alt.hn

7/3/2026 at 1:19:46 PM

Hackers shoveled snow for company, were rewarded with network admin access

 https://www.theregister.com/security/2026/07/02/hackers-shoveled-snow-for-company-were-rewarded-with-network-admin-access/5265240

by ike_usawa

7/3/2026 at 2:28:43 PM

”Finally, the company should have enforced a strong password policy that would have prevented our heroes from finding dozens of accounts with “winter2023!” as the password.”

Capitalize that “w”, and you’ve got a password that will pass most PWD policies. Why do they think it was “winter2023!” to begin with? In 90 days when the PWD expires, well, it will be spring of the next year, so…

The better idea is to require passwords with some real entropy, and get rid of expiring passwords. It’s not 1999 anymore.

by mikestew

7/3/2026 at 5:25:23 PM

Replying to my own post: wait a minute, why are there so many accounts with the same password in the first place? Oh, because "dozens" of people are tired of changing their password every 90 days, and someone piped up on an email thread (with the subject line: "Changing passwords all the time is bullshit!", I'm sure) and said, "I just set it to $SEASON$YEAR'!'. Easy to remember, fits the policy."

And now you have a system that is far less secure than if you just ditched the expiration policy to begin with.

by mikestew

7/3/2026 at 4:30:42 PM

Expiring passwords are one of my biggest gripes, and I still see them everywhere

by alt227

7/3/2026 at 4:40:18 PM

Expiring passwords and length limits. Why can't my password be a 5KB long? My password manager has no limits. Are people storing them in plain text in 2026?

by grg0

7/3/2026 at 4:58:14 PM

And content limits. Why can't my password contain the % character? No special characters? What makes a character "special"? Why can't it contain emoji? So many password systems go to great lengths to remove potential entropy and randomness from passwords with their rules. The usual excuse is "blah blah blah legacy systems" which is not a good reason.

by ryandrake

7/3/2026 at 5:18:04 PM

Personally, I wouldn't use anything beyond ASCII in a password. I don't want encoding bugs to lock me out of my encrypted partition or bank account, thank you very much.

by fph

7/4/2026 at 9:00:09 AM

I agree, content limits are a royal PITA. Do you know how long I had to search to find a password manager that would accept my password with its doodles, sign language, and squirrel noises?

by pseudohadamard

7/3/2026 at 6:32:01 PM

Probably because there is some mildly decent reason (or very good, I don't know) to avoid them and it really doesn't matter enough to worry about getting around it.

Why would you want emojis in your password? It's a piece of text not meant to be seen, emojis are meant to be seen. Just randomly generate some characters and get on with your life. I don't understand why you care about this at all, it's such a pointless thing to complain about.

by sfn42

7/4/2026 at 1:55:38 AM

> Why can't my password be a 5KB long

Because that opens you up to an entirely new class of attack. You have to set the limit somewhere and if you set it at INT_MAX, then a malicious user could find a O(n^2) path in your password validator and input a 4GB password that locks up the machine. Or they could create 1000 users in a row with 4GB passwords and fill up your storage.

by shalmanese

7/3/2026 at 5:01:51 PM

I ran into a website for work that would let you create a long password, but silently truncate it to 12 characters before saving. Mind boggling.

by sgc

7/3/2026 at 5:07:03 PM

This is the best. Especially when the password is being autotyped by the pw manager and so you never see the truncation and now have a bad pw saved in your manager. Alongside a restrictive password policy with no ui explaining what the policy is.

by halJordan

7/3/2026 at 5:15:45 PM

This happens on some HP printers too, the web interface lets you happily enter lengthy passwords, but doesn't bother telling you it truncated the entry at 16 or 12 characters.

by j4k3

7/3/2026 at 7:45:25 PM

I unfortunately had the infuriating experience dealing with a (government, of course) site that did this. To add to the experience, not only did it silently truncate at registration, but it did NOT truncate on the login fields. And of course, it has a lockout after several failed attempts. UX gore at it's finest.

by pull_my_finger

7/3/2026 at 6:13:30 PM

Blizzard/battle.net used to do this (still does?), lol

by grg0

7/4/2026 at 1:54:46 AM

Good security policies should have an upper bound on password length, but also those upper bounds should maybe be like 100 characters or so. There's a couple reasons for this. First being is that hashing does take some compute resources, second being that there is some security/usability tradeoffs here, etc, and third being that after like 30 characters or so, the effective (key phrase here) security gains become marginal.

by jkrejcha

7/3/2026 at 9:35:11 PM

Unbounded length anything is a denial of service vector, even if they do hash. I can assure you that even if your password manager doesn't impose limits, you can most certainly hit some if you try hard enough. It is also completely pointless. Two dozen or so ASCII letters and numerals will let you encode all the entropy you could possibly want.

Expiration is self-evident. Long lived tokens you can just whip around will whip around. The number one group of people who are hurt by expiration are those not using a password manager anyways. Autogenerated and autofilled passwords can expire all they want, it's a non-issue.

Special characters are dumb and unnecessary. They also pose a fun challenge when you happen to run into a situation where you can't input them anymore all of a sudden.

People cannot participate in cryptographic schemes, only machines can. These gimmicks do not help fix that. It's "theatre", as they say.

by perching_aix

7/3/2026 at 6:28:51 PM

> Why can't my password be a 5KB long?

Probably because that's just unnecessary. A few dozen characters is plenty, anything beyond that is just excessive.

by sfn42

7/3/2026 at 4:56:08 PM

I wouldn’t trust enterprise internet security boxes to not trip on such long text fields.

by mschuster91

7/3/2026 at 4:40:50 PM

My company does it to our phone passcodes. 90 days.

by wpm

7/3/2026 at 9:34:45 PM

Well, I’ve only got 10 fingers, so looks like my time there would be limited to 900 days.

by kaikai

7/3/2026 at 6:08:35 PM

Due to corporate IT working its fingers into everything vaguely computer related, I now have to annually change the passwords that operators use to log onto the HMIs on my OT network (which has no connection to the greater Internet.)

That means I now get calls after hours for a couple weeks (allowing for all shifts to cycle through) from operators who are locked out of their ops stations. I can't send the password via email, obviously, and word-of-mouth is inconsistent at best. So I'm left with the sticky note under the keyboard or stuck to the monitor, which the operators won't read anyway.

by black6

7/3/2026 at 7:06:09 PM

One good thing about expiring passwords is that it forces you to use something that you probably don't use for everything else in your personal life.

by wildzzz

7/3/2026 at 3:08:20 PM

I swear if the ghouls running things had abit more decency and allowed people to actually access and controll their passkeys then that would be the future, everyone would adopt it. The experience is so nice with key pair exchange for ssh. Its just that there i have thr security of knowing exactly where my secret is and how i can manage it, its just a file and i can move it like a file

Nobody wants the risk of getting locked out because of apple and googles walled garden bullshit

by samrus

7/3/2026 at 2:33:09 PM

1. Open a web browser and do a search

2. Read until you find a sentence that you like.

3. Use it as your password

by Xeoncross

7/3/2026 at 2:50:10 PM

I like the last line of your comment

My password is now password

by ChrisRR

7/3/2026 at 3:48:38 PM

Should have been "use it as your password"

by daredoes

7/4/2026 at 1:58:29 AM

"That's the best password ever!"

by jkrejcha

7/3/2026 at 5:24:21 PM

That's cool. Yours comes up as stars (*). Must be a HN thing.

by nickweb

7/3/2026 at 10:24:06 PM

hunter2

doesnt look like stars to me

by ndsipa_pomu

7/3/2026 at 3:08:09 PM

Hacked

by hnthrow10282910

7/3/2026 at 3:08:18 PM

How about mixing up band names? Take the end of "Florence and the machine" and mix it with the start of "Rage against the machine" and you now have the totally unguessable "Rage sharing the machine". It's a different machine see?! Nobody would know that!

by raffraffraff

7/3/2026 at 4:16:47 PM

The The but the first The is from The Who

by NopIdoN

7/3/2026 at 9:48:27 PM

That's crazy! Imagine what The The and The Who would sound like? Not The The and The Who, but the The The and the The Who your comment alludes to. Or would the original ones be called The The The and The The Who?

by daledavies

7/3/2026 at 2:56:50 PM

Not enough numbers or special characters usually.

by glitchc

7/3/2026 at 3:43:20 PM

Use one specific special character/number as word separator.

by lukan

7/3/2026 at 3:23:25 PM

I loathe two things in password requirements: special characters and not allowing spaces. C'mon, it's 2026. Require 20 characters and call it a day.

by chopin

7/3/2026 at 4:00:21 PM

"password is to long, max length..."

(╯°□°）╯︵ ┻━┻

by Xeoncross

7/3/2026 at 4:37:41 PM

I couldn't decide which sentence of Alice in Wonderland was my favorite, so I just used the full text.

by Volundr

7/3/2026 at 10:10:47 PM

Alibaba Cloud in 2026 lol

by antonkochubey

7/3/2026 at 3:55:24 PM

Letting users pick their own passwords has always been a mistake. If passwords are needed, the system should choose them.

by James_K

7/3/2026 at 4:04:41 PM

just directly give them a post-it for their monitor

by NopIdoN

7/3/2026 at 4:11:59 PM

As a person with memory issues, this is a recipe for me writing a password down where somebody else can probably find it.

by kg

7/3/2026 at 5:00:33 PM

If your machine or service is connected to the Internet, 631U)VN0Onl? written on a post-it note is generally going to be better than hunter2 not written down.

by ryandrake

7/3/2026 at 4:58:59 PM

but post-its are vulnerable to the wrench attack!

by fouc

7/3/2026 at 4:07:10 PM

Being overly suspicious of everyone is a terrible way to live. Maintenance should have the autonomy to do as they did here - and security correctly followed up. The right response should only be technical imo. A meeting room should not lead to this level of network access.

by UnfitFootprint

7/3/2026 at 4:51:42 PM

A better approach is to train everyone to be polite and helpfully walk the person to reception, who can arrange access.

by lokar

7/4/2026 at 10:29:17 AM

Yeah, true.

by UnfitFootprint

7/3/2026 at 6:10:43 PM

Agreed! As a friendly favor, could you please post your full name, ZIP code, credit card number, and the 3 digit security code on the back?

- Love and peace, your neighbor on HackerNews

(which is to say, I think you know that you can be friendly without being foolish - but if not I'm going to really enjoy the gift of that credit card :))

by handoflixue

7/3/2026 at 4:40:03 PM

> Maintenance should have the autonomy to do as they did

Really? We're talking about letting strangers in through the literal back door.

by Volundr

7/3/2026 at 3:48:36 PM

Maintenance employees are the weakest link. They aren't paid much and don't believe anything is important.

Be nice to them and they'll be nice to you back.

by mannyv

7/3/2026 at 6:51:39 PM

Since they came in through an open door, a fake badge that passed quick casual visual examination would have seemed potentially helpful here. I'm surprised the pen testers didn't craft such badges. Perhaps it was difficult to get a sufficiently high res image of a real badge from an employee entering or leaving the facility (although, if the front desk is manned, it might be possible to walk up to the desk with an innocuous question and snap a pic of the receptionist's badge if it's visible)?

I've never worked anywhere that stressed keeping your badge concealed until the moment of entry and concealing it upon last "scan" point on exit. If followed, such a policy would slightly reduce the risk of fake, but visually adequate, badges -- but compliance with such a policy would probably be very low in most commercial situations.

by uqual

7/3/2026 at 3:06:49 PM

The company also should have restricted network access to the port in the conference room so that an unknown device like a Raspberry Pi could not make an Ethernet connection from that spot

Bad take - the actual problem is that there was a trusted network in the first place. This kind of network access control is trivial to bypass, and trusted devices can get compromised.

by lima

7/3/2026 at 3:48:26 PM

It's not my field, but at least at my work the network can somehow tell the difference between an authorized user and not. It is not simply using the MAC address.

A guest device connected to the ethernet port in the conference room has the same access as a device connected to the guest wifi, a staff laptop has it's usual access.

by Symbiote

7/3/2026 at 4:34:18 PM

Probably a RADIUS server setup.

Basically staff machines get a certificate to present to the server and the server controls the network.

So, if your machine does nothing, it's on the guest vlan and has limited access. If it presents a valid certificate that network port is reassigned to the staff vlan and you get full access.

If someone leaves, you just revoke the certificate and they have guest access again.

Not rocket science once you know it :)

by onraglanroad

7/3/2026 at 4:53:07 PM

Still better to do that same thing (cert based auth) at the application layer instead of the network layer.

by lokar

7/3/2026 at 5:27:40 PM

That's great when you have control of your applications. For most corporate IT you're stuck with COTS applications and whatever their built-in auth functionality is. Sure, you can probably bolt a reverse proxy in front (if you're lucky enough for it to be a web app and not a thick native code client) but you get to argue with the vendor when they refuse support because you're not using their recommended configuration.

802.1x certificate-based authentication at layer 2 is a good defense in depth strategy.

by EvanAnderson

7/3/2026 at 5:45:49 PM

Use envoy or some other reverse proxy and do per-app auth there

by lokar

7/3/2026 at 5:24:46 PM

Yes, you can do it by MAC address instead but that can be changed so you can spoof a legitimate device.

Edit: oh wait, you mean have the applications check the certificate? Yes, but then you need support from the application. Does your printer do that, for example? You need to make sure everything does. You can of course do both.

by onraglanroad

7/3/2026 at 5:46:14 PM

Reverse proxy

by lokar

7/3/2026 at 8:23:48 PM

Probably 802.1x, but it's easy to bypass if you have access to an authorized device. This kind of authentication has to be done at the application level, treating the network as a perimeter doesn't work.

by lima

7/3/2026 at 7:30:19 PM

This made my day for the third time today for every time I checked the homepage.

by wseqyrku

7/3/2026 at 5:30:51 PM

> There are a lot of lessons here, but they start with training every member of the team to be suspicious of people coming from the outside, without badges, no matter what they say or do. Schloss noted that, if someone looks and acts like they belong in a space, most people will treat them that way.

> “First and foremost, what most people believe is crime is not crime. It's a Hollywood myth of what crime looks like,” Schloss told us. “I call it the ski mask bias. Everyone assumes you're not getting robbed until a person comes in with a ski mask and a gun yelling.”

I call this "Trained By Hollywood Syndrome". It's a huge problem, and far beyond mere computer security.

by bell-cot

7/3/2026 at 3:19:10 PM

What always gets me about these red team attacks is the same thing that gets me about internal phishing test emails.

My company sent an internal phishing test last week. Several people immediately reported it to a cybersecurity engineer, posted about it in Slack, saying they were surprised that such a sophisticated phishing attack was happening.

I too was surprised - Google is usually much better about catching these kinds of things in the GMail filter before they get through. Oh well, sometimes one slips though. Reported it and moved on

Come to learn that the only reason it made it through is because we let it through _on purpose_.

By analogy to these red team attacks: _theoretically_ someone could rent a car, pose as an employee, and set up a Raspberry Pi in the network.

But who would go to all that trouble?

Theoretically, someone could craft a perfect phishing attack, but who would go to all that trouble? Spray-and-pray, low precision, high surface area, attacks are the ones I end up reading about.

The only reason this attack vector was open is because the red team stood to gain a massive benefit from succeeding in the attack. What real-world actor would go to the trouble and stand to benefit as much?

by z3ugma

7/3/2026 at 4:16:52 PM

Imaginary country called Nicha can’t buy lithography machine from imaginary company called SAML. Nicha can kidnap some scientists and torture them to get all the secrets. But it’s not elegant. Nicha can pay a lot for hacking and get the result in anonymous way. I guess 8 figures can be paid easily for these secrets. With that money “red team” can launch very nice multifaceted social hacking attack.

by lnsru

7/3/2026 at 4:54:33 PM

I remember at some point Google disallowed more phishing attacks from red teams. Nothing new was being learned. They always work.

by lokar

7/3/2026 at 8:29:33 PM

Google solved credential phishing a long time ago using hardware tokens (gnubby - the predecessor to FIDO/U2F/Passkeys...).

There's other types of social engineering, but phishing is mostly an engineering issue.

by lima

7/3/2026 at 5:22:29 PM

> Theoretically, someone could craft a perfect phishing attack, but who would go to all that trouble? Spray-and-pray, low precision, high surface area, attacks are the ones I end up reading about.

I've been at a company that was well targetted. I forget which group it was, but they were got into a lot of customer service sites that week; not ours, but we had some near misses. Almost got me, sent me an email from the boss with 'The blog is down' and a link ... I was checking my mail on mobile as I was out the door, but of course mobile doesn't show any useful headers like from address.

by toast0

7/3/2026 at 6:14:11 PM

"Theoretical" becomes "pretty much guaranteed" if standards sink low enough - the more effort you put in, the more problems you ward off.

Sort of like how a lock can be picked in 30 seconds, but still deters 90% of crime - a lot of criminals are just searching around to find out who is vulnerable, and most every company has something that's worth at least a bit (even if it's just stealing $500 laptops instead of breaching the network)

by handoflixue

7/3/2026 at 4:46:16 PM

> But who would go to all that trouble?

I mean, a company I worked at had a significant amount of money stolen after the attackers spent 6 months sitting on their access waiting for the right moment to fake an (expected) reply to an email exchange. The original breach (or at least the breach of this executives account) involved a very targeted phish. When the potential payout is millions it justifies a lot of effort.

by Volundr