The security firm undone by one reused password

The story

In early 2011, Aaron Barr, the CEO of security firm HBGary Federal, said he had used social media to work out who was behind the hacking group Anonymous. He planned to share the names.

The group responded. The company’s website had a common flaw that let them pull out the list of user accounts. The passwords were scrambled, but in a weak, outdated way, and two of them were quickly worked out.

Both people had used the same password elsewhere, including for email, social media and a company server. One password gave the attackers the CEO’s email.

From inside that email, they found another executive’s account and wrote, as him, to an administrator asking for help getting into a server while traveling. The administrator believed the message, reset a password and opened access.

The group published tens of thousands of company emails.

Why it mattered

A security company was undone by weak password storage, reused passwords and a believable email, the same basic mistakes it was paid to help others avoid. Its CEO resigned within weeks and partners cut ties with the company. The published emails also led members of Congress to call for an investigation into the work it had proposed.

The lesson today

Nothing in this story required advanced skill. A website flaw, a reused password and an email from a trusted colleague were enough. Unique passwords, multi-factor authentication, and confirming access requests by phone would each have stopped a step.