Slashdot Mirror


Operation 'Cyber Storm' Starts Tomorrow

cyberbian writes "Federal Computing Week reports that the Department of Homeland Security have moved up their rescheduled cyber security exercise, designed to test enterprise and private sector alike. The tests are expected to run from February 6-10, and are intended to gauge the state of readiness for a cyber attack on critical infrastructure. FCW also reports that the scope of the fake attacks will be global, and they are coordinating with partners in Australia, Canada and the UK."

157 comments

  1. I wonder by andreMA · · Score: 4, Funny

    How much damage they'll end up doing?

    1. Re:I wonder by alexmipego · · Score: 5, Insightful

      The perfect time to hackers attack. In the middle of the "fake" attacks they can really attack and steal some data. It would be hard to spot. Are they doing this tests in a global way but to their structures only (UK and North America) or are they testing random sites all over the world?

    2. Re:I wonder by TubeSteak · · Score: 3, Funny

      And on this day... SkyNet is born.

      It was a secret military project to create a defense system capable of protecting the nation.

      But... It became sentient

      --
      [Fuck Beta]
      o0t!
    3. Re:I wonder by osbjmg · · Score: 0, Offtopic

      Hmm, sounds just September 11, 2001... if you don't know what I am talking about, educate yourself.

    4. Re:I wonder by KDR_11k · · Score: 0

      Which one of the many theories is the one you're implying?

      --
      Justice is the sheep getting arrested while an impartial judge declares the vote void.
    5. Re:I wonder by macguys · · Score: 0, Offtopic

      This sounds much more like learning how to attact than learning how to defend.

      --
      wherever I go, there I am.
    6. Re:I wonder by chivo243 · · Score: 1

      here is how it happened... The system needed to be updated, but the WSUS wouldn't update until the computer account was in the Admin container..... put the computer in the admin container... hmmm, now the computer is its own administrator! I just read that while studying for my MCSE Cert ;-) scary

      --
      Sig Hansen?
    7. Re:I wonder by Zaiff+Urgulbunger · · Score: 1, Funny

      here is how it happened... The system needed to be updated, but the WSUS wouldn't update until the computer account was in the Admin container..... put the computer in the admin container... hmmm, now the computer is its own administrator! I just read that while studying for my MCSE Cert ;-) scary

      Sooooo, what you're saying is, the computers end up taking over the world, seizing control of all our automated systems and in turn starting the third world war, AND, you're out of a job 'cos "the system" no longer needs an MCSE?!

      Double-whammy! :D

    8. Re:I wonder by ultranova · · Score: 2, Insightful

      This sounds much more like learning how to attact than learning how to defend.

      In Neoconservative America, attack is defense !

      --

      Forget magic. Any technology distinguishable from divine power is insufficiently advanced.

    9. Re:I wonder by Gyorg_Lavode · · Score: 3, Interesting

      From the sound of it, this is a paper exercise. The Government more than anyone is scared of the impact of actual pen testing. More than likely this will consist of everyone sitting in the same room or VTC'd in. They'll go, "ok, a hacker just disabled electrical junction boxes shutting down power to Boston, how do you respond?" and then they'll talk it over for a while. End the end they'll realize, "humm, we don't know how" or "well we know how but we rely on group X for help and group X didn't know they'd need to be involved" or something like that.

      --
      I do security
    10. Re:I wonder by VJ42 · · Score: 1, Redundant

      As the old axiom goes, the best form of defence is to attack.

      --
      If I have nothing to hide, you have no reason to search me
    11. Re:I wonder by Anonymous Coward · · Score: 0

      But... It became sentient

      You mean it became Bayesian.

      Weesa screwed, Gunga Din.

    12. Re:I wonder by jalet · · Score: 5, Funny

      Solving such a problem is easy : just tell your president to call Jack Bauer !

      --
      Votez ecolo : Chiez dans l'urne !
    13. Re:I wonder by bigbadwlf · · Score: 3, Funny

      Eliza: What makes you think I'm trying to take over the world?

    14. Re:I wonder by Anonymous Coward · · Score: 0

      I look forward to Viagra spam from Department of Homeland Security. At least I know the drug quality will be guaranteed.

    15. Re:I wonder by Anonymous Coward · · Score: 0

      All .gov and .mil are aware of the IP's doing the scanning/attacking. Don't worry :) They will see through the storm.

    16. Re:I wonder by clydemaxwell · · Score: 1

      local system account is administrator by default anyway, so.

      --
      Browsing with classic discussion, noscript, at -1 and nested
      no hidden comments and I only mod UP
    17. Re:I wonder by ForteMaster · · Score: 1

      Tell me where the Mactop is or I swear to god I will kill you!

    18. Re:I wonder by Anonymous Coward · · Score: 0

      Yeah, just like robbing a bank during a security convention. The goal of such an exercise is to evaluate the security of a system by detecting and stopping an attack. Some exercises have central referees who monitor both teams, as well as a "playbook" configuration of what patches can be loaded and what versions of what applications can be running.
      An outside attack would go over "like a fart in church". You usually have extra people on staff and people are actually looking for an attack. Not like tuesday night at 1100 (or even during the superbowl) when you have no one on staff and an attack is not expected.

    19. Re:I wonder by glesga_kiss · · Score: 1
      The perfect time to hackers attack. In the middle of the "fake" attacks they can really attack and steal some data.

      Actually, that would not surprise me. On both 9-11 and the London Bombings, the authorities were conducting a simulated attack of the exact same nature. Seriously, on 9-11 they were training for hijackings and in London it was tube bombs.

      You can't make this shit up. My tinfoil hat is on and I'll be watching the news... ;-)

      In all seriousness, I doubt we hear the half of all cyber attacks; it's rarely in the interests of the victim to announce it publically.

    20. Re:I wonder by Anonymous Coward · · Score: 0

      http://www.truthout.org/docs_2006/021706A.shtml

        "Cyber Storm" was testing the government's ability to withstand an onslaught of information and protest from bloggers and online activists.

      ENEMY TARGET SIGHTED: BLOGGER CRITICAL OF US GOVT.

  2. good job by joe+155 · · Score: 5, Interesting

    I'm glad that they are doing something like this, in the UK people have been estimating that "in the city" only around 50% of companies are anything like prepaired for an attack of this nature, hopefully this will show people what needs to be done...

    I hope no real attacks take place during this time though...

    --
    *''I can't believe it's not a hyperlink.''
    1. Re:good job by rts008 · · Score: 2, Insightful

      While the 9/11 event brought focus on this issue from a slightly different direction (infrasructure being disrupted), I'm not sure that overall we are much better off than your 50% in the UK, I just don't really know.
      I also wonder how much this issue has influenced the court's handling of the "Crackberry" patent infringement case (not trying to start flame war-that time of disrupted communications when many people/agencies were using their Blackberries because nothing else was working-that really scared a lot of people, and made rescue work less efficient due to hobbled comm's)

      Hopefully Feb. 11th headlines won't be:
      Psuedo-CyberTerrorists pwn DHS

      --
      Down With Slashdot BETA!!! I've been around the corner and seen the oliphant; you can only abuse me from your perspecti
    2. Re:good job by IAAP · · Score: 5, Funny
      hopefully this will show people what needs to be done..

      Clock out of work when the attack happens and go to the corner pub?

  3. A good idea.... by Geekbot · · Score: 3, Funny

    And then they discover they accidently broke the internet.

    1. Re: A good idea.... by Alwin+Henseler · · Score: 3, Funny

      How would they know, when they couldn't read Slashdot reporting about it?

    2. Re:A good idea.... by nurb432 · · Score: 1

      Its already broke.

      --
      ---- Booth was a patriot ----
    3. Re:A good idea.... by TubeSteak · · Score: 4, Funny

      Give us a link to click... we'll make sure it stays broken.

      --
      [Fuck Beta]
      o0t!
    4. Re: A good idea.... by hachete · · Score: 1

      don't worry, the internet'll be ok by the time the fourth dupe is posted.

      --
      Patriotism is a virtue of the vicious
  4. How to parcipate... by IAAP · · Score: 5, Funny
    Go to work, turn your machine off, and say "I've voluteered to be someone who was hit by a virus that knocked my machine out of commission."

    Then go home for a couple days!

    WooHoo!

    1. Re:How to parcipate... by LiquidCoooled · · Score: 2

      Don't forget to delete all your word documents before turning off.

      --
      liqbase :: faster than paper
    2. Re:How to parcipate... by jZnat · · Score: 1
      Way ahead of you...
      find / -type f -iname '*.doc' -execdir rm {} +
      Didn't find anything; care to try '*.odw'?
      --
      'Yes, firefox is indeed greater than women. Can women block pops up for you? No. Can Firefox show you naked women? Yes.'
  5. So.... by interiot · · Score: 4, Interesting

    So all you need to do is find one unlucky zombie on a government IP, and use it to break in to random computers, and people will assume you're a good guy?

    1. Re:So.... by Anonymous Coward · · Score: 0
      So all you need to do is find one unlucky zombie on a government IP, and use it to break in to random computers, and people will assume you're a good guy?

      I don't have to do all that for people to assume I'm a good guy! That's what my charming personality and honest face are for.
    2. Re:So.... by Anonymous Coward · · Score: 1, Insightful

      Everyone on a government IP is an unlucky zombie. ;-)

  6. Thank Ford! by paulthomas · · Score: 4, Funny

    Well, I think I speak for all of us when I say on behalf of the internet community: Thank Ford for the Department of Homeland Security.

    1. Re:Thank Ford! by cyberbian · · Score: 1

      'We're all going on a 'soma' holiday'

      --
      if I claimed I was emperor just because some watery tart lobbed a scimitar at me they'd put me away!
  7. Post-Superbowl? by Old+Spider · · Score: 3, Interesting

    Exactly what can be expected in regard to online use just after the Superbowl? Will there be more or fewer people online during that time? I expect there'll be more. People will want to celebrate and complain about whomever won or lost. If we were under a cyberattack, then certainly that would be the best time to do these tests.

    1. Re:Post-Superbowl? by Anonymous Coward · · Score: 0

      I am sure that there will be a marked increase in internet traffic after the Superbowl. I'm quite certain that these two sites will receive the majority of the increased traffic.
      Seahawks
      Steelettes

      Woops! Looks like its already starting.

    2. Re:Post-Superbowl? by Anonymous Coward · · Score: 0

      You can expect many misspellings as people will be drunk from watching the games. Well, maybe the activity will go down as people will be passed out too.

    3. Re:Post-Superbowl? by rbochan · · Score: 2, Funny

      Google willl probably get hits with umpteen bazillion searches for 'janet jackson tits' or 'destroying the moral fabric of america' or whatever debacle will occur this time...

      --
      ...Rob
      The American Dream isn't an SUV and a house in the suburbs; it's Don't Tread On Me.
    4. Re:Post-Superbowl? by ToasterofDOOM · · Score: 4, Funny

      Ewww ... Mick Jagger naked. I'm gonna go sit in a corner for the rest of the day now, silently crying to myself at the loss of whatever semblance of innocence I had left. If it actually happens, then I guess I'll implode.

      --
      I am Spartacus
  8. From TFA by 5plicer · · Score: 3, Funny

    "IT-ISAC has eight members participating in the exercise, the center's Web site states. The participants are Cisco Systems, Citadel Security Software, CA (formerly Computer Associates), Computer Sciences Corp., Intel, Microsoft, Symantec and VeriSign."

    In other words, little, if any.

    --
    The bits on the bus go on and off... on and off... on and off...
    1. Re:From TFA by LilGuy · · Score: 3, Informative

      Well.. if those large corps are all in on it, what chance does anyone have? Unless they're running a super hardened linux/bsd... cisco has undocumented/unpatched bugs in their IOS code that can easily be exploited.. as does MS I'm sure.. verisign could easily fuck people's certs up... come on... its not even a fair fight.

      --

      You're nothing; like me.
    2. Re:From TFA by Anonymous Coward · · Score: 0
      verisign could easily fuck people's certs up

      They already do. So you should be prepared.

    3. Re:From TFA by rtb61 · · Score: 1
      Further on the note of successfull exploits, I wonder if they will let each other know all the successfull exploits that they were able to achieve or if they will keep a few secret for future use ;-). After all they now have the oppurtunity to hide a bit of skulldugery and if they manage a successfull exploit with out being caught, just leave those other guys believing how great and secure they "think" their system is.

      Any other time of year and it would be an international incident, now they can play trial and error and get away with it (Oh the life of the professional paranoid, now they're stuck they can't even trust this testing process anymore ;-P).

      --
      Chaos - everything, everywhere, everywhen
  9. Damage by Anonymous Coward · · Score: 5, Interesting

    Last time i saw something like this, our 'organizataion' was tested.

    They caused more damage to us with childhood tactics ( like locking out system accounts ) than doing 'real' tests. We were screwed for a week trying to undo damage, and trying to figure out how it was happening again and again.

    Posting anonymously for obvious reasons.

    1. Re:Damage by Gyorg_Lavode · · Score: 3, Informative

      It sounds like they uncovered 2 issues. First the things you called "childhood tactics" impared your operations and second, you don't have an addiquate policy to deal with compormised systems. (THis could be in a bunch of policies: Disaster recover, incident reporting and forensics, Configuration Management, etc)

      --
      I do security
    2. Re:Damage by Anonymous Coward · · Score: 0

      Maybe that taught your sys admins not to be so bloody incompetent.

      Posting anon because slashdot is full of a bunch of fags that get offended too easily.

    3. Re:Damage by Anonymous Coward · · Score: 1, Insightful

      A real enemy won't care whether their tactics are considered "childish" by anyone.

      They will measure their success by the number of people who say, as you just did, "we were screwed".

    4. Re:Damage by Beryllium+Sphere(tm) · · Score: 1

      If you were down for a week, I'd classify those as "real" tests.

      It's good to test "childhood tactics". They're part of the real-world threat spectrum and you need to guard against them.

      If the only attacks that interest you are the brilliant and sophisticated kind in _Silence on the Wire_, you should leapfrog over being a sysadmin and try for a job studying masint methods at the NSA.

    5. Re:Damage by Koshmar · · Score: 1

      It sounds like you had a useful test then - if an attacker was able to take down your system for a week by something as trivial as locking accounts out then your system had serious weaknesses. It should have been pretty straight forward to re-enable the accounts and then identify what system had locked them out and disable connections from that system.

      Just because the attacks were simple doesn't mean that they didn't give you useful information about your system - if a security test causes *anything* to break/crash/fall over then that's useful information telling you that someone else could do the same if they wanted to.

      I'm not surprised you're posting anonymously - if I had to administer a system that had a weakness like this then I wouldn't want to tell people about it either.

  10. Call For A Red Synthetic Terror Alert by Anonymous Coward · · Score: 0, Offtopic

    http://www.rense.com/general69/redsynth.htm

    Call For A Red Synthetic Terror Alert
    By Webster Griffin Tarpley
    2-5-6

    The intense international intelligence warfare pattern mandates a move to red alert -- the highest vigilance -- for the upcoming superbowl Sunday in the USA and the Turin winter Olympics, and perhaps all the way to the March 20 opening of the Iranian oil bourse, which spells the beginning of the end for six decades of world dollar hegemony.

    The Iranian oil bourse opens March 20 -- this is the strategic key. The Cheneyacs want war to stop the bourse from deflating the sick US dollar. The crumbling of European resistance has given new strength to Condi's nuclear lynch mob against Iran, with that country about to be hauled before the UN Security Council. At that point, a wider Middle East war will be immediately in sight.

    The Mohammed cartoons are a transparent provocation by NATO intelligence through a Danish right wing newspaper of limited circulation. This classic US-UK provocation has had an enormous effect. Islamic circles need to realize that this is a cynical ploy designed to lead to an attack on Iran and thence to general war, and treat it that way.

    We had the latest British terror bombing in Achwaz, Iran last week (Jan. 24), killing several people. The trial of British-backed terrorists in Iran starts in about 2 weeks. The situation of the British invaders in southern Iraq is becoming critical. Afghanistan is about to boil over. The US and North Korea are trading nuclear war threats across the 38th parallel. Russia has accused the British of flagrant spying, and there is every reason to believe this charge. Venezuela has expelled a US military attache as an obvious agent provocateur; now the US expels top Venezuelan diplomat. Now the fake provocation of an alleged IED bomb near a school in Gaiithersburg, Maryland in the Washington DC suburbs, impacting the personnel of the Bush administration and the federal government in general; many top officials live within a few miles of this school.

    There was real hysteria in the corridors of the US government this afternoon. A new Sudden Response terror drill is taking place at Charleston. South Carolina. Will this drill go live in the way other drills went live in London last July 7? The latest leaked Downing Street memorandum reveals Bush as proposing to send US U-2 spy planes disguised in UN colors to be shot down over Iraq to secure a pretext for the illegal aggression there. This reveals Bush in the Operation Northwoods tradition, ready to commit acts of war in the form of impeachable offenses.

    Detroit is a burned-out auto city, expendable in the eyes of the finance oligarchs. Turin, Italy, home of FIAT, is another expendable burned out ex-industrial city. An action in Turin would push the Europeans to join the US in the attack on Iran. The sinking of the Egptian ferry in the Red Sea may well fit into this pattern, but this is not clear. The Patriot Act has not been renewed. Top neocons face indictment and jail sentences.This is the classic moment when the neocons and their rogue network backers go back to Leo Strauss's nihilist revolution, capable of throwing humanity back into the Stone Age.

    Webster Griffin Tarpley Washington DC
    February 4, 2006

  11. More worrisome threats by OpenGLFan · · Score: 5, Insightful

    I'm a lot more worried about the damage caused by the "Tiered Internet" proposals currently being bandied about. All network admins know that the damage caused by attackers is insignificant compared to the damage caused by upper management and government meddling.

    1. Re:More worrisome threats by ScentCone · · Score: 4, Interesting

      All network admins know that the damage caused by attackers is insignificant compared to the damage caused by upper management and government meddling.

      All admins do not necessarily agree with this. Most of messes I have to clean up are from malware, fraud, "traditional" crime (and attempts at such) that have taken on a 'net communications component, and the usual tsunami of noise and bot blather that lands on every public-facing port I have open.

      Tiered internet? That's a misnomer, I think. Big internet users pay for the bandwidth they (or their visitors) use. More traffic means higher costs. I don't care if some Comcast user has already paid for "his" bandwidth... serving up a streaming video to him isn't only using his bandwidth. I don't know where people get that idea. But regardless, if SBC or Verizon or any other carrier wants to screw with per-site or per-visitor metering or biasing, they're welcome to. Other ISPs will just set a price that's easier to predict and work with, and win the business away from the people trying to make it more complicated. But how much time do I have to give "upper management" or "government meddling" vs. attempted attacks, fraud killing, malware, etc? It's not even close. The bad guys are much more of an issue.

      --
      Don't disappoint your bird dog. Go to the range.
    2. Re:More worrisome threats by winwar · · Score: 2, Funny

      "damage caused by upper management and government meddling."

      I think you are underestimating upper management. :)

  12. This sounds extremely logical by Dunbal · · Score: 3, Interesting

    This is like Microsoft checking its own code for security holes. If there is a weakness then resources could be better used by trying to eliminate the weakness instead of finding theoretical ways it could be exploited - because there's always the way you didn't think of and THAT's the one that's going to get you.

          Homeland security is going to turn around and tell everyone that we're NOT ready for a "terrorist cyber attack"? No, it makes much more political sense to say "see? Our networks can survive millions of nerf-ball hits; more funding please."

    --
    Seven puppies were harmed during the making of this post.
    1. Re:This sounds extremely logical by kfg · · Score: 3, Interesting

      "see? Our networks can survive millions of nerf-ball hits

      "Cool! Well, right then. Turns you aren't actually needed after all so we're shutting your dept. down."

      You don't understand how the game is played. The DHS depends on terrorism for their funding, but; they are the terrorists.

      KFG

    2. Re:This sounds extremely logical by ZoneGray · · Score: 1

      Yeah, but if there's ever a cyber-terorist who thinks just like a government bureaucrat, we'll be ready for him.

    3. Re:This sounds extremely logical by Evil+Shabazz · · Score: 1

      Uhm, the way you FIND security holes is by thinking of various ways a feature can be exploited. It's not like you write 10,000 lines of code and leave little comments in there like, //this is a security hole or /* plug this security exploit later */. Security holes aren't things you just have - they're methods or features that someone else figures out can be used in a way that wasn't thought of by the designer. Take the WMF thing - there's no comment in there saying //i hope no one notices this security hole. It's a method that provides a way of cancelling print jobs that someone realized had a tie in to WMF files and could be exploited to execute other code.

      --
      Down with the career politician! SUPPORT TERM LIMITS
    4. Re:This sounds extremely logical by DerekLyons · · Score: 1
      This is like Microsoft checking its own code for security holes. If there is a weakness then resources could be better used by trying to eliminate the weakness instead of finding theoretical ways it could be exploited - because there's always the way you didn't think of and THAT's the one that's going to get you.
      This test isn't about finding security weakenesses, we already know those exist. This test is about responding to attacks against the weakness - a somewhat different matter.
    5. Re:This sounds extremely logical by Anonymous Coward · · Score: 2, Funny

      This is like Microsoft checking its own code for security holes.

      It only happens once every couple of years?

  13. Wait a minute by Teresh · · Score: 2, Insightful

    Aren't "enterprise sector" and "private sector" the same thing (as opposed to "government sector")? When did we install Communism? Did I miss something?

    --
    Do you Gentoo?
    1. Re:Wait a minute by Daniel+Dvorkin · · Score: 5, Insightful

      Not communism, but capitalist oligarchism. "Enterprise sector" is the Fortune 500 that can buy politicians to manipulate the market to their ends. "Private sector" is everyone else, competing on an increasingly tilted playing field. Hope this clears things up.

      --
      The correlation between ignorance of statistics and using "correlation is not causation" as an argument is close to 1.
    2. Re:Wait a minute by mindtriggerz · · Score: 0

      # emerge communism

    3. Re:Wait a minute by FusionDragon2099 · · Score: 1

      I can already hear the response from the government.

      "National security. You oppose our operations, you oppose freedom, justice, and the American Way. NOW SCREW OFF, YOU COMMIE TERRORIST-LOVER!"

    4. Re:Wait a minute by thesnarky1 · · Score: 1
      I dunno when we installed it, but lets fix it..

      rpm -e Communism

  14. DDO Stress test by Anonymous Coward · · Score: 2, Interesting

    Hrm, wonder how this will affect companies planning stress tests of their systems during that time period. Like for example the DDO stress test that starts on the 7th. It's wonderfully nice of the government to move the schedule at the last minute like this. I'm sure they won't be specifically targeting a small internet games company like Turbine... but I'd feel for any company who's planned tests will get nice and invalidated because the government decided that'd be a nice day to DDOS them.

  15. Time to Go Phishing by Billosaur · · Score: 4, Funny

    I can see it now...

    FROM: cyberstorm@dohs.gov

    TO: unlucky.recipient@yourcompany.com

    SUBJECT: Participation in Cyber Storm exercise

    Your company has been identified by the Department of Homeland Security as potentially vulnerable to cyber attack. During the week of February 6th - February 10th, the DoHS will be testing cyber infrastructure as part of our Cyber Storm security exercise. In order to participate, you will need to supply us with [insert favorite hacking data here]...

    --
    GetOuttaMySpace - The Anti-Social Network
    1. Re:Time to Go Phishing by LupeSpywalper · · Score: 1, Funny

      It will be just another DoHS attack.

    2. Re:Time to Go Phishing by Anonymous Coward · · Score: 0

      Operation CyberStorm

      Confidential - For Your Monitor Only

      Objective: To DDoS major websites to see if it's possible knock them offline and thus cause minor inconviences to their repeat users and give their techies something to fix aside the boss' laptop that won't print.

      Operational Procedures:

      1) Identify Key Servers that may be suceptible.
      2) Post fake articles on Slashdot.Org with links to the servers in question.
      3) ????
      4) Profit!!

  16. That was a game... by PAPPP · · Score: 1

    The headline made me think of an old sierra game set in the the Earthsiege (WOO GIANT ROBOTS) universe: Misson Force: Cyberstorm (its abadonware, download here). I picked it up from a bargin bin about 2 years after it came out, one of the only turn-based games I've ever enjoyed. Probably not related, but then again the flunkie that came up with the name could well be a gamer.

  17. Cyber Storm? by Winlin · · Score: 4, Funny

    I thought for a minute there they were talking about IRC back in the late 90's. Now THERE was a storm of cybering for you. Not that I would..ummm...have any personal knowledge or anything.

    1. Re:Cyber Storm? by Anonymous Coward · · Score: 0

      Speaking of which, whatever happened to all that cybering?

  18. And so it begins. by cosmotron · · Score: 2, Funny

    Now that Cyberdyne has been established, I wonder how much longer it will be until SkyNet is initialized?

    --
    Ryan - http://www.thecosmotron.com/
  19. And while they plan all these... by bogaboga · · Score: 0, Offtopic
    And while they plan all these, our southern border with Mexico remains wide open to even more dangerous folks from all over the world. I will not be suprised if they announce the capture or closing a major terrorist cell after these exercises.

    The likes of Osama bin Laden will use crude methods to inflict maximum harm to us, just like they are doing in Iraq with 5 of our GIs already dead in this month alone. They are using a very well known tactic: The IED. And so far nothing in our technologically superior army has an answer to it. Sad indeed. When wil these politicians learn?

    1. Re:And while they plan all these... by thedletterman · · Score: 0

      actually we have several answer to the IED: 1. Snipers 2. Warlocks 3. Informants 4. Route sweeps 5. Recon spotters 6. Thermal imaging I get news everyday of how many IEDs we disabled, how many bomb makers we killed or captured, etc.. the score is like 5 - 75 for this month

      --
      Any fool can criticise, condemn, and complain, and most fools do. - Benjamin Franklin
    2. Re:And while they plan all these... by pointyhairedmba · · Score: 1

      Don't forget the largest undefended border in the world. You forgot to mention it. Also, what exactly are our politicians supposed to learn? That it's relatively easy to make a IED?

      "My impression is that perhaps our border with Canada has, to some degree, been of a bit greater concern than that with Mexico," John Negroponte, director of national intelligence, told a U.S. Senate hearing Thursday on global terror threats.

    3. Re:And while they plan all these... by Antony.S · · Score: 1

      Warlocks?

    4. Re:And while they plan all these... by nietsch · · Score: 1

      That is a hairstyle, isn't it
      Wigs for peace!

      --
      This space is intentionally staring blankly at you
  20. nice war game by towaz · · Score: 1

    Anyone know If it's possible to sign up for such a thing? I guess not but without special clearence; but would be fun.

    --
    "I disapprove of what you say, but I will defend to the death your right to say it." - Voltaire
  21. The Paranoid Style in American Politics by Anonymous Coward · · Score: 0, Offtopic
  22. Greenspan by RootsLINUX · · Score: 1

    Pshhh, big deal. This has already done before by Alan Greenspan, my hero. The only difference is he didn't have some big PR campaign. He's old school, and just slapped those bitches up the side of the head without any warning at all.

    What, you don't believe me? See this historical proof and prove it to yourself. Alan Greenspan is a l33t h4xor, that fact is undeniable!

    --
    Hero of Allacrost, a FOSS RPG for *NIX/*BSD/OS X/Win
  23. It would be a good idea if... by Anonymous Coward · · Score: 1, Interesting

    ...the government didn't really do any testing at all, and just used this as a trap to find real hackers. Just stay extra-vigilant for a few days, and find the people attempting to go under the radar...

  24. Suggestions anyone? by poind3xt3r · · Score: 2, Funny

    As a precautionary measure, should I set fire to all my machines running XP???

    1. Re:Suggestions anyone? by mindtriggerz · · Score: 0

      You should do that anyway.

    2. Re:Suggestions anyone? by corychristison · · Score: 1

      That sounds like a great idea! But maybe installing something different would be more cost effective?

  25. look out! by ShineyMcShine · · Score: 1, Troll

    remember what happened last time the govt. had a "security" exercise on 9.1.1.?

    1. Re:look out! by hackstraw · · Score: 1

      I'm amazed you got modded up for this. I agree completely, but that kind of thinking is not popular here on Slashdot.

      Regarding this nebulous "Cyber Storm" thing, doesn't the Microsoft worm/virus of the week already give people enough experience? Odds are either a similar kind of attack will be done on the net, or they might just go and cut the fiber.

      Personally, all of my international business that I do where I care about the integrity and reliability of the communication is done over a proprietary encrypted satellite uplink to my own satellite.

      Isn't that what everybody does?

  26. enterprise and private sector alike by Numen · · Score: 0, Redundant

    Since when where enterprise and the private sector anything other than the same thing?.... and more importantly, which one did the OP think refered to government?

  27. Wierd. by Burz · · Score: 2, Interesting

    FCW also reports that the scope of the fake attacks will be global, and they are coordinating with partners in Australia, Canada and the UK."

    I didn't know that computers only speak English.

    Hmmm... learn sumthin new evry day.

    1. Re:Wierd. by _xeno_ · · Score: 1
      I didn't know that computers only speak English.

      Well, yeah: "HELO", "GET", "POST", "if", "then", "mov", "add" - those are all English... :)

      --
      You are in a maze of twisty little relative jumps, all alike.
  28. recovery during pen testing by Gyorg_Lavode · · Score: 2, Interesting

    While I think this article is talking about a table top or paper drill, it does hint at a bigger question. How do you do realistic pen testing on a system that must be 100% configuration controlled? I think you have to assume that the Pen Testing will take the system into an unknown state though you should know the range of that unknown state, (it may not effect the entire system.) From that you can conclude you need to have a plan to take the system or parts of the system from an unknown configuration state back to the current baselined configuration state. But is this possible? How long does it take? What methods do you use? Does anyone on slashdot have any experience with such a plan? Has anyone had to write one or even enact one?

    --
    I do security
  29. Goverments can't hack it by hutchike · · Score: 5, Insightful
    What makes the government(s) think their fake attack will be anything like a genuine attach? For example, the UK government has a long and famous history of botching every computer initiative (e.g. UK tax credit theft via gov web site).

    I doubt the Department of Homeland Security has anything like a globally distributed botnet, or permission to run DDoS like a real attacker might. The virus attack on the Russian stock market is not something goverments can replicate.

    The only winners will be the companies who sell the extra bandwidth!

    --
    Zen tips: Pay attention. Don't take it personally. Believe nothing.
  30. Digg and Slashdot by writermike · · Score: 3, Funny

    So, they're just going to submit a bunch of web sites to Digg and Slashdot. Big Deal! :-)

    --
    If Nalgene water bottles are outlawed, only outlaws will have Nalgene water bottles.
  31. Findings from their "Wargames" by slashbob22 · · Score: 2, Funny

    "Mr. McKittrick, after very careful consideration, sir, I've come to the conclusion that your new defense system sucks."

    --
    Proof by very large bribes. QED.
  32. "I expect there'll be more" by Anonymous Coward · · Score: 0

    "I expect there'll be more. People will want to celebrate and complain about whomever won or lost."

    Wow, spoken like a true geek. Yes I can see it now... the jocks watching the last seconds of the game, guzzling down beer, pizza, and chicken wings... game over! Let's run to our computers and discuss the big game over an electronic forum 0_o

  33. blog outtage by Anonymous Coward · · Score: 2, Interesting

    Was the massive blog outtage yesterday part of this, and someone just jumped the gun a little? What's to stop the feds from shutting down huge pieces of the net, or replacing pages with look-a-likes that have information they want you to believe, as opposed to real information? Phed Phishers in other words, geek goose stepping order followers.

    This crap is weird. I fully expect them to pull off another false-flag terrorist attack and use that as an excuse to do real damage to the freedom parts of our society, they have already shown that is their primary agenda and that is exactly what they have been doing. Controlling the web could be part of it.

    1. Re:blog outtage by Anonymous Coward · · Score: 0

      No that was just down to massive winds in the NW of US, where a lot of hosting is based. 100k individuals/businesses lost connection.

  34. What about the information gathered??? by DivideX0 · · Score: 4, Insightful

    Suppose their attacks allow them to get into various machines and networks, what will they do with the data that is accesible in those machines?

    Is this just another end run around warrantless search and seizures of data?

    What kind of oversite is there on this process and how can we be sure the information is not used, stored, or otherwise desiminated among the various US spook agencies and their foreign lackeys.

    And how much do you want to bet Google will be a very well excercised target since they have been fighting the governments abuse of power already.

    --
    My next Slashdot post will be ready soon, but subscribers can beat the rush and see it early!
    1. Re:What about the information gathered??? by 16777216 · · Score: 1

      BINGO!

      --
      I am. Lower your shields and power down your weapons, they are useless. Your biological and technological distinctivenes
    2. Re:What about the information gathered??? by d474 · · Score: 1

      That is exactly what I'm thinking. This sounds like a REAL attack by the U.S. Gov't on the information infrastructure under the guise of a "training op". I'd like to have my Congressman file an FOIA to discover precisely what networks were compromised and what data was accessed by CyberStorm.

      --
      Authority questions you. Return the favor.
  35. Real Test by RichiP · · Score: 1

    They should invite crackers around the world to participate, and not have some "carefully controlled environment" if they really want to test their system.

    1. Re:Real Test by maxwell+demon · · Score: 1

      Since when do crackers need an invitation? So if I don't invite them, my system is safe? :-)

      --
      The Tao of math: The numbers you can count are not the real numbers.
  36. Thanks for the news ... by whitehatlurker · · Score: 1

    .. especially since I'll be travelling that week. This will likely play bloody havoc with the airlines.

    --
    .. paranoid crackpot leftover from the days of Amiga.
  37. In the words of Fark: by AmicoToni · · Score: 1

    ...what could possibly go wrong?

  38. Disruptions? by SleepyHappyDoc · · Score: 1

    If their simulated attacks actually expose any problems, I wonder if the rest of us will experience any disruptions of the net in general that week. Sure would suck if they found some hidden flaw in whatever the backbone is running on, and crashes it somehow (although I guess that's the point, is to find these flaws or problems).

    --
    Stasis is death. Embrace change.
  39. Shouldn't they wait for the next Leap Day? by EChris · · Score: 5, Funny

    http://www.april-fools.us/internet-cleaning.htm

    Original Message - 1996

    DO NOT CONNECT TO THE INTERNET FROM 12:01 AM GMT ON FEB. 29 TO 12:01 AM GMT, MARCH 1 !!

    *** *** Attention ***

    It's that time again!

    As many of you know, each leap year the Internet must be shut down for 24 hours in order to allow us to clean it. The cleaning process, which
    eliminates dead email and inactive ftp, www and gopher sites, allows for a better-working and faster Internet.

    This year, the cleaning process will take place from 12:01 a.m. GMT on
    Feb. 29 until 12:01 a.m. GMT on March 1. During that 24-hour period, five powerful Internet-crawling robots situated around the world will search the Internet and delete any data that they find.

    In order to protect your valuable data from deletion we ask that you do the following:

    1. Disconnect all terminals and local area networks from their Internet
    connections.

    2. Shut down all Internet servers, or disconnect them from the Internet.

    3. Disconnect all disks and hardrives from any connections to the Internet.

    4. Refrain from connecting any computer to the Internet in any way.

    We understand the inconvenience that this may cause some Internet
    users, and we apologize. However, we are certain that any
    inconveniences will be more than made up for by the increased speed and efficiency of the Internet, once it has been cleared of electronic flotsam and jetsam. We thank you for your cooperation.

    Kim Dereksen
    Interconnected Network Maintenance staff
    Main branch, Massachusetts Institute of Technology

    Sysops and others: Since the last Internet cleaning, the number of
    Internet users has grown dramatically. Please assist us in alerting
    the public of the upcoming Internet cleaning by posting this message
    where your users will be able to read it. Please pass this message on to
    other sysops and Internet users as well. Thank you.

  40. Cover up by Anonymous Coward · · Score: 0

    What if it is just a cover up of the major sniffers being installed at all major routes. Oh wait they would never do that. Maybe google just pissed them off for not giving the data and they are going to dos them and say oops it was just a test gone bad.

  41. Who Pays For Damages? by Anonymous Coward · · Score: 0

    SO, Yeah, Who pays for the damage if this "fake attack" Does damage.

    and since the intent of all attacks are to do damage...
    also, this had better be a volentary program.

  42. Hurricane CyberPam by dpbsmith · · Score: 2, Insightful

    They'll conduct the exercise, discover that there are serious problems--just as every other evaluation of our cybersecurity has discovered. They'll make a report, the report will note that to fix things it would be necessary to spend money. And involve uncomfortable decisions like reducing our dependence on a monoculture of Microsoft Windows.

    The decision-makers will decide (as they have so far about everything involving actual defensive measures involving the homeland that they would prefer to spend the money in some other way. They'll appoint yet another cyber defense "czar" as evidence of action, he will start with the clear understanding that the one thing he can't do is get the funding to implement the measures recommended in the report.

    And when the actual attack happens and is devastating, they'll say nobody could have anticipated it.

    See also Hurricane Pam

    1. Re:Hurricane CyberPam by El+Torico · · Score: 1

      So, how long have you been working for the government? You are exactly right.

      --
      In the land of the blind, the one-eyed man is usually crucified.
  43. 3's Cyberstorm! by Anonymous Coward · · Score: 0

    I have a great many fond memories of that game.

  44. Can the gov't only do one thing at a time? by Infonaut · · Score: 1

    And while they plan all these, our southern border with Mexico remains wide open to even more dangerous folks from all over the world.

    So you're saying that because there is one hole in our defenses, we should not attempt to plug other holes? Are you saying it's a zero-sum game, and that while the DHS is attempting to thwart cyber-attacks, suddenly all of their other efforts have come to a standstill?

    When wil these politicians learn?

    You mean, when will government cyber-security experts learn. It seems they're trying to do what they can to keep their area of responsibility protected. If they didn't, certainly there would be plenty of people ready to give them a hard time for "not learning" that protection was necessary.

    --
    Read the EFF's Fair Use FAQ
    1. Re:Can the gov't only do one thing at a time? by randyjg2 · · Score: 1

      The problem is, this is the wrong cyber security threat to worry about. It won't do any harm, though, and give everyone a false fuzzy feeling that they are doing their job. There won't be a serious cyberattack against America for the foreseeable future (outside of normal business competition, that is), it would ruin the value of the stocks owned by just about every organization and influential individual on the planet. For example, theres an urban legend that a cyberattack against America in the mid 90's by Indian terrorists was stopped before it started by Chinese warlords fearing for their TBonds. Even Bin Laden had $300 million in US stocks.

      The southern border situation won't go critical (as a national security threat, anyways) until 9/09 at least, and it is probably too late to do anything about it, most of the persons of interest have been in the US for years and have no need to cross the border.

      What really worries me is the multitier outsourcing threat. There are enough stories floating around about various exploits that it bears serious investigation.

      For example, A defense contractor builds the battlefield C4I systems that are going to defend against a Chinese incursion into, say, Afghanistan. The core of their system is a COTS product from a prominent North American Silicon Valley company, which bought it from a smaller Silicon Valley company; which still has the maintenance duties... and since has moved to Shentzen, PRC.

    2. Re:Can the gov't only do one thing at a time? by Infonaut · · Score: 1

      There won't be a serious cyberattack against America for the foreseeable future (outside of normal business competition, that is), it would ruin the value of the stocks owned by just about every organization and influential individual on the planet.

      By extension you're saying that no party would want to do serious damage to the American economy, because doing so would damage the value of stocks. It seems obvious that bin Laden wants to do serious damage to the American economy, so I'm not sure I buy the supposition that no enemy would dare attack the American economy. You're assuming a rational actor where there may not be one.

      --
      Read the EFF's Fair Use FAQ
    3. Re:Can the gov't only do one thing at a time? by randyjg2 · · Score: 1

      ..."It seems obvious that bin Laden wants to do serious damage to the American economy, ..." I give up.. why does it seem obvious? There was one attack on America (9/11) which seemed very carefully designed to avoid any serious damage to the economy. The attack occured just before the markets opened. Can you imagine how much worse it would have been if the attack had occurred during normal trading hours, or worse, just at closing? Bin Laden turned $50 million to $300 million in the stock market in the years before 9/11, he would have to know when the market was most vulnerable. Furthermore, there are thousand of serious potential targets that require no more preparation that a box of matches to destroy. It would certainly do serious damage to our economy if our cities and forests were burning...but they aren't. Finally, one sucessful attack in 5 years? There are high security prisons that have poorer safety records. If damage to the American economy were a goal, you think there would have been a lot more attempts. If Bin Laden's goal is serious damage to the American economy, he certaily seems to be incredibly incompetant.

  45. Insanity Re:Call For A Red by n54 · · Score: 2, Insightful

    And people wonder about the existence of crazed fundamentalists in the middle east? We have the exact same kind of mentally unbalanced (or damaged) people in the west as presented on behalf of Webster Griffin Tarpley by the Anonymous Coward parent poster.

    "The Mohammed cartoons are a transparent provocation by NATO intelligence through a Danish right wing newspaper of limited circulation."
    I'm sure that makes much more sense to the conspiracists than the issue as put forward by both the original publisher (making a point against self-censorship by the media on muslim issues) as well as the outbursts of support by other newspapers and magazines all over europe (and even in Jordan and Egypt!) and international press organisations correctly coming to the defence of freedom of speech.

    If people like Webster Griffin Tarpley had a few more firing synapses they would instead speculate about the following peculiarities:
    - the original publishing happened last year in september, there was zero international outcry at that point in time (only local danish discussion on the topic between civilized muslims and the rest)
    - yesterdays burning of embassies in Syria is extremely unlikely to have happened without the approval of the brutal Syrian Baath-party dictatorship. Violent destruction of embassies would normally be regarded as a declaration of war as it's the sovereign domain of whatever country the embassy belongs to
    - todays attacks on embassies in Beirut, Lebanon was in all likelihood initiated by people who ideologically are extremely closely related to Syria, if not also directly related to them (Hamas-supporters)
    - the Beirut attacks very quickly shifted focus onto attacks on Lebanese christians and christian churches, so quickly as to make it likely that the inital attacks were a cover for trying to reinflame the unrest in Lebanon
    - Norwegian imams as well as other western islamic representatives are urging for calm, non-violence, as well as against the hijacking of the issue by islamic extremists (most muslims are intelligent rational people and have nothing in common with the extremist rabble)
    - there has been next to none, or at least extremely small levels, of muslim outcry on the issue in Norway (I'm a norwegian btw). In general I would say norwegian muslims are better integrated into society (through no small effort of the muslims themselves as should be expected) than danish ones although we of course have issues in Norway too. I live next door to the oldest mosque in Norway (and a very pretty one imo) and have had enough muslim friends and aquaintances both in Norway and South East Asia to feel confident in saying this
    - respect for the prophet Mohammed is one thing, the prohibition against depiction in Islam actually isn't specifically about the prophet Mohammed but about all living things and intended to discourage idolatory! (might want to read http://news.bbc.co.uk/1/hi/world/middle_east/46782 20.stm). By the logic of the extremist pseudo-muslims any picture or photograph should be equally protested but instead they actually break the intentions of Islam in their idolatry of the prophet Mohammed and sadly as such (in my personal opinon) showing how Islam is falling into the same trap as those "christians" who idolate Jesus Christ as a replacement of God.

    But no, instead of all the above Webster Griffin Tarpley concocts paranoid delusions based on ignorance of how NATO even works and is structured (all NATO decisions are made by unanimous approval of all members). The level of idiocy required to hold the opinions of the AC is the same as that which is required to claim Denmark and other scandinavian countries are ruled by "Zionists" as some middle east government representators have said... lol

    --
    this additional sig includes a portrait of Mohammed in support of freedom of expression, feel free to reproduce it

    --
    this comment is provided "as is" and without any express or implied legibility or congruity [...]
    1. Re:Insanity Re:Call For A Red by rednip · · Score: 1

      I haven't seen the cartoons (I'd like to...), but if they cannot repoduce his image, how do they know what he looks like?

      --
      The force that blew the Big Bang continues to accelerate.
    2. Re:Insanity Re:Call For A Red by n54 · · Score: 1

      I've seen a two of the cartoons (did some extensive googling days ago):

      - one is a completely innocent depiction in typical cartoon style (think Newsweek cartoons or any other major newspaper political comment cartoon) of a line of smoking (as from having blown up) suicide bombers in front of the gates of heaven. A robed muslim (not necessarily Mohammed) is blocking their path saying something like "sorry we're out of virgins". Not exactly highbrow but nothing especially bad either compared to many ordinary political cartoons in arab media.

      - the second I've seen I do understand that muslims will find offensive just like most israelis (and others) will find offensive any superimposition of swasticas on a star of David (and I'm sure you know that isn't exactly rare). It's a cartoon portrait of a muslim/arabic man with black beard and a black turban with a lighted fuse sticking out of it. That in itself shoudln't be too offensive but if you add the supposition that it's the prophet Mohammed (afaik that wasn't even alluded to by the publishers) it gets a bit worse. However what is really offensive (imo) is that on the turban there is an arabic caligrafic which is said to be (I don't read arabic so I'm not sure) the first pillar of Islam (http://en.wikipedia.org/wiki/Shahada) thus implying that when the fuse reaches the bomb the first pillar of Islam is destroyed. I see how that can be extremely offensive yet mostly of all imo because it has a certain truth to it: the "islamic" terrorism will, if not fought and conquered by muslims themselves, destroy Islam.

      Almost all westeners finds something in the media that they (can) take offense at, just like the rest of us those who are muslim need to understand that freedom of speech implies the right to offend even if considered blasphemous to some religion and I think most of them actually do understand it (at least most of those living in the west).

      SFGate had an article/blogentry with the second cartoon: http://sfgate.com/cgi-bin/blogs/sfgate/detail?blog id=15&entry_id=2796 (didn't manage to find the other one again and there should be others as well -- I think Die Welt has printed them all in a recent issue and since that is a fairly large and wellknown german newspaper it might be available at your local library or university library).

      As to how Mohammed looked nobody knows (the BBC link in my original post addresses this issue briefly). Yes, it makes the whole shebang even more absurd :)

      --
      this additional sig includes a portrait of Mohammed in support of freedom of expression, feel free to reproduce it

      --
      this comment is provided "as is" and without any express or implied legibility or congruity [...]
  46. Your tinfoil hat is on a bit too tight by Infonaut · · Score: 2, Insightful

    Suppose their attacks allow them to get into various machines and networks, what will they do with the data that is accesible in those machines?

    Well, according to TFA, "IT-ISAC has eight members participating in the exercise, the center's Web site states. The participants are Cisco Systems, Citadel Security Software, CA (formerly Computer Associates), Computer Sciences Corp., Intel, Microsoft, Symantec and VeriSign." So those companies seem to have signed up and are ready to have their networks accessed as part of the excercise. In the absence of evidence to the contrary, your supposition is groundless.

    Is this just another end run around warrantless search and seizures of data?

    If you were going to attempt to grab all sorts of data, would you publicize it and bring in several nongovernment participants? It seems that bringing in so many actors and making it all public would violate several of the tenets of Black Helicopter Ops 101.

    What kind of oversite is there on this process and how can we be sure the information is not used, stored, or otherwise desiminated among the various US spook agencies and their foreign lackeys.

    In the House of Representantives, the House Committee on Homeland Security provides oversight. In the Senate, the Senate Committee on Homeland Security and Governmental Affairs provides oversight.

    And how much do you want to bet Google will be a very well excercised target since they have been fighting the governments abuse of power already.

    Google is fighting a subpoena from the Department of Justice. If you think that the Department of Homeland Security automagically does the bidding of the DOJ, you've obviously never worked in government. The people at DHS aren't morons, and though the structure of the organization almost guarantees incompetence, I doubt they would be so stupid as to "target" Google in this exercise.

    --
    Read the EFF's Fair Use FAQ
  47. tin foil time by Anonymous Coward · · Score: 0

    real 'terrorist' attacks usually occur during simulations:
    1) New York
    2) London
    3) Internet?
    4) Profit

  48. How about a coordinated response by RelaxedTension · · Score: 1

    Post the IP's of the attackers here, and we'll have a run at them while they carry out their attacks. Let's see just how ready they are for a response to the attacks. It seems only fair to me, and would be an appropriate part of the test as well.

  49. Learn before speaking...unless you just want to... by jscotta44 · · Score: 0, Troll

    ...spout political nonsense. In the real world, the best defense is a great offense. It is amazing your mod points are so high. I guess there are a lot of people like you.

  50. Re:Governments can't hack it by mdfst13 · · Score: 1

    The result of this is very unlikely to be validation where they pass with flying colors. The more likely result is that some number of areas will fail and be improved in response.

    There's no perfect system. Initiatives like this are simply aimed at making existing systems better. It's quite possible that the initiative itself could be better as well. However, rather than waiting for the perfect initiative, it's better to go with what one has now and repeat (better) later.

  51. "Cyber Storm" by ScrewMaster · · Score: 2, Insightful

    "Cyber" this and "Cyber" that. I'm just about as sick and tired of that term as I am "rampant piracy". Somehow, I think certain portions of the United States Federal Government, specifically those involving national security, have been taken over by either small, odious children or full-grown chimpanzees. At this point I can't really tell which.

    --
    The higher the technology, the sharper that two-edged sword.
  52. ... but what if you don't run Windows by Anonymous Coward · · Score: 0
    Go to work, turn your machine off, and say "I've voluteered to be someone who was hit by a virus that knocked my machine out of commission."

    Then go home for a couple days!

    But what if you're not running Windows?

  53. should we make it fun for them? by Hosiah · · Score: 1

    OK, the government's going to play tiger team tomorrow. I guess I'll oblige by creating a 'honey-pot'. I know! I'll make a directory called "stolen_mp3s" and softlink it to /dev/random ! That ought to slow 'em down...

  54. Wait a minute by squoozer · · Score: 1

    The Government is going to attack company websites? What if they knock one off line can the company sue them for damages. Ok the company should be in a position that it can survive the attack but last I heard it wasn't illegal to run servers that can be compromised. This sounds like a really bad idea even for the Government.

    --
    I used to have a better sig but it broke.
  55. Disturbingly Odd Timing by buckhead_buddy · · Score: 3, Interesting
    When I participated in some security tests related to the banking industry, one thing that was never played around with was the announced timing of the testing window. There was a type of security test that involved surprise (e.g. testing clarity of thought of a bank teller in a hold up situation) but these didn't have announced testing windows at all: you compromised the test if the test subjects knew it was "just a test".

    The type of test I participated in wasn't invalidated by this lack of surprise because it was deliberately designed to expose procedural flaws and systematic gaps that fell between different areas of responsibility. The lack of surprise was a nuscience in the design of the test, but it was planned for and accounted from the very beginning. Having an announced testing window was a necessary security feature and not a flaw in the test.

    These tests either were performed within the announced window of time or they were cancelled outright. Delay was out of the question. Delay was insecure. Cancelled tests were a nuscience for the test teams because it meant almost a month delay before they'd be allowed to perform the test, but the insecurity introduced by saying "Oh wait, the tests are back on schedule" or "Oh we'll just delay the test window a few days" was unnaceptable to security.

    I've heard a time (though I didn't participate) in a test where a piece of equipment failed the day before the two day test window. Without this piece of equipment data measurements would be fuzzed by an order of magnitude on one part of the test. A replacement was ordered but on the day the tests were to begin it still required a day of prep time. To you and me our first inclination might be to simply delay the test a day. That was not acceptable to the security team. The test went on with the bad piece of equipment and the test results were compromised but in only that part of the test. Another test window was scheduled six weeks in the future and the test team's budget was increased to have redundant pieces of certain test equipment on hand and ready as part of the design of new testing procedures.

    What seems almost absurd was the idea of moving forward the timeframe of an announced security test. There were times when test teams were very ready ahead of time, but they used the time to double and triple check their preparation, take documentation for next test, meet and discuss the game plan, and use the extra time productively while waiting for the arrival of the upcoming announced testing window. Why not just go ahead with the tests? Because once again, moving the announced test window was a security risk. And performing the test outside a test window was considered a break-in by security, and unnecessary for properly designed tests by the test teams.

    I know banking security differs from computer security, but it still seems rather insecure and dangerous to move an announced test window period at all. What's worse is that it seems unnecessary, unusual, and odd to move the test period forward. If the test requires surprise, then it's either a poorly designed test or it was compromised by having an announced test window to begin with. If we're dealing with computer security on an international scope, then it would seem incredibly helpful to take the extra test time and double check the game plan. Tests inside a single banking company with far fewer issues of timing, language, and politics welcomed an extra week to plan and prepare before most tests of even moderate complexity. It seems arrogant, ignorant, or careless to say "Oh, we don't need this extra time before the tests. We'll deliberately tamper with our security and throw away this extra time we could use to prepare and coordinate this very complex international test."

    So what's really going on here?

    • Is this just a poor test design that graduated to an international scope?
    • Is this good test being ignorantly executed by teams on an international scope?
    • Or is perhaps the use of "secuirty
  56. BBC: US plans to 'fight the net' revealed by Philip+K+Dickhead · · Score: 2, Informative
    US plans to 'fight the net' revealed

    By Adam Brookes
    BBC Pentagon correspondent

    A newly declassified document gives a fascinating glimpse into the US military's plans for "information operations" - from psychological operations, to attacks on hostile computer networks.
    Bloggers beware.


    As the world turns networked, the Pentagon is calculating the military opportunities that computer networks, wireless technologies and the modern media offer.

    From influencing public opinion through new media to designing "computer network attack" weapons, the US military is learning to fight an electronic war.

    The declassified document is called "Information Operations Roadmap". It was obtained by the National Security Archive at George Washington University using the Freedom of Information Act.

    Officials in the Pentagon wrote it in 2003. The Secretary of Defense, Donald Rumsfeld, signed it.

    The "roadmap" calls for a far-reaching overhaul of the military's ability to conduct information operations and electronic warfare. And, in some detail, it makes recommendations for how the US armed forces should think about this new, virtual warfare.

    The document says that information is "critical to military success". Computer and telecommunications networks are of vital operational importance.

    Propaganda

    The operations described in the document include a surprising range of military activities: public affairs officers who brief journalists, psychological operations troops who try to manipulate the thoughts and beliefs of an enemy, computer network attack specialists who seek to destroy enemy networks.

    All these are engaged in information operations.
    Perhaps the most startling aspect of the roadmap is its acknowledgement that information put out as part of the military's psychological operations, or Psyops, is finding its way onto the computer and television screens of ordinary Americans.

    "Information intended for foreign audiences, including public diplomacy and Psyops, is increasingly consumed by our domestic audience," it reads.
    "Psyops messages will often be replayed by the news media for much larger audiences, including the American public," it goes on.

    The document's authors acknowledge that American news media should not unwittingly broadcast military propaganda. "Specific boundaries should be established," they write. But they don't seem to explain how.

    "In this day and age it is impossible to prevent stories that are fed abroad as part of psychological operations propaganda from blowing back into the United States - even though they were directed abroad," says Kristin Adair of the National Security Archive.

    Credibility problem

    Public awareness of the US military's information operations is low, but it's growing - thanks to some operational clumsiness.

    "When it describes plans for electronic warfare, or EW, the document takes on an extraordinary tone. It seems to see the internet as being equivalent to an enemy weapons system"

    Late last year, it emerged that the Pentagon had paid a private company, the Lincoln Group, to plant hundreds of stories in Iraqi newspapers. The stories - all supportive of US policy - were written by military personnel and then placed in Iraqi publications.

    And websites that appeared to be information sites on the politics of Africa and the Balkans were found to be run by the Pentagon.

    But the true extent of the Pentagon's information operations, how they work, who they're aimed at, and at what point they turn from informing the public to influencing populations, is far from clear.

    The roadmap, however, gives a flavour of what the US military is up to - and the grand scale on which it's thinking.

    It reveals that Psyops personnel "support" the American government's international broadcasting. It singles out TV Marti - a station whi

    --
    "Speaking the Truth in times of universal deceit is a revolutionary act." -- George Orwell
  57. Re:Governments can't hack it by hutchike · · Score: 1
    I always feel that this kind of thing is best left to private business. There's a profit motive for providing good security, so most private businesses (banks, shops, etc) invest in security.

    There's always a new initiative out there costing tax dollars/pounds with questionable results. Yes, it might make things a little better, but I doubt it will give value for money compared with buying a security audit from a reputable consultancy (Accenture?).

    I get the feeling that governments are slowly trying to take control of the internet, bit by bit (no pun intended). Examples are P2P, Data Protection, DMCA, Patriot Act, etc. This looks like yet another example where the goverment should leave well alone (or outsource).

    --
    Zen tips: Pay attention. Don't take it personally. Believe nothing.
  58. Hmmm by nexcomlink · · Score: 1

    Well at least we know Windows is not going to pass this test so if they begin banning unsecure operating systems they got my vote at least on this one.

  59. Echelon Partners. by pr0digy25 · · Score: 1

    Interesting how the same "partners" in this exercise are also members of the Echelon eavesdropping initiative.

  60. So we're finally striking back... by The+Master+Control+P · · Score: 1
  61. Major Internet Resources by Deliveranc3 · · Score: 1

    This is exactly why the U.N. gets upset about the U.S. controlling the internet, they are going to be taking down things like dns servers and major routing switches for THEIR OWN military testing and everyone else can just suck an egg.

  62. remember... by Anonymous Coward · · Score: 0

    there were 'security exercises' weeks before 9/11 on the WTC towers too...

  63. The Weakest Link by triso · · Score: 1
    is certainly the power grid. Although the larger ISP's have UPS support and backup generators, many smaller sites and individuals do not.


    Up here in Canada, most cellphone receivers have no backup power, so cells stop working. Cable and POTS seem to work for at least 12 hours. My laptop only goes for about three hours before needing a recharge.


    On the home front, heating systems require electricity to run, (fireplaces and woodstoves still work.) Radios, TVs and the like only work with batteries (and get harder to buy every year).


    In short, I am crippled when the mains go out.

  64. Steps to prevent an attack by Anonymous Coward · · Score: 0

    1. Turn off the router
    2. Turn off the computer
    3. Turn on the tv and watch the next episode of "Another day"
    4. Open a couple brew and relax

    Isnt that in everyone computer emergency manual ?

  65. would Nortin or F-prot get finded and jailed for.. by adaminnj · · Score: 1
    would Nortin or F-prot or whom ever, get find and jailed for this kind of silly tactic?

    I had a friend who tried to get me to crack and jack a company in NY so he could sell security software (encription) to them. I nearly choked when he asked me for this, and I read him the riot act about finding anybody to do this for him. Then tried to explane why it is / was such a bad idea. Now DHS wants to do this on a global scale and what about the countys they bork who are not so keen on the US, WOW this looks like the begining of the end.

    [HEADLINES] "WW-III Starts over Data and bandwidth with the US taking the first blood" and that's all I got ta say bout that. YIKES,,, Ok so it might not be that bad but it could be.

    Check out http://www.linuxrecruiting.org/

    --
    I'd Tell you all my secrets but I lie about my past
  66. In preparation for this event... by Pantero+Blanco · · Score: 1

    The Government has rented hundreds of these.

  67. Re:Learn before speaking...unless you just want to by ultranova · · Score: 1

    ...spout political nonsense. In the real world, the best defense is a great offense.

    So which one is it ? Nonsense or a valid real-world tactic ?

    It is amazing your mod points are so high. I guess there are a lot of people like you.

    Well, the US does seem to be big on pre-emptive strikes nowadays, so my comment was Insightfull, and it is also ruled by neoconservatists, allowing me to put my comment into the "In Soviet Russia" form factor, earning me "Funny" as well. And, of course, since it was possible to detect less-than-absolute adoration of America there, I also got modded troll, leading to a net change of zero from my original +2 (thanks to karma bonus).

    Does this explain the matter to your satisfaction ?

    --

    Forget magic. Any technology distinguishable from divine power is insufficiently advanced.

  68. Its not real attacks you fools! by Anonymous Coward · · Score: 0

    Real attacks are NOT going to be happening by the Govt against systems. If anyone had read the article it is just to test the communication between depts and other orgs in the event of a "cyber attack". You are all very very stupid.

  69. Re:LOL HY attempt by Anonymous Coward · · Score: 0

    LOL

  70. 9/11 all over again? by ayeco · · Score: 1

    Weren't there some drills also going on the morning of 9/11?

  71. yeah super ... by Anonymous Coward · · Score: 0

    prices of backhoes and scissors are going up ...
    and those *bang* plugs and rj45-2-poweroutlet cables.

    cyberattacks are a complete lie and like every good
    hacker knows really 95% on social manipulating skillz,ay?

  72. He may be incompetent, but... by Infonaut · · Score: 1
    it may also be that the American intelligence aparatus has been successful in thwarting al-Qaeda's attempts to do damage. Just because the CIA, FBI, et al aren't broadcasting their successes from the rooftops doesn't mean there haven't been any. Intelligence successes tend to be vastly underreported, while intelligence failures get wide play.

    ..."It seems obvious that bin Laden wants to do serious damage to the American economy, ..." I give up.. why does it seem obvious?

    Bin Laden has stated that economic disruption is his goal, and American intelligence analysts haven't argued otherwise. He could be playing a sophisticated game of misdirection, but his propaganda is intended for would-be suicide bombers as much as it is intended for our consumption. It wouldn't suit his cause to misdirect his own followers.

    We "bled Russia for ten years until it went bankrupt and was forced to withdraw in defeat," bin Laden boasted in his October 2004 videotape.

    The October video, released just before the U.S. election, offers a glimpse into the jihadist strategy. "We are continuing in the same policy to make America bleed profusely to the point of bankruptcy," said bin Laden. His logic is simple: To bring the U.S. to suffer a fate similar to that of the Soviet Union, the terrorists need to drain America's resources and bring it to the point it can no longer afford to preserve its military and economic dominance. As the U.S. loses standing in the Middle East, the jihadists can gain ground and remove from power regimes they view as corrupt and illegitimate while defeating other infidels who inhabit the land of Islam.

    - - - -

    He said the September 11 attacks have "shaken the throne of America and hit hard the American economy at its heart and its core." Bin Laden said that if the U.S. economy suffers enough, Americans will withdraw from those countries mentioned.

    - - - -

    According to bin Laden's math, each $1 al Qaeda has spent on strikes has cost the United States $1 million in economic fallout and military spending, including emergency funding for Iraq and Afghanistan.

    "As for the size of the economic deficit, it has reached record astronomical numbers," bin Laden said, estimating the deficit at more than $1 trillion.

    Al Qaeda has long made a point of hitting economic targets. The World Trade Center was likely targeted on Sept. 11 both because attacking it would kill thousands and because the twin towers were symbols of America's economic power. In a video that surfaced in December 2001, bin Laden said the Sept. 11 attackers struck the American economy "in the heart."

    --
    Read the EFF's Fair Use FAQ
    1. Re:He may be incompetent, but... by randyjg2 · · Score: 1

      "it may also be that the American intelligence aparatus has been successful in thwarting al-Qaeda's attempts to do damage. "

      Aw comon. Israel, a far smaller country with much tighter security, has several incidents a day. Even ordinary (non terrorist crime) flourishes here in the US. We can't even control ordinary street gangs, let alone far more sophisticated terrorist cells.

      It is hard to believe that there is 100% effectiveness in just this one area, when we can't even achieve that level of success in our most tightly controlled and monitored prisons. Just exactly how could even the most efficient law enforcement organization stop someone in advance from taking a box of matches and setting a bunch of forest fires or a few city blocks ablaze?

      "Bin Laden has stated that economic disruption is his goal,.."
      "Bin Laden said that if the U.S. economy suffers enough, Americans will withdraw from those countries mentioned..."

      Of course, we wouldn't even BE in the country in the first place if he hadn't acted.

      Saying he just wants to destroy America begs the question of why he wants to do so. I suspect that is misdirection on his part. There is an alternative explanation that doesn't depend on irrational, suicidal behaviour that confers no benefits.

      Lets assume his real goal is to break the power of both the regional dictators and the traditional religious clergy. In that case, most of his actions make perfect sense without depending on positing any irrational behaviour at all.

      His one sucessful attack on America resulting in the American military breaking the power of the worst regional dictator, Iraq. That was not only pretty predictable, but remember, without that attack, the American military refused to take the war from Kuwait to Iraq earlier.

      The rest of attacks seem to have the goal of causing chaos in areas where the traditional religous clergy is powerless to stop them. It doesn't seem likely his targets are American audiences, the kill rate of the past four years in Iraq is less than what happened in a few days in wars like Vietnam, WWI and the American civil war. He could do far more damage if his goal was hurting American troops. I think he is playing to local audiences, and trying to tell them the traditional religious structures are unable to protect them.

      It seems likely that if his goal was to increase the power of the traditional clergy, that it would have been simple enough to work with them in the attacks. Instead, he seems to be going around them.

      It appears that his real goal is to break the traditional religious structures by inducing the formation of small independent groups. If this is the case, he is having great success.

      It is uncertain what he intends to do with those groups, but one thing is clear: for the first time in over a thousand years, it is possible for the basic power structures in the middle east to change radically. In the past, the roles always stayed the same, even though the persons occupying those roles, and the geographic areas they controlled changed.

      Is his goal to destroy the American economy? Possibly, but what would it gain him? It seems more likely that he would want to consolidate his power first, and he needs oil revenues to do that, which means he doesn't want to particularly disrupt one of his biggest potential customers.

      Thats probably why he offered the truce recently. He has eliminated his biggest political rivals, the regional dictators and the influence of the top religious clergy, and now wants to concentrate on consolidating his vistory by controlling the formation of new power structures in the region.

  73. So it's really about restructuring power? by Infonaut · · Score: 1

    It is uncertain what he intends to do with those groups, but one thing is clear: for the first time in over a thousand years, it is possible for the basic power structures in the middle east to change radically. In the past, the roles always stayed the same, even though the persons occupying those roles, and the geographic areas they controlled changed.

    Your thesis seems to be that he may have some larger aim, but in the medium term his goal is to establish a new power structure in the Middle East. That is an interesting notion, and I definitely could imagine bin Laden practicing strategic misdirection. I can see why he would want to induce America to wage war in the Middle East, but the larger question of his end goal remains. If not to take down America, what is his real mission?

    I could imagine a scenario in which his intention is to take over Saudi Arabia, to topple the House of Saud. Perhaps the only way he figured he could gather sufficient manpower would be through fighting America first, in order to profit from the obviously forseeable recruiting benefits. So he draws in America, which as predicted, roils the Middle East. The Sauds fall, and bin Laden steps in and takes over Saudi Arabia. Perhaps he establishes a new caliphate, encompassing several Middle Eastern countries. He proceeds to attempt to overwhelm Israel with suicide bombers. Then what?

    Your line of reasoning, if I'm interpreting it correctly, is interesting. I don't know that the answers are as obvious as any of us think, though. After all, generals have a difficult enough time getting inside the heads of their counterparts on the battlefield. Here, we're dealing with a man from a vastly different culture, who follows a radical version of a religion most Westerners don't understand very well (having read the Koran, I can say that it doesn't tell you much about Middle Eastern culture or politics), and who is playing a very, very long game.

    One more nit: I don't buy the inference that if he wanted to, bin Laden could be doing more harm to American troops in Iraq. Comparing casualty rates between the Civil War, WWII, Vietnam, and Iraq is just too loose. There are so many variables. The South kicked the North all over the battlefield in the first years of a traditional army against army war. World War II was another struggle between giant conventional forces. Vietnam, though a guerilla war, was primarily rural and involved large numbers of NVA units that were formed along relatively conventional lines. Casualty rates in Iraq are influenced by the overwhelming capabilities of American combat forces at the unit level, the availability of rapid surveillance data, access to extraordinary medical care, and so on. Assuming that the Americans in Iraq aren't getting their hats handed to them by the insurgents merely because bin Laden is holding back seems a stretch to me, absent any evidence to that effect.

    --
    Read the EFF's Fair Use FAQ
    1. Re:So it's really about restructuring power? by randyjg2 · · Score: 1

      Well, yes and no...

      The real answer is a bit more ocmplicated. For various reasons, America, China, the Arabic people and Bin Ladin have a common interested in breaking up the present power structures in the area.

      There has been no equivalent of a "Tet offensive" because, I suspect, there is a tacit understanding that everyone is acheiving their goals under the present conditions.

      China faces ethnic unrest for the them, especially in its hardest to govern provinces like Xiang, and would rather face many small groups than one large organized group.

      There has been a lively debate from the past several decades among the Arab peoples themselves, that they have somehow "lost their way" over the past 100 years. You have to remember, that for a 1000 years, they were the dominant civilization on the planet. The recent riots are not so much about the cartoons as the loss of status amd power. Many believe that anything is better than the present situation.

      The reason for the stasis is that they got caught up in what economists call a "water economy", an economy where control of one resource (oil in this case) dominates. Such economies can only be changed by outside forces, such as the recent American invasion. The strict, monolithic religious structures (like the Christian church in early western civilization) also acted to buttress the stasis of their civilization.

      Bin Laden obviously believes that this course of action will move his civilization into growing again. Exactly where he wants to guide it, and whether that conflicts with American interests is unclear. It must be remembered that it hasn't been that long since Britain was a deadly enemy of America. Things change very fast these days.

      America also wants this to happen, though the reasons aren't as obvious. Many people believe that the Iraq war is about oil. Nothing could be further from the truth. Western civilization had a very nice efficient system of puppet governments to efficiently extract the oil, and would not go for something this radical without extremely good reasons.

      It is not about spreading democracy either. If you listen to CSPAN, the moderates in Congress (a minority) are the only ones that actually believe in a two party system, and more than a few barely believe in a one party system.

      The war is about spreading capitalism (which, to Bush, is indistinguishable from democracy). Let me explain.

      Every hundred years or so, the financial centers of the world move to the next expanding economy. In the 1600's from the Dutch on up to moving to America in the early 1900's (see OECD's reports by Angus Maddison for details)

      In the 2000's, the financial centers are moving from America to the Hong Kong/Singapore area to take advantage of the growing Chinese economy. This doesn't bode well for America. Bush has to offer big business every incentive he can to keep them here until he can find a market to offer them that is as big in potential as the Chinese one.

      There is only one other market that fits the bill. The Middle East. Lots of money from the oil, and lots of people needing to buy even the basics.

      Problem is, most of the money is tied up in a few families.If in even one country (in this case, Iraq) that money if spread among the general populace, Bush has the market to offer as an incentive for big business to stay loyal to America.

      The rest of the countries in the region would soon follow suit, even if America did nothing more. Arab civilization is even more vulnerable to "keeping up with the Jones" than even Western civilization. All they need to know is that it can be done.

      Unfortunately, it isn't as simple as the American army strolling in, kicking out the dictators (easily done) and and spreading the wealth. A "king of the hill" game would soon arise and the money would concentrate in a few hands again.

      The reason is that it was greek civilization which invented the idea that you could have a stable government where no one was trusted with all t