TV5Monde discussion

dalta5billion

So sick of this "sophisticated cyber attack" lark.

Some people on Twitter have found that their opsec leaves, well, a lot to be desired...

http://arstechnica.com/security/2015/04/hacked-french-network-exposed-its-own-passwords-during-tv-interview/

Gatling

Happened to BBC too during a live broadcast

BoB_BoT

I was reading the link in the other thread that dbit posted, http://edition.cnn.com/2015/04/09/europe/french-tv-network-attack-recovery/

They mention that they had strong firewalls, that's all well and good unless an internal device is compromised. There's also the possibility that there were no backdoors exploited as such, but an admin or elevated user could have been compromised, enough to get a foothold. I'm sure they have VPN access into the network, all it takes is one high level account to be compromised.

BoB_BoT

Just reading the link you posted dalta5billion, you'd imagine people would learn by now about post its and passwords. My god, invest in password management software, it's not expensive.

dbit

Post its , I love post its !!!

dbit

BoB_BoT wrote: »

I was reading the link in the other thread that dbit posted, http://www.cnn.com/2015/04/09/europe...tack-recovery/

They mention that they had strong firewalls, that's all well and good unless an internal device is compromised. There's also the possibility that there were no backdoors exploited as such, but an admin or elevated user could have been compromised, enough to get a foothold. I'm sure they have VPN access into the network, all it takes is one high level account to be compromised.

Link removed ????

dbit

Here is one of the passwords shots
http://arstechnica.com/security/2015/04/hacked-french-network-exposed-its-own-passwords-during-tv-interview/

BoB_BoT

dbit wrote: »

Link removed ????

Copy paste mistake, good thing I didn't copy my text file of passwords into the post :P

dbit

lols haaa haaa so your a broadcaster infosec head lolz.

dalta5billion

More worrying is how many confidential sources may have been exposed by their sheer incompetence.

BoB_BoT

Humm, but will they ever divulge the source of the breach. I'm sure they'll have to reveal to their stakeholders what happened, but not necessarily the wider public. As you said dalta5billion, how many confidential sources have been leaked due to this.

I'm intrigued to see if it was an actual hack / network penetration rather than acquiring login credentials via social engineering / phishing. We might never find out if "ISIS" want to keep their techniques secret and TV5Monde don't want to reveal it either.

syklops

They mention that they had strong firewalls

By strong firewalls do they mean they had an IPS in blocking mode, deep packet inspection firewalls, with a dedicated team of analysts watching logs? Or strong firewalls as in, they hit them with mallets a couple times and they didnt get dented?

Impetus

These fr.idiots published screen shots of their post it notes with login info for their TV station twitter, youtube etc accounts. Dumb to put this stuff on yellow pieces of paper, and super dumb to broadcast camera images of same. And the passwords used were super dumb, obvious etc.

What are the limit of dumbness, if any?

Surely a key question for computer security? How to protect the world from dumbos.... Perhaps it will require the electric chair to make some people think intelligently? Because at the moment we have websites everywhere taking payment cards and personal info, operated by ejits who haven't a clue about computer security.

dbit

Impetus wrote: »

These fr.idiots published screen shots of their post it notes with login info for their TV station twitter, youtube etc accounts. Dumb to put this stuff on yellow pieces of paper, and super dumb to broadcast camera images of same. And the passwords used were super dumb, obvious etc.

What are the limit of dumbness, if any?

Surely a key question for computer security? How to protect the world from dumbos.... Perhaps it will require the electric chair to make some people think intelligently? Because at the moment we have websites everywhere taking payment cards and personal info, operated by ejits who haven't a clue about computer security.

Don't be hating on post its , they are innocent in all of this !!.

pah

On a side note the guy in charge of tv5 is Bigot