The NY Times recently published a story about how they were hacked during a four month period. The hacks allegedly were carried out by part of the Chinese military.
One part of the story that confused me was the following:
From there they snooped around The Times’s systems for at least two weeks before they identified the domain controller that contains user names and hashed, or scrambled, passwords for every Times employee.
While hashes make hackers’ break-ins more difficult, hashed passwords can easily be cracked using so-called rainbow tables — readily available databases of hash values for nearly every alphanumeric character combination, up to a certain length. Some hacker Web sites publish as many as 50 billion hash values.
I remember that when news about the LinkedIn passwords being stolen was announced last year that LinkedIn was criticized for not having salted their passwords, and they also said that they would salt passwords in the future to improve security.
If the NY Times had salted passwords then rainbow tables would not be useful for the hackers correct? Does the fact that rainbow tables are mentioned in the story mean that the reporter was confused about how the hack would likely have occurred? Or does this mean that the NY Times was likely using unsalted passwords. If so does this point to poor security on the part of the NY Times (I guess that wouldn't be too surprising given the extent of the hack).
Basically my question is does the fact that rainbow tables were mentioned in the story imply that the NY Times had poor security policies in place. Or are rainbow tables still useful for hacking organizations that have good security practices in place.