fne8w2ahPassword to Louvre’s video surveillance system was 'Louvre', according to employee
WhatsHerBucketProving once again that humans are the weakest link in your security chain. No firewall or other security protocol matters when people are too lazy to use more secure passwords (or just click on random links in their email).
I once read an interview with a white hat hacker. He said that people expect him to try to remotely connect to their network and try to brute force his way in. The first thing he actually does is put on a suit, visit the company’s headquarters, walk in the front door, start a conversation with the receptionist, and see how far he can get.
This reminds me of an excellent episode of Dark Net Diaries, “Jeremy from Marketing”.
pca.st/…/52252c9e-e4a8-42f6-85f5-f162ec3f6b40
Ok this sounds bad, but I have a question…
Was the camera system accessible from the internet?
If not, this issue is far too overblown.
FuglyDuckUsually, there’s a network for IP cameras, with a central server holding the video. There’s then, usually, a firewall to anything outside that, and frequently just a hardline to a monitoring system. (another computer with lots of monitors, typically.)
Most modern systems can VPN to the firewall and run a client there via remote desktop, and then access the monitoring system that way; but the server itself is not.
As to the complexity of the password, typically there’s different levels of permissions. The basic ones would just let you monitor real time, probably review recordings, and maybe rip those recordings. (but not change settings, or otherwise delete anything.) A place like the Lourve would have multiple guard stations connecting in on the local network; with dozens of guards watching cameras at any given time; and would each need their own account/logins if you wanted to make the password actually complex.
a large part of the problem is just the sheer amount of people that would need to have acounts- the lourve says they have ~1300 ‘reception and security’ staff. (for the record, reception would also be part of the security envelope… though they probably wouldn’t need the password.)
anyone dialing in from off sight would likely have their own password (and have elevated permissions to allow that.). Frequently, by remote desktoping into a system on the local network.
You’ll also notice theyre not saying the security system was actually compromised- even if the cameras were pointed the right way, they’d still have gotten in and out because the windows were a point of vulnerability. They might have been able to respond faster, but they were in and out in ten minutes. a camera wouldn’t be able to stop that, if you account for normal human reaction times… if they’d even notice the ‘contractors’.
The Musée du Louvre at a glance - Espace presse du musée du Louvre
Ancien palais des rois, le Louvre épouse l’histoire de France depuis huit siècles. Conçu dès sa création en 1793 comme un musée universel, ses collections, qui figurent parmi les plus belles au monde, couvrent plusieurs millénaires et un territoire qui s’étend de l’Amérique aux frontières de l’Asie.
Also, this was found by an audit years ago. Doesn’t mean it was fixed, but doesn’t mean it was still the same during or after the theft.
At least it wasn’t the default password.
I’ve known clients that have never removed the default admin account, with a default admin password… and looked at me like I had a horn growing out my ear…
I’ll admit it, I have systems at work with weak or default passwords. But they don’t handle any sensitive information, and exploiting them wouldn’t get you any additional privileges on the network.
Until someone figures out how to use this non critical system to exploit other parts of your network. An ssh shell on an internet connected coffee machine in a bank would make a great starting point to gain access to more critical systems for example.
that’s just it… any vulnerable system lets them get their nose in the door, then the camel starts snooping around the tent for whatever it can get. Eventually, they find away to something juicy.
The thing is, whether we’re talking about digital or physical security, the weakest thing in any system is the humans. The sloppy passwords (c’mon it should have been Louvre25! lol.) is a human thing. clicking that phising scam is a human thing. kipping off to the egyption bedroom for tryste with receptionist is a human thing.
the simple password isn’t the problem. The people being complacent is.
MikinaIt depends on how well segmented is their network, but all you might need for that is a Raspbery PI with ethernet and GSM.
I’ve done some engagements where we sent someone into the company to get in as an air conditioning tech, and when they got in he planted that device between a printer and the network. It was set up to forward all traffic, but also allowed us to connect through GSM and get into the network.
It takes like a few seconds to plant it.
Or if it’s really bad, then you might be able to reach it from the WiFi.
“This next heist will be far more daunting. It will take years of planning and—oh no way, it was changed to ‘Louvre1’”
Louvre2026
PetteriPanoI use my dog’s name as password for my WiFi.
Ed&1e.78x!
We call him Eddie for short.
jordanlundfourwordsalluppercase
Just hand over all your biometric data to a private company that definitely won’t sell them on, Promise!
No. It’s my biology.
Something Burger 🍔Hardware keys use biometics as a password to unlock a key or OTP code. Your fingerprints never leaves the device.
They also apparently had another system developed by a company called Thales, and the password for it was “THALES”.
Not surprising tbh.,I’ve been in a security meeting before where the owner of the company just said outright his password was written in big letters on the outside of the building we were sitting in. Some people really have zero sense for security or just don’t care.
One time I got written up for stating that “failing to take cyber security seriously creates a massive potential liability” for the company. Apparently that was “out of line.”
Well you know what else is out of line? Critical infrastructure organizations (i.e. utilities) that don’t take security seriously.
I do not miss that dumpster fire.
𝕱𝖎𝖗𝖊𝖜𝖎𝖙𝖈𝖍