it).

  2) This kid WILL be caught and regret it the rest of his life.

• by yeukhon on 10/21/15, 4:05 PM

  Now the kid is going to be hunted. Blacklist. You know. Anything, hacking someone's account is wrong regardless. just because he's the Director of CIA.

• by jotux on 10/21/15, 4:09 PM

  >Teen Who Hacked...

  >The hacker, who says he’s under 20 years old

  20 years old is a teen? What a terrible headline.

• by ryanlol on 10/21/15, 3:54 PM

  Why is this even a story?

  Has there been any confirmation that this account even actually belonged to the CIA director? If yes, has there been any evidence that there was actually anything sensitive on the account? (I seriously doubt the latter)

  If there was nothing on the account how is this different from any of the other tens of thousands of aols that have been hijacked since the 90s?