Virus Knocks Out U.S. Visa Approval System

GillBates0 writes "According to this story and many others, the State Department's electronic system for checking every visa applicant for terrorist or criminal history failed worldwide late Tuesday because of a computer virus, leaving the U.S. government unable to issue visas. The virus crippled the department's Consular Lookout and Support System, known as CLASS, which contains, among others, names of at least 78,000 suspected terrorists. It was unclear which computer virus might have affected the system. But a separate message sent to embassies and consular offices late Tuesday warned that the Welchia virus had been detected in one facility. Welchia is an aggressive infection unleashed last month that exploits a software flaw in recent versions of Microsoft Windows."

Comments

Does the state dept. read /. ??? NO

[setzman]

If they did, they would know they following:

1.) Use a firewall to block unnecessary access from the external network
2.) Patch Windows often
3.) Use anti-virus software and update the definitions often

I would have thought that the State Department would at least do these minimums (to keep its systems "safe from evil-doers"), but I guess you can't even expect that much from government work.

Re:Does the state dept. read /. ??? NO

[duffbeer703]

Don't be silly. If the DoS read /., everything would be running on OpenBSD and MySQL.

Re:Does the state dept. read /. ??? NO

[Leffe]

2.) Patch Windows often

Should be:

2.) Use Linux.

Re:Does the state dept. read /. ??? NO

[Trigun]

That is not without its own problems. A certain secure shell comes to mind...

The answer, whether it's windows, linux, unix, bsd, plan 9, or even a commodore 64, is patch early, patch often, test, and pray.

Re:Does the state dept. read /. ??? NO

[PaulK]

At what point will the government and public at large decide that "enough is enough?" Do people have to die before someone takes this seriously?

Day after day, example after example, the world is inundated with successful attacks.

We can say, "Well, people are stupid... They should know not to click on attachments," The reality is though, that "1 in 7" users have problems with the power button.

There is no future security in blaming the end user. It's high time that we look at the systems that allow this type of invasion, replace where necessary, and train the users accordingly.

The talk of cost becomes irrelevant when recovery costs are totalled. Just wait for the first wrongful death suit revolving around an insecure system failure.

If we insist that users are accountable, we must also demand that the corporate citizens are accountable.

Re:Does the state dept. read /. ??? NO

[Eric_Cartman_South_P]

You forgot...

4.) vi is better than e-macs

5.) In Soviet Russia, you attack Virus!

6.) People should patch their boxes bec.#J^@ATDT[NO CARRIER]

7.) Don't use FreeBSD because it's dead/dying.

8.) Apple is awesome. But I can't afford one.

9.) Imagine a Beowolf cluster of those!

10.) Patents, RIAA, Spooks, Windoze, Verisign, Politician, Spalling Checkirs; all bad.

11.) Ogg, Apple, *nix, RMS, EFF; all good.

12.) ???

13.) Profit!

PS. Mod's, go away. I'm just having fun. Don't put it up or down you fu%#d2DHATDT[NO CARRIER]

Re:Does the state dept. read /. ??? NO

[jaredcat]

>> 1.) Use a firewall to block unnecessary access from the external network

Really this doesn't work as well as you'd think. If you have laptop users on your network, which nearly everyone does, its analagous to wearing a plastic bubble suit but having unprotected sex with strangers every weekday morning.

My office has about 60 users in it and is protected by PIX firewalls and techdata's email virus scanner. We have about 20 Windows servers in our server room (this doesn't include the many dozens of servers running Linux or Solaris, or the machines at one of our 3 colo sites), and we patch them all about once a month. Office workstations are forced to patch themselves weekly through a distributed Windowsupdate. So yeah, this should be pretty safe, right?

Well about 3 times per week some user brings in a laptop, plugs it in to the LAN, and we get some new worm running around the office LAN.

Re:Does the state dept. read /. ??? NO

[Xerithane]

1.) Use a firewall to block unnecessary access from the external network

They probably do. Then a user VPNs in with an infected machine against policy, or brings a laptop in and plugs it in. This happens at my work, too.

2.) Patch Windows often

Define "often", please. It could be once a month, once a quarter. I'm sure they have change control plans.

3.) Use anti-virus software and update the definitions often

See above.

I would have thought that the State Department would at least do these minimums (to keep its systems "safe from evil-doers"), but I guess you can't even expect that much from government work.

No, it's just that it's easier to assume that you are smarter than them and assume you know their network and systems.

Re:Does the state dept. read /. ??? NO

[spruce]

iIt's high time that we look at the systems that allow this type of invasion,

What systems don't allow this? Paid attention to the recent bugs in OSS apps? It is the "users" - read admin's responsibility to keep up with these things. No system is immune.

Re:Does the state dept. read /. ??? NO

[Zak3056]

The reality is though, that "1 in 7" users have problems with the power button.

I once worked for an engineer who was very fond of quoting that, by definition, 50% of the population has an IQ below 100.

Re:Does the state dept. read /. ??? NO

[Dwedit]

You forgot to mention SCO :)

Re:Does the state dept. read /. ??? NO

[Soul-Burn666]

You forgot:
14) Hot grits!
15) Smoking crack for 699$
16) It's thursday, who do we hate today?
17) Imagine the implications for the pr0n industry!
18) Don't forget insensitive clod, you insensitive clod!
19) You can mod me down if you want, but....
20) And for the math impared...... 1.6miles = 1km
21) Slashdotted? Here's the google mirror.
22) But does it run linux? .........

Re:Does the state dept. read /. ??? NO

[Nick_dm]

From what I've gathered the bugs in OpenSSH didn't even have known exploits when then were patched. No system is perfect but their minimalistic approach with attention to little details is an improvement over other systems where lots of 'minor' bugs are left lying around and sometimes are then found to be major bugs that no one had really understood.

Its true however that in most cases a good sysadmin would solve most of the problems. Most windows users wouldn't be better of switching to openBSD or such, so its the admins job to keep patching boxes and have a decent firewall.

There is still an argument though, that in critical goverment departments, everything possible should be done to avoid security problems and maybe changing the OS as well as hiring some new admins would be sensible.

Re:Does the state dept. read /. ??? NO

[Frater 219]

No system is immune.

But systems are not equally buggy. I discuss this here. No design and no development method is perfect. However, it is incontrovertible that some designs and some development methods yield software that fails less often; that fails less severely; and that fails more recoverably. We can inspect systems' behavior and say that for particular purposes, certain software is better than others. We can say this on the basis of technical facts, not merely marketing claims and promises of "support" and "warranty". We can also say it on the basis of historical evidence -- some systems have failed more often and more severely than others.

A Microsoft Exchange mail server stores users' mail in a binary database, in a proprietary format. A Postfix or Qmail mail server stores users' mail in text files in a simple directory structure. We can make a reasonable (and correct!) prediction that in case of failure, it is easier to recover the content of mail from a Postfix or Qmail system than from Exchange. And, indeed, this is borne out by the experience of administrators: a maildir can get into an inconsistent state, but it's much easier to recover it than to recover an Exchange mail database.

(Note that I'm not describing frequency of failure, but rather severity. We can also make predictions about the former, of course ....)

Security holes are, from an engineering standpoint, simply another kind of failure. We can look at design choices such as privilege separation and chrooting -- applications of the Principle of Least Privilege -- and say that some systems will fail worse than others. A program that can't access files outside of /home/myprog cannot scribble on the kernel in /boot/vmlinuz. A Web server that runs as Administrator on Windows 2000 has opportunities to fail worse than a Web server that runs as www-data on Solaris.

Simply put, there exist objective facts about security design, just as there exist objective facts about, say, civil engineering. Why doesn't the city construct water mains out of balsa wood and bridges out of papier-mache? It simply doesn't work very well. :)

Re:Does the state dept. read /. ??? NO

[antiMStroll]

Congratulations, you win the MS/Godwin award for the first spurious comparison between an arcane, difficult OpenSSH exploit requiring manual application on a per-computer basis and detailed expertise, and a Windows plug-it-in-and-watch-it-die automatic worm vulnerability. I knew someone would rush to claim equivalency between such radically different apples and oranges but am surprised it's getting modded inside of a dozen first posts.

Re:Does the state dept. read /. ??? NO

[sporty]

And block attachments that are prone to viruses for the love of God. pdf, yeah, it can get a virus due to acrobat .. but that's usually less broken than say, word and it's macro viruses, or microsoft lookout and it's vulnerabilities. So you'd at least filter all the extensions for attachments that aren't safe..

Re:Does the state dept. read /. ??? NO

[Trigun]

Where do I pick up my prize? Do I have to say a speech?

And, as long as this has no bearing on the judges decision, I am most definitely not claiming equivalancy, but rather responding to the ever-present troll which claims that linux is a drop-in security solve-all.

Re:Does the state dept. read /. ??? NO

[__past__]

You test it before you roll it out, like most larger sites have a policy of doing. It's not as if the vulnerability, and the patch, are brand-new, after all, it's just that nobody can afford testing something for months any more (or rather, having too much to do for months before having time to properly patch it), not when various exploits are out in the wild, taking sites down left and right. You better be damn fast at it. If their change plan takes that long, it's broken, and most likely they will just have to pay more testers, so that it becomes faster.

Of course, the money required to pay those testers/admins is not something you'll read about in most TCO studies, nor do the costs of having your network hosed because you didn't pay it. Because, you know, being hit by a worm/virus is just bad luck, and has nothing to do with the rest of your IT strategy.

Re:Does the state dept. read /. ??? NO

[Robber Baron]

3.) Use anti-virus software and update the definitions often

Define "often", please. It could be once a month, once a quarter. I'm sure they have change control plans.

I've been using Norton Corporate Edition on my networks quite successfully for some time now. A server is config'd to be the update server and all the clients are managed from it. You can push updates to all the clients either manually or schedule them to update automatically. You can even force clients that come on the network to accept an AV client install package before they are allowed to participate.

I also would recommend putting the laptops on a separate node and firewalling them off from the rest.

No, it's just that it's easier to assume that you are smarter than them and assume you know their network and systems.

Not necessarily. Whenever you get into larger bureaucracies, there's always a level of friction with respect to implementing IT changes/updates. Any number of things could be causing it. It could be clueless, IT staff used to screwing the pooch in gov't service, it could be difficulties in getting anything approved, it could simply be toxic office politics. It could be little dictators building mini-kingdoms for themselves...refusing to implement any suggestions because THEY didn't come up with it (I've seen that one many times!). I don't think it's the nature of their networks and systems that's the issue here at all, after all it's a Windows virus/worm that took them out. How unusual is that?

Re:Does the state dept. read /. ??? NO

[zelurxunil]

Ok, good point pulling linux out of the box does not fix security problems, but correct configuration of a linux system WOULD prevent a lot of the threats that viruses present. Not to mention the fact that it would save them millions in licensing. The time it would take knowledgable techies to set up a linux based security system can't be much more than that of a Windows based system, and in the long run saves money. The real question is how can a government organization using tax money pay millions for software licenses for crap software...

Re:Does the state dept. read /. ??? NO

[Wakkow]

But IQ is not necessarily a good indicator of common sense or decision making ability ;-)

True, but remember that HALF of the population has below average common sense or decision making ability. =)

Re:Does the state dept. read /. ??? NO

[EzInKy]

Simply put, there exist objective facts about security design, just as there exist objective facts about, say, civil engineering. Why doesn't the city construct water mains out of balsa wood and bridges out of papier-mache? It simply doesn't work very well. :)

You bring up a good point here. Civil Engineers are licensed professionals who are held legally accountable to follow certain well known design standards. Software Engineers on the other hand are unlicensed and expected to ensure that their designs are not well known to anyone other than their employers.

Re:Does the state dept. read /. ??? NO

[mpe]

A Microsoft Exchange mail server stores users' mail in a binary database, in a proprietary format. A Postfix or Qmail mail server stores users' mail in text files in a simple directory structure. We can make a reasonable (and correct!) prediction that in case of failure, it is easier to recover the content of mail from a Postfix or Qmail system than from Exchange. And, indeed, this is borne out by the experience of administrators: a maildir can get into an inconsistent state, but it's much easier to recover it than to recover an Exchange mail database.

Or at an even more basic level the difference between the Windows Registry which has everything from the critical to the trivial in one big binary lump and the "unix method" of having text config files.

Re:Does the state dept. read /. ??? NO

[mpe]

There's a difference, however, when a software company sits on its hands and fails to fix known holes, as (ahem) "that" company has on more occasions than I am prepared to take the time to count.

Or play "It's a feature, not a bug". Let alone consider unstructured "sphagetti" code a good thing (whilst describing the result as "integration".)

Re:Does the state dept. read /. ??? NO

[ColeNielsen]

It's just another reason why use of Microsoft Software when it comes to my finances and other personal information should be forbidden...

Re:Does the state dept. read /. ??? NO

[pmz]

I once worked for an engineer who was very fond of quoting that, by definition, 50% of the population has an IQ below 100.

What an amazing prediction of the 2000 Presidential election!

Re:Does the state dept. read /. ??? NO

[matvei]

I for one welcome our SCO overl.. nevermind.

Re:Does the state dept. read /. ??? NO

[bheerssen]

Software Engineers on the other hand are unlicensed and expected to ensure that their designs are not well known to anyone other than their employers.

It's so true.

*sniff, wipes tear*

I love perl.

Re:Does the state dept. read /. ??? NO

[texaport]

Just so long as it did not wipe out the nation's MasterCard approval system.

--
Fulfill your economic, patriotic duty.
Spend ourselves out of this recession.

Windows Means Work

[akedia]

As much the Slashdot community hates Windows and likes to dump on its flaws, I've realized one thing: Windows means jobs in the IT security sector. As a Network Security technician, my job is, among other things, to make sure the latest threat to Microsoft software doesn't bring down the entire infrastructure in the federal department where I work. At least twice a week, my office has a meeting where we discuss the latest Windows virus or exploit, organize a task force, and then do a system-wide deployment of the fix to some 2000+ clients. I like to think that as long as Microsoft keeps making, er, crappy software, and as long as we still have crackers writing virii and trojans, I don't have to worry about losing my job. If there was some magical "perfect" sofware that never needed fixing (note: there isn't) then we wouldn't need IT security professionals now, would we?

Re:Windows Means Work

[Sevn]

I see where you are coming from. The problem is, Windows also means WORK. And MONEY. and LOST PROFIT. and having a freaking stone tied around your neck. Actually, more like having a TICKING TIMEBOMB around your neck and you have no idea what the timer is set for. So from an employees standpoint, sure. Windows problems employ a hell of a lot of us. It's the companys that are getting royally screwed. And the ticking timebomb for us is when they suddenly wake up and realize that. At that point knowing another platform is going to come in mighty handy.

Re:Windows Means Work

[grub]

What you mean is "Windows Means Job Security".

Think of it from the other side of the fence; if you weren't running Windows on every desktop you wouldn't need your 2+/week meetings to discuss the latest viruses and trojans.

Of course that would mean your IT budgets would be cut and people laid off as your group became more productive with less.

We can't have that now, can we?

Re:Windows Means Work

[Morosoph]

Time again to post an article on The Broken Windows fallacy.

Re:Windows Means Work

[Afty0r]

I've realized one thing: Windows means jobs in the IT security sector.

This is analogous to saying that poor house building regulations and standards means more jobs for builders, plasterers, repairmen, plumbers etc.

It does mean more jobs, however more jobs != a good thing - you're using the wrong metrics.

Re:Windows Means Work

[Morosoph]

This link is better.

Re:Windows Means Work

[scorilo]

The same argument was not long ago used by US car makers. They built crappy cars, that required many visits to the mechanic, buying parts, getting to know your car "intimately", etc. (Didn't they invent the term "planned obsolescence"?). Then the Japanese came with cheaper and much better quality cars, bringing the US auto industry to near collapse. They survived only through protectionism and government bailouts.

Re:Windows Means Work

[Spectre]

A better analogy might be:

Poor household wiring means better job security for firefighters.

Why why why?

[grub]

Why is such an important system run on Windows? This isn't an "MS sux0r5, install Linux" rant, they should use the proper systems for the job. If that tool is some open source stuff or closed source then so be it but you can't tell me that this database can only be run on Windows.

Of course "When your only tool is a hammer, every problem starts to look like a nail." ..

Re:Why why why?

[Creep73]

Your comment assumes you know the setup the hows and the whys of what they are using. I would like to know how you know all of this.

I know you don't know the setup so how can you say Microsoft isn't the best tool for the job unless you are simply an anti-Microsoft person then of course your rant is nothing more than the same old Rhetoric. I have read allot of the speculation thrown out as if it was fact or had some basis in reality (Which it doesn't) and find it humorous. It's like watching a group people have a conversation on something they do not know anything about. Hey, that's exactly what it is :)

Thats all I can say at the moment.
:)

Damn terrorists!

[MagerValp]

So now even terrorists using a fake name won't be able to get into the US!

Re:Damn terrorists!

[Dr Caleb]

Only 78,000 suspected Terrorists?

I thought the U.S.A. P.A.T.R.I.O.T act made everyone in the US a suspected terrorist. That should read "300,000,000+ suspected terrorists".

Did you read that article on politechbot.com that they wouldn't let some guy wearing a little button that read "Suspected terrorist" fly on an airplane?

Re:Damn terrorists!

[blibbleblobble]

"Did you read that article on politechbot.com that they wouldn't let some guy wearing a little button that read "Suspected terrorist" fly on an airplane?"

Some guy being John Gilmore:

http://freetotravel.org/terrorist.html

You're right: there are 300 million suspected terrorists. But their names don't need to be stored - they took a hint from verisign, and just used a wildcard.

Select * from americans where police_badge = NULL;

Priceless!

[ncmusic]

Seems like there's a Mastercard joke in here somewhere.

Oh, *that* VISA....

[KFK - Wildcat]

And here I was thinking about all the new "Already approved VISA platinum card!" in my inbox...

78.000 suspected terrorists?

[Raindeer]

Dang, just imagine how many people that is. Have they actually researched all those people? I am just baffled by the sheer number and really wonder how they came up with that list.

Re:78.000 suspected terrorists?

[eddy]

We'll, if Steven owns ten guns and threaten a government official, that's equivalent to two terrorists (5 guns / threat == 1 terrorist).

Please call the MPAA if you want to learn more about this new branch of mathematics.

Re:78.000 suspected terrorists?

[stratjakt]

Actually, after looking at the state depts website, I found this.

Seems that when someone applies for a visa, gets checked out and denied, they get added to CLASS.

Re:78.000 suspected terrorists?

[Hes Nikke]

make that 78,001 suspected terrorists! questioning how the government decides who is a terrorist makes you an obvious potential terrorist!

<soup="nazi"> NO VISA FOR YOU!!! </soup>

Re:78.000 suspected terrorists?

[ikkonoishi]

You read it wrong.

Its only 78.

The computer added the precision on so if the terrorists blow themselves up they can count the pieces.

Re:78.000 suspected terrorists?

[Orne]

78,000 out of an estimated 6 billion people on this planet, comes out to about 0.0013 % of the world's population. The government's 2001 statistics show that there was 1,063,732 new permanent immigrants entering the united states. Another report on visas issued (Table F) shows that in 2002, there were 13,230,001 temporary visas issued to foreigners to enter the united states. And thats just visas granted, not counts of applications. The raw data also shows the USA had a total of 27,907,139 visitors crossing our borders with visas in 2002.

So, from the numbers above, they have 78,000 applicants as suspect, which is roughly 0.28 % of all visitors. Not exactly a huge amount relative to the sheer number of people trying to get in.

Yes, I can believe a number that large. They could be ex-soldiers from suspect countries, foreign "students" registering in obscure american colleges for odd majors, maybe someone trying to get in with an H1-B who doesn't seem to match his job description, or anything that appears out of the ordinary when cross referenced with other security lists. Did our visa applicant recently travel from Iraq to North Korea, next to the USA? Flag him. Did our visa applicant happen to be in a particular Afghanistan town 2 years ago, when we know that other known terrorists were there at the same time frame? Flag him too.

There are thousands upon thousands of people trying to enter the united states every day, and our government has a monumental task to validate their reasons for entering. Obviously they are trying to research the histories of everyone to the best of their ability, which is why getting the different law enforcement agencies talking to each other was such an issue for the Bush administration. Some people say we're scrutinizing too much, but even more believe it's not enough. Thinking that we have secure borders is a fallacy the US public needs to wake up to and recognize how easy it is for individuals to slip in under false pretenses. We can't be isolationists, but we can certainly do a better job than we've done in the past.

Re:Here we go

[garcia]

maybe the US government could have better IT departments...

Instead of wasting time being completely down, take the time to patch these system (either with distributed patching or even individuals taking the time to patch EACH machine -- oh the horror).

It's much better than not being able to issue Visas or do any other work while you have to keep your PC powered down until it is certified clean by IT.

Even if a perfectly secure OS existed

[garrulous]

security professionals would still exist to protect users from their own stupidity.

Shut down on purpose, not failed....

[jdreed1024]

According to a CNN article, the State Department shut down the network to prevent the spread of the virus. It was down from noon until 9PM on Tuesday. Shutting down a network on purpose is different from having it "fail" due to a virus.

Re:Shut down on purpose, not failed....

[phillymjs]

Shutting down a network on purpose is different from having it "fail" due to a virus.

Not by much, since both have the effect of putting a stake through the heart of user productivity for however long it takes to exorcise the virus from all the systems.

~Philly

When is the Gov't gonna learn

[Anonymous Coward]

Some day soon there will be a class action lawsuit against M$ regarless of their 'Hold Harmless Agreement' in the EULA.

And BTW, firwall WON'T in and of themselves stop this kind of attack. Sure firewalls are your first line of defense, but all it takes is someone that has a notebook that is infected from home, a business trip or somewhere ELSE to bring it as a 'trusted' device on your clean network and BOINK, you are infected internally.

Firewalls??

[Kushy]

What is a gov agency doing having open ports on their firewalls anyway?

Honestly issuing visa's is just way to importiant to trust to a closed OS with known security flaws, with at least one major one a month.

MS is so entrenched in the gov now that its kind of scary, that one day a order might come down to homeland security that some town is nothing but terrioriests and should be arrested, then taken to cuba. Meanwhile some hacker in the assend of the planet wiring a virus to gain entry to the gov systems is laughing his ass of at Ma and Pa being taken to a Marine base in another country.

Re:Firewalls??

[cehbab]

It was cheaper to do without ? We all know how the budgets of gov departments are continually being slashed :)

Re:Firewalls??

[stratjakt]

You're a dope.

CLASS isn't an access database running on a windows server. It's running on big iron, probably Oracle, or perhaps not even a RDBMS at all, but a custom data store solution.

Anyhow, the virus didnt take the system down. They took the system down to inspect the network.

If one box on the network got r00t3d, then a r337 h4x0r could use it to query the system.

This is just a bit of better-safe-than-sorry administration. It really has nothing to do with Windows, except a line about a completely unrelated memo that refers to a totally seperate facility.

Perhaps they all run linux and are worried about the flurry of flaws found in "secure" open source. The result would be exactly the same.

And firewalls dont prevent someone from brining a virus in with their laptop or the floppy with the hilarious flash based game that one clerk wants to show her friends.

Clearly the Kofi Annan of Slashdot commenters

[Futurepower(R)]

From the parent comment: "... Microsoft keeps making, er, crappy software ..."

I just want to say that I appreciate the tactfulness, sensitivity, restraint, and diplomacy of that remark.

Windows

[cybercuzco]

Because remember, if you use Windows, the terrorists have already won. (its a feature, not a bug)

Re:Does the state dept. read /. ??? MAYBE

[Leffe]

Not allowing remote logins to something this important might be a good idea ^_^

78 THOUSAND suspected terrorists?

[braddock]

How on earth does the government come up with a list of _78,000_ suspected terrorists? This is the type of indiscriminant prejudice that a seige mentality creates. This is a list of everyone who ever talked to anyone who ever talked to someone who might be a terrorist. In many ways these people's rights are now forfeit.

If the US government actually cared about human lives, it would be spending this type of attention on automobile safety (50k dead a year in US) or malaria (>1 million dead a year worldwide) or cancer (half a million dead in US per year). Compare this to "terrorism" which has claimed maybe 5000 lives in the past 30 years.

Instead we spend more on a "war on terror" in a year than has been spent in the entire history of cancer research.

-braddock

Re:78 THOUSAND suspected terrorists?

[suso]

How? They just do a grep for names without vowels.

Re:78 THOUSAND suspected terrorists?

[bigjnsa500]

Paragraph 1: Answer is yes. Its people who talked to whoever. That's cool with me.

Paragraph 2: Car Safety. Answer is people keep getting bigger and bigger vehicles. Plus that number is mostly people who shouldn't have been in the gene pool anyway. Malaria. Don't live in a jungle. Cancer. Too bad we all get it. Stop smoking, stop fucking, stop eating bad foods. Easy.

Re:78 THOUSAND suspected terrorists?

[ryanvm]

How on earth does the government come up with a list of _78,000_ suspected terrorists? This is the type of indiscriminant prejudice that a seige mentality creates.

Ohp - now it's 78,001.

Re:78 THOUSAND suspected terrorists?

[ZoneGray]

>> Instead we spend more on a "war on terror" in a year than has been spent in the entire history of cancer research.

Not even remotely true, unless you only count the money spent by the federal government. There are billions spent every day on cancer research by companies big and small, dwarfing what is spent chasing terrorists.

It's like that year at the Oscars when all those wealthy actors stood up and complained that the US doesn't spend enough on the arts.

Anyway, read the Preamble.... "in Order to form a more perfect Union, establish Justice, insure domestic Tranquility, provide for the common defence, promote the general Welfare, and secure the Blessings of Liberty to ourselves and our Posterity"

No mention of curing cancer, or PBS documentaries, or midnight basketball, or time off from work to take your dog to the vet. Those things are all reasonable, but they're not the primary responsibility of government.

Note, too, the difference in wording: "PROVIDE for the common defense, PROMOTE the general welfare."

Re:78 THOUSAND suspected terrorists?

[thryllkill]

If they can't patch windows, you expect them to grep things?

How about: When are YOU gonna learn?

[Phax]

You don't put users and the servers inside the same firewall... do you?

microsoft

[dcordeiro]

Not trying to bash Microsoft but....

I assumed that ppl who run critical services were not from that class of "Internet guys who just want to check their email and browse the web, and don't even know what a patch is".

So, my question is: Why in hell does anybody uses a system that has a track record of so many bugs, virus, crashes, etc ?

I see this more and more: A "breakthrough" is made by some stupid CEO in a companny and in a matter of weeks everything is run under windows. Why ? because it integrates better... "we now have single sign on... for virus too: they just get in one computer and can spread around easily"!!!!

Damn stupid morons...

Re:microsoft

[stratjakt]

They dont.

Most government facilities I've been to use Windows on desktops, and big iron unix servers in the back rooms. Big mainframes that have been there since the early 80s.

There's no way this system with close to 30 million names runs on SQL Server, MySQL, PostgreSQL or any other mid-classed database system.

They shut off the network to make sure it was clean, because one infected terminal could potentially leak a whole lot of information to the wrong people.

My sister works there.

[Anonymous Coward]

Evidently, the virus was patched/cleaned pretty quickly, and there was no real security risk, as in national security, because when the system is down, they simply do not issue visas. Most places they probably just told people to come back tomorrow.

Re:My sister works there.

[BanjoBob]

That may be fine but in some parts of this planet, people must travel to another country to get their visa to the USA. My wife is an immigrant and had to do this. Come back tomorrow is easier said than done. She had to go to Poland and stay at a hotel. Stay another night at the hotel? What about her airline tickets to return home? There is a lot of expense if the attitude is simply "Come back tomorrow" and what if the problem still exists tomorrow?

Doesn't the state department realize some people, other than themselves, have lives and expenses too? Why not take a system that important and apply both patches and anti-virus programs to it. Wouldn't that be a better solution for everybody?

Trusted Computing

[webzombie]

First high level government agencies and departments suffer "apparent" virus attacks while running MS Windows...

Eventually MS will start pushing their Trusted Computing bullshit as the ultimate solution for blocking attacks on their own flawed products.

Oh and it will keep those nasty terrorist guys out too! Did we (MS) mention terrorists. Oh we did ok...

Heads should roll...

[ubiquitin]

So who's responsible for IT security there? If they've outsourced IT security to Microsoft or Symantec, then it is well past time to fire them and put some linux or unix-based (low-cost high-availability) servers up. Ask any Linux sysadmin how they survived the last two months worth of email virus bombardments. Then ask a Microscrap Exchange administrator. Do some simple math on the time and therefore money involved with maintenance of these systems. Why is no-one outraged about the tax dollars being wasted on cleanup of Microsoft-platform based email viruses?

Re:Heads should roll...

[Chibi Merrow]

Now I'm a big Linux supporter and all... but you're way off base here comparing Exchange to a Linux MTA... they're very different beasts.

Just to let you know, we use Exchange, and I think all we did about the virus e-mails was scratch our head and shrug. Never had a single e-mail borne infection...

Though that didn't stop a certain unnamed director from making us send a memo out explaining why people were getting weird e-mails and why the return address was wrong etc...

In THIS case, the article mentions Welchia... Which is NOT an e-mail virus, it's the RPC DCOM worm that tries to patch the Blaster hole. Is it still able to infect due to bad software? Absolutely! But it has NOTHING to do with e-mail or Exchange.

How would a bunch of Linux servers have helped them in this instance? If they're lax on patching Windows boxes, they'll be lax on patching Linux boxes too. Then they're just one OpenSSH exploit away from being out of commission anyway.

The only reason I can think of you being modded up is blind hatred for Microsoft. Hating MS is fine, but don't mark a post as 'Informative' that doesn't even know what they're talking about...

Re:Does the state dept. read /. ??? MAYBE

[Trigun]

Not allowing remote logins to a national database used to approve visas all over the U.S. which is located in one spot? Do you see the problem?
Ultimate control hinders flexibility. If you want to fill out your application for a visa, send it by mail which will be handled by hundreds of people, to receive your visa which will be mailed to you, again handled by hundreds of people, rather than create a network which will allow someone to remotely access the information that they need in an environment more trusted than the U.S. mail system?
This is not your mom-n-pop accounting database, this is used all over the world. Eliminating remote access is not really an option.

Easy...

[scsirob]

.. As long as any half-*ss kid can write 'applications' for the OS by point-and-click on Visual Basic, Windows will be the OS of choise. Too many companies are making money of cutting and pasting together apps.

It isn't the OS that counts, it's the applications that run on it. If it gets the job done, nobody will give a rats ass what OS is beneath.

And people wonder....

[brain1]

...why governments like Germany, etc, etc, are switching to either Linux or Unix. Windows is just one big gaping security hole. Windows is insecure. It has evolved from a single-user simple desktop on top of DOS to what we have today without much thought to security except for an easily circumvented login.

Unix (whatever your favorite flavor - Linux, Solaris, HPUX, even OSX etc, was designed from the ground up to work in a networked environment. That at least gives you a fighting chance of maintaining some level of security provided you or your MIS department set the system up right (like... dont use a default root password).

If Microsoft wants to save their market share, they should start looking into a Unix-type OS. Either port BSD (they have anyway in their TCPIP stacks) or buy someone out (um, SCO maybe - or maybe I'm psychic?).

Stop trying to push a derivitive of WinNT which came from MS OS/2 launched back in the late 80's.

Sorry to rant on so much and restate the obvious, but geez. How many times before people wise up. Every time some script kiddie throws together some crap and unleashes it, corporations and governments get clobbered.

Jail time for virus authors isnt going to solve the problem, it's time to attack it at the source: Windows.

monocultures suck

[evenprime]

I know that a lot of /. readers are going to use this to say that they should have used linux. Some of the more security-astute will say that they should have used openbsd. The truth, however, is that picking operating system X or Y would not guarantee that something similar could not happen again. The way to avoid this in the future is to change the purchasing decision process for government contracts so they don't promote monocultures. In situations where you use a single type of platform, you are vulnerable to having a single type of bug shut down your enterprise. That's basically true of any OS.

It would be a lot harder for stuff like this to happen if they would:

• develop cross-platform applications
• use a variety of platforms

That doesn't replace having an adequate system in place for testing and installing the latest patches. It does, however, guarantee that slipping up and missing one patch won't stop you cold. It may slow your enterprise down, but stuff will still get done.

78,000 suspected terrorists ?

[Anonymous Coward]

What? They cracked the slashdot users file?

Want to sue over buggy code?

[phillymjs]

Some day soon there will be a class action lawsuit against M$ regarless of their 'Hold Harmless Agreement' in the EULA.

Actually, Business Week had an article about that a couple days ago, which I submitted last night (it was rejected). The author closed with (paraphrasing) "Maybe it's time some big customers refused to buy software without some sort of guarantee."

These last few worms and e-mail viruses seem to have become the collective last straw. The unwashed masses are finally beginning to grouse about buggy software-- the tide is slowly beginning to turn against onerous "no liability" EULAs coupled to expensive software that is critical to business.

A few years ago, Microsoft was very quick to whine that any delay in the release of Windows 98 forced on them by the government would hurt the U.S. economy and/or bring about the end of the world as we know it. Well, what about all these businesses who have to eat the costs of cleanup and lost productivity every time there's another Windows worm? Nooooo, that doesn't hurt the economy at all, does it?

~Philly

And it's not just the crappy software

[delcielo]

The software is bad enough; but the patch process is ridiculous.

If you could patch non-kernel portions of the OS without rebooting, it would be a lot easier on the average Windows admin who has to argue for downtime with the internal customers.

And while you're at it, let's not install every application in the OS every time.

US State Dept has no CLASS?

[paul_pick1]

There's probably a joke here. Anyone know where?

Open Source Theory

[Carrion Creeper]

Immediate term bashing aside

The reason open source is supposed to be better is that when lots more people (like 15% market share worth) run linux, then there will be more resources being used to update and error check open source software - theoretically. Comparing Linux with a small market share to windows with a large market share in terms of bugs is not appropriate, and considering the paid resources available (but maybe not used?) to Microsoft, it is amazing that open source even compares.

Not to knock Volunteers at all, but if every company who used open source in a major way paid for 1-2 full time programmers, which is a relatively small expense, maybe Linux would have an even better security track record. Microsoft can't get much bigger, and their software maintenance model has still proven itself unworthy.

Gettin' Slow!

[doppleganger871]

Sheesh, I heard about this on The Truckin' Bozo show last nite. When a truck driving show beats Slashdot to the news, it's the dawn of a new age.

It wasn't a computer virus!

[FunWithHeadlines]

I'm getting sick of mainstream media equating Windows viruses with computer viruses. This was NOT a computer virus. Were any Linux machines at risk? No. Were any Macs at risk? No. How about mainframes? Nope. Those are all computers, and yet none of them were at risk from this virus. So it is inaccurate to call these things "computer" viruses.

Call it what it is: A Microsoft Windows virus. Maybe if the media keeps pointing out what us /.ers already know, the general public will get it through their heads that their choice of OS makes a difference.

Re:security will come eventually

[miscGeek]

Nice theory but, you miss a major point. If a software program were to stay in it's current form, i.e. no new features only bug fixes then your theory would hold true. This is almost never the case though. Software is continously evolving. Security holes and bugs are being fixed but when new features are added you have a good chance of introducing new ones, and the cycle continues.

Re:It's visUM, not visA.

[Jeremy Erwin]

The English visa is a an import of the 19th century French word le vise, which derives from the Latin plural past participle of videre to see. In Latin, visa roughly translates to "things seen".

Crudely, a visa indicates that the bearer's documents have been seen by the issuing country. As the issuance of a visa requires the examination of several papers and databases, visa is always plural. Moreover, as the French treat it as a singular form, and English imported it from the French, the Latin is of little consequence here.

Sources: TF Hoad, ed, Concise Oxford Dictionary of English Etymology (Oxford:Oxford University Press,1986)

Re:Windows Means (meaningless) Work

[47PHA60]

Murder means work too. Are you willing to die a few years early so detectives, attorneys, and judges can have jobs?

I would really much rather design and build secure network systems than apply bandages to existing hopeless systems. If a system is available that resists viruses (like BSD or Linux), that might be a good place to start...

Oh, wait, I do have that job! And I bet I am having more fun than you. One thing is certain, my employer is not flushing as much money down the toilet as yours.

One day my job will be obsolete, but it will be because of self-healing, learning software, not software that was written 'perfectly.' Until that happens, however, we might spend our time trying to do things properly, and learning from our mistakes.

Nobody would support houses of mud and straw in the Northeast US just to keep a bunch of mud-slathering straw harvesters in jobs every time it rained. My house of stone, concrete, and wood requires maintenance on my part, and it has provided plenty of skilled, high-paying work to the local tradespeople in my city, as well as opportunities for me to learn valuable skills. Because of its construction, it also provides a safe place to sleep and run electrical wiring. But oh, the unemployed mud mixers! But when you think about it, who really wants to mix mud and straw for a living?

As for your economic 'theory,' read this, In short, it says that as an employee of the government, if you are talking about the US, you are advocating the continuous waste of my tax money so that you can remain employed. Please put that on your resume when you are out of work and apply for a job working for me!

Re:Rights vs Citizen rights

[merlin_jim]

Sorry human rights and the right to fair treatment below to EVERYBODY, regardless of citizenship.
We have accepted standards of treatment for people we are actively at war with. People who have no apparent hostile intent should get treated at least as well.

While I agree with you that there needs to be an accepted standard of treatment for terrorist actions, similar to the Geneva Accord for wartime, the sad fact is that such a standard does not, at this time, exist.

And these people aren't being treated unfairly; we're not letting them come to the United States without explaining terrorist connections. The United States doesn't belong to the world, it belongs to us, and we can say who we do and do not want to let in.

While I do feel that there should be some oversight over who gets put on this list and how they are selected, that the list should be made publicly available, and that there should be an appeal process to be taken off the list if necessary, none of those is an inalienable right.

I don't have a right to come into your home at any time I like. I can knock on your door and ask if I can come into your home. But if we don't really know each other, and you've seen me in the neighborhood a couple times with some known violent criminals, you would certainly think twice about inviting me in.

I don't see how the United States implementing a similar policy is any different.

Solution: Ban Windows from the Internet

[JThaddeus]

I've about reached this point with the Swen worm. Since this past Saturday, about 80% of my email--home and office--is either the fake MS support announcement or message errors that tell me that my address was faked in trying to send Swen (got to be faked--I only run KMail on Linux). As my home email is dial-up (the pains of rural life) this is a real burden. Honest to God, are people really THAT STUPID? Until Microsloth can get it act together, we need to start blocking IE, Outlook, and Windows in general. Maybe then people would wise up and either fix there PCs or run a reliable OS.

Demand some accountability from the vendors.

[miffo.swe]

Why dont the govt just demand better software? They are such a huge player that there would be a new market created just to sell secure software.

I dont buy this bullsh*t people keeps spreading that its impossible. It aint, just as you can build secure bridges and houses you can make software that is much more secure than todays crap.

There hasnt been a strong enough market for secure software and its up to the consumers and govts to start demand better software.

Even open source could use a kick in the but to get their act togheter.

Compare vsftpd to some other random ftpd and youll get my drift. Security is about design and not about being bugfree.

The Visa system needs a major overhaul

[Orion Blastar]

need I remind anyone that the 9/11 Terrorists all had Visa or Bogus Visa information. One of them even got stopped for a speeding ticket and had a bogus driver's license. Apparently they can forge or fake Visa information. So they don't need to go through our Visa system when they can steal a Visa or produce a fake one good enough to get through our system.

Either they need to patch their Windows servers and install a software firewall and keep their AntiVirus programs updated, or they need to get off of Windows and move to Linux or something that the Windows viruses won't run on.

How do we know that the virus didn't do something like pass certain Visa applications through without a security check? How do we know that Terrorists aren't using viruses to cause damage and bypass security in Visa checks? I heard that North Korea spends $3M USD a year to create viruses and trojans to attack various countries and systems. I wonder what other countries and organizations do this?

Re:BubbleBoy

[Minna Kirai]

not allowing laptops isnt an option. some users need mobile connectivity as part of their work.

That's why firewalls are an overrated security device.

Any decently-large organization should assume that evil systems will make it onto the local network. Maybe a laptop is trojaned while it's at home. Maybe the janitor is bribed to leave a PDA in an unused jack behind a shelf. Or most likely, a regular employee wants to escalate her priviledges to make mischief (most "hacks" are insider jobs)

However the attack comes, you should be ready for it, by not giving locally-created network packets any special level of trust.

I've got Norton doing an update once daily on my home machine, and I still got the Blaster virus thanks to my not patching soon enough.

That's why virus-scanners are overrated as a security mechanism.

It's like protecting banks by checking a list of known criminals before letting someone in. Everyone gets to rob a bank at least once! Any determined attacker (as opposed to a random prankster) can have a custom, unrecognizable virus made before assaulting you.

Better than virus-scanning would be to change the unsafe behavior that exposes you to running untrusted code. Of course, that wouldn't help against Blaster much, because it's not a virus!.

Worms are different, and virus-scanners are even less well-suited to handle them.