Feed: Slashdot
Feed Link: https://slashdot.org/
---

Title: The Louvre's Video Surveillance Password Was 'Louvre'

Link: https://yro.slashdot.org/story/25/11/05/23824...

A bungled October 18 heist that saw $102 million of crown jewels stolen from
the Louvre in broad daylight has exposed years of lax security at the
national art museum. From trivial passwords like 'LOUVRE' to decades-old,
unsupported systems and easy rooftop access, the job was made surprisingly
easy. PC Gamer reports: As Rogue cofounder and former Polygon arch-jester
Cass Marshall notes on Bluesky, we owe a lot of videogame designers an
apology. We've spent years dunking on the emptyheadedness of game characters
leaving their crucial security codes and vault combinations in the open for
anyone to read, all while the Louvre has been using the password "Louvre" for
its video surveillance servers. That's not an exaggeration. Confidential
documents reviewed by Liberation detail a long history of Louvre security
vulnerabilities, dating back to a 2014 cybersecurity audit performed by the
French Cybersecurity Agency (ANSSI) at the museum's request. ANSSI experts
were able to infiltrate the Louvre's security network to manipulate video
surveillance and modify badge access. "How did the experts manage to
infiltrate the network? Primarily due to the weakness of certain passwords
which the French National Cybersecurity Agency (ANSSI) politely describes as
'trivial,'" writes Liberation's Brice Le Borgne via machine translation.
"Type 'LOUVRE' to access a server managing the museum's video surveillance,
or 'THALES' to access one of the software programs published by... Thales."
The museum sought another audit from France's National Institute for Advanced
Studies in Security and Justice in 2015. Concluded two years later, the
audit's 40 pages of recommendations described "serious shortcomings," "poorly
managed" visitor flow, rooftops that are easily accessible during
construction work, and outdated and malfunctioning security systems. Later
documents indicate that, in 2025, the Louvre was still using security
software purchased in 2003 that is no longer supported by its developer,
running on hardware using Windows Server 2003.

Read more of this story at Slashdot.

---
VRSS v2.1.180528