Border Security System Left Open

7x7 writes "Wired News is running an article on documents they recovered via the Freedom of Information Act and a lawsuit. From the article:" A computer failure that hobbled border-screening systems at airports across the country last August occurred after Homeland Security officials deliberately held back a security patch that would have protected the sensitive computers from a virus then sweeping the internet, according to documents obtained by Wired News." It looks like Zotob made it in to the supposedly protected network."

Comments

Let me get this straight

[pHatidic]

The government agency in charge of US security runs windows?

What next, making Ron Jeremy the pornography czar?

Re:Let me get this straight

[Anonymous Coward]

no, Ron Jeremy knows about porn.

It would be like making that Vote for Pedro guy the pornography czar.

Re:Let me get this straight

[LurkerXXX]

Billions of dollars available. The agency is building tons of new buildings, hiring so much new staff than congress is looking at what's going on... and they can't afford an extra workstation with the fingerprint scanners, etc, for testing purposes? That 'critical' patch should have been tested within a day or two of Microsoft's release.

Re:Let me get this straight

[javaxman]

What next, making Ron Jeremy the pornography czar?

That would actually make a lot more sense than running mission-critical security-sensitive apps on an unpatched Windows installation. If you like porn, that is.

Heck, it would make more sense even if you *didn't* like porn, now that I think about it...

But hey, remember, this is from the administration that brought you Iraq's WMDs and the post-Katrina disaster recovery response. Poor decisions ? Bungling?

I'm shocked, I tell you, SHOCKED!!

Re:Let me get this straight

[Anonymous Coward]

As our enterprising leaders promote mandatory travel checkpoints, screening and recording every citizen who arrogates to move faster than bicycle-pace, I can practically feel myself tingling with safety.

How dare you joke about their ineptitude? Don't you realize that every dollar spent on Homeland security is a dollar that otherwise would have gone to some terrorist who snuck through the border and stole a job in preparation to launch a dirty nuclear bomb in the middle of a preschool, for God's sake?

Instead of criticizing, please, take a moment to say thank you next time.

Re:Let me get this straight

[Beryllium Sphere(tm)]

Running Windows and neglecting the precautions that Windows requires.

Zotob scanned for systems with port 445 open. In the name of the Flying Spaghetti Monster, why weren't those systems behind a firewall? On a closed network so that someone couldn't just plug in an infected laptop?

Then comes a vulnerability that Microsoft marks as "critical" and a patch that Microsoft says should be installed immediately. A sane patch management policy *might* delay installations but only if some temporary mitigation were in place (like, say, a firewall, or less snarkily an updated IPS).

Re:Let me get this straight

[afidel]

The patch shouldn't have been needed because they should have had the stations on a VPN with IDS, no way for the worm to get in. I mean it requires port 445 to be open, NO firewall should have that port open from the internet!

Re:Let me get this straight

[LurkerXXX]

Certainly that port shouldn't be open to the internet. That goes without saying. But more than one network totally disconnected from the internet has gotten nuked before when a repair technician, etc, plugged an infected laptop into that private LAN. With a network the size if the one we are talking about, it's only a matter of time before something infected from outside gets plugged in somewhere. Patching is still neccessary unless you absolutely know that no infected machine will ever have the possibility of being plugged into the net behind the firewall. With a national network, there's never going to be that certainty.

Re:Let me get this straight

[mrchaotica]

...precautions that Windows requires.

I assume you're talking about Divine Providence, because otherwise Windows is physically impossible to secure because the required precautions don't exist. If that's the case, I thought Bush said something about actually having God on his side, so what's the problem?

Re:Let me get this straight

[Firehed]

Certainly any computer that is any way related to national security shouldn't be connected to the internet at all, nor should any computer that ever touches that network. The police have a private network that's more or less parallel to the internet (presumably on their own fibre though) - that or something like it would be a much smarter choice. If my grandparents can deal with not connecting their computer to the internet (which must be going on ten years old now, and runs like it did out of the box last I checked), I'd like to think that a government obsessed with national security can handle it

Of course, I'd like to think that the IT guys that bring in that rouge laptop are competent enough to not be infected. That's what you get with goverment-issue tech staff, I suppose.

Re:Let me get this straight

[Poltras]

they should have had the stations on a VPN with IDS, no way for the worm to get in

AH! If only that was true. VPN may be broken if misconfigured (and believe me it often is), it does not protect against client vulns from other computer on the network, and IDS are sooooooo easy to manipulate and are not to be considered a security: it can be compared to a fuzzy camera hanging on your roof facing one side.

Re:Let me get this straight

[sumdumass]

But hey, remember, this is from the administration that brought you Iraq's WMDs and the post-Katrina disaster recovery response. Poor decisions ? Bungling?

Well, when we look at it with all the facts, we see that some think the russians not only supplied iraq's WMDs but also help move them to siria and lebenon in the several months we pissed around at the UN. But the only people claiming that are the CIA and some Iraqi general who wrote a book about it.

As for post-Katrina disaster recovery response, it has been demonstrated time and time again that the majority of the problems there was due to ineficiencies of the local and state governments. other areas werre effected just as bad and didn't have half the problems as New Orleans did. It is because thier governments actualy followed the protocall and things work out better. Not that thousands of people losing thier homes and means of an income, all thier personal belongings and pets could ever be a "good" thing. It just wasn't a three ring circus like in other parts of the country.

I'm not writing this to change you opinion. I'm just concerned that it is a little disingenuous to place the blame on one person and ignore all the others responcible. It is like letting the murderers go and only going after the vult leader. Share the blame were it needs to be and you will see the real problems.

Re:Let me get this straight

[drinkypoo]

That port doesn't even need to be open between different locations on the same network. It's used for SMB over TCP and they ought to be using firewalls in between departments, as most major corporations do, and blocking it. If people need access to files then they can either make them available via secure intranet or they can rsync (or similar) the files between file servers in different departments. If they're using Win2k they're likely using AD and they should have different servers for different subdomains anyway - that is, if they're using AD properly, and have different subdomains for an organization with multiple locations and departments. Also, some types of military networks are often protected by a combination of physical protection and routine. You're not even allowed to bring a machine into a room where it could be plugged into such a network. In fact, you're not even allowed to bring an iPod in. Actually, let me take it one step further; they don't even permit having a phone - and I'm talking cellular, land line, whatever - in the same room as one of these systems. And by "room" I mean the phone and any computers on the network have to be separated by a door that closes itself and locks. When I worked for Tivoli Systems (part of IBM, though they weren't on the IBM campus when I worked there) I once worked on a support call where I was talking to a guy on a phone who was shouting what I said to a guy holding the door open, who in turn was shouting to the guy sitting at the TME10 console. To their credit, they got everything I said correct, and a good time was had by all except, probably, the poor bastard holding the door open.

Re:Let me get this straight

[Anonymous Coward]

Rouge laptops are always going to give the impression they're dirty.

/not ashamed to be a spelling nazi, even when it's not funny

Re:Let me get this straight

[Anonymous Coward]

Nice troll mod. Telling the truth i guess is a trollish action. I'm gald we live in america and it can just be shrugged off as another Bush basher with mod points.

Re:Let me get this straight

[xiang shui]

The fact that there is a 'Pornography Czar' at all should tell you a lot more about the state of your society...

Re:Let me get this straight

[MemoryDragon]

Actually Ron Jeremy is an expert in that area, it would be more like making Ron Jeremy the next pope.

Re:Let me get this straight

[el americano]

First, that was a joke, there isn't a Pornography Czar. Second, why do you think that a person assigned to coordinate obscenity and pornography complaints would be the hallmark of a society in decline? You probably wouldn't even notice that they were working.

Surely you could find more important things to worry about.

Re:Let me get this straight

[oldgeezer1954]

"Well, when we look at it with all the facts, we see that some think the russians not only supplied iraq's "

Wow you lept from 'facts' to speculation before you even finished the first sentence. Way to go.

Re:Let me get this straight

[sumdumass]

Acording to some in the CIA and at least one former iraqi general who recently published a book about it, that is fact.

Google won't hide what i'm talking about. I'm afraid after the troll mod that any links I post will just be discounted like anyone wanting to counter global warming or suggest a different fix then stop using fossil fuels.

Re:Let me get this straight

[oldgeezer1954]

"According to some that is fact."

Slight disconnect issues huh?

Have a good day.

Re:Let me get this straight

[Martin Foster]

When a building is zoned there can't be any unwanted radiation of signals from the building. So cell phones are most certainly not an option in those buildings.

However some buildings have additional features, basically large rooms sound proofed, completly independant of the main structure with no water pipes, windows, sealed doors and no data capable connections other then fibre going in. Its impressive to see, specially the larger versions which essentially look like a large office without a washroom because water pipes can carry sound for some distance.

Re:Let me get this straight

[Chazmyrr]

Clearly you don't work for a large organization. Applying a critical patch within week after it becomes available simply does not happen. Within a month, maybe. More likely 2-3 months. A regular patch takes 1-2 years. This is because the patches have to be tested against various configurations before being dissected and repackaged. Then the repakaged patch has to be tested against various configurations. The repackaging and testing occurs several times because someone always decides that they know better than the vendor which bits are actually required and leaves something out which later on turns out to be important.

We've been hit by a virus because some senior executive in one of the Manhattan offices decided to ignore policy and not put his internet web servers in the DMZ. Unfortunately, he's too powerful to get more than a slap on wrist. After the first attack I configured my servers to not accept any traffic from that block of addresses. I didn't patch my servers for about 3 months because no one is allowed to install anything that hasn't been repackaged and added to the standard operating environment. Senior management can ignore their own policies, but heaven help anyone else.

Sound stupid? It is. But it's par for the course in any really large organization.

Re:Let me get this straight

[Pii]

It's too bad you were modded a troll.

To any but a knee-jerk anti-Busher, this account has the air of authenticity. Like so many things, we'll probably never know for certain all of the details, but this is what I believe happened.

Re:Let me get this straight

[sumdumass]

Interesting. If i don't like what is being stated, i can pull segments of it, switch the context and make fun of the statment so as to discredit the original reply. I noticed also that all along if I actualy use the words of the previous post but ommit certain parts it isn't lieing or distorting the truth. And if i place it in quotes, it apears to be the orignial poster statments being remarked for comment. Genius!!

Slight disconnect issues huh?

Maybe you should seek help for that. I don't know what else to say that could help you. Anyways thanks for system of distorting posts that allows you to discredit it without rebuting a single statment. I will use it in the near future. iguess if it inslt like you want, make it that way right?

Re:Let me get this straight

[sumdumass]

Too many people before bush claimed they had WMDs. Even the ones now claiming they never existed. The UN inspectors claimed that some WMDs were unaccounted for and new ones were being submited for destruction. Iraq submitted documents claiming they destroyed the unacounted WMDs without waiting for the UN inspectors because they were eager to comply. France and russia were against military action because they had secrete deals with Iraq that were against the UN sanctions and would lose out on lots of money. We do have a lot of private air trafic acounted for on radar durring the time frame the former Iraqi general claimed they "removed seats from private planes and flew the WMDs across the borders". We have numerous accounts of UN inspectors being locked out of facilities until a certain order was given to let them in wich is consistant with the former Iraqi generals claims of how they sanitized facilities before UN inspecters visited them. We have CIA officials stating almost the same thing as the former Iraqi general. I see a lot of suporting evidence other then we cannot find them now or we havn't found any yet. It has convinced me too.

Yet it might not be a duck because we havn't actualy seen a duck in that area. It doesn't matter that people claim it walked like a duck and quacked like a duck while others stated that it is most likley a duck is in the area. WE told the duck we were comming after it and two months later when we finaly did, it wasn't there.

I simply amazes me that some people hate bush so much that they aren't willing to look at anything that doesn't directly support thier belief. I find it ironic in some ways and sadening in others. It is almost as if hating bush is a cult now. Any attemp to differ is seen as a direct attack on the anti-bush cult and will not be tolorated.

Re:Let me get this straight

[xiang shui]

From 2001 to 2003 there was a 'porn czar' in Utah.

Re:Let me get this straight

[javaxman]

To any but a knee-jerk anti-Busher, this account has the air of authenticity. Like so many things, we'll probably never know for certain all of the details, but this is what I believe happened.

I don't know about knee-jerk anti-Bushers... I've been looking really, really hard for hints that Iraq had WMDs. It looks like they did have them, before the first gulf war. After that, it looks like, and the current administration has told us that they now know, that Saddam was so afraid of the inevitable ( his overthrow by western-backed forces ) that he'd gone out of his way to destroy anything like a real weapons program. If you're denying that at this point, you pretty much might want to consider that you're possibly looking to justify your past actions by looking for something that isn't there.

The air of authenticity does not make actual reality. Of course, you're free to believe what you want... but just because you believe everything was created by the Flying Spaghetti Monster doesn't make it so.

I'd like dearly to be able to tell my non-US friends that we're in Iraq because we had some sort of evidence that Saddam had WMDs, but there's just nothing to point to, and worse, almost everything that was pointed to in the past has been shown to be misinformation. It's made the U.S. look very, very bad, I'm afraid, and people who have come out against Bush and Rumsfield and the lot on the Iraq war aren't neccessarily just "knee-jerk anti-Bushers" anymore... they're generals, right-wingers, and genuinely concerned citizens who think they may have been misled, intentionally or otherwise.

Territorial Pissing

[Anonymous Coward]

This whole border monitoring and attempt at an omniscient fed is just plain silly. As for the terrorists, wouldn't it just be easier not to invade other countries and invoke the ire of the natives??
 
And illegal immigrants wouldn't be streaming into the US if the dollar wasn't being artificially propped up. Probably would see the reverse if the free market would be allowed to work its course.

Borders

[Thedeviluno]

The great wall of China was also ineffective at keeping out intruders.In military terms, these walls are more frontier demarcations than defensive fortifications of worth.

Re:Borders

[Anonymous Coward]

On the other hand. your skill at copying Wikipedia articles verbatim ("In military terms, these walls were more frontier demarcations than defensive fortifications of worth") is quite effective.

Re:Borders

[Ohreally_factor]

Your plagiarism from wikipedia aside, the wall might have served another purpose, i.e., as a great public work, that would help accrue, consolidate, and maintain power for the ruling classes thru the use of "surplus" labor.

Re:Borders

[iggymanz]

the Great Wall was fine, they weren't intended to absolutely keep an intruder out, but to make difficulty for them, and to provide an elevated position for defense. It's the same philosphy as putting some hairpin turns bordered by barricades in an approach to a security gate.

Re:Borders

[ThreeE]

Pot, kettle, you know the rest.

Re:Borders

[Frogbert]

I thought the point of the wall was to stop raiding parties escaping? Ie some mongols invade, loot and pillage for a bit and then run back to mongolia. But with the wall in the way the chinese millitary could stop them on their way out.

Is this right?

Re:Borders

[Anonymous Coward]

Thats what Macro Polo Claimed in The Travels anyway.

Re:Borders

[Anonymous Coward]

That was definitely the purpose of Hadrian's Wall. The Romans knew they couldn't keep the northerners out, but that a man loaded down with loot was going to have a bitch of a time getting back over it while being pursued. A double ditch system also forced invaders to expose themselves to defenders twice; when approaching the wall, and again once they had crossed.

Re:Borders

[Anonymous Coward]

The great wall of China had machine guns, airborne monitoring systems, night vision cameras and 50 cal sniper rifles? Weird. Then a wall with Mexico defintiely won't work.

Re:Borders

[Ohreally_factor]

Excuse me? Did I plagiarize anything?

Re:Borders

[ThreeE]

Someone complaining about someone else plagiarizing something off of wikipedia, the definition of plagiarism, is just too funny. Thus, pot, kettle....

Re:Borders

[hackstraw]

as a great public work, that would help accrue, consolidate, and maintain power for the ruling classes thru the use of "surplus" labor.

So, what are you saying? Homeland Security is a social welfare program for the overpopulation of incompetent MCSEs?

Re:Borders

[Ohreally_factor]

I'm still not following you. What did I plagiarize?

Re:Borders

[Anonymous Coward]

He is trying to imply rather retardedly that by pointing out someone plaigerizing wikipedia; where he beleives everything is plagairized there, is somehow insinuating that you also plaigarized.

In essence, he's WICKED retarded.

Normal windows operations

[mtenhagen]

This sounds like normal windows operations:
  - an exploit (bug) is discoverd
  - the virus is released
  - a patch is relesead by microsoft
  - the administrators dont trust the patch (cant see what it exactly does) so need to test
  - in the mean time the virus is spreading
  - there should be a profit line here, but I gues microsoft already made a profit before all of this started.

Re:Normal windows operations

[SonicBurst]

I'm pretty sure zotob came out after the patch.

Re:Normal windows operations

[LurkerXXX]

the administrators dont trust the patch (cant see what it exactly does) so need to test

I hope that doesn't mean you think OS admins should patch away without testing, just because the code is available.

First of all, lots of admins aren't programmers. They might know some code, but for most of them, looking at a patch to some arcane TCP/IP code isn't going to be very easy to interpret. If it's a patch to a bug that got by the original coders, there's not that good of likelihood a typical administrator is going to find any flaw that might be in the patch, possibly changing it's interaction with something else on the system.

OSS patches have been released before that were re-patched in subsequent days.

Open Source is no excuse for not testing patches before updating production machines.

Re:Normal windows operations

[twitter]

Normal operations also include stuff

1. Microsoft knows about but does not fix.
2. No one knows about.
3. That does it's job without you ever knowing.

Re:Normal windows operations

[mrchaotica]

the administrators dont trust the patch (cant see what it exactly does) so need to test

So what? It's not as if they can see exactly what Windows itself does either!

If they're going to run proprietary software, they might as well have blind faith that everything the vendor does is right, 'cause they have no choice anyway -- they've already chosen to trust it with the existing system. (This is why foreign governments are switching to Free Software, by the way -- they'd have to be run by morons to trust Microsoft.)

Re:Normal windows operations

[danknight]

Yep and I got that part, patches often cause trouble. the article states that there was a fear that all the peripherals could be a problem, got that too. My question is, how did the patch fare on the test machines ?
Or, do they even have a reasonable set of test machines that reflects what they have in the field to test patches on ? It seems like they are treating this system as critical. Where is the test lab ?

Re:Normal windows operations

[Anonymous Coward]

- there should be a profit line here, but I gues microsoft already made a profit before all of this started.

No, think about this. Microsoft has been anxiously pushing their particular brand of DRM for a while now. Done right, with Microsoft DRM, machines could actually be made that wouldn't run anything but Windows.

It is to their benefit to make sure that any and all exploits on Windows cause as much trouble as possible to make sure that, in the end, people clamor for Microsoft's DRM method to put an end to what, after all, is nothing but a Microsoft created problem in the first place. Then nobody can run anything except Windows!

There's your profit!

Re:Normal windows operations

[SpaceLifeForm]

Also:

1. Microsoft knows about but does not fix.
2. Some buyers rent the ho.
3. Profit!

Re:Normal windows operations

[mtenhagen]

First:
Some admins can read the patch.
Some admins will analyse the patch.

After there can be a discussion;
Why is there a change to qos when the patch should fix an igmp issue?
Is this because the two are related are is this patching another issue in the same time?
Could this qos change have side-effects, should I include qos in my testing?

When you get a binary patch you should run all you tests, which will probably take way too long. Instead of just testing the relevant parts.

should have used unix

[trickonion]

"of Windows 2000 Professional workstations installed at U.S. points of entry" Oh snaps! Seriously though, as a formers Windows user, 2000 was the most robust and best OS MS ever put out. The best choice in windows OS still failed to do it's job

Re:should have used unix

[archen]

As an admin on a Win2k (among other OS's) network I'm actually interested that a thing I started doing 2 years ago would have probably protected much of this network. So for those slashdotters who are interested and might find this useful.

Go to advanced settings in TCP/IP and turn on tcp/ip filtering (for TCP). That basically denies incomming tcp packets - a poor man's firewall. Usually I open the SMB ports (137,139) and VNC. Depending on how agressive Zotab was this would have at least blocked the spread. Vulnerable machines could start the infection, but couldn't download from the infected host because the connection would drop.

Well it's an interesting thing to try on your own network if you're worried about Win2k. It's worked out great for me.

Re:should have used unix

[sh4na]

The question is not that you can filter packets coming in... the question is how in the hell did those packets ever get in to the network in the first place! I mean this is a private, supposedly isolated network we're talking here, not some house-brewed workgroup to play around with. You don't activate packet filtering in 3000 machines because they're supposed to be as isolated as it can be, with identified points of entry secured with *real* firewalls.

There was a mention about a network not being secure if a laptop is plugged in, but a secure network does not allow unauthorized connections of any sort into it, for example, every device should only plug in to a single plug, identified and filtered by mac address. It's a lot of work, but that's what secure means. These are not workstations for checking mail and chatting away while watching movs.

The virus coming in means someone was incompetent in setting it up, or someone was really smart in putting the virus in. Not updating the machines with the patch was correct, it shouldn't be a problem if the network was correctly setup, you can't be updating everything every time a new patch comes out without tests. Independently of the OS used, in a controlled environnment patches are not a means of security, frontend workstations should not be a point of breakage.

So this is what homeland security means in the states eh? Why doesn't it surprise me? pffft...

Re:should have used unix

[Anonymous Coward]

"of Windows 2000 Professional workstations installed at U.S. points of entry" Oh snaps! Seriously though, as a formers Windows user, 2000 was the most robust and best OS MS ever put out. The best choice in windows OS still failed to do it's job
 
not that i am the biggest fan of MS (although I'm booted into XP right now), but it was the Govt that didn't do the job. known exploit, patch already out, untested by dept, critical systems exposed with known flaw, critical system with known flaw exposed to public infrastructure where automated exploit is present. any one of those previous items would have me worrying, the total of them put together is an attrocity (as nicely as i can put it). no change in OS is going to help these folk, they need a sound beating with a clue stick.
 
i understand the whole wait with a patch (i have been holding off on a firmware update for a device myself), but don't leave access to the method of entry if your holding off on a patch, if it has to be exposed for whatever reason, then duplicate your environment and test immediately, then deploy.

Failures are routine apparently

[frdmfghtr]

Publicly, officials initially attributed the failure to a virus, but later reversed themselves and claimed the incident was a routine system failure.

I guess when you run Windows, failures are routine...

Re:Failures are routine apparently

[TubeSteak]

But two CBP reports obtained under the Freedom of Information Act show that the virulent Zotob internet worm infiltrated agency computers the day of the outage, prompting a hurried effort to patch hundreds of Windows-based US-VISIT workstations installed at nearly 300 airports, seaports and land border crossings around the country.

If there wasn't a Freedom of Information Act, would the public ever really know what had happened?

I'm surprised the information wasn't classified as relevant to National Security. Weaknesses in computer security are just as bad as weaknesses in physical security.

Re:Failures are routine apparently

[EnderWiggin99]

I'm surprised the information wasn't classified as relevant to National Security. Weaknesses in computer security are just as bad as weaknesses in physical security.

You're absolutely right. Some poor sob is gonna fry for that oversight.

Re:Failures are routine apparently

[Beryllium Sphere(tm)]

>If there wasn't a Freedom of Information Act, would the public ever really know what had happened?

Even with the FOIA it took a lawsuit to get hold of these records, and they still have some unjustifiable omissions: "A public Microsoft security bulletin is included, but with the bulletin number (MS05-039) blacked out"

Re:Failures are routine apparently

[ScrewMaster]

If you're suffering routine failures, check to make sure you aren't running Windows.

Re:Failures are routine apparently

[mOdQuArK!]

Some poor sob is gonna fry for that oversight.

You mean for the oversight of not classifying this incident under National Security?

Re:Failures are routine apparently

[wetfeetl33t]

I'll add "routine system failure" to my list of useful excuses.

Would anyone like to explain what a routine system failure actually is?

Re:Failures are routine apparently

[moeinvt]

:-) Can't believe I overlooked the idiocy of that statement. The differentiation between "virus" and "routine" clouded my normal perspicacity. Failure does seem to be the routine in FedGov

Re:Failures are routine apparently

[PhreakOfTime]

I'm surprised the information wasn't classified as relevant to National Security. Weaknesses in computer security are just as bad as weaknesses in physical security.

And there lies the problem with the current administration (one of the many). Weaknesses in computer security ARE just as bad as weaknesses in physical security. However, the powers that be dont recognize the integration of computers in daily life. Sure, they realize they can use them to control, rig votes, and spy an their own citizens. But they do NOT realize that they should pay as much attention to them when it comes time to do the ol' CYA shuffle.

Arent you happy that the people in charge of 'protecting' you still get confused when someone tells them to hit the 'start' button to shut down the computer?

Re:Failures are routine apparently

[Curmudgeonlyoldbloke]

...and that just shows that whoever is deciding what to black out and what not to doesn't know what they are doing.

Re:Failures are routine apparently

[EnderWiggin99]

Yes.

Interesting

[Anonymous Coward]

So maybe a better name than "Department of Homeland Security" might be "Single Point of Failure of Homeland Security".

I feel safer already! :-)

[Philip K Dickhead]

Let's give this system to Iran, then we can avoid a war in August - while they figure out their problems with illegals, terrorists and Bill O'Reilly commentaries! :-)

In Soviet America, the border opens you!

Should have used dumb terminals.

[khasim]

These machines will sit in border offices, staffed by government employees.

I wouldn't even trust *nix workstations in that environment.

Not to mention the WHY of this. From TFA:

The system has processed more than 52 million visitors, and allowed border officials to intercept more than 1,000 wanted criminals and immigration violators, according to DHS.

Great. 1,000 people. Didn't I see something on the news recently about 11 million illegal aliens in this country?

The documents raise new questions about the $400 million US-VISIT program, a 2-year-old system aimed at securing the border from terrorists by gathering biometric information from visiting foreign nationals and comparing it against government watch lists.

1,000 people at a cost of $400 million.

$400,000 per person caught?

Someone REALLY needs to pitch the LTSP to the government.

Re:Should have used dumb terminals.

[joe 155]

I'd be happy if a government computer system cost $400,000,000 and caught 1000 people so long as it didn't materially help terrorists. My main problem with many thing like this is that if it can get a virus this easily, how easily can it be hacked/infected with a virus to say something like "you don't have to watch out for John Smith, he's not a terrorist/drug dealer/whatever the bad guys are doing these days"... this could actually provide a conduit for the bad people, whilst doing nothing but annoying people like me who are "not actively evil" or better.

Re:Should have used dumb terminals.

[geekoid]

Most illegal immigrants aren't on any wanted list.

it is used to scan everyone, so it's cost is perperson scan. People catch criminals.

Re:Should have used dumb terminals.

[suv4x4]

"1,000 people at a cost of $400 million.
$400,000 per person caught?"

And then of course the IRS is after some PayPal shmuck who hid his $400 from taxes.

Re:Should have used dumb terminals.

[sgt_doom]

Interesting history tidbit - each time the government claimed a specific number of illegal aliens right before an amnesty program (twice in the previous two decades) the actual number turned out to be 3 times the number cited.

Look for around 33 million illegal aliens.

Re:Should have used dumb terminals.

[codegen]

Look for around 33 million illegal aliens.

Which is about the entire population of Canada.

Re:Should have used dumb terminals.

[ezzzD55J]

I'd be happy if a government computer system cost $400,000,000 and caught 1000 people so long as it didn't materially help terrorists.

It does, because it's such a huge waste of money.

Re:Should have used dumb terminals.

[Andrew Kismet]

I don't know why that amuses me so much... almost as if the two are related somehow...

Re:Should have used dumb terminals.

[sumdumass]

Huge waiste of money is a real reletive term. When you factor in how many millions if not billions of people it has cleared and the piece of mind in not spending additional resources to check them out doesn't seem too out of whack.

actualy I belive the border agents ran somethign like 327 million people at land borders in 2004 alone. This brings the total down to around $1.20 -$1.50 a person screened. I would say that is a very efficent process for a government agency.

Actualy, If 327 million people come into the borders legaly in a years time, and if these computers didn't screen them, how much investment in other resources would it take to ensure the same efficiency or safety that these computers offer? We cannot just look at it and say it caught 1000 people. We need to look at it and say while it caught 1000 people it verified millions of other people as not being an imeadiate or known threat. I think knowing that the person you just let in cross the border _isn't_ a known terrorist or some other type of criminal is just as valuable as knowing you did catch/stop some criminals or undesirables with teh same system.

Of course this is a little like the chicken and the egg concept. Wich comes first reaction or proaction/preventive actions. Were I live we saw an increase in cars being broke into and general vandalism. The cops were asking for more money to investigate these crimes. Someone on the city board suggested the extra money be used to increase patrols. It turns out that they increased patrols, change the patrol routes up so as to not be as systematic and the amount of crimes in general went down. Turns out a group of people were watching the patrol routes and knew when they were not goign to be in an area. The criminals had a portable scanner and some FRS radios to give warning if somethign was up. This iregular patrol routes caught at least one group of thieves. You may wonder what this has to do with the border and I will leave you with this. Looking at it from catching 1000 undesirables is a reaction. looking at it clearing 300+ million people and determining they are not a threat is pro-action or preventive actions. We need to focus on preventive actions as miuch as catching these people.

Re:Should have used dumb terminals.

[jcr]

I belive the border agents ran somethign like 327 million people at land borders in 2004 alone. This brings the total down to around $1.20 -$1.50 a person screened. I would say that is a very efficent process for a government agency.

You have to ask though, if that money wouldn't be better spent on agents and informers to infiltrate Al Queda.

Mossad is fantastically cost-effective. Maybe we should just subcontract to them.

-jcr

Re:Should have used dumb terminals.

[JustOK]

mmmmm, and none were "mistakenly" cleared?

Re:Should have used dumb terminals.

[sumdumass]

You have to ask though, if that money wouldn't be better spent on agents and informers to infiltrate Al Queda.

Sure if Al Queda was our only concern. There are many threats out there and probably more developing everyday. If we spread it across our top ten threats, it probalby wouldn't amount to much money. I'm sure that there is money going to infiltrating and paying informers. If this little amount is going to make a big difference then we aren't trying enough already. Thats just my opinion though.

Re:Should have used dumb terminals.

[Anonymous Coward]

I wouldn't even trust *nix workstations in that environment.

Why not? Set up a Solaris/SPARC or AIX box, shutdown all services, and strip non-essential SUID bits (e.g. using JASS for Solaris). Or set up OpenBSD.

These systems are basically run as kiosks, and you can lock them down pretty well. All you really need is SSH and perhaps SNMP open, so that minimizes your external risk. Third-party system management can listen on 127.0.0.1, and can be connected via an SSH tunnel.

Locking down a box from software attack isn't that difficult. Your main challenge will be to restrict physical access to the box. Using (say) a SPARC box with the OpenBoot tightened can help.

Re:Should have used dumb terminals.

[lifebouy]

The biggest problem with the article, both on Wired and on /., is that it's not about immigrants coming across the border. It's about boarders getting on airplanes. (More specifically, the screening of those boarders.) I know I'm being the spell-check police, but that little "a" in there makes a whole lot of difference. You can really tell who RTFA and who didn't by what comments they make.

Re:Should have used dumb terminals.

[sumdumass]

Nice. Of course i didn't read the article. I still stand by my statment though,

Beta stuff?

[TubeSteak]

"Replacement of these systems and improved biometric systems will be required."

[Former White House cybersecurity adviser Howard] Schmidt agrees, though he says the problem is hardly limited to US-VISIT. "We have to start moving at industry speed, not government speed, when it comes to the deployment of new technologies," says Schmidt. Instead of running Windows 2000, "I'd be racing to run the beta of the next generation of operating system ... and not worry about legacy stuff that we know isn't going to be supported too much longer and has had issues."

I'm glad this guy is "Former" and not current. Why does he think a beta OS is going to be any more secure than 'legacy' OSes?

Re:Beta stuff?

[TedTschopp]

I bet they are talking about running Vista in a testing enviroment, so they can roll them out near release date (say 9 months after) as opposed to the normal government roll out of say 3 years later.

Re:Beta stuff?

[dubbreak]

Why does he think a beta OS is going to be any more secure than 'legacy' OSes?

Easy, because he is an average user, not a power user or programmer etc. People think newer is better.

For example I have a friend who insisted I upgrade her computer to XP from win2k. Instead of just doing that I asked her why. The response: "It'll be faster." I querried some more and the general idea for her was, "It's newer so it should run better."

It took me half an hour to explain that it wouldn't be faster, and if there wasn't some feature in XP she desperately needed then she should not bother "upgrading" as it would most likely feel slower. (removing spyware etc would though :P)

You can't blame people for thinking that though, it's like people who turn the stove upto the top setting to heat it up "quicker", they don't understand the mechanics behind it and their assumptions are misguided (The book, "Design of everyday things" has some good examples of this. Excellent book btw.)

Re:Beta stuff?

[colinbrash]

Presumably he means that he would be testing out beta OSes so that he could then upgrade to them immediately when they were officially released.

Of course, that may be too optimistic.

Re:Beta stuff?

[allenw]

Most vendors that I have experience with fix bugs in the current development release and then backport those changes, including security changes. In theory, that would mean beta is more secure than what has been released.

Of course, those development releases generally don't see the light of day outside of their local dev group until after the backport/patch has already been completed though. So he's still (likely) wrong in this particular instance. :)

Re:Beta stuff?

[DeafByBeheading]

I'm glad this guy is "Former" and not current. Why does he think a beta OS is going to be any more secure than 'legacy' OSes?

I dunno, he may be on to something. But if next gen betas are good, bleeding edge alphas must be even better! Or better yet, he should build a Linux distro that monitors the source control repositories of all the software on the system and automatically fetches and builds any check-ins, to make sure you stay in the avant garde of security.

Re:Beta stuff?

[dpilot]

If they're really talking of a Vista rollout, replacing Win2k, that likely means a BUNCH of new hardware capable of running it.

I wonder if it will be possible to see the wheels on the Budget Deficit Counter speed up slightly when it happens.

Windows?

[Cthefuture]

Instead of running Windows 2000, "I'd be racing to run the beta of the next generation of operating system ... and not worry about legacy stuff that we know isn't going to be supported too much longer and has had issues."

Or how about this: Run a secure operating system that is stable and still maintained. Linux, OpenBSD, FreeBSD, anything other than Windows. No forced upgrade required since many of the old Linux distros are still maintained.

I mean it's Microsoft forcing them to upgrade even though Windows 2000 is still a perfectly fine OS.

Re:Windows?

[DeafByBeheading]

I mean it's Microsoft forcing them to upgrade even though Windows 2000 is still a perfectly fine OS.

Not to mention that Windows 2000 will be receiving security updates through 2010...

Non-computer Q about US Visit

[Anonymous Coward]

Except for really dumb criminals, how does US Visit actually improve security? The terminals are away from the gates, you don't need to pass special check points between the domestic and international terminals and ID doesn't get rechecked at the gate. So unless I am gravely mistaken an easy way around it would be

-subject A buys international ticket
-subject B buys domestic ticket
-both pass security
-A checks out at US Visit terminal
-A and B swap tickets
-B gets on international flight
-A gets on domestic flight or leaves the terminal
-B gets off the plane outside the country and uses his or her own passport to pass the border control. IIRC, most countries including the US don't feed back who passes passport controls back to the airlines or country of origination. But even if, B could just take a fake passport to a third world country without scanners or live database hookup instead of Europe, Japan or the like.

Re:Non-computer Q about US Visit

[ScrewMaster]

Except for really dumb criminals, how does US Visit actually improve security?

Well, I have the feeling that if the government had simply deployed a bunch of dumb terminals instead of Windows machines, they'd have had a much easier time catching dumb criminals. Sometimes you really don't need a fancy-ass GUI to get the job done.

Re:Non-computer Q about US Visit

[zakezuke]

Except for really dumb criminals, how does US Visit actually improve security? The terminals are away from the gates, you don't need to pass special check points between the domestic and international terminals and ID doesn't get rechecked at the gate. So unless I am gravely mistaken an easy way around it would be

-subject A buys international ticket
-subject B buys domestic ticket
-both pass security
-A checks out at US Visit terminal
-A and B swap tickets
-B gets on international flight
-A gets on domestic flight or leaves the terminal
-B gets off the plane outside the country and uses his or her own passport to pass the border control. IIRC, most countries including the US don't feed back who passes passport controls back to the airlines or country of origination. But even if, B could just take a fake passport to a third world country without scanners or live database hookup instead of Europe, Japan or the like.

The way at least airports like SEA and DEN are aranged, one could in theory do this. Once you pass security you can from I can tell go to any airport gate including international. MCO (Orlando) on the other hand seemed to have different concourses with security at each one checking tickets. A friend for example who had a flight going elsewhere couldn't go beyond that checkpoint when they asked about the subject, thinking the tram united all concorses.

Now... Here is the stupid part. From my understanding in most parts of the world, international airports an international concorse where to exit, i.e. enter the country, you have to go through customs. People from outside north america through america to canada for example often don't have visas for America... why should they they are not actually traveling to the US. So rather than have an International zone where people not interested in going to "your" country i.e. America in this case, they prefer to give those TWOVs (Transit WithOut Visa) an escort to make sure they don't enter the United States.

But to resolve this loophole and actually resolve an existing problem... i.e. how to deal with people going though America to Canada or Mexico, it would make sense to have an international zone where only passangers with properly ticketed and ID verified can enter.

Re:Non-computer Q about US Visit

[afidel]

Uh, except that, at least in the US, the carrier checks your ID when you board the plane. Haven't flown internationally since 9/11 so I can't comment there.

Re:Non-computer Q about US Visit

[Anonymous Coward]

You have obviously not flown domestically in the last two years or so.

You no longer need to show identification at the gate to fly.

Re:Non-computer Q about US Visit

[afidel]

Uh, I flew in June and October last year and had to both times.

Re:Non-computer Q about US Visit

[GreyPoopon]

Haven't flown internationally since 9/11 so I can't comment there.

I can confirm that on every single International flight I've been on since 9/11 (four or five trips annually), my passport was checked and compared against my boarding pass prior to boarding the plane. The procedure has been even more rigorous coming back to the US. We weren't even allowed into the sitting area at the gate without a comparison between boarding pass and passport and answering several questions (for like the umpteenth time). Also, the carrier is required to generate and submit a manifest to government officials containing the exact passenger list at time of departure. There are rather steep fines for every mistake on that list. Finally, I believe that the immigration official can take the customs declaration form (required on entry to the US) and compare it against the flight manifest. I know they look at the information on the customs form and make some sort of notation in the computer, but I'm not sure exactly what it is. I seem to remember hearing of a situation where a couple arrived in the US with no record on the manifest and got to enjoy a couple hours of interrogation, so I'm pretty sure they are checking this sort of thing (at least on entry). I also have a friend who had a strange connection in the UK where he had to claim his bags and recheck them for the ongoing flight. He decided to recheck only one of the two bags and carry on the other. Because of this decision, the plane was not allowed to leave the airport, and he was treated to a round of interrogation while the rest of the passengers waited.

Therefore, I can officially say that at least with the airports I normally use, the possibility of pulling a international / domestic ticket swap is rather slim.

Re:Non-computer Q about US Visit

[Jah-Wren Ryel]

Read this for how it is done:

http://www.csoonline.com/read/020106/caveat021706. html

Re:Non-computer Q about US Visit

[biglig2]

Who needs 2 people? It's been well established that all you need to do is:

- subject A buys international ticket
- A photoshops and prints an electronic boarding pass for another flight under a different name.
- A uses the boarding pass to get past security
- A throws the pass in the bin and uses the real ticket to get on the plane

Re:Non-computer Q about US Visit

[Ollierose]

As a person who has suffered this proceedure, I think I can shed some insight.

As the people above have suggested, its not about keeping their eye on Americans (of the North sort, not the United States sort), but keeping their eye on Foreigners in general.

When I flew in from London last summer, my flight was routed to go through a "Port of Entry" which is a location where they have installed the US-Visit fingerprint scanners and such. Lucky me, I got to go to Detroit as my first port of call into the US on my way down to Florida. On the transatlantic flight, they gave out a form which was different for where you started out - the guy next to me was a US citizen, so he got a blue form while I got a green one.

In between arriving at Detroit and hooking up with the connecting flight south, there is a security bank where you need to collect your luggage from the inbound carrier, cart it across to another more sensitive luggage and body scanner (which picked up coins in my pocket that weren't noticed at Gatwick), check that on to your new flight, then go see the guy in the pseudo-military DHS uniform to make sure that you're not trying to overthrow the country. They then take your mugshot and index fingerprints on the scanner, part of the form you filled in on the plane inbound, and then over to the gates for the next stage of the trip.

What is supposed to happen on the way out is that you return through the same process to make sure you leave in line with the form, and they use a standalone fingerprint scanner to make sure you're the you that checked in. Flight delays put paid to that, so I was sent on a direct flight out instead of the hop back to Detroit.

I believe this privilege is reserved for countries that have an agreement with the US on such things, so the previous Visa system is still an option for entry if you pick a suitable source and destination airport.

The DHS website has a list downloadable that shows which airports are ports of entry, so it might be worth checking if you have a trip to the US planned. I'd say most inbound flights from the UK are routed through entry ports, as my return trip has been organised to go through Atlanta this year.

42

[Wayne247]

If anyone is surprised by the incompetence of governmental bureaucracy, please email me about my new perpetual motion machine that taps the unlimited energy of herbal pills.

Security Theatre

[bill_mcgonigle]

The government agency in charge of US security runs windows?

It doesn't matter - it's just security theatre anyway. There are thousands of ways around the current systems.

Oh, it get's better.

[twitter]

Former White House cybersecurity adviser Howard Schmidt says the incident is typical ...

Yow-ser, yow-ser, it just does that.

typo

[dotpavan]

line 2: Fomr the article:

Patch Cycle

[0xA]

The reasons they give in the article for not pushing the patch make sense. If you have a plug and play patch that you need to push to that many workstations with plug and play devices to immediately push the patch would be gross folly.

The mention the real problem in the article, why is there a connection to this network from the public internet? They are just inviting problems like this. At the very least there should be some perimeter security with an IDS of some kind. Even a $40 linksys router with the "firewall" and NAT enabled could have stopped this.

IMO that is a much bigger concern than why they held back the patch.

Re:Patch Cycle

[LiquidCoooled]

No it wouldn't.

With a border router nothing stops an infected laptop from attacking on the inside.

Re:Patch Cycle

[0xA]

No it wouldn't.

With a border router nothing stops an infected laptop from attacking on the inside.

True enough but I would think that a laptop would automatically not be a trusted device in that kind of network.

Re:Patch Cycle

[TheSpoom]

What they should do is first, have a public policy of no outside storage devices or media, including laptops, CDs, memory sticks, etc., then have a clause in the employment contract that states very clearly that anyone who brings in outside media and then infects the internal network will be considered a threat to national security and will be treated as such. I think that might have the required effect.

Re:Patch Cycle

[/dev/trash]

Until a maanger just HAS to plug in his laptop.

Re:Patch Cycle

[tsm_sf]

You know, there's a real difference between incompetence and just not giving a rat's ass. I think we're dealing with the latter at the DHS.

Incompetence would install the most insecure OS available, but surround it with other measures. Apathy just plops down desktops and moves on to the next meeting. What could possibly go wrong?**

**Unofficial motto of the Bush Administration.

Interesting...

[nawcom]

An interesting question is to the Administrators:

If you don't trust the patch that software developer provides for its product, then why trust to use the product at all?

It sounds like someone saying, "Our OS has security holes in it, but we don't trust the fixes because they will just open up more holed until we verify for sure.. .. but since 90% of the world use this "hole-y" OS we'll just do what works. Like reporting a planned virus infection. *all hail bill*"

-nawcom

Re:Interesting...

[Jose]

If you don't trust the patch that software developer provides for its product, then why trust to use the product at all?

good admins..heck, even half decent admins don't trust any new software, including patches. Not neccessarily because they will introduce holes, but because they might break something. Even if it is not security patches, they still need to be tested to make sure they don't break anything in their particular environment.

I'd wager that at least 90% of admins do not test patches for new security problems. Effectively testing patches for new security problems is very hard.

I am not an MS fanboy. This goes for every single piece of software written.

Re:Interesting...

[mrchaotica]

good admins..heck, even half decent admins don't trust any new software, including patches.

But if it's closed-source, you can't trust the old software either!

Re:Interesting...

[Brandybuck]

This isn't a problem with homeland security, it's a problem for 90% of IT departments out there.

Re:Interesting...

[cryptoguy]

Beyond all doubt, the patch had never been tested on their combination of software and peripherals. No IT shop in its right mind would push a patch out to mission critical systems without some sort of testing.

The article has it backwards

[tuxlove]

The failure here was not that the Windows boxes weren't patched. It's stupid to be patching thousands of systems that are in use w/o serious testing first. Full testing of patches in a world where new viruses/security holes appear every day is effectively impossible. Untested patches may cause new problems for the systems that could actually be worse than a problem caused by a virus.

No, the problem here is that these systems are even on the Internet to begin with. Shouldn't such a network exist in an airspace as a totally private net, with no outside access? Of course, at the core of the private network must be some sort of control mechanism/database with some connectivity to an outside network. But that should be a chokepoint, the only source of ingress/egress to the private network, with no other access than what's needed to serve the system from the local DHS network. That limited access should not include web/email/instant messaging, etc. Just whatever custom/specialized protocol is needed to serve the system.

I'm constantly amazed at the high profile companies/government offices that get nailed by viruses. It's inexcusable.

Those dollars are earmarked.

[twitter]

says Schmidt. Instead of running Windows 2000, "I'd be racing to run the beta of the next generation of operating system ... and not worry about legacy stuff that we know isn't going to be supported too much longer and has had issues."

It's amazing someone who was in that position thinks the next Windoze won't have the same problems every other version has had. What a total waste of money.

Re:Those dollars are earmarked.

[pallmall1]

What a total waste of money.

No kidding. Using Windows garbage for any Homeland Security tasks means that every Windows vulnerability (and there are many, many, many of them) becomes a National Security vulnerability. That's a fact, PERIOD. That the clowns responsible for the safety of the citizens of the US think that Windows is suitable for Homeland Security applications shows they are more concerned with protecting Microsoft's profits than protecting our families.

Re:Those dollars are earmarked.

[biglig2]

It's amazing that someone worried about security thinks running a beta of a security system is the way to go.

This is of course the great counter to the "but FOSS doesn't have any support". "The US Government can't get support for W2K, what makes you think you can?"

Re:Those dollars are earmarked.

[Anonymous Coward]

You're assuming they're thinking. The problem is the decision makers are only aware of Windoze. To them OS=Windows, or All computers use Windows.

Re:Those dollars are earmarked.

[HiThere]

Maybe it means the "Homeland Security" has a different job than the PR claims...and *that* is where it's attention lies.

Don't believe what they say, watch what they do. They lie constantly, but you can't even depend on that.

Watch your legislator. When they claim to be against something, but they vote for it, you know one of the things they are lying about.

Re:Those dollars are earmarked.

[RockDoctor]

Using Windows garbage for any Homeland Security tasks means that every Windows vulnerability (and there are many, many, many of them) becomes a National Security vulnerability. That's a fact, PERIOD.

Yup. You're right.
It gets better - you've just drawn public attention to many, many significant issues of National Security. The only possible reason for you doing that is that you're an evil Al-Quaeda operative. Hear that banging on the door? That's The Man coming with your shackles and hood for your one-way ticket to Guantanamo.
Have a nice day. Don't bother to pack any toilet paper - you won't be using a toilet for years to come, just your coveralls.

This'll really piss you off..

[way2trivial]

I don't know where the 400 million source is, but- that's couldn't cover more than a month or two over a single year
so- in two years, 800,000 per person caught.
see below, FY 05 budget for US-Visit was 340million (for one year) which is 10mill more than the prior year

http://judiciary.senate.gov/testimony.cfm?id=1034& wit_id=2961

US-VISIT Budget Requests In FY 2003, CBP processed 412.8 million passengers and pedestrians arriving in the U.S. - 327 million at land borders, 70.8 million at international airports, and 15 million at sea ports. The FY 2005 budget seeks $2.7 billion for border security inspections and trade facilitation at ports of entry and $1.8 billion for border security and control between ports of entry. This includes $10 million for Unmanned Aerial Vehicles testing and $64 million for border enforcement technology, such as sensors and cameras. The FY'05 budget provides $340 million for US-VISIT, an increase of $10 million over the FY 2004 funding. Only one month old, US-VISIT has successfully and efficiently recorded the entry of 1,114,119 passengers and the exit of 3,067 travelers without causing delays at ports of entry or hindering

Re:Homeland Security?

[waferhead]

Why do I see these guys as "Dubyas SS"...

Just like the old SS, only incompetent.

My thoughts too

[EmbeddedJanitor]

Dumb terminals are far more robust for this sort of use. They are far easier to administer and upgrade too (patch the app server, not each box).

Mainly though, the dumb fuckwits^h^h^h^h^hskilled operators don't get a chance to load porn/itunes/email/IM and use the box for uncontrolled purposes which cause all kinds of problems (overloaded networks, IT headaches,...).

All up, this could only lead to improved productivity and better security.

Re:My thoughts too

[sumdumass]

Another plus for a dumb terminal or even a remotley mounted home directory (windows or *nix) is that you can store a copy of the users space and after each logoff copy it back to oringinal. This way every change that could lead to a screwup or porn/spyware/whatever is automaticaly removed before the next logon.

Another good thing is that you can to some degree control all the hourse of playing solitare or WOW at $18 an hour.

One born every minute.

[twitter]

Why does he think a beta OS is going to be any more secure than 'legacy' OSes?

Because someone lied to him.

How many times M$ can get away with the same lie? "This OS is totally new and improved and does not have the problems our last one did." It's sickening to hear the head of a US government agency buy such stuff while perfectly usable and secure free software is available.

Re:One born every minute.

[ScottyH]

Yeah, but this guy is a Cybersecurity Adviser. A king among men. He should know better.

Re:One born every minute.

[MadUndergrad]

"'This OS is totally new and improved and does not have the problems our last one did.'"

Nope, it has a whole new set of problems!

Fine print: it also has all the problems of the last one.

Re:One born every minute.

[advocate_one]

How many times M$ can get away with the same lie? "This OS is totally new and improved and does not have the problems our last one did."

no... never... /sarcasm_tag = "on" what was the very first security patch for Vista then??? it was for the WMF hole... legacy code dating back to win 3

Great argument as to why *nix is no more secure

[edbarbar]

We hear a lot about how open source systems are more secure because security bugs are exposed. But in this case, the system failed precisely because the security bug was exposed, even though there was already a fix.

Meanwhile, it was less than a week after the uSoft announcement of the fix that the worm was created, so the problem happened precisely because of exposure.

So let's say, bug is found (in this case by the good guys), code is written, tested, release created, then there is the window during which the millions of users need to apply the new image. In the closed source case of this bug, the hackers only got a chance to violate security after there was already a release image. In the open source world, they get access to the bug much earlier, presumably shortly after it is found or latest after code is written.

Re:Great argument as to why *nix is no more secure

[SpinJaunt]

Although you answered yourself whilst blurring the line:

So let's say, bug is found (in this case by the good guys), code is written, tested, release created, then there is the window during which the millions of users need to apply the new image. In the closed source case of this bug, the hackers only got a chance to violate security after there was already a release image. In the open source world, they get access to the bug much earlier, presumably shortly after it is found or latest after code is written.

There is no difference here between open source/free/commercial software, only that in most cases in open source software you'll have the patch in hours and it would of been announced at the sametime, where as commercial software it can take weeks maybe months after a bug has been found before you see a patch, if your lucky.

The bigger picture here is regardless to the nature of the software albeit open source/free/commercial - no software is 100% bug-free.

Re:Great argument as to why *nix is no more secure

[edbarbar]

Oh, I see, the open source distrubtion is faster, and people accept it more readily. No, not really. This is just the open source religion in you wanting to not have to accept the obvious.

Re:Great argument as to why *nix is no more secure

[BeanThere]

Oh, I see, the open source distrubtion is faster, and people accept it more readily

Are you saying that the OpenSource world takes longer than Microsoft to release patches for critical security issues? Because that is patently false.

Re:Great argument as to why *nix is no more secure

[edbarbar]

Oh, they might. But that's not the point, and I think you must be ignoring it.

So, once again. When does the security bug become visible in the open source world? Shortly after the discovery. The uSoft bug became only visible after the bug was found, fixed, QAd, built, and posted.

Re:Great argument as to why *nix is no more secure

[BeanThere]

When does the security bug become visible in the open source world? Shortly after the discovery. The uSoft bug became only visible after the bug was found, fixed, QAd, built, and posted.

But there are also security bugs that are found, fixed, QAd, built and posted before (non-internal) discovery in the OpenSource world -- same as with closed source. You seem to be implying that bugs in the OpenSource world are only found externally, and then patched. That's not true. Fact is, both 'methodologies' are at least equal in that particular aspect. Sometimes bugs are found internally, sometimes not. How is the closed source model better? Seems to me that with security, OpenSource has a few advantages that closed source doesn't, but closed source has no advantages that opensource doesn't also have.

Re:Great argument as to why *nix is no more secure

[edbarbar]

So long as you are going to argue that closed source has all the qualities of open source, yeah, sure. Who can argue with that? There's not point to it.

I'm arguing about the specific point that open source advocates make about open source being more secure: there are all these eyeballs looking at the source so the bugs are found more quickly.

Now let's take a moment to recap this particular security bug. The claim of the article is that the security hole was found, patched, and posted, but before administrators took the image from a very trusted source and loaded it on their machines, the bug was exploited as a part of being exposed by having a fix for it, and that caused damage.

There is very little way to keep the hole smaller than that.

Open source by its very nature is meant to operate such that outsiders find the bugs, isn't it true? So how can you argue that open source is better than that? But it won't stop you.

Re:Great argument as to why *nix is no more secure

[BeanThere]

Open source by its very nature is meant to operate such that outsiders find the bugs, isn't it true? So how can you argue that open source is better than that?

No, it isn't, I'm not sure where you get that misconception from, the majority of opensource development work is done by core teams that often work full-time on projects --- exactly like closed source. The fact the outsiders can also look for and find bugs is just a "bonus". One can easily argue that open source is "better" by just comparing what each has going for it:

Closed source projects have: (1) A core team of developers.

Open source projects have: (1) A core team of developers, AND (2) Extra 'outside eyes' looking at the code.

Re:Great argument as to why *nix is no more secure

[edbarbar]

So now the truth hurts so much someone has to label this a "troll." How funny.

This shouldn't come as a surprise

[i_want_you_to_throw_]

I spent ten years as a government contractor and this shouldn't surprise anyone. First Homeland Security runs Windows which in itself isn't bad if it's properly patched and maintained.
The danger comes from the the people in government who control the money who have no technical knowledge. This is positively RAMPANT in government. Many times agencies just go with the cheapest bid and contractors give cheaper bids by hiring fairly inexperienced and not so knowledgable techs.

Many government agencies can get by with using Windows but really important agencies whose security cannot be left to chance should not be using Windows....period. Sadly Homeland Security and NSA are both starting to deploy more Windows units and that's only going to be bad for everyone.

Biggest reason why? Strong security requires techs that actually have technical knowledge and can do more than just set up insecure boxes by pointing and clicking. Big difference between *nix and Windows?
*nix needs techs with a decent amount of computer aptitude.
Windows does not
The person attacking you, or entity, or rogue state will not be using script kiddies. This only gets worse from here. "Homeland Security" is fast becoming an oxymoron.

Re:This shouldn't come as a surprise

[stinky wizzleteats]

First Homeland Security runs Windows which in itself isn't bad if it's properly patched and maintained.

...

Big difference between *nix and Windows?
*nix needs techs with a decent amount of computer aptitude.

Well now wait a minute. Windows is OK if it is properly maintained, but those who run Windows are generally less capable of doing so, because they don't have to? That doesn't make any sense.

Rather than trying to figure out which is the chicken and which is the egg in your causality loop there, why don't we admit to ourselves, and most importantly, the rest of the world, that Windows is just inherently insecure? How many more years is the IT community going to pretend that this elephant is not in the room? 5? 10? 20?

Re:This shouldn't come as a surprise

[Blakey Rat]

His theory is BS anyway, because there's as many incompetent losers doing *nix system administration (percentage-wise) as doing Windows administration. And there are as many good Windows administrator (percentage-wise) as good *nix system administrators. And the only conclusion we end up drawing is that it doesn't really matter what OS/platform you choose as long as you hire smart and skilled admins for it, which supports my personal experience.

Re:This shouldn't come as a surprise

[stinky wizzleteats]

it doesn't really matter what OS/platform you choose

How is it possible to look at the last 20 years of computing history and come to that opinion? That's like saying that it doesn't matter if you go to war with plastic swords or machine guns, competent leadership and good soldiering will win the day no matter what tools are used. That's not just bullshit, that's insane!

It is not possible to rationally argue that Windows is anything but a security train wreck. How many dollars have been lost to Windows uber-worms? How many dollars in lost productivity are incurred EVERY DAY due to Windows malware?

In every aspect of life, it is universally recognized that to do anything well, you have to plan very carefully up front and make very carefully considered choices about what to do before you do anything. What is it about computer technology that invalidates that fundamental truth? Yes, it DOES matter what you use. It matters a hell of a lot! You have to choose very carefully in computers, just as you do in medicine, construction, warfare, or any other human endeavor.

Configuration Control

[Detritus]

Because in large and complex systems, you don't install patches until they have been tested for unintended side effects. That may mean scheduling, running and evaluating some very complex tests. This can take weeks or months, depending on budgets, priorities, and operational commitments.

Re:Configuration Control

[metatruk]

If it's border security we're talking about, I'd sure as hell rather have a *broken* system than an *insecure* and *vulnerable* system.

These people don't know what they're doing.

Re:Configuration Control

[Anonymous Coward]

Absolutely; "At least there were no unintended side effects while our entire network was being converted into a zombie fleet by a Russian script kiddie."

Re:Configuration Control

[Idarubicin]

If it's border security we're talking about, I'd sure as hell rather have a *broken* system than an *insecure* and *vulnerable* system.

These people don't know what they're doing.

How do you know that the just-released patch doesn't break something in a way that opens a new vulnerability?

Is the border more or less secure if border officials have to do things 'by hand' because their computer system is brought down by a troublesome patch? Overworked officials are going to be less thorough that usual, and they may not have access to as much information.

Which risk to national security is greater--the chance that a patch will break something, resulting in less stringent checks at the border, or the possibility that unpatched systems will be infected by the latest Windows worm?

I know that I'm not comfortable giving a pat answer to any of those questions. It's fortunate that the federal government of the U.S. has Slashdot to provide them with so much free I.T. advice. Is it possible that this is plain vanilla government incompetence at work? Sure. Is it also possible that some sysadmins - despite being employed by Uncle Sam - are competent and capable of considering the costs, benefits, and risks associated with different patch management strategies?

Re:Configuration Control

[metatruk]

Is it also possible that some sysadmins - despite being employed by Uncle Sam - are competent and capable of considering the costs, benefits, and risks associated with different patch management strategies?

I never said that all of them didn't know what they were doing. It's just the ones who chose to use Windows, and didn't bother patching.

Irony with a 60lb mallet

[caudron]

It looks like Zotob made it in to the supposedly protected network.

I'm supposed to be surprised that the department that is there to "protect" us from attack fell to an easily preventable virus?

Not when that same agency appoints Gator (now Claria) executive, D. Reed Freeman, to their Data Privacy and Integrity Advisory Committee or when that very same agency hired its own Chief Privacy Officer from Doubleclick.

No, I couldn't muster less shock at the irony if my nutsack depended on it.

Tom Caudron
http://tom.digitalelite.com/politics.html

Re:Homeland Security?

[titzandkunt]

Never mind Homeland Security: I've got to say, I find the (recent?) introduction of just the term "Homeland" into the political lexicon rather troubling.

All other [mumble]-land places I can think of did not have enlightened and benign regimes: "Motherland" (Russia, during the Soviet Union era), "Fatherland" (Germany during the 3rd Reich). Any more for the list?

T&K.

The real meat of the article

[whitehatlurker]

"Perhaps most significantly, the pages do not reveal how the Zotob virus made its way onto the private CBP network -- an ominous migration that demonstrates that computers used in protecting U.S. borders are accessible, via some path, from the public internet, and could be subject to tampering."
You know, that might be a problem, too ...

Re:The real meat of the article

[Arimus]

Or some stupid oik could have stuck a usb stick into the CBP network...

Warning, offtopic

[LurkerXXX]

government-issue tech staff? The examples of this occuring that I've always heard about were always vendor technicians bringing in infected laptops. Not government-issue techs. I think you give way too much credit to hadware/software vendors tech staffs.

Re:Warning, offtopic

[Firehed]

I forgot that it's not safe to make the assumption that the only people with physical access to secure information are the people that are supposed to have physical access. You know, "clearance". Shouldn't random techies with infected laptops not have the clearance to go close enough to those machines to break them?

Re:Warning, offtopic

[Voltageaav]

They have clearance if they're working on it. It's much cheaper to hire outside people and get them clearance than to have your own staff for many things. It's also much harder to make the outside people's life miserable for messing up, so they don't care as much. Homeland Security dosn't really have access to much classified material though anyway. They don't need it, so the systems techs working on the system probably only needed a basic background check to be allowed in.

Re:Warning, offtopic

[sarhjinian]

http://www.cisco.com/en/US/netsol/ns466/networking _solutions_package.html Or even wired 802.1x..

Re:Warning, offtopic

[cayenne8]

" government-issue tech staff?"

There really isn't much of a gov. tech staff any longer...most everything is contracted out with only gov. oversight.

Re:Warning, offtopic

[LurkerXXX]

As the other poster said, they do have clearance. Unsurprisingly, if they trust their hardware/software vendors enough to use them, they also trust their support staff to work on the machines.

It might be different if we were talking about a secret CIA/Pentigon network with top secret information on it. We're not. We're talking about a network with most of it's workstations in airports throughout the country. Not exactly stuff locked behind vaults.

And it's not super-secret information. The terminals just query a big central database server with a list of restricted passengers (with lots of non-terrorists, including congressmen on it). People find out they are on the list if they get turned down to fly. It's not exactly super secret Pentigon/CIA information.

Government Insecurity...

[RyoShin]

You know, when you think about, wouldn't you want government agencies that need tight security to run a propritairy OS? Maybe base it off Linux, so you still have app availablity, but change enough that its guts work different from Linux itself, and only use it within the government itself (Perhaps call it LinUS, though Torvalds may get a little cheesed.) Use dumb terminals when possible. Restrict access to the servers to a select few.

After all, it would be much harder to create a virus for a system that few people have real access to. Think of it as a master lock-picker coming to a new and complex lock that no one has seen before. After quite some time he might be able to pick it, but chances are that guards would come by and pick him up first.

As much as I like Microsoft as a regular user, there's no way in hell I plan to run servers on it.

Re:Government Insecurity...

[Josh teh Jenius]

I've always wondered the same thing.

Then I remember the MS lobbyists...

Re:Government Insecurity...

[msuarezalvarez]

As much as I like Microsoft as a regular user...

It is when I am in my "regular user" mode that I displike Windows the most.

Re:Government Insecurity...

[kalidasa]

Think of it as security through obscurity. Not necessarily the best option. And when one of the people using the computer has to run something only available on Windows, what do you do? The problem is far more basic than the security decisions made by individual administrators: the problem is the monoculture that makes using Windows necessary.

Re:Government Insecurity...

[donaldm]

I could not agree more with the use of dumb tty or smart graphical terminals. These are very easy to setup and forget and almost impossible to put off line baring cutting their network connection and that would hopefully be setup in a way to facilitate quick repairs.

There is too much emphasis placed on active terminals (ie. read PC's) which may be cheaper although that can be debated. Get a virus or worm and a PC becomes a brick and requires quite a few man hours to get rid of the problem, not to mention the agro', now translate that to 100's or more PC's and fixing the problem becomes very expensive. If a PC is used in just a client/server or just dumb client configuration then why not go for a dumb or even an intelligent graphical terminal.

The only useful thing a PC has over a dumb/smart terminal when its prime use is to connect to centralised secure server(s) is the fact that you can play solitaire. Before telling me you need a PC for "Office and Outlook" then I suggest you read some history. Full graphical Office/mailer suites were available for *nix in the mid 1980's when MS Word was a joke, admittedly they weren't cheap but they did have network licenses which did reduce overall costs. Today *nix Office or Productivity suites have got even better and they conform to Open Standards (some cost and others don't).

On a side-note I still remember the time (late 1980's)when I was called by a very aggravated women who said she setup her display for proportional spaced fonts and why could she not see her fonts. She was using a dumb tty terminal at the time and no she was not blond. I was quite nice about the whole thing and did not embarrass her in front of her colleagues, although it was very hard not to laugh. Her document did print properly though which impressed everyone, later we did organise an 1024x1024 colour X terminal (cost was $4000 compared to a $5000 PC with Windows 3.1 and VGA screen) for her. Wordperfect under X11 had a Framemaker look and feel which was very impressive. Hmmm I can see a Dilbert joke here.

The spelling correctors are still here?

[dbIII]

line 2: Fomr the article:

Your parser just failed the Turing test but all the real people out there determined the meaning.

Re:The spelling correctors are still here?

[dotpavan]

..all the real people out there determined the meaning

My point is not the inability to understand the meaning due to the typo, but the lack of interest shown by the editor. Your intelligence did not help you figure that? All the real people did.

It's about test automation, not MS

[Precipitous]

While stating "deliberately held back a security patch" might be factually correct and a good catch line, I think it's highly misleading: it directs the reader towards many of the wrong conclusions.

Later in the article: "Officials -- not unreasonably, say security experts -- wanted to test the patch before installing it." Well, duh. This is the interesting story. They couldn't get through the tests that they SHOULD do fast enough.

The problem is agility and testability of the systems and deployment. The easiest solution has nothing to do with MS, nothing to do with windows, and everything to do with giving your test group more respect and resources.

This is not a problem inherently Microsoft's making. You can argue up and down that patches should be faster, product more secure etc. In the end, it's plausible that discovery, patch, exploit can come with bad timing in any system. System admins and project managers that don't plan for this are asking for trouble.

Elaboration: I push very hard to ensure that all my products have automated tests. My company's Desktop Engineering department requires automated tests of all its myriad apps (DE is not my department, won't take credit). I force redesign if a product can't be tested cheaply. The benefit is: I need new feature x tomorrow (maybe some suprise regulation) or company needs patch y tomorrow (e.g. Zotob worm). Where we've achieved our test automation goals (haven't in all cases, but our coverage is good enough), we can hit a few buttons, run our tests. Repeat on all 20 configurations / platforms. 90% of the time, we find no problems, and can deploy. If it's critical, you take the risk and deploy. If not, you go on to slower manual testing to complete coverage.

Had this US-VISIT program implemented adequate and automated tests, they could have deployed in a few days, not a few weeks. The methods and tools to do so have nothing to do with Microsoft. They don't even make the type of test automation tool required for this - although I know they have one for internal use.

CTU doesn't use Windows, why should Homeland Sec

[olcrazypete]

Get Chloe O'Brien to set up your servers, it works for Jack Bower :) P

Not a bad idea.

[pallmall1]

Let's give this system to Iran, then we can avoid a war in August

That's rather interesting. This is offtopic, but I'm curious as to what software/system the Iranians are using in their government. If there's a significant Microsoft implementation, I kind of would feel safer. Nuclear technology is very risky, and if they've got any failsafes depending on Microsoft technology (blackmarketed or licensed) they might end up with a massive nuclear disaster of there own making, like the Mayak disaster in the Soviet Union.

Re:Not a bad idea.

[hotdiggitydawg]

...or an accidental launch, cold-war nightmare style. And no prizes for guessing where their secret missiles would be pointing!

Feel safer now?

So that would make this

[teamhasnoi]

the first undoucumented Mexican virus?

I'm confused. Who will clean my Walmart now?

Thank You!

[R3d M3rcury]

"Instead of criticizing, please, take a moment to say thank you next time."

Thank you for that link.

It seems that every time I travel, when I get to my destination, I have a little note in my luggage from the TSA saying, "We searched your bag." I've been trying to think of something to do next time I travel.

This will be perfect. Thank you very much.

Re:Thank You!

[chrish]

Welcome to that secret No Fly list, sucker!

D'oh.

surprised?

[esmrg]

Someone mentioned that homeland security is becoming an oxymoron. That appears to be the case if you confuse an idea of homeland security -(strong friendly americans keeping bad guys from blowing up your house) - with the actual department of homeland security. The department was not actually created to protect you or me - so why should it use the tightest os, or hire the smartest people? Remember the slashdot article about goverment agencies making the grade? Agenicies like the EPA, where you would expect dumping used oil to be more important than security, recieved an A.
The DHS was created for one reason - to diseminate fear and confusion, a job which it does quite effectively.

Re:Headline!

[pallmall1]

Can anyone say "slashdot bias"?

Slashdot didn't go to court to get this story, Wired News did. The fact that Wired had to file a federal lawsuit to get the information regarding a massive computer failure involving border, national, and homeland security, and that a coverup was attempted, is worthy of film at 6, 10, and 11.

Can you say "Microsoft fanboy?"

These are kiosks. Why are they running services?

[Animats]

These are kiosk systems. Why are they running any general-purpose Microsoft services?

If they insist on running Microsoft software on kiosks, they should be running XP Embedded, where you only configure in the stuff you need, not the kitchen-sink approach Microsoft uses in their desktop distros.

Re:CTU doesn't use Windows, why should Homeland Se

[Anonymous Coward]

Bauer. Sheesh - you don't want to piss him off by getting his name wrong.

So Homeland are too busy 'rolling up' CTU to take care of their own systems... Figures.

Spellcheckers do not catch all misspellings.

[lifebouy]

I guess all those boarders better make a run for the border.

border
1 : an outer part or edge.

boarder
one that boards.

Virus is busted

[suv4x4]

"Homeland Security officials deliberately held back a security patch that would have protected the sensitive computers from a virus then sweeping the internet, according to documents obtained by Wired News."

They actually were collecting incriminating evidence against the virus.

additionally

[Anonymous Coward]

OSS having extra outside eyes looking at the code is only a problem if the technical expertise of the bad people outweight the technical expertise of the good people. So unless more that 50% of the people looking are naughty people, it is necessarily a benefit. Open source has bugs found faster than closed source. Black-hats find bugs faster and White Hats even faster. While white-hats have to work out how to stop it being a problem, black-hats have to work out how to exploit it. Both have to then pass on this information, so we can figure this to be a tie.

Re:Homeland Security?

[Instine]

A german friend of mine recently pointed out that the phraze "Unamerican" only rang one bell for him. Undeutch! Again, from an era best rembered but never relived.

Re:These are kiosks. Why are they running services

[Anonymous Coward]

One - per the diagram in the article, these aren't kiosks

Two - Embedded XP probably isn't going to support "the array of peripherals hanging off of the US-VISIT workstations -- fingerprint readers, digital cameras and passport scanners --" identified in the article.

Re:Headline!

[PMuse]

Who said anything about M$? You'd have done better to accuse me of being a DHS/CBP fanboy. (Which isn't true either, but YMMV.) If I deserve to be tarred for anything, it would have to be for suggesting that the failure of DHS to push the patch immediately was just a routine error.

For instance, I didn't mention that -- get your fanboy stamp ready -- M$ had the patch ready in time.

The only interesting thing in the whole piece is that the spokesman in December tried to deny that they'd been hit by a virus. That a government department has a cobbled together computer system full of M$ products that doesn't work, inconveniences people, and costs too much -- that's just routine. I submit that the reason news outlets (Wired, slashdot, etc.) care about this example of government waste is that they don't like DHS. Suppose the Social Security Administration, Medicaid, or Sallie Mae had a 1-day nationwide computer failure. Odds of that making slashdot are pretty slim.

Correcting the spelling of strangers

[dbIII]

Your intelligence did not help you figure that?

1337 speak and spelling out of order demonstrate that people can get the meaning while machines can't. I consider a bad joke (which I apparently have to explain) to be more polite than asking why someone would consider correcting the spelling of strangers on an international forum.

A good way to get over the obsession with correcting the spelling of strangers is to read Shakespear to let you know that something can be good without formalised spelling. I'm a little touchy on the subject since a series of insulting spelling correction flames from people who didn't know better when I used the english spelling of aluminium and not the US version.

Let's get back on topic and "Lat every fellowe tell his tale about" - and use our reading comprehension skills instead.