Government passwords scattered across the Web, study finds
Login credentials for websites linked to nearly 50 government agencies have been found scattered across the Internet, according to a new report from Recorded Future. The credentials -- usually consisting of a government e-mail account linked to a password -- showed up on numerous public so-called paste sites, such as Pastebin, according to the findings from the threat intelligence company. The company said those sites tend to be a dumping ground for passwords acquired through various cyberattacks.
More worrisome, according to the report, is that some of the government agencies did not require two-factor verification, which would make the credentials much more valuable. “The presence of these credentials on the open Web leaves these agencies vulnerable to espionage, socially engineered attacks, and tailored spear-phishing attacks against their workforce,” according to the report. The analysis was conducted between November 2013 and November 2014. During that time, the Department of Energy had the most exposure, followed by the Commerce Department, Interior, Heath and Human Services, Homeland Security, Justice and Treasury.