U.S. Commerce Department Hacked Again

evil agent writes "The Bureau of Industry and Security (BIS), a branch of the Commerce Department, has sustained several successful attacks. Chinese hackers were able to gain access to its computers and install rootkits and other malware." From the article: "This is the second major attack originating in China that's been acknowledged by the federal government since July. Then, the State Department said that Chinese attackers had broken into its systems overseas and in Washington. And last year, Britain's National Infrastructure Security Co-ordination Center (NISCC) claimed that Chinese hackers had attacked more than 300 government agencies and private companies in the U.K."

Comments

Chinese Hackers?

[IlliniECE]

Chinese hackers installing root kits? Are you sure they weren't Japanese (aka Sony)?

Meanwhile, at a government workstation...

[CompMD]

Hm...so this here purple panda bear says he wants to be my buddy and help me out on the intarweb. Sounds good to me! (click) Gosh I wonder why my workstation is so slow, almost as if its sending all its files to ch!@$!$JGOJ!THIS POST 0WNZ0R3D BY CHINESE HAXORS

Nothing real will happen

[frinkster]

The Chinese have been trying for years to lose that pesky Most-Favored-Nation status, and this administration is not going to give in.

It makes even less sense in TFA.

[khasim]

An August e-mail from acting Undersecretary of Commerce Mark Foulon quoted by the Washington Post said that BIS "had identified several successful attempts to attack unattended BIS workstations during the overnight hours." Last month, reported the Post, Foulon wrote: "It has become clear that Internet access in itself is a vulnerability that we cannot mitigate. We have tried incremental steps and they have proven insufficient."

What the fuck? Aren't they even behind a firewall?

Wouldn't a simple firewall "mitigate" that "vulnerability"?

Re:It makes even less sense in TFA.

[AuMatar]

No, it wouldn't. Firewalls themselves can be hacked. An internal network with no access to the internet is more secure than one with. The question is if access to the internet adds enough value to be worth the risk. The answer depends on what you're doing. Military plans- probably not. Joe Blow working for some small buisness- probably yes. In this case, no idea.

How sure?

[fredistheking]

How can they be so sure that the attacks originated from China? Sure there may have been Chinese IP addresses involved but the attackers could have been anywhere. The chinese systems could have simply been compromised and used to cover the attackers tracks.

Re:How sure?

[sgt_doom]

I hope I don't lose anyone by getting too technical - but another tell-tale sign is the presence of those nifty fortune cookie fortunes at the bottom of all their hax.

Ipv6

[growse]

Don't forget kids, all these problems will be solved when the US govt goes to ipv6. Since no-one else will be using it, it will confound and confuse anyone trying to hack in!

Re:I don't buy it.

[Shadyman]

You mean you're going to ask the Department, "Does it run Linux"?

Re:I don't buy it.

[anagama]

Just out of curriosity -- how many exploits for linux are there in which your machine can be rooted simply by viewing a website? How many such exploits have there been for windows? I honestly don't know the true answer but I'm betting there is a large difference between the frequency of this type of exploit with windows having the "high score" by a large margin. Please correct me if I'm wrong (with actual examples, not opinions).

Its not about who did it

[in2mind]

Its not about whether the chinese or japanese did it. Its about whether the commerce dept knows enough to protect itself or not.

Re:and?

[AuMatar]

Since you've opted for pedantic, no, it is not. It is only more "secure" from Internet-based attacks. There is still physical security to be considered.

Hence more secure, and not "totally secure".

Yes, a firewall can be cracked. But because it is a single point of access, it is far easier to monitor/secure than if all the workstations are directly connected to the Internet. Therefore, having a firewall would "mitigate" that "vulnerability".

Yes, it would mitigate the risk. For many government computers, thats still an unacceptable level of risk. If a buisness/government computer doesn't have good reason for internet access, it shouldn't have it. A better solution is to give those people 2 computers, one on the internet and not the internal network, the other reversed.

Re:The Army Got Smart

[rabbit994]

Nice job linking to extremely old article. Before you go spouting off facts, you could check netcraft.

http://uptime.netcraft.com/up/graph?site=goarmy.co m

http://uptime.netcraft.com/up/graph?site=www.us.ar my.mil

Been running on Solaris for years. I'm sure your buddy Steve is happy your still drinking the kool-aid.

fight back

[ExploiT1001]

If they say it's most likely state sponsored hack attacks, why not fight back with state sponsored hack attacks, i doubt government agencies have people hacking away at china, and if they do, they arent doing it very well...why not supply the hacker community with what to attack and offer incentives for any help?

Re:fight back

[Ignis Flatus]

If you really want to fight back, then the best thing to do is actually let them think they're getting in. Leave a few insecure holes here and there and plant some misinformation. If you're clever enough, then you can even use that misinformation to gain an advantage against them.

You don't understand "security", do you?

[khasim]

Hence more secure, and not "totally secure".

By that "logic", a house with a 10' hole next to the open front door is "less" "secure" than the same house with the front door closed and locked.

No, it is not.

Yes, it would mitigate the risk.

Which is what I said that you had previously taken exception to.

For many government computers, thats still an unacceptable level of risk.

And for others it is an acceptable risk. What is it with you and the pedantic generalizations?

If a buisness/government computer doesn't have good reason for internet access, it shouldn't have it.

Again with the pedantic generalization. Do you have ANY evidence that these workstations are not used to access legitimate web-based resources?

A better solution is to give those people 2 computers, one on the internet and not the internal network, the other reversed.

You even get your pedantic generalizations wrong.

Back in the old days, when computers weren't networked, we still had a virus problem that was spread from computer to computer via floppy disks. Having 2 computers available means "sneaker-net" would be easy. Not to mention that it depends upon ALWAYS getting the cables correct.

Why not just put those extra $$DOLLARS$$ into locking down the desktops, setting up the firewall and monitoring the traffic?

It's not like we don't have all those technologies TODAY. Look up "snort" and SELinux for starters.

Another fake news?

[zitintheass]

There is no source cited etc. no example shown, no logs etc. only that "new york post" said that. If true, is that department admiting idiocy? Even simple rule on the router that restricts whole **ina IP block to only certaing data resources could do the job. Keeping us scary they want. Fear agenda again?

DON'T BE RIDICULOUS

[Anonymous Coward]

ARE YOU CRAZY OR SOMETHING? let's not let obvious facts such as these get in the way of a good xenophobic rant and/or nationalistic orgy

I've banned China's netblocks outright

[Sycraft-fu]

Well ok I should be more clear, I've banned the blocks allocated to an ISP which I'm told is the Chinese state ISP. The reason is that I get no legit traffic, tons and tons of hack attempts, and they just ignore abuse e-mails, including those translated to Chinese.

That's the real answer to this problem. If particular ISPs refuse to behave, just start banning them. I mean sure, all ISPs will have people who act bad, but if you contact them and get no response and if the bad/good ratio is vastly (or completely) slanted to bad just ban them. Eventually they'll have access to little enough of the Internet that they'll really have no choice but to reform, or it won't matter because for all intents and purposes they won't be a part anyhow.

It's really not asking too much for ISPs to respond to abuse complaints. I remember one time I found my net connection off. Called the ISP, apparently I had a computer spewing worm traffic. Questioned my roommates and the system was located (unpatched Win 2000 will do that). Got it cleaned, they let me back on. That's how it should work. You get an e-mail saying there's abuse, you check you logs, if there is you shut off access. We have to do it at work from time to time. Usually an infected laptop but sometimes someone being malicious.

For ISPs/companies that won't, fuck it, ban them.

That's more true than you think

[Travoltus]

In the US, globalist free trade advocates would rather trade with people that are attacking us, than take the necessary steps to sanction them and defend our country from them.

They start throwing out off topic words like "protectionism" and "nativism", which when you ask them what it all means, alarmingly resembles "concern for national security" and "patriotism".

Ah, patriotism, that evil word. The notion that, just as caring for your family is more important than caring for someone else's, so is taking care of your country first.

Globalism. Another word for "screw national sovereignty, screw your own citizens, let's transfer all our wealth elsewhere". See: the national deficit and the national debt.

Re:That's more true than you think

[Travoltus]

1) If we continue to accept globalism, the US economy is ruined anyway. The global race for the bottom must eventually hit the rocks, because there is only so far wages can drop before the unrelenting cost of living becomes unbearable.

2) US companies already can't sell their goods abroad - or, more specifically, we're running a global trade deficit large enough to have its own gravitational field. Exactly what do we have to lose here?

3) US laws that tariff all goods made in sweatshop / undemocratic nations don't have that effect. If that law is put in place consistently, you can't undercut US companies in the US - not if you're Chinese, not if you're German, or British. Your rebuttal makes no sense - if Nike and its sweatshop operations moves to Singapore, they still have to deal with the tariff. If a Chinese Nike tries to undercut them, they too have to deal with the tariff. And if China decides not to buy any US goods... so what? We're in a deficit with them already! I propose that you don't even come into the US market unless you are an ethical player. Who's then going to undercut ethical companies in the US?

Oh, wait, offshoring to Europe won't hurt us as much because a) they also offshore heavily to us; and b) they have excellent worker protections and they're democratic.

4) Free trade with sweatshop nations / undemocratic regimes is going to ruin us any way. They're owning all our debt and they can also embargo us. (Oh yes, I know you think that despotic foreign nations can't embargo us. The 1970s and the oil embargo was all a lie. Sillyme.) Furthermore, we're transferring gobs of wealth to these monsters, impoverishing America and giving the world's most powerful enemies of freedom our cutting edge industrial capacity to boot. Germany should have sold us cheap shoes made of Jew labor, they would have won World War II with the help of the "surrender to globalism" agenda: there is nothing in your rhetoric that would provide for stopping them.

5) Free trade with nations that are attacking the United States will also lead to our annihilation. They can strike with impugnity, and others will follow.

Your theory is that fighting globalism leads to ruin. The facts say that giving into globalism leads to ruin anyway. I say die fighting; you say die in supplication.

Re:That's more true than you think

[Darkman, Walkin Dude]

The global race for the bottom must eventually hit the rocks, because there is only so far wages can drop before the unrelenting cost of living becomes unbearable.

No, the mark that globalism leaves behind it is higher wages for the previously third world countries. Its already extant in India. So instead of lowering wages in first world countries, its increasing wages in poorer countries. Might take a while, but it gets there.

US companies already can't sell their goods abroad - or, more specifically, we're running a global trade deficit large enough to have its own gravitational field. Exactly what do we have to lose here?

About 25% of the economy of my own country, Ireland, is composed of American multinationals, like Dell, Microsoft, Medtronic, Boston Scientific and so on, exporting to the half billion citizens of the EU. I'd say you have quite a lot to lose. I know we do.

Your rebuttal makes no sense - if Nike and its sweatshop operations moves to Singapore, they still have to deal with the tariff.

Thats because you are seeing the US as the sole export destination. There are many other places to earn just as much money. What I am saying is that if these tariffs were in place, people would just not bother to even do business with the US. No profit in it.

Free trade with sweatshop nations / undemocratic regimes is going to ruin us any way.

Politically its not a great idea to outsource everything, naturally. However you need to realise that a strong economy leads to the growth of a middle class, which is the downfall of dictators everywhere. You'll note that not many countries are dealing with places in Africa, where the cash won't go to the workers, but to the fuhrer du jour.

They're owning all our debt

Have you ever heard the saying, if you owe the bank a thousand dollars, its your problem, but if you owe the bank a hundred million, that's the banks problem? After a certain point, ownership of debt becomes an interdependant realtionship; they need to see the US economy succeed, or they will never get their money back. And the more money they lend, the more dependant they are.

5) Free trade with nations that are attacking the United States will also lead to our annihilation. They can strike with impugnity, and others will follow.

No, you won't be annihilated. Maybe equalised. Although I do believe that these nations should be slapped hard on the wrists for their activities; I'm no fan of the Chinese government, thats for sure.

I say die fighting; you say die in supplication.

Oh grow up. The world may be what we make it, but we have to live in it too. You want my advice, open a software house in Bangalore.

Re:That's more true than you think

[DavidTC]

No, the mark that globalism leaves behind it is higher wages for the previously third world countries. Its already extant in India. So instead of lowering wages in first world countries, its increasing wages in poorer countries. Might take a while, but it gets there.

That works in free and democratic countries like India, where workers are free to do whatever they want. If we required the same safety standards and whatnot (1), and actually taxed companies there providing services here, just like they should tax companies here providing services there, there would be no problem. There are already huge areas that you can't tell apart from other first world countries, which means that manufacturers move to poorer areas, which raises them up, etc, etc... It's working fine, and in fifty years or so we'll have a fairly serious competitor in the world economy. We just need to make sure politicans don't operate India at the expense of the Indian people for American businesses, but considering we can't seem to stop them from operating the US that way, we're probably going to have to deal with that problem locally first.

However, that doesn't apply to China and other communist countries. What happened with Russia proves we shouldn't just ignore them, and trading and openness can be good, but if you think that enough money from the US gets passed to workers in China to raise their standard of living you have another think coming.

Workers in non-open countries are essentially, slave laborers. Your logic is like attempting to free pre-Civil War slaves by buying a lot of cotton from slave-owners, thus the slave's standard of living will go up and they will eventually be able to afford a better life. That doesn't make a lot of sense.

And, yes, we are not the only country in the world, and others could, indeed, trade with them. Pre-Stupid-War, we had some influence on the global community, but we can still offer other countries incentives,and a lot of places already don't want to trade with China or have such small economies it doesn't matter. Instead, we offer China incentives for...I have no idea.

1) Bhopalm India, was the site of the most horrific industrial accident ever, caused by an American company, United Carbine, due to cutting corners on their almost non-existent safety systems. And we've still refused to extradite the people responsible to India, and India is so deep in their pockets they aren't pressing the matter of 15,000 charges of manslaughter! If they'd killed Americans, the entire company would have been sued to the ground.

looks like BIS workstations ..

[rs232]

"doesn't mean the hacked server wasn't using Windows, but there's also a good chance it was running Linux", xswl0931

It's not a server but hundreds of workstations. What OS do you think they are running on the desktop.

"Hundreds of computers must be replaced to cleanse the agency of malicious code, including rootkits and spyware."

"had identified several successful attempts to attack unattended BIS workstations during the overnight hours."

"The official also confirmed that BIS has limited Internet access to stand-alone workstations that are not connected to the bureau's internal network."

http://www.bis.doc.gov/ was running Microsoft-IIS on Windows 2000 when last queried at 7-Oct-2006 02:01:33 GMT

was Re:What OS? Looks like Linux

Thanks Ted!

[bblboy54]

Apparently the the head of commerce has found a way to unclog the tubes. Now when chineese haxors put their message into the internet it won't be delayed.

more than cheap labor

[zogger]

For the past several years china has been using their surplus cash to buy up resources around the planet, long term heavy deals in you-name-it, oil, natgas, various minerals and metals, etc. Manufacturing takes labor and energy and raw resources combined with an infrastructure that can combine those three things into manufactured goods then you need a shipping industry to move stuff in and out. You might be able to shift just the labor part in theory easily, but without the actual factory built and without the raw stock to feed it, it just sits there. To use an IT term, china has the whole stack. while everyplace else has been concerned with next quarter's profits, they have been working towards the next generation's profits. And they used a ton of free western resources and investments to accomploish this.

They got to be seriously laughing about it over there, how naieve and shortsighted the west has been to purposely kill off wealth producing for some relatively short term gains. That's what we have been primarily exporting to them, the ability to keep producing wealth.

Were government computers purposefully targeted?

[code65536]

My network, connected to the Internet via a vanilla DSL service from Verizon, logs tons of break-in attempts on various ports. Most of them are from Chinese IP addresses. And unless the Chinese government has waaaaaaaaaaaaaay too much time on its hands (they are barely able to keep domestic order right now, so I doubt that they'd give a damn about some home computer), I think it's safe to say that the attacks against my system are blind, automated attacks by regular hackers trying to steal passwords, financial/identity info, or to pull me into a botnet for things like spam.

So, in the case of the Commerce Department, are these hackers "Chinese" in the sense that they represent the Chinese regime (and are thus hacking for national interests)? Or "Chinese" in the sense that they just happen to originate from that part of the world (and are thus hacking for petty selfish criminal interests)?
- Given the prevalence of hackers hacking for selfish crimes (vs. for national interests), I would think lean towards the latter.
- If the Chinese government really wanted to hack the US government, they could've picked a more useful department. Like Defense or State. But Commerce?!?!
- Attacks originating from Chinese IP addresses are extremely common, mostly because of software piracy. Because over 90% of the Windows installations there are illegal, it is common practice for software updates to be disabled (you can thank WGA for that), and thus, a HUGE number of computers in China are zombies out on a mission to zombify (is that a word?) other computers.

Re:Were government computers purposefully targeted

[Anonymous Coward]

could've picked a more useful department. Like Defense or State. But Commerce?!?!

BIS systems contain all sort of useful information regarding applications for US businesses wanting to do business overseas, including technology reviews for export controls.

Of course the fucking Chinese are interested in Commerce. This is only one small piece of an over all plan to steal US technology and business secrets. Read some Bill Gertz.

This should scare the crap of the west. By something like 2020, China will have an estimated surplus of 20 million men over women. What do you do with an extra 20 million men who can't make babies after you've slowly, over the course of 30 years raped the west of it's technology advantage and destroyed it's industrial base? Bet even lame Slashdot liberals can guess!