News for hackers. Stuff that matters.

A comment on Probe of leaked U.S. NSA hacking tools examines operative’s ‘mistake’.

Re:Probe of leaked U.S. NSA hacking tools examines operative... by bpchaps on Sunday September 25, 2016 @12:31AM (#12573972)
Funny. I reported something similar to comcast after finding several of their engineers' home directories on github. Ssh keys, usernames, passwords, scripts, logs, and even code for a DVR machine (no idea). Thankfully comcast got the GH account deleted fairly immediately. It just took a public reddit post to get in contact with them after their posted routes didn't work.

The person who uploaded them there did government security before joining comcast, so it doesn't surprise me even for a second that this was a mistake. Though, the repo also had updates after his employment there ended.

[ Parent | on HN ]
Re:Probe of leaked U.S. NSA hacking tools examines operative... by reolt on Sunday September 25, 2016 @01:49AM (#12574152)
A junior security operations employee at a company I worked at - who was fired for persistent incompetence - somehow obtained a fairly important position doing security for a government agency. That agency was (shockingly) later revealed to have very publicly embarrassing security issues.

I imagine this sort of thing is pretty common.

I feel like NSA might be able to make a stronger case for themselves if they were at least able to show they could do one of the most basic and fundamental things they're supposed to do be doing.

[ Parent | on HN ]
Re:Probe of leaked U.S. NSA hacking tools examines operative... by mynameislegion on Sunday September 25, 2016 @12:46AM (#12574016)
IIRC there are services archiving all github repos. It would be better to just change all the codes that were leaked.
[ Parent | on HN ]
Re:Probe of leaked U.S. NSA hacking tools examines operative... by bpchaps on Sunday September 25, 2016 @01:47PM (#12576364)
They said that they were going to work on swapping things out. When I talked to the PR rep about it last, he didn't have much of a clue whether they did or didn't swap anything out. They also mentioned a bug bounty, but that didn't go through either.
[ Parent | on HN ]
Re:Probe of leaked U.S. NSA hacking tools examines operative... by daurnimator on Sunday September 25, 2016 @12:59AM (#12574053)
easier said than done when it's the keys for rolled out consumer premises equipment
[ Parent | on HN ]
Re:Probe of leaked U.S. NSA hacking tools examines operative... by londons_explore on Monday September 26, 2016 @07:50AM (#12581033)
If you ship hardware to a customer with software installed and don't have the ability to do automatic security updates on it in 2016, you need to rethink your strategy.
[ Parent | on HN ]