Dismisses recent hack leaks
Information Network Security Agency (INSA), Ethiopia’s foremost cyber security agency, struggles to sail through the turbulent current of political reforms in Ethiopia,during the past one year as it scrambles to plug the security leaks left behind the unceremonious departure of a number of key cyber security agents following the reform, The Reporter has learnt.
Admitting the heavy toll that the sudden exodus of key security officials has taken on the Agency, Solomon Tesfaye, acting communication director, told The Reporter yesterday that the past few months has been unusually tough since the Agency has launched reform initiatives on multiple fronts on top of the need to feel the vacuum left by the loss of human resources.
According to Solomon, the political reform process is the reason behind the mass exodus of key officials and with them important information and tools critical to the cyber security of the nation. “I have to admit, the Agency was staffed, disproportionately, with personnel who were in one way or the other affiliated with a certain political interest group,” Solomon explains, and that the political reform in the country appeared to have sent shock waves across the security apparatus forcing the rather unceremonious departure of security personnel.
“So happens, the proper exit procedures and handover of sensitive data including passwords did not take place at the time of departure,” Solomon said. So, it is in this context that recent reports of leaked email hackings should be understood, according to the communication director.
Apparently, on Thursday, May 30, 3019, Safety Detective.com,an antivirus review website, has released a report entitled: “Ethiopian INSA Agents Hacked: 142 agents chose the predictable password ‘P@$$w0rd’” in which it claims its pro bono research lab has intercepted information about a potential hacking of the Agencies email server as they scrape off email addresses and passwords of some 300 INSA agents still active in the agency.
“Political hacking is nothing new: While the fact that hackers could so easily hack a security agency – and the Ethiopian INSA especially – is alarming, what was even worse was that the passwords we discovered in use by INSA were basic (and hackable) beyond belief,” reads the report. Furthermore, out of the 300 passwords, about 142 were found to be “using ‘p@$$w0rd’ and 62 passwords containing a `123’ sequence” both which were extremely easy to hack. “It goes without saying that, even had the server not been hacked, the passwords we saw post-scraping were easily hack able,” reads the report.
As far as the Agency’s technical team, who prefers to remain anonymous, the so called leaked information about a potential hacking of INSA email server is nothing but “privileged information” which the disgruntled agents had access to at the time of their departure, almost a year ago.
“Some of these ex-agency employees walked away with data, which their previous position allows them to obtain; and now we are seeing the blow back from that incident,” young expert with agency explained. “It obvious that it list of email and passwords are copied from the Admin side and not hacked,” he continued to argue. He also cites some of the email accounts purportedly scraped and claims that they clearly belong to disgruntled former agents.
As to the rather unusually simplistic password choices, the technical team claim that most of the supposedly scraped passwords look default because they are indeed default passwords issued to employees with new email accounts. “The Admin issues default passwords like ‘P@$$w0rd’ with new accounts and it is not out of the ordinary; and hence, it makes it clear that the purported “screenshots of the hacked emails” are in fact copied from Admin sides as they were newly issued accounts and as such it essentially an outdated data,” the expert said in conclusion.
“Had we not implemented what we call the ‘quick fixes’ to address some of the obvious security vulnerabilities, we could have could have witnessed a lot more,” Solomon said, and predicted future challenges as the Agency continues to deepen the reform. For now, the Agency is focusing on setting up purely professional environment devoid of political interests and affiliations so that future political reforms would not affect the institution. Setting up process based working procedure that does not depend on individuals is essential, according to him, and that ensuring the Agency does not continue to exist at mercy of few individuals is priority at moment.
“Furthermore, INSA is also opening its doors to the public; we essentially working on our rules of engagement including information classification laws ensuring better access to the supervisory entities like the House of Peoples’ Representatives (HPR) and the public,” he concluded.
