Slashdot Mirror
Is it Just Me, Or Is Our Mainframe Missing?
xnuandax writes "Here's a salient lesson for those system security personnel who spend their time fretting over the theoretical crack-ability of their 1024 bit encryption keys. Australian Customs have recently suffered a rather unfortunate set back in their "War Against Terror" with the admission that two of their secure mainframe servers have been wheeled out of the building by persons unknown. I'll bet my $2 that the root password on those boxes was 'trustno1'."
Let this be a lesson...
When you're caught being grossly negligent and incompetant, blame terrorists.
Simple security procedures.
Didn't anyone learn anything from losers like Kevin Mitnick?
Deography Photoblog
As the article states, they were likely after information, not hardware. It's likely that hardware will be destroyed after the info is sucked off of it.
This just reminds us what the greatest risks are to any secure system: social engineering and inside men. If you look authoritative and dress up in a serviceman's outfit, very few people will question your actions. You can steal furniture, computers, machinery, tools, whatever by just looking important. By imporsonating a sysadmin on the phone, you can easily talk passwords out of gullible people. With a fake service order "signed" by the right people, the odds are endless.
On the same note, people inside an organization are often responsible for hacks, stolen information, and other things since they have the keys already!
It just goes to show the weakest portion of any system is the people.
The Australian Customs Service has admitted the security blunder, but told customs officers in an email that no sensitive operational information was lost.
As we can see it's a well-planned action, and there's almost no way to sell the two mainframe for good profit. The major cost center of a mainframe lies mainly in the operational and maintanence, which are not applicable to stolen hardware.
Obviously, their target is the data within. If the authority do not start investigating what information the thieves are looking for and the possible use of the information within the stolen hw, the consequence might be very serious.
No more official BS. Do something before too late.
If, as described, they were actual mainframes, the Customs people's statement that no sensitive info was lost/stolen might not be too far from the truth. In servers & other high end systems, it's not uncommon for the hard drives in the computer to contain only the OS & applications. The data used/created by the applications would be on a RAID attached to the computer. If that was the setup of the systems, the only actual data would system passwords and possibly temp data currently in use at the time of shutdown.
If, however, one or more of the systems was a RAID or some such data storage system, then the Custom's people are (as expected) lying through their teeth. The next question would be whether or not some form of encryption was in use (fs or application level).
to access your data, I have to know your publicly available ID and I have to have access to the phone in your (unlocked) cubicle.
How well does your company pay their cleaning/janitorial staff? Suppose a coworker went into your cubicle and called IT from your phone -- how would security find out who did it?
I would assume that they would need to see your ID (as well as you) before resetting your password. If that is too burdensome, then have a system in which you contact your manager or HR. One of these can then log in through a secure connection and file a password reset request with your ID to the remote IT support site. The fact that they are logged in (with their password) at least ensures there is a starting point for an audit, and the odds of impersonation are less likely.
When in doubt, have a man come through a door with a gun in his hand.
The article "states" that, but how does anyone know? The thieves didn't give any interviews.
They presented themselves to the security desk as technicians sent by Electronic Data Systems, the outsourced customs computer services provider which regularly sends people to work on computers after normal office hours.
Another reason you should be damn careful about how you outsource, who you outsource with, and the security involved. People need to know who they're really dealing with and how to check.
"The Sage treasures Unity and measures all things by it" - Lao Tzu
I had to visit the data center for a major financial center in Jersey City, NJ shortly after WTC. (A lot of the big iron is across the river from Manhattan... for price reasons more than security) Because of the sudden lack of available downtown office space, every available empty space in Jersey City was suddenly rented out.
So... I walked into see my customer. I was surprised a the new security in place. I showed my company badge, signed in, and was lead to a desk under a sign marked "High Value Transactions". Plopped me right down in front of a terminal. I was really confused. The setup was totally different than what I was expecting from previous visits. So I started looking around for people I knew, etc... After about 10 minutes I realized I was in the data center for the WRONG company!
So I got up and left. I have no idea how long I could have stayed there, or what I could have done. I suspect that if I had gotten out a screwdriver, I could have likely started shopping for hardware.
Moral of the story: chaos breeds insecurity, and an "official" plastic badge with your picture on it is shockingly powerful.