The password to the RIPE network was “ripeadmin”. Without the quotes.
Customers of the Orange network in Spain suffered a major outage in their internet access on January 3. The fault lies with a hacker named Snow, who obtained, far too easily, access to an administrator account on the RIPE network, allowing him to block or disrupt access to numerous websites for the users concerned. The flaw has since been fixed.
Orange Spain’s security clearly raises questions
Last Wednesday, a hacker obtained access to an Orange administrator account to the RIPE network, which is a database of all IP addresses in Europe, the Middle East, and Central Asia. He first made a few changes, without causing any reaction, before going further and hijacking the routing of Orange clients’ IP addresses, making many websites inaccessible to them.
In a post on X.com at the end of the day, Orange Spain acknowledged the incident, announced that it had corrected it, and reassured its customers that no personal data had been leaked on occasion. But the simple fact that it could have happened calls into question the company’s level of security. Because the ridiculously weak password, ripeadmin, was not even obtained by brute force, but via an infostealer (information thief) installed on the computer of one of the Orange employees. This password has been available and on sale since at least last September. Best of all, no two-factor identification was required to gain access.
In a laconic press release, the RIPE coordination center insisted to all its members on the importance, at least, of this last point.
A “white hat” behind the attack
If we know so many details about the incident and the security breaches at Orange Spain, it’s because the hacker who caused it, Snow, published everything on X.com, screenshots supporting. He castigated the company’s poor security practices, explained how he had obtained access, before directly calling out Orange: “ I fixed the poor security of your RIPE account. Contact me to obtain the new identifiers “.
He therefore had no other bad intentions than to expose the negligence of a multinational. For Orange and its customers, it could have been much worse.
Source : Ars Technica
2