<story><title>U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise</title><url>https://krebsonsecurity.com/2020/12/u-s-treasury-commerce-depts-hacked-through-solarwinds-compromise/</url></story><parent_chain><item><author>Jtsummers</author><text>The insistence on the stupidly long passwords and 30-60 day expiration times created &lt;i&gt;so&lt;/i&gt; many weaknesses. People choose obvious patterns for their passwords to get around it. Like `1q2w3e4r!Q@W#E$R`. Then they shift by one each time they have to update, by the time they get across the keyboard they can restart (or twice, in which case you swap the shift to the first half instead of second half). Or, this was fun, my first gov&amp;#x27;t job the guy had stored passwords on a sticky underneath the keyboard (I changed them all). They also used a shared account for admin stuffs, even though we were all given an admin token (like the smart card or CAC for regular login, but with admin credentials and issued separately).&lt;p&gt;In theory, the DOD CAC system (they&amp;#x27;ve gotten better over the years) eliminates the need for passwords entirely, but somehow most teams never tie their system to it properly.</text></item><item><author>random5634</author><text>A couple of quick notes:&lt;p&gt;1) The OPM hack and now this all illustrate - if govt gives itself the big backdoors into everything, it&amp;#x27;s likely they will give it to russia, criminals, ex-boyfriends stalking ex-girlfriends etc.&lt;p&gt;2) My own impression of govt IT is largely security theatre in the area I was involved. In particular such massive complexity that agency staff think going around the rules is normal, because it&amp;#x27;s the only way to actually get work done. And then such glaring weaknesses that no one cares to fix. With google I&amp;#x27;ve had one password for 20 years (my google account) which allows a hardware key for 2FA or google authenticator with what I imagine is sensible monitoring, new device authentication etc (I find this pretty secure).&lt;p&gt;Govt you are forced to write down these insanely long passwords with super complexity that cannot be cut and pasted that change very 30 or 60 days.&lt;p&gt;Because lost passwords are so common in these settings, the password reset process is usually a MASSIVE weakspot. I&amp;#x27;ve seen it just be a phone call to a third party, you give them your username, they give you a new temp password - that&amp;#x27;s literally it. And the passwords end up everywhere. In lots of documents that float around, emailed around etc etc. And lots of password sharing when you get locked out of a tool and it will take a long time to get a new account setup (months). Pretty soon the procedures manual also gets you root access to everything.</text></item></parent_chain><comment><author>vngzs</author><text>NIST no longer suggests such a rotation policy. They have accepted that it weakens security.&lt;p&gt;Anecdotally, colleagues have successfully lobbied to drop (or not enforce) password expiration policies from other government bodies on the strength of this recommendation from NIST.</text></comment>
<story><title>U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise</title><url>https://krebsonsecurity.com/2020/12/u-s-treasury-commerce-depts-hacked-through-solarwinds-compromise/</url></story><parent_chain><item><author>Jtsummers</author><text>The insistence on the stupidly long passwords and 30-60 day expiration times created &lt;i&gt;so&lt;/i&gt; many weaknesses. People choose obvious patterns for their passwords to get around it. Like `1q2w3e4r!Q@W#E$R`. Then they shift by one each time they have to update, by the time they get across the keyboard they can restart (or twice, in which case you swap the shift to the first half instead of second half). Or, this was fun, my first gov&amp;#x27;t job the guy had stored passwords on a sticky underneath the keyboard (I changed them all). They also used a shared account for admin stuffs, even though we were all given an admin token (like the smart card or CAC for regular login, but with admin credentials and issued separately).&lt;p&gt;In theory, the DOD CAC system (they&amp;#x27;ve gotten better over the years) eliminates the need for passwords entirely, but somehow most teams never tie their system to it properly.</text></item><item><author>random5634</author><text>A couple of quick notes:&lt;p&gt;1) The OPM hack and now this all illustrate - if govt gives itself the big backdoors into everything, it&amp;#x27;s likely they will give it to russia, criminals, ex-boyfriends stalking ex-girlfriends etc.&lt;p&gt;2) My own impression of govt IT is largely security theatre in the area I was involved. In particular such massive complexity that agency staff think going around the rules is normal, because it&amp;#x27;s the only way to actually get work done. And then such glaring weaknesses that no one cares to fix. With google I&amp;#x27;ve had one password for 20 years (my google account) which allows a hardware key for 2FA or google authenticator with what I imagine is sensible monitoring, new device authentication etc (I find this pretty secure).&lt;p&gt;Govt you are forced to write down these insanely long passwords with super complexity that cannot be cut and pasted that change very 30 or 60 days.&lt;p&gt;Because lost passwords are so common in these settings, the password reset process is usually a MASSIVE weakspot. I&amp;#x27;ve seen it just be a phone call to a third party, you give them your username, they give you a new temp password - that&amp;#x27;s literally it. And the passwords end up everywhere. In lots of documents that float around, emailed around etc etc. And lots of password sharing when you get locked out of a tool and it will take a long time to get a new account setup (months). Pretty soon the procedures manual also gets you root access to everything.</text></item></parent_chain><comment><author>Covzire</author><text>Indeed. Sports Team + Year, Season + Year, Company + Year or some other such combination should get you a good 10% or more of your users with only a few dozen permutations.&lt;p&gt;They wrote 60 days into FEDRAMP I believe, something I jaw-droppingly realized last year sometime. Whoever is writing these policy frames don&amp;#x27;t know what they&amp;#x27;re doing. NIST did away with those periodic password change recommendations for a very good reason but IMO they need to now recommend the opposite, directly, because the constant password changes are doing real harm.</text></comment>