U.S. Commerce Department Hacked Again

evil agent writes "The Bureau of Industry and Security (BIS), a branch of the Commerce Department, has sustained several successful attacks. Chinese hackers were able to gain access to its computers and install rootkits and other malware." From the article: "This is the second major attack originating in China that's been acknowledged by the federal government since July. Then, the State Department said that Chinese attackers had broken into its systems overseas and in Washington. And last year, Britain's National Infrastructure Security Co-ordination Center (NISCC) claimed that Chinese hackers had attacked more than 300 government agencies and private companies in the U.K."

Comments

I don't buy it.

[pair-a-noyd]

They say they can't clean the systems. Bullshit, they just want to blow more of OUR tax dollars on new toys.

Also, what's the OS? No mention of that in TFA. Why are they using an OS that allows this sort of thing to happen. Shall we take a guess as to the OS?

If they were serious about security they WOULD put a stop to this crap.
It's easy to batten down the hatches.

Re:I don't buy it.

[Anonymous Coward]

Why are they using an OS that allows this sort of thing to happen. Shall we take a guess as to the OS?

The parent is a troll. All OSes can get infected by rootkits, malware and viruses and they can all get hacked and exploited one way or another. This most likely wasn't a problem with the OS, but a problem with how the OS was set up. The systems cracked were probably being run as root (or Administrator on win32), or possibly had some easily cracked passwords, or even no passwords at all set up for them. This also probably has to do with the users not knowing or being trained properly on basic security.

It's annoying how Slashdot likes to jump to conclusions and blame a certain company for the failures of system admins and users.

Re:I don't buy it.

[anagama]

Just out of curriosity -- how many exploits for linux are there in which your machine can be rooted simply by viewing a website? How many such exploits have there been for windows? I honestly don't know the true answer but I'm betting there is a large difference between the frequency of this type of exploit with windows having the "high score" by a large margin. Please correct me if I'm wrong (with actual examples, not opinions).

It makes even less sense in TFA.

[khasim]

An August e-mail from acting Undersecretary of Commerce Mark Foulon quoted by the Washington Post said that BIS "had identified several successful attempts to attack unattended BIS workstations during the overnight hours." Last month, reported the Post, Foulon wrote: "It has become clear that Internet access in itself is a vulnerability that we cannot mitigate. We have tried incremental steps and they have proven insufficient."

What the fuck? Aren't they even behind a firewall?

Wouldn't a simple firewall "mitigate" that "vulnerability"?

Re:It makes even less sense in TFA.

[AuMatar]

No, it wouldn't. Firewalls themselves can be hacked. An internal network with no access to the internet is more secure than one with. The question is if access to the internet adds enough value to be worth the risk. The answer depends on what you're doing. Military plans- probably not. Joe Blow working for some small buisness- probably yes. In this case, no idea.

Its not about who did it

[in2mind]

Its not about whether the chinese or japanese did it. Its about whether the commerce dept knows enough to protect itself or not.

You don't understand "security", do you?

[khasim]

Hence more secure, and not "totally secure".

By that "logic", a house with a 10' hole next to the open front door is "less" "secure" than the same house with the front door closed and locked.

No, it is not.

Yes, it would mitigate the risk.

Which is what I said that you had previously taken exception to.

For many government computers, thats still an unacceptable level of risk.

And for others it is an acceptable risk. What is it with you and the pedantic generalizations?

If a buisness/government computer doesn't have good reason for internet access, it shouldn't have it.

Again with the pedantic generalization. Do you have ANY evidence that these workstations are not used to access legitimate web-based resources?

A better solution is to give those people 2 computers, one on the internet and not the internal network, the other reversed.

You even get your pedantic generalizations wrong.

Back in the old days, when computers weren't networked, we still had a virus problem that was spread from computer to computer via floppy disks. Having 2 computers available means "sneaker-net" would be easy. Not to mention that it depends upon ALWAYS getting the cables correct.

Why not just put those extra $$DOLLARS$$ into locking down the desktops, setting up the firewall and monitoring the traffic?

It's not like we don't have all those technologies TODAY. Look up "snort" and SELinux for starters.

Re:fight back

[Ignis Flatus]

If you really want to fight back, then the best thing to do is actually let them think they're getting in. Leave a few insecure holes here and there and plant some misinformation. If you're clever enough, then you can even use that misinformation to gain an advantage against them.

I've banned China's netblocks outright

[Sycraft-fu]

Well ok I should be more clear, I've banned the blocks allocated to an ISP which I'm told is the Chinese state ISP. The reason is that I get no legit traffic, tons and tons of hack attempts, and they just ignore abuse e-mails, including those translated to Chinese.

That's the real answer to this problem. If particular ISPs refuse to behave, just start banning them. I mean sure, all ISPs will have people who act bad, but if you contact them and get no response and if the bad/good ratio is vastly (or completely) slanted to bad just ban them. Eventually they'll have access to little enough of the Internet that they'll really have no choice but to reform, or it won't matter because for all intents and purposes they won't be a part anyhow.

It's really not asking too much for ISPs to respond to abuse complaints. I remember one time I found my net connection off. Called the ISP, apparently I had a computer spewing worm traffic. Questioned my roommates and the system was located (unpatched Win 2000 will do that). Got it cleaned, they let me back on. That's how it should work. You get an e-mail saying there's abuse, you check you logs, if there is you shut off access. We have to do it at work from time to time. Usually an infected laptop but sometimes someone being malicious.

For ISPs/companies that won't, fuck it, ban them.

That's more true than you think

[Travoltus]

In the US, globalist free trade advocates would rather trade with people that are attacking us, than take the necessary steps to sanction them and defend our country from them.

They start throwing out off topic words like "protectionism" and "nativism", which when you ask them what it all means, alarmingly resembles "concern for national security" and "patriotism".

Ah, patriotism, that evil word. The notion that, just as caring for your family is more important than caring for someone else's, so is taking care of your country first.

Globalism. Another word for "screw national sovereignty, screw your own citizens, let's transfer all our wealth elsewhere". See: the national deficit and the national debt.

Re:That's more true than you think

[Travoltus]

1) If we continue to accept globalism, the US economy is ruined anyway. The global race for the bottom must eventually hit the rocks, because there is only so far wages can drop before the unrelenting cost of living becomes unbearable.

2) US companies already can't sell their goods abroad - or, more specifically, we're running a global trade deficit large enough to have its own gravitational field. Exactly what do we have to lose here?

3) US laws that tariff all goods made in sweatshop / undemocratic nations don't have that effect. If that law is put in place consistently, you can't undercut US companies in the US - not if you're Chinese, not if you're German, or British. Your rebuttal makes no sense - if Nike and its sweatshop operations moves to Singapore, they still have to deal with the tariff. If a Chinese Nike tries to undercut them, they too have to deal with the tariff. And if China decides not to buy any US goods... so what? We're in a deficit with them already! I propose that you don't even come into the US market unless you are an ethical player. Who's then going to undercut ethical companies in the US?

Oh, wait, offshoring to Europe won't hurt us as much because a) they also offshore heavily to us; and b) they have excellent worker protections and they're democratic.

4) Free trade with sweatshop nations / undemocratic regimes is going to ruin us any way. They're owning all our debt and they can also embargo us. (Oh yes, I know you think that despotic foreign nations can't embargo us. The 1970s and the oil embargo was all a lie. Sillyme.) Furthermore, we're transferring gobs of wealth to these monsters, impoverishing America and giving the world's most powerful enemies of freedom our cutting edge industrial capacity to boot. Germany should have sold us cheap shoes made of Jew labor, they would have won World War II with the help of the "surrender to globalism" agenda: there is nothing in your rhetoric that would provide for stopping them.

5) Free trade with nations that are attacking the United States will also lead to our annihilation. They can strike with impugnity, and others will follow.

Your theory is that fighting globalism leads to ruin. The facts say that giving into globalism leads to ruin anyway. I say die fighting; you say die in supplication.

Re:That's more true than you think

[Darkman, Walkin Dude]

The global race for the bottom must eventually hit the rocks, because there is only so far wages can drop before the unrelenting cost of living becomes unbearable.

No, the mark that globalism leaves behind it is higher wages for the previously third world countries. Its already extant in India. So instead of lowering wages in first world countries, its increasing wages in poorer countries. Might take a while, but it gets there.

US companies already can't sell their goods abroad - or, more specifically, we're running a global trade deficit large enough to have its own gravitational field. Exactly what do we have to lose here?

About 25% of the economy of my own country, Ireland, is composed of American multinationals, like Dell, Microsoft, Medtronic, Boston Scientific and so on, exporting to the half billion citizens of the EU. I'd say you have quite a lot to lose. I know we do.

Your rebuttal makes no sense - if Nike and its sweatshop operations moves to Singapore, they still have to deal with the tariff.

Thats because you are seeing the US as the sole export destination. There are many other places to earn just as much money. What I am saying is that if these tariffs were in place, people would just not bother to even do business with the US. No profit in it.

Free trade with sweatshop nations / undemocratic regimes is going to ruin us any way.

Politically its not a great idea to outsource everything, naturally. However you need to realise that a strong economy leads to the growth of a middle class, which is the downfall of dictators everywhere. You'll note that not many countries are dealing with places in Africa, where the cash won't go to the workers, but to the fuhrer du jour.

They're owning all our debt

Have you ever heard the saying, if you owe the bank a thousand dollars, its your problem, but if you owe the bank a hundred million, that's the banks problem? After a certain point, ownership of debt becomes an interdependant realtionship; they need to see the US economy succeed, or they will never get their money back. And the more money they lend, the more dependant they are.

5) Free trade with nations that are attacking the United States will also lead to our annihilation. They can strike with impugnity, and others will follow.

No, you won't be annihilated. Maybe equalised. Although I do believe that these nations should be slapped hard on the wrists for their activities; I'm no fan of the Chinese government, thats for sure.

I say die fighting; you say die in supplication.

Oh grow up. The world may be what we make it, but we have to live in it too. You want my advice, open a software house in Bangalore.

more than cheap labor

[zogger]

For the past several years china has been using their surplus cash to buy up resources around the planet, long term heavy deals in you-name-it, oil, natgas, various minerals and metals, etc. Manufacturing takes labor and energy and raw resources combined with an infrastructure that can combine those three things into manufactured goods then you need a shipping industry to move stuff in and out. You might be able to shift just the labor part in theory easily, but without the actual factory built and without the raw stock to feed it, it just sits there. To use an IT term, china has the whole stack. while everyplace else has been concerned with next quarter's profits, they have been working towards the next generation's profits. And they used a ton of free western resources and investments to accomploish this.

They got to be seriously laughing about it over there, how naieve and shortsighted the west has been to purposely kill off wealth producing for some relatively short term gains. That's what we have been primarily exporting to them, the ability to keep producing wealth.

Commerce CIO changes

[Anonymous Coward]

Commerce recently picked up a new CIO, Berry West. Within a couple of months of West arriving, we've had announcements about Commerce/Census losting hundreds of laptops, and now BIS getting repeatedly hacked by a foreign government.

Former DOC CIO Tom Pyke is now at Energy. DOC has repeatly flunked security reviews by the DOC Inspector General (IG), known as C&A's. Story is Pkye had a crappy relationship with the DOC IG.

West is clearly cleaning house. West has a huge challenge... DOC bureaus like NOAA, BIS, PTO, Census and so forth have little in common and little reason to work together on anything or respect authority from DOC HQ.

Re:Were government computers purposefully targeted

[Anonymous Coward]

could've picked a more useful department. Like Defense or State. But Commerce?!?!

BIS systems contain all sort of useful information regarding applications for US businesses wanting to do business overseas, including technology reviews for export controls.

Of course the fucking Chinese are interested in Commerce. This is only one small piece of an over all plan to steal US technology and business secrets. Read some Bill Gertz.

This should scare the crap of the west. By something like 2020, China will have an estimated surplus of 20 million men over women. What do you do with an extra 20 million men who can't make babies after you've slowly, over the course of 30 years raped the west of it's technology advantage and destroyed it's industrial base? Bet even lame Slashdot liberals can guess!