Emails of hundreds of Ethiopia's Information Network Security Agency agents hacked due to predictable passwords

• Hackers have gained unauthorized access to the agents’ email accounts by using easily predictable usernames and passwords.
• Out of the 300 hacked credentials, 142 used ‘p@$$w0rd’ as the password.

A bunch of hackers have managed to easily scrape a few hundred of Ethiopian Information Network Security Agency (INSA) agents’ email accounts. This has been possible due to the security lapse of the agents.

What happened?

Researchers from Safety Detective’s research lab have discovered a leak online which is related to INSA agents. It has been found that hackers have gained unauthorized access to the agents’ email accounts by using easily-predictable usernames and passwords.

Where is the loophole?

During the investigation, researchers had found the passwords that were used by INSA were basic. They were not salted and hashed.

“While the fact that hackers could so easily hack a security agency – and the Ethiopian INSA especially – is alarming, what was even worse was that the passwords we discovered in use by INSA were basic (and hackable) beyond belief. Basically, they weren’t salted and hashed. While big databases usually have their data protected and encrypted (in case someone breaks in), this one didn’t and had common passwords easy to decrypt,” said the researchers in a blog post.

Out of the 300 hacked credentials, 142 had ‘p@$$w0rd’ as passwords. On the other hand, 62 passwords contained the ‘123’ sequence.

Worth noting

Upon discovery, the agency was quick at resolving the issue. It has reset the passwords of hacked accounts and changed the internal email server.

However, the Safety Detective’s research lab researchers believe that the sensitive data is still available with the hackers. They can use it to hack new email servers of the INSA if they are insecure and not encrypted.