Slashdot Mirror
U.S. Commerce Department Hacked Again
evil agent writes "The Bureau of Industry and Security (BIS), a branch of the Commerce Department, has sustained several successful attacks. Chinese hackers were able to gain access to its computers and install rootkits and other malware." From the article: "This is the second major attack originating in China that's been acknowledged by the federal government since July. Then, the State Department said that Chinese attackers had broken into its systems overseas and in Washington. And last year, Britain's National Infrastructure Security Co-ordination Center (NISCC) claimed that Chinese hackers had attacked more than 300 government agencies and private companies in the U.K."
Chinese hackers installing root kits? Are you sure they weren't Japanese (aka Sony)?
...with so many people there using Red Flag, if this is an unfortunate result of having more literate users...
Hm...so this here purple panda bear says he wants to be my buddy and help me out on the intarweb. Sounds good to me! (click) Gosh I wonder why my workstation is so slow, almost as if its sending all its files to ch!@$!$JGOJ!THIS POST 0WNZ0R3D BY CHINESE HAXORS
They say they can't clean the systems. Bullshit, they just want to blow more of OUR tax dollars on new toys.
Also, what's the OS? No mention of that in TFA. Why are they using an OS that allows this sort of thing to happen. Shall we take a guess as to the OS?
If they were serious about security they WOULD put a stop to this crap.
It's easy to batten down the hatches.
Bureau of Industry and Insecurity? Why would successful Chinese cracks be a surprise to them?
// file: mice.h
#include "frickin_lasers.h"
The Chinese have been trying for years to lose that pesky Most-Favored-Nation status, and this administration is not going to give in.
What the fuck? Aren't they even behind a firewall?
Wouldn't a simple firewall "mitigate" that "vulnerability"?
They're not using WINDOWS are they?
How can they be so sure that the attacks originated from China? Sure there may have been Chinese IP addresses involved but the attackers could have been anywhere. The chinese systems could have simply been compromised and used to cover the attackers tracks.
I'll post the obligatory meme:
In China, USA government computers hack you!?
Come on...don't be mean to the folks over at the Commerce Department. They were just in the process of transferring some money from a Chinese-Nigerian bank account to help out a buddy. Lay off of 'em.
Don't forget kids, all these problems will be solved when the US govt goes to ipv6. Since no-one else will be using it, it will confound and confuse anyone trying to hack in!
There is nothing interesting going on at my blog
Since you've opted for pedantic, no, it is not. It is only more "secure" from Internet-based attacks. There is still physical security to be considered.
The most "secure" system is one that has been turned off, encased in cement and dropped into the deepest part of the ocean.
Now, can we possibly get back to a discussion of this specific situation instead of displaying our pedantic generalizations to the world?
Yes, a firewall can be cracked. But because it is a single point of access, it is far easier to monitor/secure than if all the workstations are directly connected to the Internet. Therefore, having a firewall would "mitigate" that "vulnerability".
Its not about whether the chinese or japanese did it. Its about whether the commerce dept knows enough to protect itself or not.
Wincopy
They got sick of this crap years ago and installed an Apple server. No hacks since.
If they say it's most likely state sponsored hack attacks, why not fight back with state sponsored hack attacks, i doubt government agencies have people hacking away at china, and if they do, they arent doing it very well...why not supply the hacker community with what to attack and offer incentives for any help?
By that "logic", a house with a 10' hole next to the open front door is "less" "secure" than the same house with the front door closed and locked.
No, it is not.
Which is what I said that you had previously taken exception to.
And for others it is an acceptable risk. What is it with you and the pedantic generalizations?
Again with the pedantic generalization. Do you have ANY evidence that these workstations are not used to access legitimate web-based resources?
You even get your pedantic generalizations wrong.
Back in the old days, when computers weren't networked, we still had a virus problem that was spread from computer to computer via floppy disks. Having 2 computers available means "sneaker-net" would be easy. Not to mention that it depends upon ALWAYS getting the cables correct.
Why not just put those extra $$DOLLARS$$ into locking down the desktops, setting up the firewall and monitoring the traffic?
It's not like we don't have all those technologies TODAY. Look up "snort" and SELinux for starters.
There is no source cited etc. no example shown, no logs etc. only that "new york post" said that. If true, is that department admiting idiocy? Even simple rule on the router that restricts whole **ina IP block to only certaing data resources could do the job. Keeping us scary they want. Fear agenda again?
Congratulations on choosing the pedantic option. Commiserations on your failed definition. The system you describe would not be appropriatelyavailable, which is a fundamental quality of a "secure" system
My next sig will be ready soon, but subscribers can beat the rush
ARE YOU CRAZY OR SOMETHING? let's not let obvious facts such as these get in the way of a good xenophobic rant and/or nationalistic orgy
A bit off topic but I wonder how many of you /.ers get port scans from China based computers on a regular basis, as I do. The scans are alway for port 88, presumably looking for kerberos keys, and always from computers behind the same IP servers in Beijing. I've never sent the IP a complaint, even though they list an abuse email address, because I'm sure nothing would be done.
Hacked by Chinese!
I said IP when I ment ISP. Also, my router ignores these requests but logs the pertinent information, of course.
There is no reason for these databases to be physically connected to the outside world, or even allow physical installation of untrusted software or hardware. Its probably just a sand box instance that they allowed them to pierce for intelligence reasons, with a nice feed of propaganda. If it is accessable in this manner, they deserve the intrusion.
openbsd ?
This whole thing is fishy.
Well ok I should be more clear, I've banned the blocks allocated to an ISP which I'm told is the Chinese state ISP. The reason is that I get no legit traffic, tons and tons of hack attempts, and they just ignore abuse e-mails, including those translated to Chinese.
That's the real answer to this problem. If particular ISPs refuse to behave, just start banning them. I mean sure, all ISPs will have people who act bad, but if you contact them and get no response and if the bad/good ratio is vastly (or completely) slanted to bad just ban them. Eventually they'll have access to little enough of the Internet that they'll really have no choice but to reform, or it won't matter because for all intents and purposes they won't be a part anyhow.
It's really not asking too much for ISPs to respond to abuse complaints. I remember one time I found my net connection off. Called the ISP, apparently I had a computer spewing worm traffic. Questioned my roommates and the system was located (unpatched Win 2000 will do that). Got it cleaned, they let me back on. That's how it should work. You get an e-mail saying there's abuse, you check you logs, if there is you shut off access. We have to do it at work from time to time. Usually an infected laptop but sometimes someone being malicious.
For ISPs/companies that won't, fuck it, ban them.
I doubt there is any way to be sure, but let's not forget that it could be individuals responsibile instead of the Chinese gov't.
Table-ized A.I.
Originally they wanted to named it simply The Bureau of Security, but then they considered the acronym and decided to put "Industry" there in the middle.
Their population is more than 3-times that of the US's. In an all-out hacker war, the nation with the biggest population would most likely win.
Table-ized A.I.
I, For One, Welcome Our New, Chinese Overlords. How does one say, Owned, in Red Chinese?
Another WINDOWS story, but no mention in headline. If you want this to stop, go after the enabling technology. Take them to court, lock them up, or at least change to a secure alternative.
you had me at #!
Soviet Russia Joke someone please.
...we don't use computers for commerce in third world countries.
Perhaps some not too obvious honeypots should be left lying around next time so that we can get a better look at their attack methods when they come back and they will be back. Then we can catch them with their red hands stuck in the fortune cookie jar.
In the US, globalist free trade advocates would rather trade with people that are attacking us, than take the necessary steps to sanction them and defend our country from them.
They start throwing out off topic words like "protectionism" and "nativism", which when you ask them what it all means, alarmingly resembles "concern for national security" and "patriotism".
Ah, patriotism, that evil word. The notion that, just as caring for your family is more important than caring for someone else's, so is taking care of your country first.
Globalism. Another word for "screw national sovereignty, screw your own citizens, let's transfer all our wealth elsewhere". See: the national deficit and the national debt.
--- Grow a pair, liberals... stop letting the Republicans bully you!
...that the people working for these agencies aren't the brightest. They're the people, well, let's put it this way... you know the people in your computer science classes who struggled a lot in class but scraped by? Well, that's who you've got working for these agencies. What that means is that not only can they not do it, they have no ability to judge what needs to be done, so they can't even hire consultants to do it.
Plus, you know this was a Windows exploit. But they won't use a Unix variant because *nix is like the giant black monolith in the movie "2001" to these people.
I think the problem is not the technology, it's the people.
With China being the point of growth on this ball of dirt, no one is going to dare piss them off. Even Microsoft has decided to let them steal software in China but in the USA you're doing 10-20 in the Pound You in the Ass Federal Prison.
I would not be surprised if the response from our government is to send the Chinese government a list of the root passwords to all our computers with a note attached, "So sorry for the inconvenience."
"doesn't mean the hacked server wasn't using Windows, but there's also a good chance it was running Linux", xswl0931
It's not a server but hundreds of workstations. What OS do you think they are running on the desktop.
"Hundreds of computers must be replaced to cleanse the agency of malicious code, including rootkits and spyware."
"had identified several successful attempts to attack unattended BIS workstations during the overnight hours."
"The official also confirmed that BIS has limited Internet access to stand-alone workstations that are not connected to the bureau's internal network."
http://www.bis.doc.gov/ was running Microsoft-IIS on Windows 2000 when last queried at 7-Oct-2006 02:01:33 GMT
was Re:What OS? Looks like Linux
davecb5620@gmail.com
But..are they running Linux? If they got crap installed...guess not.. Another reason our gov. Sucks.
Apparently the the head of commerce has found a way to unclog the tubes. Now when chineese haxors put their message into the internet it won't be delayed.
"There is no source cited etc", zitintheass
.."
I don't know if we've read the same text. The article clearly quotes at least two named sources in the Commerce department. It never mentions Windows or Linux. Yet we have the above and other commments coming out with: It's a fake news item, it must be Linux that got hacked, it wasn't Windows etc. We also have such posts getting modded up as 'interesting', more mod trolling.
"An August e-mail from acting Undersecretary of Commerce Mark Foulon quoted by the Washington Post said
Has Foulon ever denied sending the e-mails. Do you have a citation.
"Through established security procedures, BIS discovered a targeted effort to gain access to BIS user accounts," said Commerce Department spokesman Richard Mills. "We have no evidence that BIS data has been lost or compromised."
Has Mills ever denied saying this. Do you have a citation.
was Re:Another fake news?
davecb5620@gmail.com
For the past several years china has been using their surplus cash to buy up resources around the planet, long term heavy deals in you-name-it, oil, natgas, various minerals and metals, etc. Manufacturing takes labor and energy and raw resources combined with an infrastructure that can combine those three things into manufactured goods then you need a shipping industry to move stuff in and out. You might be able to shift just the labor part in theory easily, but without the actual factory built and without the raw stock to feed it, it just sits there. To use an IT term, china has the whole stack. while everyplace else has been concerned with next quarter's profits, they have been working towards the next generation's profits. And they used a ton of free western resources and investments to accomploish this.
They got to be seriously laughing about it over there, how naieve and shortsighted the west has been to purposely kill off wealth producing for some relatively short term gains. That's what we have been primarily exporting to them, the ability to keep producing wealth.
Do they have Chinese hackers? I thought they all moved here and started a Chinese restaurant. I used to hang out with a group of asians and I'm not joking when I say this: The Korean's parents were both dry cleaners. The Chinamen's parents ran a Chinese Restaurant. The Vietnamese's parents ran a nail salon. The Indian's parents were both doctors. I am not making this up.
The administrators are clearly utterly inept at their jobs, and should not have it, network administration really is not that hard, nor is locking out your users from doing stupid things like installing software.
In our ongoing "Soft War" with China, Jack Abramoff and Dennis Hastert are a double agents.
It's like a James Bond story, if Bond were a child molester posing as a religious gangster.
--
make install -not war
My network, connected to the Internet via a vanilla DSL service from Verizon, logs tons of break-in attempts on various ports. Most of them are from Chinese IP addresses. And unless the Chinese government has waaaaaaaaaaaaaay too much time on its hands (they are barely able to keep domestic order right now, so I doubt that they'd give a damn about some home computer), I think it's safe to say that the attacks against my system are blind, automated attacks by regular hackers trying to steal passwords, financial/identity info, or to pull me into a botnet for things like spam.
So, in the case of the Commerce Department, are these hackers "Chinese" in the sense that they represent the Chinese regime (and are thus hacking for national interests)? Or "Chinese" in the sense that they just happen to originate from that part of the world (and are thus hacking for petty selfish criminal interests)?
- Given the prevalence of hackers hacking for selfish crimes (vs. for national interests), I would think lean towards the latter.
- If the Chinese government really wanted to hack the US government, they could've picked a more useful department. Like Defense or State. But Commerce?!?!
- Attacks originating from Chinese IP addresses are extremely common, mostly because of software piracy. Because over 90% of the Windows installations there are illegal, it is common practice for software updates to be disabled (you can thank WGA for that), and thus, a HUGE number of computers in China are zombies out on a mission to zombify (is that a word?) other computers.
Former DOC CIO Tom Pyke is now at Energy. DOC has repeatly flunked security reviews by the DOC Inspector General (IG), known as C&A's. Story is Pkye had a crappy relationship with the DOC IG.
West is clearly cleaning house. West has a huge challenge... DOC bureaus like NOAA, BIS, PTO, Census and so forth have little in common and little reason to work together on anything or respect authority from DOC HQ.
that the "Great Firewall" doesn't work so well in the other direction.
The higher the technology, the sharper that two-edged sword.
BIS systems contain all sort of useful information regarding applications for US businesses wanting to do business overseas, including technology reviews for export controls.
Of course the fucking Chinese are interested in Commerce. This is only one small piece of an over all plan to steal US technology and business secrets. Read some Bill Gertz.
This should scare the crap of the west. By something like 2020, China will have an estimated surplus of 20 million men over women. What do you do with an extra 20 million men who can't make babies after you've slowly, over the course of 30 years raped the west of it's technology advantage and destroyed it's industrial base? Bet even lame Slashdot liberals can guess!
I agree - very nice summation.
Those Chinese zombies are probably not even being comprimized by Chinese attackers - it's probably just good ol' American Malware.
Anyone remember the simpler days when the worst the internet had to offer was a really nasty usenet flame war?
~sigh~
The Digital Sorceress
I bet dollars to doughnuts that the end users are surfing porn and downloading mp3z thereby infecting themselves. Replacing the systems won't help a bit unless they replace them with linux, osx, bsd... anything but ms.
A worker needs access to some sort of database. They also need email.
That could be two computers on their desk, connected to two separate networks, with separate user accounts and so on. Besides the hardware expense, there would be no ability to do a cut-and-paste between the two. The worker would be constantly reading stuff from one computer to type into the adjacent computer. This would be horribly wasteful.
Chairman Mao died. The moment he did, the Chinese began switching to a relatively free-market economy and getting back the educated middle class. It's taken some time of course, but they did it.
It's the machine tools, entire factories they have gotten from the west. Entire factories from the rust belt here have been dissasembled, crated up and shipped over. Go look at what they buy from the US, you'll see. It's the wealth producing stuff needed to keep an economy going, it's not just paper products like the collateral on our and our kids and grand kids labor, which is all T bills are.
As to the investment guys, it's not just the chinese folks, and I am surprised you didn't know this, it's brand name western consortiums and banks and large corporations that have dropped *serious* cash over there over the last 20 years-those investors, and at least from the US side they got *tax breaks* to do this. Big names like boeing, siemens, stuff like that are over there "investing" and helping them build up their economy. As to the trade deals, I'd call buying up entire mines all over (and they aren't done shopping yet) and negotiating 20 year energy supply contracts for huge amounts from the heavy hitters pretty serious planning and lock-in efforts.
I've been following this for a long time now, this is just data that you can go look up, the data is inarguable. The trends you can argue about, but not past history and present reality. They bought up and now control both ends of the panama canal, they have the largest deep water port in the caribbean, they ownzorz long beach for most purposes with shipping, and they are building huge ports in mexico that will tie in to the globalists other pet dream, the new superhigways, the trans national "corridors", that will bring stuff in from mexico, that comes from china via these new(expanded) ports, and thereby by-pass the exensive US ports and truckers. That will be cutting out another swatch of middle class incomes, longshoreman and teamsters and the independents. They are now importing so much stuff into the US that they leave the shipping containers *here*, it's cheaper for them to build new ones then send the old ones back empty. This is called a clue.
Their take over in global trade is not a joke and shouldn't be minimized or made light of like it is some sort of neglible token effort, it's huge, simply enormous, and they have all their ducks in a row quite handily to keep expanding while other old world nations keep dropping in importance. And once they don't need to export to the west as much, when the rest of the planet hasd what they want and their infrastructure is advanced enough-they won't. the cheap goods gravy train will be over then.
Not that I am in favor of any this, no way, I have been speaking out against it for decades now, saying it would reduce the US to second world status eventually once they started, and everything I thought would happen, has happened, up to this point. I am more than satsified with my analysis to date, and why I am confident to assert what I assert.. You can just look at all the stats and then it is fairly easy to extrapolate the trends. Even our own national security establishment has quite blatantly predicted they will surpass the US within the next 15 years or so.
Beyond any concern for internal net security, the Chinese internet agency should be concerned about acts like this because of their effect on internet access for the average citizen.
/. Every time a Saudi clicks on a link, a new IP is used for each request, and so to read /. articles I had to keep reloading until I got an IP which wasn't blocked. (I made a list of the blocked IPs, wrote in to /. about the problem and they did fix it)
Countries who strictly control their citizens' internet access route all national traffic through proxies, and a block of IPs are assigned to each country. When hackers from China or Saudi Arabia go around messing with sites, a typical response is for the victim to block that IP. Over time, a large number of a country's IPs can be blocked by victim sites.
An example: when I lived in Saudi Arabia, for a while I had a hard time accessing slashdot (and some other sites) because it seemed about half the Saudi IPs were blocked by
Anyways, in such cases, the malicious actions of a very few ultimately result in an entire nation having its internet access blocked. It would be easy to say that such actions give the Chinese or Saudis a taste of their own medicine, but if we are to claim to be on the moral high ground, then we should not be making life so difficult for the average internet user in these countries. If the Chinese authorites have any interest in their citizens being able to access the international web (even if they restrict it themselves), then they should be concerned about the fallout from hackers in their countries and cooperate in tracking them down.
RTFM; please, I beg you.
Sorry, I think you have it all wrong. China has a well developed system for remote intelligence gathering through the Internet; this includes hacking military and commercial systems. If anything, I'd guess that China is more interested in getting commercial information that can be used to develop their economy. It's important to understand that lots of countries think nothing of using industrial espionage to get an edge over their competitors. If you live in America and are used to doing business with other American companies, you might feel a bit annoyed about this; don't waste your energy! The solution is to have a clear understanding of the way modern global business works and take appropriate security precautions. Right now, there are far too many systems that are insecure or just shoudn't be on the net in first place. If you leave the door open, don't be surprised if you are robbed.
We both have our predictions. We'll check back once a year to see how things are going, deal?
TFA says that all this has made the department "less efficient for at least a month". So does that make their efficiency negative? I mean come on, it's the fucking government. It's inefficient by definition.
Other than this text, there is no discernible information contained in this sig.
Its not just countries that are deemed "sketchy" in the United States that are problematic. I block 82.0.0.0 and 83.0.0.0 on my mail server because I get nothing but spam from those networks. Its clear the ISPs don't give a damn about their bandwidth being wasted or the security of their users. As far as Asian problems go, my IDS blocks an IP from somewhere in 211.0.0.0 every other day or so.
Agreed. Good debating with you.
What he can't kill, he has sex on. Trent.
They did a good job of reverse engineering pebble bed reactors and putting men in space, did they not?
Exactly which advanced technology has China failed to reproduce?
As for the toxic smoke, well there you have it - America's clean air requirements are part of why offshoring is happening. For America to be competitive in a globalist market, we have to settle for the lowest common denominator - toxic skies, dangerous factories, and prison labor.
As I said, we lose in a globalist system.
--- Grow a pair, liberals... stop letting the Republicans bully you!
So, Chinese are now hacking for fun and profit? Heh, I guess the Chinese embrace of anything-goes capitalism is fully complete now. A socialist hacker would be an oxymoron.
The Gospel according to lolcat
hacked by chinese