Thursday, March 8, 2012

Password security fail...

It appears that one of the most talented young minds in Euorpe has fallen afoul of his school.  He is a terribly intelligent young man who, at the age of 14, has already developed 6 apps for smartphones, is the managing director of his own web design company and last year was hand picked to attend the Apple conference.  Unfortunately, he is also, well, 14.

He has admitted to hacking into the systems at his school and acting like a teenager.  This has earned him a suspension followed by an expulsion.  I do not blame school staff at all for the response.  However, there is a small bit that is being downplayed by said staff. 

It seems that the passwords were gained by the amazingly difficult task of looking at the whiteboard in the IT room at the school.  The school administrator claims that the passwords listed are just examples, not actual passwords, and the child used that information to guess his way into the system.   Even if that is the case, which I doubt, passwords (or password examples that can lead a teenager down the path to the real ones) should not be on a whiteboard.  Ever.  I get annoyed when I find people storing passwords in text files or on post it notes under their desk phone.  But putting that info on a whiteboard where anyone walking by an open door can look is just plain stupid.  This is the type of mentality that allowed Kevin Mitnick to accomplish everything that he did before getting arrested.  While he was skilled as a hacker, he was far more skilled in social engineering to accomplish access.  We have the same thing here, only easier. 

No comments:

Post a Comment