back to article 'Surprise!' West Oz gummint is hopeless at information security

Western Australia's auditor general is blinking in disbelief, after an audit of the state's password practices turned up just how many people use bad passwords. Yes, friends, password123 and abcd1234 remain popular among government employees, and the agencies covered by the audit don't block them. Yesterday, the office tabled …

  1. veti Silver badge

    To test the passwords, the auditor general's staff compiled a dictionary of common weak passwords from pentest resources, and tested those against 520,000 current and disabled accounts on WA government systems.

    If the system even allows you to attempt that sort of crude dictionary attack... Wot, no timeout between failed login attempts? No maximum number of failed logins before locking the account? I don't know if any kind of "strong password" policy could compensate for those weaknesses.

    1. Mayday
      Alert

      Possibly (well I hope at least) that usual account lock out after x attempts and retry times were temporarily disabled for the duration of the audit. If they weren't in place at all to begin with then that's of course as bad as you say it is.

    2. Rockets

      Having been through a audit like this the auditors typically want an offline copy of the AD database etc and then use tools to extract the password hashes and run other tools like hashcat against them testing against the dictionary.

      I once failed an audit because the server rack doors weren't locked. Even though the rack cabinets all had the same key out of the factory. The server room itself had much better security but the auditors don't care.

      1. BristolBachelor Gold badge

        If unsalted password hashes are available, then the system is not really secure; it just means you need a bigger dictionary. If you have no unsalted password hash file, you only have 3 attempts; is "password1234" one of your first attempts? What if "Sunday10" is the password, but is 4th on your list, and the account is locked out first?

        I've worked in facilities where there was very strict password control (think auto generated passwords comprising 5 blocks of 3 letter syllables, changing every month, and a different one on each system). What happens is that people write their password in their logbook or underneath the keyboard.

  2. Anonymous Coward
    Anonymous Coward

    Par for the course

    Working as security manager for a govt agency in <state> in Aus some years back, I took the org through the whole PCI-DSS compliance rigamarole.

    Procedures, policies, sign-offs, the whole shebang.

    Including, of course, a strict password policy, with length and rotation.

    The moment the auditors gave us their blessing and were out the door, I was *ordered* by the PHB CIO to turn off password enforcement policies on accounts for all servers and PCs. Verbally, of course, so there's no papertrail.

    I handed in my notice a few weeks later. For all I know they still use 'abcdef' for the admin passwords on their servers and databases which contain hundreds of thousands of personal records, including health and financials.

    1. Brangdon

      Re: Par for the course

      Nowadays rotation is considered a bad idea, partly because it is so painful for users. Switching it off probably helped security.

  3. Anonymous Coward
    Anonymous Coward

    The inclusion of disabled accounts invalidates the result. Disabled accounts aren't at risk. Also there's no mention of the access or systems.

    25% of critical web facing, production system accounts having weak passwords is a very different risk profile to 25% of non-production, non-critical, non-SPI systems.

    1. Phil Kingston

      I always think disabled accounts could still be a risk. Take disgruntled employee Jonno. Has his account disabled when he's black-bagged on Friday. Rings the service desk on Monday and gets lucky that the operator decides to re-enable his account. Assuming some sort of remote access, Jonno's back in, and up to mischief.

      Worse, if another person knew Jonno's account had been disabled they could attempt to get it reactivated and try their luck at a few passwords.

      Small, but disabled accounts still pose a risk.

      1. Brangdon

        If Jonno's account is re-enabled with his old password, it doesn't much matter how weak it was. Jonno knows it regardless.

  4. Tim99 Silver badge

    I retired long ago

    so, hopefully, the perpetrators have moved on. "For example, because disk storage is in short supply, medical records are getting scanned at low resolution, and the paper records are then being sent offsite for archival storage" This is a SOP by many State contractors, underspec the hardware, then there is more money left from the tender for "consulting" and unaccounted costs; and if you are really lucky lots of opportunity to extend the contract by consulting on why the system is suboptimal. Why solve the problem when there is good money to be made by letting it continue?

    I did a small job specking a couple of PCs to run our software for the Health Department years ago. At the time they were using Windows 95 on Novell, it was almost reassuring to find the fences that had to be crossed to install a Windows 98 PC with a necessary multimedia attachment...

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon