Critical.
Authoritative.
Strategic.
Subscribe to CIO Magazine »

Weak passwords to blame for Australian Defence Force Academy hack

Security expert says some student and staff login passwords were stored in plain text

The Australian Defence Force Academy (ADFA) has been slammed by an Australian security expert for using “weak” passwords stored in plain text which were stolen by a hacker known as Darwinare in November.

Sophos Asia Pacific head of technology Paul Ducklin said in a blog post that the hack, which saw a number of SQL database records containing student and staff identification details posted online, shouldn’t have happened and there could be “no excuses”.

Security threats explained: Internal negligence

Social engineering, big data top security priorities for 2013

Privacy Commissioner condemns RailCorp over USB drive auction

Students at ADFA apply to the Defence Force and to the University of New South Wales (UNSW), which runs the academic side of ADFA's operations in Canberra.

While Ducklin praised the UNSW for acting quickly and notifying students/staff a day after the breach occurred, he scolded the University for storing usernames and passwords for at least one of its computer systems in plain text.

“To be fair, these passwords were meant just for initial login, and were therefore expected to have a short life. But passwords should never be weak or guessable, or, for that matter, stored in plain text.”

He said the algorithm for generating the passwords was like a “time warp” back into the 1970s because all of the passwords were seven and eight lower-case letters long.

“Many of these passwords are repeated and all are meant to be pronounceable -- surely an unnecessary step for a password that is intended to be typed in once and then changed -- which leads to a conspicuous lack of randomness.”

For example, Ducklin pointed out that 1 per cent of the passwords end in the word 'poo' which made the passwords “sadly self-descriptive”.

He warned companies to harden their Web services and bring password handling into the 21st Century to avoid compromises like the ADFA incident.

Follow Hamish Barwick on Twitter: @HamishBarwick

Follow Computerworld Australia on Twitter: @ComputerworldAU, or take part in the Computerworld conversation on LinkedIn: Computerworld Australia

Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.

References show all
Comments are now closed.
Related Coverage
Related Whitepapers
Latest Stories
Community Comments
Tags: Australian Defence Force Academy, password security, algorithms, Sophos Paul Ducklin, hacking
Latest Blog Posts
Whitepapers
  • The F5 DDoS Protection Reference Architecture part 1 of 3
    Distributed denial of service attacks (DDoS) attempt to make a machine or network resource unavailable to its intended users, with a wave of crippling attacks on enterprises since 2012. This whitepaper offers guidance to security and network architects in designing, deploying, and managing architecture to protect against increasingly sophisticated, application-layer DDoS attacks.
    Learn more »
  • Information Management
    Valuable data can be a needle in a haystack, but by leveraging the value in existing information assets, organisations can generate real and achievable gains in revenue generation, IT investments and productivity gains. This whitepaper discusses how Information Management (IM) is a multi-faceted discipline that can be employed to meet or exceed your business objectives.
    Learn more »
  • Migrating from BlackBerry? See Our Trusted Method.
    Are your business leaders demanding a migration plan from BlackBerry? Let the mobile experts at Good help you migrate without migraines. Our Professional Services team has deep experience supporting Fortune 500 organizations through the transition; read this sample planning chart and see our trusted method.
    Learn more »
All whitepapers
rhs_login_lockGet exclusive access to Invitation only events CIO, reports & analysis.
Salary Calculator

Supplied by

View the full Peoplebank ICT Salary & Employment Index

Recent comments