A startup backed by the CIA discovered the login credentials and passwords of 47 US government agencies being posted online, essentially leaving the federal services open to any attacker, or any curious person.
The company Recorded Future, based in Boston, is a data mining service that is backed by the CIA's venture capital. The company stated that it discovered credentials belonging to 47 U.S. government agencies across 89 unique online domains.
Two-factor authentication is an option offered by various online services, such as Facebook, Gmail, and PayPal, to enhance personal security by providing a second layer of defense.
Since passwords are no longer the most secure way to protect an account, linking a mobile phone to your account can be used to prevent an unauthorized login.
However, since early 2015, 12 of the breached American services do not use the two-factor authentication security feature.
“The presence of these credentials on the Open Web leaves these services vulnerable to espionage, to Social engineering attacks, and to tailored spear-phishing attacks against their workforce,” says Recorded Future.
Recorded Future used the Web Intelligence Engine, an “analytics” engine designed to search for “invisible interconnections” among content that refers to “the same or related things and events.”
The Web Intelligence Engine has scanned over 680,000 web sources in multiple languages, and by linking the contextual data and sources together discovered the credentials belonging to government entities.
