Not even in verlan? Vrelou would have been at least amusing.
Verlan is one of my fav French gimmicks, je le trouve drôle
Ledrô even
Not surprising tbh.,I’ve been in a security meeting before where the owner of the company just said outright his password was written in big letters on the outside of the building we were sitting in. Some people really have zero sense for security or just don’t care.
I grew up having to learn everything about network security at home, on a windows PC, in a family with no regard for the concept of internet security because basically the idea didn’t exist yet. I was the one who scrubbed the PC every week and removed the 1300 toolbars and spyware apps, I was the one who had to repair the registry every time a sibling downloaded a file sent to him by a “hot girl” claiming it was a picture of her boobs.
So it’s maddening now working in a company of adult humans who are so bad at safety and security that our workstations have even had their settings menus neutered because everyone is so bad at security. Yesterday someone asked how to install the file they received in email titled “security update, please install asap!” from “rnicrosoft. com.”
One time I got written up for stating that “failing to take cyber security seriously creates a massive potential liability” for the company. Apparently that was “out of line.”
Well you know what else is out of line? Critical infrastructure organizations (i.e. utilities) that don’t take security seriously.
I do not miss that dumpster fire.
I would really like to see companies held more accountable for their data security. If data gets leaked through some security breach, regardless of the criminality of the perpetrators of that breach, if it contains sensitive data like unhashed passwords, credit card or other personal data, and other potentially even more sensitive stuff (medical, financial), the company that was supposed to secure that data needs to be held liable too.
Any company that stores any of that kind of data, needs to have real security experts on board and listen to them. If you can’t, don’t store that kind of data.
They also apparently had another system developed by a company called Thales, and the password for it was “THALES”.
“This next heist will be far more daunting. It will take years of planning and—oh no way, it was changed to ‘Louvre1’”
Louvre2026
“okay, i’m gonna need about five min- oh!”
Proving once again that humans are the weakest link in your security chain. No firewall or other security protocol matters when people are too lazy to use more secure passwords (or just click on random links in their email).
I once read an interview with a white hat hacker. He said that people expect him to try to remotely connect to their network and try to brute force his way in. The first thing he actually does is put on a suit, visit the company’s headquarters, walk in the front door, start a conversation with the receptionist, and see how far he can get.
This reminds me of an excellent episode of Dark Net Diaries, “Jeremy from Marketing”. https://pca.st/episode/52252c9e-e4a8-42f6-85f5-f162ec3f6b40
In marching band, I learned you can get pretty much everywhere with a white polo, black slacks, and (optionally) an instrument. The same usually holds true for a hi-vis vest and jeans.
I’ve done quite a bit of freelance work and visited various office spaces with multiple companies in a single building. It was pretty common just to call to the building reception and tell them that I’m working for this-and-that-company upcoming weekend for their network stuff and I’d need access to network cabinets and whatnot and they’d have keys ready for me with very little (if any) verification if I’m actually doing what I’m supposed to or if I am who I claim to be. Some of the locations just handed me keys with access to practically everything, including shared server rooms hosting their CCTV setup, key managing servers and all.
So, just get a name tag with a local operator logo and clothes to match and ask nicely. You’ll get access to a lot more than you think.
I’ve done exactly that, worked as a Red Team Lead, and the success rate is pretty disturbing. That, and vishing - calling people from the company you find on Linkedin from a spoofed number of their IT that they fucked something up and need to download and run this .exe to fix it before The Audit that’s currently happening notices it.
Even if we do internal infrastructure tests where they let you in, switch AVs to “detect mode” instead of “block mode” and the goal is to find as many unpatched systems/vulnerabilities as you can (instead of, well, testing the AV solution), what we usually do is run a password spray for all domain accounts with a combinations (you can try like 3 to not lock the accounts) of “<month><year><companyname>” we every single time got at least few accounts.
Fortunately this kind of tests are getting more popular, and passwords such as this should’ve definitely been caught in some kind of security test. But it is also pretty depressing, when you repeat the same test next year, and 80% of the passwords are still the same, and vulnerabilities are still not patched.
Not the onion?
lol I louvre it!
Ok this sounds bad, but I have a question…
Was the camera system accessible from the internet?
If not, this issue is far too overblown.
It depends on how well segmented is their network, but all you might need for that is a Raspbery PI with ethernet and GSM.
I’ve done some engagements where we sent someone into the company to get in as an air conditioning tech, and when they got in he planted that device between a printer and the network. It was set up to forward all traffic, but also allowed us to connect through GSM and get into the network.
It takes like a few seconds to plant it.
Or if it’s really bad, then you might be able to reach it from the WiFi.
If your network does not have NAC and just lets unknown devices plugged into a random wall outlet inside, you might as well get rid of passwords alltogether.
Or if it’s really bad, then you might be able to reach it from the WiFi.
Or some employee might have dropped their own wifi access point onto the Lan for their own convenience.
I found 2 of those on the same floor during one sweep…
Usually, there’s a network for IP cameras, with a central server holding the video. There’s then, usually, a firewall to anything outside that, and frequently just a hardline to a monitoring system. (another computer with lots of monitors, typically.)
Most modern systems can VPN to the firewall and run a client there via remote desktop, and then access the monitoring system that way; but the server itself is not.
As to the complexity of the password, typically there’s different levels of permissions. The basic ones would just let you monitor real time, probably review recordings, and maybe rip those recordings. (but not change settings, or otherwise delete anything.) A place like the Lourve would have multiple guard stations connecting in on the local network; with dozens of guards watching cameras at any given time; and would each need their own account/logins if you wanted to make the password actually complex.
a large part of the problem is just the sheer amount of people that would need to have acounts- the lourve says they have ~1300 ‘reception and security’ staff. (for the record, reception would also be part of the security envelope… though they probably wouldn’t need the password.)
anyone dialing in from off sight would likely have their own password (and have elevated permissions to allow that.). Frequently, by remote desktoping into a system on the local network.
You’ll also notice theyre not saying the security system was actually compromised- even if the cameras were pointed the right way, they’d still have gotten in and out because the windows were a point of vulnerability. They might have been able to respond faster, but they were in and out in ten minutes. a camera wouldn’t be able to stop that, if you account for normal human reaction times… if they’d even notice the ‘contractors’.
Usually, there’s a network for IP cameras, with a central server holding the video. There’s then, usually, a firewall to anything outside that, and frequently just a hardline to a monitoring system. (another computer with lots of monitors, typically.)
I hate to say it man, but this assumes someone is going above and beyond to lock down the cameras.
I used to have a milestone implementation where I work. There was a security PC in a security office that has the cameras on and always logged in but nobody shuts down requests for camera access for other users. The flimsiest of justification is all that is necessary for the highest level of leadership to give the go ahead. We do manufacturing and everyone thinks these low quality grainy security cameras are a replacement to going on the floor and actually watching how things are working so dozens of non-security people had access.
When I started everybody was using the same local account to log in. I migrated us to AD authentication (with exception of the security PC) but anybody could still technically reach the camera system from the network.
Absolutely anybody could just enter the IP of a camera on the network though and view what it sees. Every camera had default passwords. We even had some fun brands like Hikvision that were banned in 2022 by the FCC. We had a firewall from the outside world, but a guest network that was not isolated at all.
We’ve migrated to a different solution that cost hundreds of thousands of dollars and over a year of replacing cameras, but still probably a third of people in the org have access to the cameras for bullshit reasons and leadership doesn’t care to shut it down. Thankfully none of them are admins and nobody but myself and a couple of others have any kind of admin level permissions now, but my point is that it’s the wild west out there in terms of IT processes… and often Shadow IT from groups like a security team that isn’t truly tech-savvy ends up running something like this.
If money didn’t flow like water due to a total lack of purchasing controls and nobody complaining about expenditure at the time, we’d still be using the same old security cameras. I can’t imagine the Lourve having much of a budget. museums are run like shitty nonprofits and are held together with string and bubblegum in the US.
Also, this was found by an audit years ago. Doesn’t mean it was fixed, but doesn’t mean it was still the same during or after the theft.
At least it wasn’t the default password.
I’ve known clients that have never removed the default admin account, with a default admin password… and looked at me like I had a horn growing out my ear…
I’ll admit it, I have systems at work with weak or default passwords. But they don’t handle any sensitive information, and exploiting them wouldn’t get you any additional privileges on the network.
that’s just it… any vulnerable system lets them get their nose in the door, then the camel starts snooping around the tent for whatever it can get. Eventually, they find away to something juicy.
The thing is, whether we’re talking about digital or physical security, the weakest thing in any system is the humans. The sloppy passwords (c’mon it should have been Louvre25! lol.) is a human thing. clicking that phising scam is a human thing. kipping off to the egyption bedroom for tryste with receptionist is a human thing.
the simple password isn’t the problem. The people being complacent is.
Until someone figures out how to use this non critical system to exploit other parts of your network. An ssh shell on an internet connected coffee machine in a bank would make a great starting point to gain access to more critical systems for example.
There was a story a few years back about a casino getting hacked through a smart thermometer in a fish tank.
the Target hack went in through the HVAC system.
You’ll also notice theyre not saying the security system was actually compromised- even if the cameras were pointed the right way, they’d still have gotten in and out because the windows were a point of vulnerability. They might have been able to respond faster, but they were in and out in ten minutes. a camera wouldn’t be able to stop that, if you account for normal human reaction times… if they’d even notice the ‘contractors’.
This, Camera are useless at stopping/preventing crime. Thanks to the Camera 5 persons have been charged and wait their trial in jail but camera won’t prevent a jackasss to steal something in a museum
deleted by creator
I use my dog’s name as password for my WiFi.
Ed&1e.78x!
We call him Eddie for short.
fourwordsalluppercase
Little Eddie Tables
you got your dog from elon and the one chick and kept the name
Haha you fool. I’m in.
Now what…
Look at a bunch of weird stuff on social media to screw up the targeted ads for their IP address
That is crazy. At the nursery that I work at we have to type in 3 passwords + a 6 digit key generator just to type in what kind of poop they’ve made.
Biometrics plus Fido key is the way to go.
Just hand over all your biometric data to a private company that definitely won’t sell them on, Promise!
No. It’s my biology.
Hardware keys use biometics as a password to unlock a key or OTP code. Your fingerprints never leaves the device.
I was mostly talking about the yubi key bio.
Further reading the fingerprint is still relying on you remembering a numeric pin. (Which is usually someone’s birth year)
