The CardBoard
Ex Michigan OC, former Stanford GA Matt Weiss indicted - Printable Version

+- The CardBoard (https://thecardboard.org/board)
+-- Forum: C-House! (https://thecardboard.org/board/forum-4.html)
+--- Forum: The CardBoard (https://thecardboard.org/board/forum-5.html)
+--- Thread: Ex Michigan OC, former Stanford GA Matt Weiss indicted (/thread-25528.html)


Ex Michigan OC, former Stanford GA Matt Weiss indicted - dabigv13 - 03-20-2025

https://www.freep.com/story/sports/college/university-michigan/wolverines/2025/03/20/matt-weiss-charged-crimes-computers-michigan-football/82570958007/

Quote:A former Michigan football quarterback coach was indicted on federal criminal charges Thursday, accused of hacking into computers at more than 100 universities across the country and stealing the identities of more than 3,300 student athletes — most of them women.

According to the U.S. Attorney's office, former U-M co-offensive coordinator Matthew Weiss, 42, of Ann Arbor, pulled off his scheme over eight years, between 2015 and 2023, during which he broke into student athlete databases at more than 100 colleges and universities that were maintained by a third-party vendor.

Formerly a GA under Harbaugh from 05-08

RE: Ex Michigan OC, former Stanford GA Matt Weiss indicted - fullmetal - 03-20-2025

Quote:[He]...downloaded the students' passwords that they used to access the system.
...
Weiss cracked the students' encrypted passwords, the indictment said, helped from his own research on the internet.

Wild that databases would store passwords of their users without salting and proper (one-way) hashing.  Malpractice on the part of those database admins.

Here's what those admins should have done: https://www.vaadata.com/blog/how-to-securely-store-passwords-in-database/

RE: Ex Michigan OC, former Stanford GA Matt Weiss indicted - dabigv13 - 03-20-2025

I'm at bit confused, the article apart from the above quoted line seems to indicate he researched information about these people and then used that to guess their passwords. 

Quote:Weiss cracked the students' encrypted passwords, the indictment said, helped from his own research on the internet.

Weiss whittled down his pool of targets to more than 2,000 student athletes, breaking into their social media, email and other accounts by guessing or resetting their passwords, the indictment said. Through further research, he obtained students' personal information, such as maiden names, pet names, places of birth and nicknames — all of which, the indictment said, helped him gain access to yet more information and photos.

I'm guessing the initial reference to "downloading passwords" is sloppy writing but hard to say. In any case, a good reminder of the importance of strong passwords.

RE: Ex Michigan OC, former Stanford GA Matt Weiss indicted - 82lsju - 03-20-2025

(03-20-2025, 04:29 PM)dabigv13 Wrote:  I'm at bit confused, the article apart from the above quoted line seems to indicate he researched information about these people and then used that to guess their passwords. 

Quote:Weiss cracked the students' encrypted passwords, the indictment said, helped from his own research on the internet.

Weiss whittled down his pool of targets to more than 2,000 student athletes, breaking into their social media, email and other accounts by guessing or resetting their passwords, the indictment said. Through further research, he obtained students' personal information, such as maiden names, pet names, places of birth and nicknames — all of which, the indictment said, helped him gain access to yet more information and photos.

I'm guessing the initial reference to "downloading passwords" is sloppy writing but hard to say. In any case, a good reminder of the importance of strong passwords.

and if available two factor authentication

RE: Ex Michigan OC, former Stanford GA Matt Weiss indicted - bl82 - 03-20-2025

This seems like as good time as any to ask whether I should use a password manager service like 1Password, LastPass, Dashlane, Bitwarden or something similar. Surely someone here is very knowledgeable in this area.

RE: Ex Michigan OC, former Stanford GA Matt Weiss indicted - cctop - 03-20-2025

(03-20-2025, 04:45 PM)bl82 Wrote:  This seems like as good time as any to ask whether I should use a password manager service like 1Password, LastPass, Dashlane, Bitwarden or something similar.  Surely someone here is very knowledgeable in this area.

A few things you can and should be doing to make yourself more secure online:
- turn on two-factor authentication (2FA) for all sites that support it.  Usually that means the site texts or emails you a code that you have to type in. Sometime it means you download a phone app that generates a random code.
- use different passwords for every site so when (not if) one site gets compromised you don't give the attacker access to a bunch of other sites.
- use longer passwords. Gibberish passwords are better than words you can find in the dictionary.

All put together, yes it's an excellent idea to use a password manager. Then you only have to remember one really-long difficult-to-guess password:

https://www.xkcd.com/936/

Both Apple and Google Chrome offer free password managers. They're not as full-featured as the ones that you pay for, but they're way better than not using one at all.

RE: Ex Michigan OC, former Stanford GA Matt Weiss indicted - fullmetal - 03-20-2025

Agreed on the usefulness of password managers and 2FA, although I will say that I have been a victim of a SIM swap attack, and that could easily defeat 2FA for an attacker that was targeting you specifically.  Most of the time 2FA is used for silly things like changing a bank password and stealing money over Zelle (my situation).

RE: Ex Michigan OC, former Stanford GA Matt Weiss indicted - cctop - 03-20-2025

(03-20-2025, 05:21 PM)fullmetal Wrote:  Agreed on the usefulness of password managers and 2FA, although I will say that I have been a victim of a SIM swap attack, and that could easily defeat 2FA for an attacker that was targeting you specifically.  Most of the time 2FA is used for silly things like changing a bank password and stealing money over Zelle (my situation).

That's unfortunate.

But yeah, it's like locking the doors to your house. It'll stop people from just walking in but a determined thief will just break a window.

I started using a password manager and an app-based 2FA for my important accounts after a friend got his bank account stolen repeatedly.

RE: Ex Michigan OC, former Stanford GA Matt Weiss indicted - martyup - 03-20-2025

I have used LastPass for several years.  I've never had a compromise, but I'll still knock on wood.

RE: Ex Michigan OC, former Stanford GA Matt Weiss indicted - M T - 03-21-2025

A password manager seems both necessary and obvious.  Besides allowing you to use secure passwords with ease, it also allows you to enter passwords without typing them (avoiding cameras capturing what you type).

A SIM attack is just one way to bypass what many sites pass off as two factor authentication (2FA).
Anyone who gets into your email is going to bypass most of them.  Anyone who gets into your phone (such as with a SIM attack) is going to get into the validation codes texted to your phone.  Anyone who gets into your computer can also get them, if your computer is also receiving text messages.

If your bank offers sending you you login validation codes by text, email, or their app, turn off text and email and just use the app.

Time-based one-time passwords (TOTP), generated by a device, is a better choice, but of course is vulnerable to the compromise or loss of the device or whatever you use to read it.  (IIRC, the biggest supplier of those had a vulnerability for all previous devices in the last year.)    I would advise against using TOTP from your password manager or even from a device that has your password manager on it.

BUT... Password managers are vulnerable to anything that captures you typing your password to it. (keyloggers or cameras)  There was a significant incident recently that started with an privileged user getting a keylogger on a personal computer.  The bad actors captured the password to his password manager, then used that to get into his work systems.

A suggestion:  For your critical passwords, do not store the entire password in your password manager.  Do something like having a suffix that you add to the stored password (or, alternatively, add a few characters to your stored password, that you delete after the password is filled in.)

I also am a believer in the use of long, word-based passwords. (Not "beam-me-up-scotty" but random words, such as DOCKHAND-socrates-finn-frizz).  These are perhaps easier to type and certainly easier to verbally pass to someone else, or to remember from the time you see it to the time you type it.  I expect most password managers offer the ability to choose these.  My password manager uses a dictionary of 30,000 words, so there are (30,000)^4 = 8.1x10^17 4-word passwords.  That is equivalent to truly random 9-character passwords such as NL9gC-aDE.  A 5-word password (2.4x10^22) is better than a truly random 11-character password.  

Beware of using Leet-speak passwords (P@55w0rd) as attacking that is built into all password cracking tools.  The crackers also have every typing pattern password you can imagine (1qaz@WSX).  If you insist upon coming up with your own password, try to make it one that no one in the world would have EVER used.  If someone in Portugal used it 5 years ago, it very well could be in the dictionaries of previously captured passwords.  I quickly found a list of 8.4 billion such passwords.  These would be checked first.

How fast can passwords be cracked?  Online attacks (attempting to login over the net) are usually throttled by the server's speed of checking the password, or intentional delays in that process.   Offline attacks (where the bad actor has a stolen copy of a set of hashes used to authenticate users) can run at amazing speeds.  Basically, the system guesses passwords very, very quickly.  An M3 MacBook can attack Mac 10.6 password hashes at a rate of 2.3 billion tests per second  (so it would cover that 8.4 billion captured passwords in 4 seconds, and start testing variants).  It can attack captured WPA-2 (wifi) packets at 145,000 guesses/second to discover the WPA2-PSK password.  Not only can bad guys have big rigs with lots of even faster GPUs, but they also post the hashes publicly for others to use their rigs on them.

Edit: If you use a PIN or password to unlock your laptop/tablet/phone, you need to expect that whoever steals that device has recorded a video of you entering that password. (which, by the way, means a long password is not much better than a shorter one). It is much better to use the face recognition technology (I don't know about others, but Apple's seems pretty solid against someone forging your face). From the little I know about fingerprint readers, I'd be wary of them, but I haven't noticed any common attacks of, say, 3-d printing fingertips from a fingerprint or a picture of a finger tip. Eventually, we'll get to where we carry one device to unlock the other devices. That device IS the digital you, so it needs to be protected. (Something like the Apple Watch could be that, as it knows when it leaves your wrist and shuts down. But so far, it doesn't seem there yet. And it isn't sufficiently protected from someone entering your unlock PIN.)

RE: Ex Michigan OC, former Stanford GA Matt Weiss indicted - Mick - 03-21-2025

Posty! This is the most useful post I've seen in good long while, at least useful for me...

RE: Ex Michigan OC, former Stanford GA Matt Weiss indicted - Griffins78 - 03-21-2025

Agree but also very scary.

RE: Ex Michigan OC, former Stanford GA Matt Weiss indicted - M T - 03-21-2025

My post about passwords was therapy to get past the effects of going to the WBB game. I love it when they win but I don’t like how I am after a loss like that. (It must have been Chuck’s fault that every traffic light on the way south down El Camino to 85 was red!)