Virus Knocks Out U.S. Visa Approval System

GillBates0 writes "According to this story and many others, the State Department's electronic system for checking every visa applicant for terrorist or criminal history failed worldwide late Tuesday because of a computer virus, leaving the U.S. government unable to issue visas. The virus crippled the department's Consular Lookout and Support System, known as CLASS, which contains, among others, names of at least 78,000 suspected terrorists. It was unclear which computer virus might have affected the system. But a separate message sent to embassies and consular offices late Tuesday warned that the Welchia virus had been detected in one facility. Welchia is an aggressive infection unleashed last month that exploits a software flaw in recent versions of Microsoft Windows."

Comments

Does the state dept. read /. ??? NO

[setzman]

If they did, they would know they following:

1.) Use a firewall to block unnecessary access from the external network
2.) Patch Windows often
3.) Use anti-virus software and update the definitions often

I would have thought that the State Department would at least do these minimums (to keep its systems "safe from evil-doers"), but I guess you can't even expect that much from government work.

Re:Does the state dept. read /. ??? NO

[Leffe]

2.) Patch Windows often

Should be:

2.) Use Linux.

Re:Does the state dept. read /. ??? NO

[Trigun]

That is not without its own problems. A certain secure shell comes to mind...

The answer, whether it's windows, linux, unix, bsd, plan 9, or even a commodore 64, is patch early, patch often, test, and pray.

Re:Does the state dept. read /. ??? NO

[PaulK]

At what point will the government and public at large decide that "enough is enough?" Do people have to die before someone takes this seriously?

Day after day, example after example, the world is inundated with successful attacks.

We can say, "Well, people are stupid... They should know not to click on attachments," The reality is though, that "1 in 7" users have problems with the power button.

There is no future security in blaming the end user. It's high time that we look at the systems that allow this type of invasion, replace where necessary, and train the users accordingly.

The talk of cost becomes irrelevant when recovery costs are totalled. Just wait for the first wrongful death suit revolving around an insecure system failure.

If we insist that users are accountable, we must also demand that the corporate citizens are accountable.

Re:Does the state dept. read /. ??? NO

[lanswitch]

As usual, the type of software is probably not the problem. It's the fact that the people running the system either don't know, or don't get the time for the necessary security measurements. Even if you run a completely sealed linux-box, you still will need the time and means to install firewalls, virusscanners, patches etc.

Re:Does the state dept. read /. ??? NO

[jaredcat]

>> 1.) Use a firewall to block unnecessary access from the external network

Really this doesn't work as well as you'd think. If you have laptop users on your network, which nearly everyone does, its analagous to wearing a plastic bubble suit but having unprotected sex with strangers every weekday morning.

My office has about 60 users in it and is protected by PIX firewalls and techdata's email virus scanner. We have about 20 Windows servers in our server room (this doesn't include the many dozens of servers running Linux or Solaris, or the machines at one of our 3 colo sites), and we patch them all about once a month. Office workstations are forced to patch themselves weekly through a distributed Windowsupdate. So yeah, this should be pretty safe, right?

Well about 3 times per week some user brings in a laptop, plugs it in to the LAN, and we get some new worm running around the office LAN.

Re:Does the state dept. read /. ??? NO

[Xerithane]

1.) Use a firewall to block unnecessary access from the external network

They probably do. Then a user VPNs in with an infected machine against policy, or brings a laptop in and plugs it in. This happens at my work, too.

2.) Patch Windows often

Define "often", please. It could be once a month, once a quarter. I'm sure they have change control plans.

3.) Use anti-virus software and update the definitions often

See above.

I would have thought that the State Department would at least do these minimums (to keep its systems "safe from evil-doers"), but I guess you can't even expect that much from government work.

No, it's just that it's easier to assume that you are smarter than them and assume you know their network and systems.

Re:Does the state dept. read /. ??? NO

[spruce]

iIt's high time that we look at the systems that allow this type of invasion,

What systems don't allow this? Paid attention to the recent bugs in OSS apps? It is the "users" - read admin's responsibility to keep up with these things. No system is immune.

Re:Does the state dept. read /. ??? NO

[DGtlRift]

My brother works for the EPA and their IT department is contracted out.. I can't remember who it is now but it was Lockheed Martin before.. they lost the contract and now it's another company... I would imagine the DoS does the same trying to find the lowest bidder... I would imagine that the company that lost the contract may take advantage of the fact that they have knowledge of the system and try to make the new contractor look bad....

Although, according to my brother, usually the loosing contractor lays off the un-needed employees, and the new contractor hires them back... but I would imagine there are a few that might not make the cut with the new company and would be a little disgruntled.
-DG

Re:Does the state dept. read /. ??? NO

[Nick_dm]

From what I've gathered the bugs in OpenSSH didn't even have known exploits when then were patched. No system is perfect but their minimalistic approach with attention to little details is an improvement over other systems where lots of 'minor' bugs are left lying around and sometimes are then found to be major bugs that no one had really understood.

Its true however that in most cases a good sysadmin would solve most of the problems. Most windows users wouldn't be better of switching to openBSD or such, so its the admins job to keep patching boxes and have a decent firewall.

There is still an argument though, that in critical goverment departments, everything possible should be done to avoid security problems and maybe changing the OS as well as hiring some new admins would be sensible.

Re:Does the state dept. read /. ??? NO

[Frater 219]

No system is immune.

But systems are not equally buggy. I discuss this here. No design and no development method is perfect. However, it is incontrovertible that some designs and some development methods yield software that fails less often; that fails less severely; and that fails more recoverably. We can inspect systems' behavior and say that for particular purposes, certain software is better than others. We can say this on the basis of technical facts, not merely marketing claims and promises of "support" and "warranty". We can also say it on the basis of historical evidence -- some systems have failed more often and more severely than others.

A Microsoft Exchange mail server stores users' mail in a binary database, in a proprietary format. A Postfix or Qmail mail server stores users' mail in text files in a simple directory structure. We can make a reasonable (and correct!) prediction that in case of failure, it is easier to recover the content of mail from a Postfix or Qmail system than from Exchange. And, indeed, this is borne out by the experience of administrators: a maildir can get into an inconsistent state, but it's much easier to recover it than to recover an Exchange mail database.

(Note that I'm not describing frequency of failure, but rather severity. We can also make predictions about the former, of course ....)

Security holes are, from an engineering standpoint, simply another kind of failure. We can look at design choices such as privilege separation and chrooting -- applications of the Principle of Least Privilege -- and say that some systems will fail worse than others. A program that can't access files outside of /home/myprog cannot scribble on the kernel in /boot/vmlinuz. A Web server that runs as Administrator on Windows 2000 has opportunities to fail worse than a Web server that runs as www-data on Solaris.

Simply put, there exist objective facts about security design, just as there exist objective facts about, say, civil engineering. Why doesn't the city construct water mains out of balsa wood and bridges out of papier-mache? It simply doesn't work very well. :)

Re:Does the state dept. read /. ??? NO

[antiMStroll]

Congratulations, you win the MS/Godwin award for the first spurious comparison between an arcane, difficult OpenSSH exploit requiring manual application on a per-computer basis and detailed expertise, and a Windows plug-it-in-and-watch-it-die automatic worm vulnerability. I knew someone would rush to claim equivalency between such radically different apples and oranges but am surprised it's getting modded inside of a dozen first posts.

Re:Does the state dept. read /. ??? NO

[__past__]

You test it before you roll it out, like most larger sites have a policy of doing. It's not as if the vulnerability, and the patch, are brand-new, after all, it's just that nobody can afford testing something for months any more (or rather, having too much to do for months before having time to properly patch it), not when various exploits are out in the wild, taking sites down left and right. You better be damn fast at it. If their change plan takes that long, it's broken, and most likely they will just have to pay more testers, so that it becomes faster.

Of course, the money required to pay those testers/admins is not something you'll read about in most TCO studies, nor do the costs of having your network hosed because you didn't pay it. Because, you know, being hit by a worm/virus is just bad luck, and has nothing to do with the rest of your IT strategy.

Re:Does the state dept. read /. ??? NO

[Wakkow]

But IQ is not necessarily a good indicator of common sense or decision making ability ;-)

True, but remember that HALF of the population has below average common sense or decision making ability. =)

Re:Does the state dept. read /. ??? NO

[EzInKy]

Simply put, there exist objective facts about security design, just as there exist objective facts about, say, civil engineering. Why doesn't the city construct water mains out of balsa wood and bridges out of papier-mache? It simply doesn't work very well. :)

You bring up a good point here. Civil Engineers are licensed professionals who are held legally accountable to follow certain well known design standards. Software Engineers on the other hand are unlicensed and expected to ensure that their designs are not well known to anyone other than their employers.

Re:Does the state dept. read /. ??? NO

[lanswitch]

Maybe because the avarage windows-sysadmin is less knowledgerable (phew) than the average *nix sysadmin?
Or because the M$-biased management doesn't understand anything about computers and security, and won't listen to their it-team?
Or because the favourite app of the management requires a hole in the firewall at (for Christ's sake) port 137?

It may be because Windows-based computers are easier to attack, so the majority of the attackers choose windows as their main target. What will happen in 5 years, when the majority of the computers will be running Linux? I think that they will eventually start attacking linux-boxes, because there will be no windows-boxes left ;-)

Re:Does the state dept. read /. ??? NO

[mpe]

There's a difference, however, when a software company sits on its hands and fails to fix known holes, as (ahem) "that" company has on more occasions than I am prepared to take the time to count.

Or play "It's a feature, not a bug". Let alone consider unstructured "sphagetti" code a good thing (whilst describing the result as "integration".)

Windows Means Work

[akedia]

As much the Slashdot community hates Windows and likes to dump on its flaws, I've realized one thing: Windows means jobs in the IT security sector. As a Network Security technician, my job is, among other things, to make sure the latest threat to Microsoft software doesn't bring down the entire infrastructure in the federal department where I work. At least twice a week, my office has a meeting where we discuss the latest Windows virus or exploit, organize a task force, and then do a system-wide deployment of the fix to some 2000+ clients. I like to think that as long as Microsoft keeps making, er, crappy software, and as long as we still have crackers writing virii and trojans, I don't have to worry about losing my job. If there was some magical "perfect" sofware that never needed fixing (note: there isn't) then we wouldn't need IT security professionals now, would we?

Re:Windows Means Work

[Sevn]

I see where you are coming from. The problem is, Windows also means WORK. And MONEY. and LOST PROFIT. and having a freaking stone tied around your neck. Actually, more like having a TICKING TIMEBOMB around your neck and you have no idea what the timer is set for. So from an employees standpoint, sure. Windows problems employ a hell of a lot of us. It's the companys that are getting royally screwed. And the ticking timebomb for us is when they suddenly wake up and realize that. At that point knowing another platform is going to come in mighty handy.

Re:Windows Means Work

[grub]

What you mean is "Windows Means Job Security".

Think of it from the other side of the fence; if you weren't running Windows on every desktop you wouldn't need your 2+/week meetings to discuss the latest viruses and trojans.

Of course that would mean your IT budgets would be cut and people laid off as your group became more productive with less.

We can't have that now, can we?

Re:Windows Means Work

[Anonymous Coward]

Heaven forbid. If you installed something that didn't have Virii, Exploits, Flaws & crashes, what would you do?

Maybe find ways to improve the infrastructure? Evaluate new software products? Streamline internal procedures? Make your infrastructure better, instead of constantly fighting fires?

Is it really such a great job to run around putting out fires and installing fixes, or would you rather sit around and come up with new ways to save the company money and improve efficiency?

God, it sounds like you're a Horse Manure shoveller around the time of Automobiles. "If the Automobile gets popular, we won't have any sh*t to shovel. We'll be out of a job!"

Re:Windows Means Work

[Afty0r]

I've realized one thing: Windows means jobs in the IT security sector.

This is analogous to saying that poor house building regulations and standards means more jobs for builders, plasterers, repairmen, plumbers etc.

It does mean more jobs, however more jobs != a good thing - you're using the wrong metrics.

Re:Windows Means Work

[scorilo]

The same argument was not long ago used by US car makers. They built crappy cars, that required many visits to the mechanic, buying parts, getting to know your car "intimately", etc. (Didn't they invent the term "planned obsolescence"?). Then the Japanese came with cheaper and much better quality cars, bringing the US auto industry to near collapse. They survived only through protectionism and government bailouts.

Re:Windows Means Work

[Spectre]

A better analogy might be:

Poor household wiring means better job security for firefighters.

Why why why?

[grub]

Why is such an important system run on Windows? This isn't an "MS sux0r5, install Linux" rant, they should use the proper systems for the job. If that tool is some open source stuff or closed source then so be it but you can't tell me that this database can only be run on Windows.

Of course "When your only tool is a hammer, every problem starts to look like a nail." ..

Re:Why why why?

[Creep73]

Your comment assumes you know the setup the hows and the whys of what they are using. I would like to know how you know all of this.

I know you don't know the setup so how can you say Microsoft isn't the best tool for the job unless you are simply an anti-Microsoft person then of course your rant is nothing more than the same old Rhetoric. I have read allot of the speculation thrown out as if it was fact or had some basis in reality (Which it doesn't) and find it humorous. It's like watching a group people have a conversation on something they do not know anything about. Hey, that's exactly what it is :)

Thats all I can say at the moment.
:)

Re:Does the state dept. read /. ??? MAYBE

[Leffe]

Not allowing remote logins to something this important might be a good idea ^_^

Re:Firewalls??

[cehbab]

It was cheaper to do without ? We all know how the budgets of gov departments are continually being slashed :)

78 THOUSAND suspected terrorists?

[braddock]

How on earth does the government come up with a list of _78,000_ suspected terrorists? This is the type of indiscriminant prejudice that a seige mentality creates. This is a list of everyone who ever talked to anyone who ever talked to someone who might be a terrorist. In many ways these people's rights are now forfeit.

If the US government actually cared about human lives, it would be spending this type of attention on automobile safety (50k dead a year in US) or malaria (>1 million dead a year worldwide) or cancer (half a million dead in US per year). Compare this to "terrorism" which has claimed maybe 5000 lives in the past 30 years.

Instead we spend more on a "war on terror" in a year than has been spent in the entire history of cancer research.

-braddock

Re:78 THOUSAND suspected terrorists?

[ZoneGray]

>> Instead we spend more on a "war on terror" in a year than has been spent in the entire history of cancer research.

Not even remotely true, unless you only count the money spent by the federal government. There are billions spent every day on cancer research by companies big and small, dwarfing what is spent chasing terrorists.

It's like that year at the Oscars when all those wealthy actors stood up and complained that the US doesn't spend enough on the arts.

Anyway, read the Preamble.... "in Order to form a more perfect Union, establish Justice, insure domestic Tranquility, provide for the common defence, promote the general Welfare, and secure the Blessings of Liberty to ourselves and our Posterity"

No mention of curing cancer, or PBS documentaries, or midnight basketball, or time off from work to take your dog to the vet. Those things are all reasonable, but they're not the primary responsibility of government.

Note, too, the difference in wording: "PROVIDE for the common defense, PROMOTE the general welfare."

Re:Shut down on purpose, not failed....

[phillymjs]

Shutting down a network on purpose is different from having it "fail" due to a virus.

Not by much, since both have the effect of putting a stake through the heart of user productivity for however long it takes to exorcise the virus from all the systems.

~Philly

Trusted Computing

[webzombie]

First high level government agencies and departments suffer "apparent" virus attacks while running MS Windows...

Eventually MS will start pushing their Trusted Computing bullshit as the ultimate solution for blocking attacks on their own flawed products.

Oh and it will keep those nasty terrorist guys out too! Did we (MS) mention terrorists. Oh we did ok...

Re:Does the state dept. read /. ??? MAYBE

[Trigun]

Not allowing remote logins to a national database used to approve visas all over the U.S. which is located in one spot? Do you see the problem?
Ultimate control hinders flexibility. If you want to fill out your application for a visa, send it by mail which will be handled by hundreds of people, to receive your visa which will be mailed to you, again handled by hundreds of people, rather than create a network which will allow someone to remotely access the information that they need in an environment more trusted than the U.S. mail system?
This is not your mom-n-pop accounting database, this is used all over the world. Eliminating remote access is not really an option.

Open Source Theory

[Carrion Creeper]

Immediate term bashing aside

The reason open source is supposed to be better is that when lots more people (like 15% market share worth) run linux, then there will be more resources being used to update and error check open source software - theoretically. Comparing Linux with a small market share to windows with a large market share in terms of bugs is not appropriate, and considering the paid resources available (but maybe not used?) to Microsoft, it is amazing that open source even compares.

Not to knock Volunteers at all, but if every company who used open source in a major way paid for 1-2 full time programmers, which is a relatively small expense, maybe Linux would have an even better security track record. Microsoft can't get much bigger, and their software maintenance model has still proven itself unworthy.

Re:Heads should roll...

[Chibi Merrow]

Now I'm a big Linux supporter and all... but you're way off base here comparing Exchange to a Linux MTA... they're very different beasts.

Just to let you know, we use Exchange, and I think all we did about the virus e-mails was scratch our head and shrug. Never had a single e-mail borne infection...

Though that didn't stop a certain unnamed director from making us send a memo out explaining why people were getting weird e-mails and why the return address was wrong etc...

In THIS case, the article mentions Welchia... Which is NOT an e-mail virus, it's the RPC DCOM worm that tries to patch the Blaster hole. Is it still able to infect due to bad software? Absolutely! But it has NOTHING to do with e-mail or Exchange.

How would a bunch of Linux servers have helped them in this instance? If they're lax on patching Windows boxes, they'll be lax on patching Linux boxes too. Then they're just one OpenSSH exploit away from being out of commission anyway.

The only reason I can think of you being modded up is blind hatred for Microsoft. Hating MS is fine, but don't mark a post as 'Informative' that doesn't even know what they're talking about...

Al Qaeda, traitors, and virus

[WindBourne]

I find it interesting that W. and staff is pushing known insecure systems throughout the government. At the same time, they state that by putting in a firewall, a known insecucure system is as safe as *nix. But of course, in our government we have always had traitors, some who believe in a cause (such as the 2 airmen), and others who will simply take money to look the other way( or to change a final judgement) or to possibly just conenct a laptop into the network. There is no way to secure a computer network, even when not plugged into the internet. Our society is all too willing to accept an insecure system to be plugged into the network. Witness the nuke plant that was infected. It is almost certain that at this point, that a number of virus have been created by UBL that target US (and propably the world) systems to feed info back to them and quite probably to feed money back into their accounts. What Allah does not provide, then willing theives will.
W. et. push security and are having us give up liberties (supposedly temporary), but they are not willing to change their systems due to their pocketbooks.
Bad policies.

Re:Damn terrorists!

[Dr Caleb]

Only 78,000 suspected Terrorists?

I thought the U.S.A. P.A.T.R.I.O.T act made everyone in the US a suspected terrorist. That should read "300,000,000+ suspected terrorists".

Did you read that article on politechbot.com that they wouldn't let some guy wearing a little button that read "Suspected terrorist" fly on an airplane?

It wasn't a computer virus!

[FunWithHeadlines]

I'm getting sick of mainstream media equating Windows viruses with computer viruses. This was NOT a computer virus. Were any Linux machines at risk? No. Were any Macs at risk? No. How about mainframes? Nope. Those are all computers, and yet none of them were at risk from this virus. So it is inaccurate to call these things "computer" viruses.

Call it what it is: A Microsoft Windows virus. Maybe if the media keeps pointing out what us /.ers already know, the general public will get it through their heads that their choice of OS makes a difference.

security will come eventually

[Hrrrg]

I think that we have to remember that computing is still in its early childhood; Eventually software will become more secure. People often state that software is becoming less secure, but one has to remember that today's software is exposed to many more challenges and malicious influences than software 5 or 10 years ago. There are a finite amount of vulnerabilities in code. Once software is "mature" and no longer has new versions coming out every few years, those vulnerabilities will start to disappear. After the same piece of software has been in use for 20 or 50 years, then I suspect it will be quite secure. I do recognize that there will always be a human factor providing insecurity. The human factor, however, will not be the fault of the software.

Re:Rights vs Citizen rights

[merlin_jim]

Sorry human rights and the right to fair treatment below to EVERYBODY, regardless of citizenship.
We have accepted standards of treatment for people we are actively at war with. People who have no apparent hostile intent should get treated at least as well.

While I agree with you that there needs to be an accepted standard of treatment for terrorist actions, similar to the Geneva Accord for wartime, the sad fact is that such a standard does not, at this time, exist.

And these people aren't being treated unfairly; we're not letting them come to the United States without explaining terrorist connections. The United States doesn't belong to the world, it belongs to us, and we can say who we do and do not want to let in.

While I do feel that there should be some oversight over who gets put on this list and how they are selected, that the list should be made publicly available, and that there should be an appeal process to be taken off the list if necessary, none of those is an inalienable right.

I don't have a right to come into your home at any time I like. I can knock on your door and ask if I can come into your home. But if we don't really know each other, and you've seen me in the neighborhood a couple times with some known violent criminals, you would certainly think twice about inviting me in.

I don't see how the United States implementing a similar policy is any different.

Re:78.000 suspected terrorists?

[Orne]

78,000 out of an estimated 6 billion people on this planet, comes out to about 0.0013 % of the world's population. The government's 2001 statistics show that there was 1,063,732 new permanent immigrants entering the united states. Another report on visas issued (Table F) shows that in 2002, there were 13,230,001 temporary visas issued to foreigners to enter the united states. And thats just visas granted, not counts of applications. The raw data also shows the USA had a total of 27,907,139 visitors crossing our borders with visas in 2002.

So, from the numbers above, they have 78,000 applicants as suspect, which is roughly 0.28 % of all visitors. Not exactly a huge amount relative to the sheer number of people trying to get in.

Yes, I can believe a number that large. They could be ex-soldiers from suspect countries, foreign "students" registering in obscure american colleges for odd majors, maybe someone trying to get in with an H1-B who doesn't seem to match his job description, or anything that appears out of the ordinary when cross referenced with other security lists. Did our visa applicant recently travel from Iraq to North Korea, next to the USA? Flag him. Did our visa applicant happen to be in a particular Afghanistan town 2 years ago, when we know that other known terrorists were there at the same time frame? Flag him too.

There are thousands upon thousands of people trying to enter the united states every day, and our government has a monumental task to validate their reasons for entering. Obviously they are trying to research the histories of everyone to the best of their ability, which is why getting the different law enforcement agencies talking to each other was such an issue for the Bush administration. Some people say we're scrutinizing too much, but even more believe it's not enough. Thinking that we have secure borders is a fallacy the US public needs to wake up to and recognize how easy it is for individuals to slip in under false pretenses. We can't be isolationists, but we can certainly do a better job than we've done in the past.

Demand some accountability from the vendors.

[miffo.swe]

Why dont the govt just demand better software? They are such a huge player that there would be a new market created just to sell secure software.

I dont buy this bullsh*t people keeps spreading that its impossible. It aint, just as you can build secure bridges and houses you can make software that is much more secure than todays crap.

There hasnt been a strong enough market for secure software and its up to the consumers and govts to start demand better software.

Even open source could use a kick in the but to get their act togheter.

Compare vsftpd to some other random ftpd and youll get my drift. Security is about design and not about being bugfree.