Weak passwords to blame for Australian Defence Force Academy hack
- 13 December, 2012 10:44
The Australian Defence Force Academy (ADFA) has been slammed by an Australian security expert for using “weak” passwords stored in plain text which were stolen by a hacker known as Darwinare in November.
Sophos Asia Pacific head of technology Paul Ducklin said in a blog post that the hack, which saw a number of SQL database records containing student and staff identification details posted online, shouldn’t have happened and there could be “no excuses”.
Students at ADFA apply to the Defence Force and to the University of New South Wales (UNSW), which runs the academic side of ADFA's operations in Canberra.
While Ducklin praised the UNSW for acting quickly and notifying students/staff a day after the breach occurred, he scolded the University for storing usernames and passwords for at least one of its computer systems in plain text.
“To be fair, these passwords were meant just for initial login, and were therefore expected to have a short life. But passwords should never be weak or guessable, or, for that matter, stored in plain text.”
He said the algorithm for generating the passwords was like a “time warp” back into the 1970s because all of the passwords were seven and eight lower-case letters long.
“Many of these passwords are repeated and all are meant to be pronounceable -- surely an unnecessary step for a password that is intended to be typed in once and then changed -- which leads to a conspicuous lack of randomness.”
For example, Ducklin pointed out that 1 per cent of the passwords end in the word 'poo' which made the passwords “sadly self-descriptive”.
He warned companies to harden their Web services and bring password handling into the 21st Century to avoid compromises like the ADFA incident.
Follow Hamish Barwick on Twitter: @HamishBarwick
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.
- Appropriate Backup Applications for Accelerated Virtualisation Projects
- 5 Steps to Advanced Malware Protection
- Transforming Virtualised Infrastructure: The Key to Enabling Mission-critical Databases and Applications
- Getting a Better Grip on Mobile Devices
- Clearswift SECURE Email Gateway Evaluation Guide
Why change management doesn’t work
Larry Page wants to see your medical records
Dual-Persona Smartphones Not a BYOD Panacea
After two-year hiatus, EFF accepts bitcoin donations again
CIOs struggle to deliver timely mobile business apps: survey
Hybrid IT Service Management: A Requirement for Virtualisation and Cloud Computing
When competition is tough and resources are limited, corporate leaders are depending on growing their existing capabilities in order to grow their business. Information technology can be a unique catalyst for business growth, delivering a competitive advantage when creatively applied to established and emerging problems. Read more on what trends are accelerating the value of IT.
Clearing the Clouds for Midmarket Businesses
Cloud computing promises to help midmarket companies reduce cost and complexity in the IT equation – and gain the flexibility and agility they need to thrive. Yet charting a clear course to the cloud isn’t always easy. In this paper, we aim to clear the clouds. We examine different cloud computing models, discuss the types of requirements that each can best address, and consider what midmarket businesses should look for in a cloud solutions provider.
Mobility Apps: What every developer should know
Learn how others have delivered industry-leading, multi-platform management and security solutions. In this whitepaper, we look how app developers can develop, deploy and manage apps that enterprises can rely on today and into the future. Click to download!