Slashdot Mirror


Another NASA Hacker Indicted

eldavojohn writes "Earlier this year, UK citizen & hacker of NASA Gary KcKinnon was extradited to the United States (also interviewed twice). Now, another hacker has been indicted for hacking more than 150 U.S. government computers. Victor Faur, 26, of Arad, Romania claims to have led a 'white hat team' to expose flaws in U.S. government computers. It seems everyone else has been busy hacking into government systems while I've been wasting my time playing Warcraft." From the article: "The breached computers were used to collect and process data from spacecraft. Because of the break-ins, systems had to be rebuilt and scientists and engineers had to manually communicate with spacecraft, resulting in $1.36 million in losses for NASA and nearly $100,000 in losses for the Energy Department and the Navy, prosecutors said. Several suspected NASA hackers have been dealing with law enforcement recently."

164 comments

  1. Teh Interwebs by foldingstock · · Score: 5, Insightful

    If a system is that important, and only has a single task, such as communicating with a spacecraft, why would it be accessible from outside sources?

    1. Re:Teh Interwebs by The+Zon · · Score: 5, Funny

      It's NASA 2.0. They're looking for input from the community.

      --
      Some attitudes replaced or by cgi optimizes
    2. Re:Teh Interwebs by nEoN+nOoDlE · · Score: 3, Funny

      so that the people manning the system can check their Gmail in between shuttle launches.

      --
      Don't trust a bull's horn, a doberman's tooth, a runaway horse or me.
    3. Re:Teh Interwebs by cyclone96 · · Score: 4, Informative

      If a system is that important, and only has a single task, such as communicating with a spacecraft, why would it be accessible from outside sources?

      Indeed. The article is pretty thin on what was actually compromised and what "manually communicating with spacecraft" really meant. Rule number 1 with mission critical systems at NASA (I work for them, but not at the locations attacked) is that they are *completely* walled off from the outside.

      Now, there are some mission associated systems that are accessible from the internet which are storing spacecraft data. Here's one that has datasets from the acceleration system on the International Space Station:

      http://pims.grc.nasa.gov/html/ISSAccelerationArchi ve.html

      It's out there because that's the easiest way to get the data to researchers, many of whom are at universities around the world. I suppose if that server ended up hacked, it would hit the news as "Hacker brings down Space Station support system!". Sounds bad, but it's not like you can actually gain control of the spacecraft. I suspect the machines affected were used for this sort of purpose.

      --
      Worst...sig...ever!
    4. Re:Teh Interwebs by gwayne · · Score: 1

      Critical systems are firewalled off or completely isolated. Some of the systems on our contract got hacked. Some of the targeted NASA systems that are publicly accessible house engineering drawings and such that must be available to a variety of people and places. Incidently, most of the hacked systems were running Windows.

    5. Re:Teh Interwebs by wximagery95 · · Score: 5, Interesting

      I work for Lockheed Martin on a classified contract for the USAF and our entire classified network infrastructure is not accessible from the outside (no VPN, no dial in, no nothing). It's a completely isolated AND encrypted network. It's a pain to work on/maintain, but it's the only way you can guarantee no one other than an insider can compromise the system by manually copying data to removable media and taking it with them. Leaked information at this level could causer serious harm to nation's national security.

      When I read articles like this one, it makes me wonder what classification of information was compromised. I highly doubt it's DoD Secret or greater and if it's less than that, the damage caused by this information landing in the wrong hands is probably minimal, though disconcerting.

    6. Re:Teh Interwebs by Zantetsuken · · Score: 1
      When I read articles like this one, it makes me wonder what classification of information was compromised. I highly doubt it's DoD Secret or greater and if it's less than that, the damage caused by this information landing in the wrong hands is probably minimal, though disconcerting.
      So quite possibly, its just more fud from an anti-US government "news-service" (I think it was zdnet)...
    7. Re:Teh Interwebs by tubapro12 · · Score: 1

      You forgot the satellites have bluetooth and Wireless-G adapter! Our satellite overloads have to have some way to get pirated music.

    8. Re:Teh Interwebs by Anonymous Coward · · Score: 0

      in the first case, NASA engineers should isolate the system or set of machines from the network.. rather than *walling* them. understanding that its always possible to enter through an imaginary software wall.

      secondly, the idea of deciding to manually do something becos the systems are prone to attack is a decision taken by NASA for a problem inside NASA... adding this cost of manual work to the damage cost by the hacker is the *most* lethargic way of blaming the internal fault on an outside hacker. what next, NASA will wait for another hacker to blame costs due to internal cable and network faults that happens already.

    9. Re:Teh Interwebs by master_p · · Score: 1

      Sounds bad, but it's not like you can actually gain control of the spacecraft.

      Not even by sending a virus up the incoming data stream???

    10. Re:Teh Interwebs by mindwhip · · Score: 1

      No! not the people! It's the intelligent EO-1 satellites that need to check their Gmail!

      --
      [The Universe] has gone offline.
    11. Re:Teh Interwebs by Anonymous Coward · · Score: 0

      That's bad enough. If the server is cracked, then the data stored on it can no longer be guaranteed to be valid, because no one can prove that the cracker hasn't messed with it. That means everyone has to start over, with the loss of time (and money) that entails.

      In law enforcement this concept is called "chain of evidence".

    12. Re:Teh Interwebs by patdbr · · Score: 1

      When I read articles like this one, it makes me wonder what classification of information was compromised. I highly doubt it's DoD Secret or greater and if it's less than that, the damage caused by this information landing in the wrong hands is probably minimal, though disconcerting.

      This doesn't deal with calssification through aggregation. While there may not be any classified documents (though how many 'drafts' are there) the classification of the information can increase due to an agregation of data.

      What that means is that each piece of data may be classified at a lower level, but when combined with other information it create a highly sensitive data set. It is important to never underestimate the value of the information stored on your networks, even those at the lowest level

  2. $1.3? $100k?! by elysiuan · · Score: 4, Insightful

    Why bring the monetary damage (I'd be interested to see how it was calculated in the first place) into the equation at all? These are trifling amounts of money on the scale of government spending. 100k from the Navy and US Department of Energy? Yeah I'm sure they're feeling the 'loss'. Hacking into government systems should be enough of a crime without throwing this wacky money figure into it all.

    1. Re:$1.3? $100k?! by h2g2bob · · Score: 3, Informative

      For extradition, there's often a minimum amount of damage (in $$$) that is required before someone can be extradited.

    2. Re:$1.3? $100k?! by Anonymous Coward · · Score: 0

      Because as someone that ran a small IT department on governmental $$$s, I can safely say that just because my organization might have half a billion dollars a year, my area gets practically nothing.

      The money is allocated years before I ever see it. I've had one break-in with a zero-day exploit that I had no previous knowledge about, and caught hell from my boss and his boss and her boss and everyone else up the line and ended up spending $30k to fix the problems (because it was zero-day, and the damage covered up by the time there was a scanner for this, we had to scrap data that COULD HAVE BEEN altered in the time...we only found out because a few file droppings directly related to the hack were found two months later, and those two months had to be deleted).

      This is direct money that was spent. No bullshit of dollar amounts. New equipment to firewall the stuff from the outside (which ironically, the firewall that my organization recommended was exploited all over the organization a few months later)...reconstruction of previous work...consulting fees to see if potentially identifyable data was grabbed (nope, that part was encrypted and the key, as per org guidelines, kept elsewhere offline -- only our researchers have access to this, and its run offline when needed...it was a few years ago since we last needed to access identifyable data).

      All in all, my department was in the hole for a couple of years. Had to take on private consulting gigs to pay it off (yes, the gov't does consulting...and sometimes for a profit -- its the entity that has to be zero-sum at the end of the year, not individual projects...we just can't overtly compete with private industries, but if others come to us and ask for our help...)

      Luckily, my pet projects were running on OS X server...had bought the box intending to throw linux on it, but never got around to it. It was our hosted projects that our sister department were using and there were no ifs ands or buts about running anything but Windows. It was out of my hands.

      So yes, a lot of us are entirely fucked monetarily when some asshole breaks into our machines, regardless if we work for the government or not.

    3. Re:$1.3? $100k?! by Ninjaesque+One · · Score: 1

      But the thing is, govermental IT is different, especially military IT. They spend $100,000 on maintenance for 50-year-old carriers that have about the same chance as a snowball in hell's surviving to be returned into active service. The military probably spends $100,000 yearly on landscaping for Arlington Nat'l Cemetery.

      --
      Ninjas and pirates. How piquant.
    4. Re:$1.3? $100k?! by bitt3n · · Score: 1

      hey, have a heart! the Navy could have used that $100K to buy a hammer and maybe even a few nails.

    5. Re:$1.3? $100k?! by edwardpickman · · Score: 1

      Personally I'd rather see that money put towards fixing the Hubble telescope or extending the mars rover mission than fixing damage that some hacker did.

    6. Re:$1.3? $100k?! by balsy2001 · · Score: 1

      You are underestimating by an order of magnitude. In the FY 2000 budget for grounds keeping at the national cemetary cost $1.75 million and that doesn't count the $698,000 for tree and shrub maintenance (http://www.arlingtoncemetery.net/decay02.htm). I am sure it has only gone up since then. I had a hard time finding more recent numbers with such a good break down on grounds keeping cost.

      --
      GENERATION 27: The first time you see this, copy it into your sig on any forum and add 1 to the generation.
    7. Re:$1.3? $100k?! by Anonymous Coward · · Score: 0

      "But the thing is, govermental IT is different, especially military IT."

      Again, I work for the government. I know what it says on my check.

      I am a researcher, but got hired on for a good part because of my computer skills. We didn't have official IT support because of my department's budget, so I got to be research and IT manager. It was nice, it meant that I was officially above researchers that came in before I did, even though I was technically low man in the lab.

      But this is how government projects work. Every department has a budget. We are allocated this months / years ahead of time. I was told when I started on that the IT components were being phased out. This was ten years ago. It was going to go to another department. But that didn't happen...I actually took on more responsibilities before this happened.

      Out budget is such that just because there is a half billion dollars in our division's budget, that doesn't mean that they can absorb even a few grand in from a single deparment. That 100l on landscaping doesn't help me...thats in another division, another section of the world, and if we were to lose a million $$$s, there is no way that the cemetery boys are thinking of giving it up (mainly because they are probably stretched thin as it is as well -- at least in comparison to what the public expects out of them).

      Please read before dismissing.

    8. Re:$1.3? $100k?! by Warg!+The+Orcs!! · · Score: 2, Insightful

      The term "damage" is quite loose here. NASA can claim that $1.3m of damage was caused whereas I would have described it as "$1.3m was spent plugging the holes that shouldn't have been there in the first place". In this case the 'hacker' isn't causing any damage at all, he's merely exposing a badly designed system. Any damage is the fault of the original progammers.

      --
      Travelling forward in time at a rate of 1 second per second.
    9. Re:$1.3? $100k?! by Anonymous Coward · · Score: 0

      These hackers are criminals and the monetary damages attached to these crimes are meant to serve as punishment (along with long prison sentences hopefully). I don't know how much was actually spent tracking these hackers down and cleaning up their mess. But ultimately it's the US taxpayer's money being spent here. I'd hope the US government would get some of this money back.

    10. Re:$1.3? $100k?! by Anonymous Coward · · Score: 0

      Project budgets are not managed 'on the level of government spending'. For a NASA project, the $1.3M is a big deal. Once you've paid for your spacecraft and launch vehicle, there typically isn't a whole lot left for payload and ops. Money wasted on something like this is money that isn't available for science tasks such as data analysis.

    11. Re:$1.3? $100k?! by Mindzai · · Score: 1

      Firstly, this is (mostly) money that should have been spent in the first place securing the systems. If the holes existed and the figures being touted are the cost of plugging these holes, the 'hackers' haven't caused this spending to happen, they've merely caused this spending to happen NOW when it should have been spent when the system was first implemented. Aside from this, the sums involved are trifling amounts when you consider some of the pointless things the US government spends billions on. I very much doubt if your taxes will go up as a direct result of this incident!

      Secondly, the sort of sentences being touted for what is essentially a victimless crime (in this instance as no damage was done) is appalling. Last week a guy in England got 10 years for abducting a 6 year old girl from her house and raping her. It seems this guy is looking at 10 times that. Granted we're talking about the US legal system which is considerably harsher that ours in general, but even so, this crime does not imo warrant such a severe sentence. All that has happened is that NASA will have to spend the money they should have spent in the first place.

  3. Think about... by Anonymous Coward · · Score: 1, Interesting

    ...all that money spent on server security...

  4. Prove it by Anonymous Coward · · Score: 3, Insightful

    Because of the break-ins, systems had to be rebuilt and scientists and engineers had to manually communicate with spacecraft, resulting in $1.36 million in losses for NASA and nearly $100,000 in losses for the Energy Department and the Navy, prosecutors said.

    I smell a false inflation of damages, much like Motorola in the Mitnick case.

    1. Re:Prove it by loraksus · · Score: 5, Funny

      What are you talking about? NASA had to hire hundreds of people to write the communications out by hand in binary and send over 200,000 pigeons to deliver it to the spacecraft (where they had significant issues with packet loss).
      Those numbers are extremely conservative!

      --
      1q2w3e4r5t6y7u8i9o0pqawsedrftgthyjukilo;p'azsxdcfv gbhnjmk,l.;/
    2. Re:Prove it by Anonymous Coward · · Score: 1, Interesting

      I would argue that there are no financial damages due to unauthorized break ins. If someone tells them how to infiltrate their systems without actually doing it. They would have to assume it's already been done and take exactly the same steps. Don't get me wrong, it's still wrong but losses should not be a factor if nothing was done except breach security.

    3. Re:Prove it by madsheep · · Score: 1

      There is something you have to understand about how these numbers are calculated. If one system is compromised (and remember there were hundreds), it can take hours of investigation by multiple people. Then there may be computer imaging, other forensics work, and ultimately reinstallation of the machine. This may go across multiple departments, contractors, and divisions within a single organization. So if we have 6 people involved in one incident and they each spent 6 hours on it. That's 36 hours worth of effort/work. Well, how much time is that worth (not calculating any loss caused by other unproductivity from downtime)?


      Varying rates:

      $50 x 36 = $1800
      $100 x 36 = $3600
      $150 x 36 = $5400


      Yes these are arbitrary numbes and hours but think about systems that caused e-mail loss and other problems. This is tons of downtime, tons of problems, and tons of work for various individuals. That costs money.

    4. Re:Prove it by garcia · · Score: 1

      Well, it was the number of pigeon spacesuits and oxygen tanks for those suits that actually caused the financial damage. It wasn't the pigeons and binary conversions themselves!

    5. Re:Prove it by westlake · · Score: 2, Insightful
      I would argue that there are no financial damages due to unauthorized break ins. If someone tells them how to infiltrate their systems without actually doing it. They would have to assume it's already been done and take exactly the same steps.

      The Law for Geeks 101: You break it, you buy it.

    6. Re:Prove it by electrosoccertux · · Score: 1

      Those numbers are extremely conservative! That's exactly why the can't be trusted. ;)

  5. Not very bright and certainl not "white hat" by madsheep · · Score: 5, Interesting

    If you ever went to the websites that this "Victor" character hosted their "hacks" on you could see what kind of geniuses they were. The "White Hat Team" as they called themselves were/are a bunch of clueless script kiddies. They would host their website (www.whitehat.ro) on hacked servers, so it would frequently go down and be reuploaded elsewhere. They flat out told you this on their ugly poorly designed webpage. On top of that they had tons of screen shots of various systems they compromised accounts on (and sometimes gained root). It was fully of typos, bad commands, and just other terribly embarassing things.
    Honestly, I feel bad for this guy (and probably the rest of the team when they're indicted), not because he's been arrested, but because he is such a moron! Hackers... not at all. White hats.. nope (about as smart as the Ironic on). Morons..yes.

    1. Re:Not very bright and certainl not "white hat" by Anonymous Coward · · Score: 5, Funny

      > It was fully of typos, bad commands, and just other terribly embarassing things.

      Sounds like he has a bright future right here, on slashdot.

    2. Re:Not very bright and certainl not "white hat" by thripper · · Score: 0

      You are right. Script kiddies ... I mean, come on ! You crack 150+ computers and fail to hide your tracks. I live in Romania and i know there lots of ways to get online without revealing your location or identity.

    3. Re:Not very bright and certainl not "white hat" by Anonymous Coward · · Score: 0

      HAHAHAHA some mod with poor spelling (probably functionally illiterate like half of you who complain about how much you hate "grammar nazis") left his sense of humor at home. This is obviously a joke, and it's a funny joke because it's true. Fuckin' get over it.

    4. Re:Not very bright and certainl not "white hat" by pilsner.urquell · · Score: 1
      The "White Hat Team" as they called themselves were/are a bunch of clueless script kiddies.

      Yes, and can you say Deep Do Do?

    5. Re:Not very bright and certainl not "white hat" by ms139us · · Score: 2, Informative

      It was fully of typos

      Oh, teh inory!

    6. Re:Not very bright and certainl not "white hat" by Anonymous Coward · · Score: 0
      Did you stop to consider that because someone speaks/writes broken English, doesn't mean they are stupid, or a moron. I'll bet your a 3133t h4x0r right?

      get a life... At least this guy was doing something other than being a critical little bitch on /.

    7. Re:Not very bright and certainl not "white hat" by Anonymous Coward · · Score: 0
      Did you stop to consider that because someone speaks/writes broken English, doesn't mean they are stupid, or a moron. I'll bet your a 3133t h4x0r right?
      nice way to prove a point there
  6. 'hackers' by hadhad69 · · Score: 1

    The hackers didn't actually break in though, they merely sandboxed a comp in an underground bunker in new mexico...

    --
    If you can read this, it's already too late.
  7. Manually Communicate? by houstonbofh · · Score: 4, Funny

    Because of the break-ins, systems had to be rebuilt and scientists and engineers had to manually communicate with spacecraft
    I can just see one of the guys standing outside NASA JSC yelling up at the sky, "How Ya'll doin up there?"

    1. Re:Manually Communicate? by Anonymous Coward · · Score: 0
      I can just see one of the guys standing outside NASA JSC yelling up at the sky, "How Ya'll doin up there?"


      Oh come on, they didn't do that. That would just be silly.

      They used smoke signals. EO-1 noted them, interpreted them, and relayed them on to the affected satellites.
    2. Re:Manually communicate? by Detritus · · Score: 2, Informative

      You could manually compile a list of commands and type them into the command encoder. Normally, most of the work is automated.

      --
      Mea navis aericumbens anguillis abundat
  8. I guess he joins the ranks of the 1337 h4x0rz by chimachima · · Score: 0, Redundant

    I guess we'll never find out about the people who have successfully hacked into NASA and avoided legal indictment to tell the tale of how they did it. It's kind of like the winning the Olympic Gold Medal of Hackerdom no? Hack into NASA, get indicted by the FBI, you win teh intarweb.

  9. Eh, Government oversight... by rijit · · Score: 0, Redundant

    The government has a way of inflating values on damage like this to make the charges more than what they should be. I think punishment is definitely called for and the investigation should add up damages but needs to do so in a manner that makes them more responsible for their findings. Instead of tossing out a "guess-timate", they should not give a quote without all the facts present.

    1. Re:Eh, Government oversight... by Deadstick · · Score: 1, Insightful
      The government has a way of inflating values on damage like this to make the charges more than what they should be.

      Also gives 'em something to tack onto next year's budget request...

      rj

    2. Re:Eh, Government oversight... by Qzukk · · Score: 1

      The government has a way of inflating values on damage like this to make the charges more than what they should be

      Not to mention they typically charge for "fixing the hole" when they should have fixed the hole on their own dime in advance.

      --
      If I have been able to see further than others, it is because I bought a pair of binoculars.
    3. Re:Eh, Government oversight... by Mr.+Hankey · · Score: 1

      They are responsible for those figures. Without going into too much detail, the cost of the personnel's salary who work on the various aspects of the investigation as well as the salaries of researchers affected is taken into account. If they attach a figure, there's something to back it up.

      --
      GPL: Free as in will
  10. damn that warcraft :) by Anonymous Coward · · Score: 0

    was it 2, 3 or wow?

  11. This is the result by cdrguru · · Score: 4, Insightful

    of glorifying such stunts and of the FBI refusing to even consider something for which there isn't at least $25,000 worth of damages.

    Glorifying such fool pranks I would consider the same as glorifying cutting brake lines on school buses. Really quite funny when the bus driver tries to stop. How could it possibly hurt anyone because any bus driver is going to notice what is wrong long before the first child sets foot on the bus. Right. Keep thinking that way. Of course, what these folks did was just for fun and it didn't really hurt anyone, now did it?

    The FBI putting a dollar floor on damages ensures that nothing is ever done when these kids do something minor. Rather than someone identifying them and giving them a warning nothing happens. When you were 16 if you were never, ever caught shoplifting would your escapades advance to other, higher-price objects? Of course. Which is exactly what is happening here.

    ISPs refuse to identify or even forward communication from people complaining about attacks. So your only choices are to either wait for $25,000 in damages to bring in the FBI (who is the only possible law enforcement agency with jursidiction) or you decide to spend lots of your own money to file suit against some 16 year olds to "teach them a lesson". Of course, you end up with the "lesson" because they will be laughing at you when you find out you can't sue a kid in Romainia.

    1. Re:This is the result by jpardey · · Score: 1

      No. This is the result of bad security. If they hadn't done it, some mafia somewhere probably would have. If you are in the government and have a car plainly marked as such, do you leave it on the side of the road with no one attending it, and wait for someone to plant a bomb in it or cut the brakes? I highly doubt it. Big targets need security, if they want to remain secure.

      --
      I have freaks! I did something right...
    2. Re:This is the result by Anonymous Coward · · Score: 0

      When you were 16 if you were never, ever caught shoplifting would your escapades advance to other, higher-price objects? Of course.
      Rubbish. You're applying your own ethics to others, and people aren't all the same as you.

    3. Re:This is the result by twistah · · Score: 1

      Glorifying such fool pranks I would consider the same as glorifying cutting brake lines on school buses. Really quite funny when the bus driver tries to stop.

      Yeah man, lots of kids have died due to hacking attempts. There isn't a "rolleyes" icon big enough to reply to your post.

  12. Hacker Crackdown by dbIII · · Score: 4, Informative

    Read Bruce Sterling's "The Hacker Crackdown" for how these spurious figures are calculated. The examples are old but so is the mindset behind this. The author has put the entire book online.

  13. Manually communicate with spacecraft ? by Timesprout · · Score: 1

    Is that like giving hand signals to V'ger?

    --
    Do not try to read the dupe, thats impossible. Instead, only try to realize the truth
    What truth?
    There is no dupe
  14. I'm not sayin'... by lazycam · · Score: 5, Interesting

    I agree with hacking into US goverment machines. I have no plans of spending the next 10 years in a federal prison or Gitmo for that matter. But, who is then responsible for testing the security of our critical systems? Is that no our duty as programming and security professionals? Please explain to me why such machines were connected to the internet again? That's like walking outside the door in the morning without a pair of pants.

    --
    my mom posts on slashdot.
    1. Re:I'm not sayin'... by Frosty+Piss · · Score: 1
      But, who is then responsible for testing the security of our critical systems?

      The point is, not some random hacker from the UK or Romania who calls themselves a "security researcher". Honestly, this guys story is lame.

      --
      If you want news from today, you have to come back tomorrow.
    2. Re:I'm not sayin'... by lazycam · · Score: 1

      Hey, sometimes it's your average Joe who points out a problem. http://it.slashdot.org/article.pl?sid=06/11/30/133 3216

      --
      my mom posts on slashdot.
    3. Re:I'm not sayin'... by budgenator · · Score: 1

      I'd hope the these guys actually broke into a machine in the DMZ serving data over the internet and used a shell on that one to penetrate deeper into the network.

      --
      Apocalypse Cancelled, Sorry, No Ticket Refunds
    4. Re:I'm not sayin'... by Anonymous Coward · · Score: 0

      Is that no our duty as programming and security professionals?

      No.

    5. Re:I'm not sayin'... by dapyx · · Score: 1

      Not just 10 years, but up to 54 years, if he'd be found guilty of all 10 offenses. But there's a problem with his extradition: Romania and the United States have an extradition treaty from 1924, which includes a large variety of crimes, but not computer crimes.

      --
      I'm sorry, the number you have dialed is an imaginary number. Please rotate your phone 90 degrees and dial again.
    6. Re:I'm not sayin'... by Beryllium+Sphere(tm) · · Score: 1

      >Is that no our duty as programming and security professionals?

      If we're the ones owning or operating the systems. I've got some trouble believing someone who leaves taunting messages (but not detailed remediation instructions) when they claim they were running a pro bono penetration test.

    7. Re:I'm not sayin'... by Anonymous Coward · · Score: 0

      That's like walking outside the door in the morning without a pair of pants.

      You should try it sometime, it's not that bad.

    8. Re:I'm not sayin'... by asuffield · · Score: 1


      But, who is then responsible for testing the security of our critical systems?


      The point is, not some random hacker from the UK or Romania who calls themselves a "security researcher". Honestly, this guys story is lame.


      Who, then? A company who calls itself a "security researcher" will simply keep any issues secret so that the government bureaucrats can continue to do nothing about them - their customers are the people who have a vested in interest in secrecy, and no real interest in security. This sort of thing happens all the time (most recently, with the voting machine stuff).

      Ignoring this guy completely for the moment, who do you think is going to uncover this kind of idiocy and let the public know where their money is being spent? Fox News?
  15. Possibly Just Social 'Hacking' by eldavojohn · · Score: 2, Interesting
    If a system is that important, and only has a single task, such as communicating with a spacecraft, why would it be accessible from outside sources?
    Well, with the case of McKinnon, I don't think he ever actually 'hacked' into something by way of computer. I think that he was more so a social engineer than a hacker but they call him a hacker because it has a rogue/negative sound to it. Anyway, I don't know what the facts are in the Romanian's case, only reported it to Slashdot.

    Keep in mind that these guys did 150 computers, the NASA problems were only NASA's reports of their 'hacking.' It could be that he was part of a team that was trying everything to get at government computers (pretexting/social engineering, hacking, you name it) and that this guy was the only one who actually physically went to a facility and illegally accessed data. I think if you're smart enough to hack into a NASA system, you should be smart enough to cover your tracks--so maybe this guy just waltzed in and presented real ID but just lied about who he was or representing?

    So before you call NASA stupid for leaving those computers connected to the internet, I would wait until you find out what they're actually accusing this guy of--it could be another case as with Gary McKinnon where the person wasn't some steller computer genius, he was just really good at gaining trust from people and lying his way into facilities.
    --
    My work here is dung.
    1. Re:Possibly Just Social 'Hacking' by x_MeRLiN_x · · Score: 1

      Errrm.. Garry McKinnon didn't do that.

    2. Re:Possibly Just Social 'Hacking' by moro_666 · · Score: 1

      About keeping them connected to the net you are 100% right.

        Why in the bloody hell should be these machines connected to the internet ? Why ?

        There isn't really a reason for this. Backups can be managed other ways, and it's not like your going take a 5 minute break from leading your space station to read slashdot ... errr ...

        Nasa security experts: plug the cable and watch your pr0n ^H^H^H^H^H news sites from somewhere else.

      --

      I'd tell you the chances of this story being a dupe, but you wouldn't like it.
    3. Re:Possibly Just Social 'Hacking' by Crayon+Kid · · Score: 2, Interesting
      Anyway, I don't know what the facts are in the Romanian's case, only reported it to Slashdot.

      http://www.realitatea.net/27615_Hackerul-roman-sus tine-ca-a-spart-codurile-computerelor-NASA-din-joa ca-.html

      Rough translation:

      "It was not intentional, we got to them practically by mistake, very easily, considering that those systems were not adapted (updated?), the techniques in use didn't really have care for the systems. I did not try to bring damages to the US state or US, if I knew that my actions would lead to damages I wouldn't have tried to do it", he declared.
      Which IMHO contrasts wildly with the following fact, also reported by Los Angeles Times:

      [..]the young man is the leader of a hacker team known as "WhiteHat Team". The main purpose of the group is to break into US administration computers to prove that they are not the most secure in the world, as it is believed.
      My take (and I've been around Romania enough to speak the language and know what goes around): just another bunch of stupid kids with nothing better to do. They piss around with sensitive stuff like this, and when the FBI comes looking for them they whine "we didn't want to do it, it just 'happened'".

      They don't even make a moral or political stand, they're simply stupid. There was an old saying, don't do the time if you can't do the time, wasn't it? It's all the more idiotical considering these are skilled people, this one claimed to have worked for IBM at some point. Way to throw it all out the window.

      Granted, 54 years in jail is a rough punishment for stupidity. I doubt they'll be extradited, but they will have just as rough a time in Romania. The government is trying to make up for the country's standing negative fame on the Internet by dealing excessive prison sentences in such cases. And trust me, an American prison looks like a spa compared to the dumps they call prisons around here.

      On the other hand, his daddy used to be the head of a local county hospital. I doubt he hasn't made some connections and dough, which would come in handy right about now. If the son is prosecuted in Romania there's a 50/50 chance he'll be able to bribe his way out of it clean or with a minimal sentence. Of course, the moment he steps out of the country he's fair game.
      --
      i ate crayons when i was a kid and now i have two braincells and the blue ones taste nicer
  16. Please, please by Anonymous Coward · · Score: 0

    Tell me they didn't get into the Gibsons?

  17. Hacker? by radu.stanca · · Score: 0, Redundant

    I`m from Arad, and I know a friend who knows a friend who knew that guy(no joke). He used hang aroung irc channels(nickname SirVic) ddosing anything he could, he probably had no ideea he hacked NASA, ./scan, install rootkit and psybnc, and that`s it, just a stupid script kiddie cracker.

    Sadly, almost any news involving Romania are mostly about phishers, skiddies and crackers...I hate my country.

    1. Re:Hacker? by flyingfsck · · Score: 0, Flamebait

      "Sadly, almost any news involving Romania are mostly about phishers, skiddies and crackers..."

      So, what happened to the gypsies? They left?

      --
      Excuse me, but please get off my Pennisetum Clandestinum, eh!
    2. Re:Hacker? by Anonymous Coward · · Score: 0

      What kind of racist piece of shit are you?

    3. Re:Hacker? by budgenator · · Score: 1

      I met your Olympic boxing coach and your boxers at Atlanta 96 and they earned a lot of my respect; don't hate your country, it's been through more than most could endure several times over. Things will get better.

      --
      Apocalypse Cancelled, Sorry, No Ticket Refunds
    4. Re:Hacker? by budgenator · · Score: 1

      A psycho with a funny mustache named Hitler, killed them

      --
      Apocalypse Cancelled, Sorry, No Ticket Refunds
    5. Re:Hacker? by SinGunner · · Score: 1

      So if you walk outside in the morning without your pants on, it's fine for someone to throw acid on your private parts because it shows that you're an idiot for not wearing pants? Life is risky from the first second to the last second. Is your life's goal to be encased in carbonite so nothing can get at you? Cause I hear your eyes don't work for shit after they unfreeze you, which will mean you'll be even MORE vulnerable!

  18. When I was there... by jd · · Score: 3, Insightful
    ...it was standard practice to put .rhosts files on all of the servers and desktops, so that nobody needed to log in more than once and so that shell scripts on remote sites could transfer data. Frankly, I'm less surprised that people have broken into mission-critical systems than in the fact that only three (the two mentioned and a file swapper) have ever been caught. I witnessed truly godawful ignorance on security issues, not least from those in charge of IT security. From the annual reviews of security, it would seem that things have improved and are now merely very sickeningly bad, but I cannot find any reason to excuse ANY weakness in a computer network (a) run by very bright people, and (b) containing a mix of extremely sensitive and/or utterly unique data.


    That these three have been caught is almost incidental, when you consider the probability that there are possibly several orders of magnitude more people who have not. Those who have been were not doing anything significant, except insofar that it was possible to do at all. Nobody - least of all NASA - knows what those who have NOT been caught are doing. We're constantly being reminded about how dangerous the world is and how important it is to track kitty litter as it comes into the country. Assuming the claims have any merit at all, I'd be just a little more concerned with what the Government itself is openly, passively and willingly handing out to whoever asks out there in that "dangerous world". If it's so bloody dangerous, shouldn't the Government be doing at least the very basic minimum?


    (If, however, the real reason is that NASA isn't doing anything mission-critical and that all information it has has no value whatsoever, then just shut the bloody thing down and put the money into education. I think NASA is worthwhile, but then I'd have kicked their security into shape within the first five minutes of having the authority to do so. They aren't, so they clearly don't.)

    --
    It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
    1. Re:When I was there... by Anonymous Coward · · Score: 0

      you forgot to mention global espionage: china for sure, india and israel...probably...russia...probably...

    2. Re:When I was there... by dgm3574 · · Score: 5, Interesting

      I was there too. I worked as a contractor at JPL for a little over 3 years, on various projects, building what I'll call "mission support software" in the interest of brevity.

      What I learned after being there long enough (and it took me a long time) is that one of the main reasons computer security at NASA sucks is funding; or really a lack of it. Bear with me as I explain...

      The IT security people (and really, IT people in general) are considered about the lowest form of life at places like JPL, because we are ancillary to the mission. We are overhead. Our work, while helpful, is not viewed as "critical" to mission success. This is an unfortunate and incorrect perception. Try launching anything remotely complex without a computer or a network to support the mission and see what happens.

      Most of the science people at NASA just want to get their work done, get the mission to fly, get their science data back, and do their analyses. The problem is that they don't value network/computer security like IT people do. They just have their narrow view of their narrow area of responsibility. This tunnel vision prevents them from caring about security until Something Bad happens and they lose mission data. Then get ready to hear the screaming. IT people get fired. Heads roll. Memos are written. Policies changed.

      And then everything goes back to exactly how it was, again.

      Underlying all of this is the fact that IT, because of how it is perceived, is poorly funded and therefore understaffed. Without enough staff, they can't respond to all the incoming requests for IT work.

      Remember those science people? They will not accept anything getting in their way, least of all some sorry excuses from the IT department about how they can't get to your server today.

      Consider this conversation:

      IT: "I'm sorry, we're backlogged right now and I won't be able to do that for you today."

      ScienceGuy: "No, you'll fix my server today or the lab director (basically the president of JPL) will hear about it and you'll lose your job because I won't be able to talk to the Mars rover today."

      IT: "Uh, ok. You're the 5th person to threaten my job today. Looks like I'm getting fired. What would you like me to do?"

      ScienceGuy: "Just give me the root password and I'll do it myself. I use a Mac with OS X, so I am a Unix Genius."

      IT: "Sure thing. The password is p198*#&$S(s. Have a great day!"

      ScienceGuy: "Thanks for being a team player! I'll make sure to write a memo to your boss about how you helped us."

      And so, in order to "stay out of the way" of the science people, the IT people have to give away a lot of system administration duties. For this they are rewarded.

      Now, remember that those science people don't care about security? And they don't let anything get in their way? Think they'll do goofy things to make their server or data more easily accessible? You bet they will, regardless of the policies. And you know what? That is why places like JPL are so successful. The science people are dedicated, and will generally stop at nothing to make their missions successful. Most of them are what I would call True Believers. They really are there because they believe in what they do. Unfortunately, they often work within very limited budgets, and within the institutional limitations like limited funding for IT staff.

    3. Re:When I was there... by jd · · Score: 0, Flamebait
      Good point. Boeing's aircraft research (such as the blended wing body they worked on with NASA in the 1990s) was on open servers. DES encrypted, sure, but even back then, nobody took single-pass DES seriously as an encryption system. Undoubtedly work on scramjets, rocket fuels, etc, were also on public systems with insignificant protection. So far, there is no evidence of India, Pakistan or North Korea having hypersonic intercontinental cruise missiles, which tells me that those nations too unstable to be safe with such technology were also too stupid to obtain it from open technological repositories and that those who had the necessary wits to break in also had the necessary wits to not hand over any such information they found to such people.


      As a general rule, stupidity makes for a rather unreliable and unpredictable defense, even if you can practically guarantee an endless supply of it when it comes to politicians and military intelligence.


      There are other considerations. How much of Iranian nuke technology was simply FTPed off US Department of Energy servers? Mr Nuke from Pakistan may well have obtained a fair amount of his knowledge by such means, as reports repeatedly indicate he worked from old US designs. So few departments have IT security scores worth a damn and it simply isn't safe to assume that hostile nations or even hostile organizations have voluntarily chosen to "do the decent thing" and not kick the US in the goolies. Again, though, we simply don't know the detection rate. It seems to be extremely low, if NASA is anything to go by, and it was reported a while back that the DoD mis-identified a scan by a US-based team of crackers as being overseas because they used nmap's spoof system.


      Does this mean we should be all paranoid? Probably not. This level of sheer incompetence on the parts of all parties has gone on for many years, if not decades. It probably means that there should be better funding in IT security and a good, old-fashioned purge of delinquents in positions of authority, but that's not going to happen.

      --
      It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
    4. Re:When I was there... by jd · · Score: 1
      I completely agree with you, but I'd have thought JPL would have been interested in strange life-forms...


      (Seriously, what you are describing I can vouch for 100% at LARC.)

      --
      It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
    5. Re:When I was there... by dargaud · · Score: 2, Informative

      Good summary. I worked at Nasa in a lab doing mostly data analysis a long time ago, and all the system administration at the time was handled by student (full time in summer, part time the rest of the year). While many of those are dedicated and talented, it's an understatement to say that experience was lacking. Heck, I was 16 at the time ! Then again it was a long time ago in a non-mission critical lab, so things are different. But the reason was the same: funding, or rather, lack of it. Another thing I noticed is that most of the full time researchers were old, dating back to the Apolo days. Many of them had stayed through the starving years after that but with little to no new blood pouring in. So you had basically two populations: old researchers whose main job was to secure funding for the next year, and students on temp jobs. Not the best situation. Now most of those guys must have retired, so I don't know how the situation has changed.

      --
      Non-Linux Penguins ?
    6. Re:When I was there... by enven · · Score: 1

      thats just insanity....Great read/summary.

    7. Re:When I was there... by jafac · · Score: 1

      Right you are.

      Especially if the system is involved with exchange of weather data.
      (which really shouldn't be classified, IMO - anyone can lick their finger and hold it up inthe air).

      NASA's weather systems exchange data with all kinds of other government agencies, Dept of Fish and Game, National Weather Service, etc. They have accepted ways of exchanging data, and holding all of these to tight information protection standards is kind of impractical.

      --

      These are my friends, See how they glisten. See this one shine, how he smiles in the light.
    8. Re:When I was there... by jd · · Score: 1
      If the stuff's important, then they can always use a secure VPN tunnel. OpenCA will let you roll your own certs, so those cost nothing, and telling IPSec or SSH to validate on a cert is a piece of cake. It's all transparent to the user, the user doesn't need to learn anything fancy, the automated scripts would not even need touching, but you've now got a level of security that is at least beyond the average 5 year old.


      Weather stuff and other public information need to be protected only insofar as they should be read-only. You do NOT want a spotty 16 yr old converting their porn collection into the correct format for the weather database. Well, this IS Slashdot, so maybe I can't be quite so sure about that... Anyways, set up correctly, the system would use mandatory access controls (SELinux would work fine, though they probably have a spare copy of Trusted Irix somewhere) or a read-only network file system for the data with the actual writing done on a secure machine.


      This stuff really isn't rocket science... ...of course, that might be why rocket scientists don't seem very good at it...

      --
      It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
  19. They can manually communicate with a spacecraft? by DeQueue · · Score: 4, Funny

    Because of the break-ins, systems had to be rebuilt and scientists and engineers had to manually communicate with spacecraft...

    Did they use an a hitchhiker style Sub-Etha Sens-O-Matic electronic thumb or just a towel?
    Dequeue
    "Insert witty .sig here"

  20. What i really think is that - by unity100 · · Score: 1

    they are frightened to death of them that they might reveal information that nasa and co are able to hide from the public by getting scientists sign dreadful national security oath papers.

  21. Where did you get "guesstimate" ? by Infonaut · · Score: 3, Insightful

    Instead of tossing out a "guess-timate", they should not give a quote without all the facts present.

    If the government claims $1.36M + $100k in damage done, they have to submit evidence to the court as to why and how they came up with those numbers. Much of the reason cases involving economic damage take so long is that the discovery phase of the trial, when all of this information gets unearthed and shared among plaintiff and defendant, takes a lot of depositions, requests for information, requests for further information, and so on. You'd better believe that *if* the US successfully gets him extradited to the United States, his attorney will be issuing subpoenas for proof of those numbers. If the government can't substantiate them, it won't fly with the judge.

    --
    Read the EFF's Fair Use FAQ
    1. Re:Where did you get "guesstimate" ? by Anonymous Coward · · Score: 0

      You'd better believe that *if* the US successfully gets him extradited to the United States, his attorney will be issuing subpoenas for proof of those numbers. If the government can't substantiate them, it won't fly with the judge.

      You assume the defendant will be provided with a competent attorney.

    2. Re:Where did you get "guesstimate" ? by rijit · · Score: 1

      No idea where I got guesstimate, just seems to me that the damage amounts in all recent hacking cases are higher than would be expected for someone invading a network and printing some rude message. After years of hearing reports of the government paying outrageous sums for contract work it would only be a slight stretch to apply the same overinflated amounts to "virtual damage" done to government networks to try and build high dollar cases against hackers to get a better chance at extradition.

    3. Re:Where did you get "guesstimate" ? by Infonaut · · Score: 1

      You assume the defendant will be provided with a competent attorney.

      Just because someone is extradited doesn't mean they can't obtain their own counsel. Even if they were given court-appointed counsel, you'd have to try pretty damned hard to find an attorney that had passed the bar in any state in the Union who would be so incompetent as to not seek evidence during discovery. If he or she were to not take advantage of discovery, they would very likely later be sued for malpractice. The losing party wouldn't even have to know anything about legal malpractice suits. There are lawyers who specialize in legal malpractice, and they'd likely find the losing party and inform him of his right to sue the original lawyer.

      It's a shark-eat-shark world.

      --
      Read the EFF's Fair Use FAQ
  22. The money lost at NASA by joe_schmoe_the_geek · · Score: 1

    NASA = $18 billion in corporate welfare for aerospace companies and bureaucrats.  A few million more is pocket change.  Personally, I'd rather see the FBI spend its time catching terrorists and spies and leave the chasing of Romanian teenage script kiddies to someone else.

    1. Re:The money lost at NASA by ScentCone · · Score: 1

      A few million more is pocket change ... leave the chasing of Romanian teenage script kiddies to someone else.

      OK, so if some stupid punk kids decided to torch a NASA training jet worth a few $million, that wouldn't be worth the trouble, either? Wasting NASA's resources (my tax dollars) on the physical destruction of property, or the collosal waste of human energy hunting down pointless script kiddie vandalism is just as bad. And just as worth runing down.

      --
      Don't disappoint your bird dog. Go to the range.
  23. I'm a "White Hat" hacker too by Infonaut · · Score: 3, Funny

    I just hacked my way into the Bank of America, just to test its security. The fact that I managed to dowload millions of user account files with sensitive personal information I could sell to unscrupulous characters is *totally* beside the point of my wholly beneficial White Hat Crusade.

    Next week, I'll be mounting a White Hat Mission to test the security of Apple's online ordering system. If a few dozen dual core machines find their way to my house, it's a sacrifice I must make for the greater good!

    --
    Read the EFF's Fair Use FAQ
  24. US Government is a joke by Anonymous Coward · · Score: 1, Funny

    Pfft, hacking government systems are the SS/Evis - 2 button "I Win" rogues of hacking.

    Everyone knows all you do is type in login: admin and no password to get root access to every branch of the US.

    If you want a real challenge, try identifying and hacking other hackers computers.

    Honestly the US is a joke - my boss asked me to do background checks on new employees to check for criminal records (doesn't bar employment) and red flags, so I logged into the NSA's highest admin (again, l/p = admin/(blank)). Ok so that's not true, they probably changed the password to "God" since then.

    1. Re:US Government is a joke by Jeian · · Score: 1

      Pfft, hacking government systems are the SS/Evis - 2 button "I Win" rogues of hacking.

      SS/Evisc? Someone needs to learn2play. :P

  25. Claims to have led a 'white hat team' to expose... by Thaidog · · Score: 1

    I can believe that. You'd almost certainly look like a black hat trying to describe flaws in such systems.

    --

    ||| I still can't believe Parkay's not butter.

  26. its hardly Hackling when the PW is merely 'joe' ! by Anonymous Coward · · Score: 0

    its hardly Hackling when the PW is merely 'joe' !

    true story, an admin on a FL NASA mainframe was merely 'joe'

    i hardly call guessing THAT as hacking!!!

    nasa should be shut down.

    its incompetent deadwood oldtimers and young minority forced hire ethnics and forced-hire females. Universally all poorly skilled with high tech in my opinion.

    (I am telling the truth)

  27. So what's being done... by Schraegstrichpunkt · · Score: 1

    ... about the government's chronic security problems? I don't care whether or not what this guy did was illegal; He shouldn't have been able to do that much damage. Was this attack not in the government's list of screenplays?

  28. Say it with me again folks... by davmoo · · Score: 4, Insightful

    ...if you can't do the time, don't do the crime. And "if you can't pay the fine, don't do the crime" works too.

    Most people seem to be bringing up the lack of security on NASA systems or the inflated monetary loss estimates. Totally irrelevant. If I secure my house with a 100 year old skeleton key lock and also place a big sign in front of the house that says "Door key under welcome mat, $100,000 US in freezer behind ground beef", I may be stupid but that still does not give you the right to enter my house without my permission.

    --
    I want a new quote. One that won't spill. One that don't cost too much. Or come in a pill.
    1. Re:Say it with me again folks... by QuantumG · · Score: 2, Insightful

      big sign in front of the house that says "Door key under welcome mat, $100,000 US in freezer behind ground beef" Sounds like an invitation to me.
      --
      How we know is more important than what we know.
    2. Re:Say it with me again folks... by eyeb1 · · Score: 0

      you can quite clichés .. good for you ..

      so if i can pay the fine it's OK .. to do the crime .. ie. crime is OK for the rich .. but not for the poor?

      of course .. it is the act of creating and passing laws .. that produces the crime and the criminal .. not the acts ..

      you have been raised to believe that you have some right to your possessions .. the only real "rights" i or anyone else have .. are those that i can enforce for myself .. if you are not present to protect your stuff .. you have no right to it .. except by the notion .. that you think you do ..

      which the fact of someone being able to gain possession of "your" stuff .. is in fact a proof that it was not really your stuff .. "possession is 9/10th of the law" another good old cliché ..

      another old cliché is that "might is right" .. and it is one the US currently likes to live by .. the childish notion that because there is a law making it illegal .. that there is some kind of moral or ethic issue involved .. is just a product of mass brainwashing .. ie. public education ..

      it's just a convenient fact that if i claim to give people rights .. and they believe it .. i have created a job for myself of making and enforcing said rights .. it works very well for the current wealth ruling class .. the modern kings and their court .. but it is beginning to break down under the weight of the lie .. it really is time for humankind to WAKE UP and taste reality .. though it is not likely to happen anytime soon ..

      might is right is one of the relative truths of the physical universe .. numbers rule .. 300+ million people are about to find out that really have few if any rights .. to there ideas and or their stuff ..

      and that anyone living under the threat of overwhelming force .. by governments .. by the military .. by the police .. or other persons .. is really in fact noting but a prisoner of WAR and a slave .. like it or not ..

      WAR=We Are Right ..

    3. Re:Say it with me again folks... by bzipitidoo · · Score: 1

      NASA ought to get slapped around for being reckless. The law shouldn't be used to shelter this willful disregard of basic computer and data safety. Turning to the law ought to be a last resort. What if they'd lost their valuable data because they didn't back it up off site and a fire broke out and destroyed their data center? Sue the fire department? Or if a hurricane destroys it, sue NOAA? So I suppose they'll sue this hacker into bankruptcy and lock him up for 10 years so theyll have plenty of time before they'll have to phear him again. However, revenge won't restore whatever they lost.

      Your example is nearly entrapment. You don't have any additional signs saying "no trespassing" or any other kind of injunctions. You hardly need add "make yourself at home" as if you are expecting a guest, because the info you have provided practically screams it. Why else would you have provided it?

      I've heard of a medieval ruler name of Vlad the Impaler, who hailed from Romania or somewhere near there, and who earned his name for impaling thieves. He'd leave purses of money lying in the streets, and have them watched. People (other than the owners) who so much as touched one were convicted of theft, never mind their intentions.

      --
      Intellectual Property is a monopolistic, selfish, and defective concept. It is "tyranny over the mind of man"
    4. Re:Say it with me again folks... by davmoo · · Score: 1

      Come on my property while I'm home and threaten me or that property and I'll allow you to possess 10/10ths of a number of pieces of lead, all flying at high speed. And in my state, gun ownership os legal. And so is deadly force if you feel yourself, your family, or your property is under imminent threat.

      And if I'm not home, my two dogs will possess 9/10ths of your body parts.

      --
      I want a new quote. One that won't spill. One that don't cost too much. Or come in a pill.
    5. Re:Say it with me again folks... by _Sprocket_ · · Score: 3, Informative

      Various US Government Agencies have been slow to pick up information security. With few notable exceptions, the US Government just doesn't get infosec. But what the US Government does understand is law. Law is a relatively slow process compared to the hack. Some of these cases take years before the Feds are knocking on doors. If you're a script kiddie who's keen on a *.gov address for your IRC bot, keep that in mind. In the short term you may be successful. But you have no idea if the US Government actually did notice and are taking the long, drawn out process to bring you down via whatever Law allows it.

      I once attended an infosec meeting at a NASA center several years ago. The initial presentation was an analysis of an incident involving some Oganization's lab systems. It was well done and full of very handy technical information, lessons learned, and advice to other Orgs on how to avoid a simular incident. I looked around the room. Most eyes were well glazed over. Obviously the information was lost on an audience who should be taking notes. The next presentation came from our FBI representative. The rep. basically talked about the lab equipment that was confiscated... what was happening to the HDs during analysis... and the process of "getting the bad guys." The crowd lit up. Everyone was rather excited. They were going to get the bad guys. Few there seemed to realize that this was not "good news". Rather, it was a failure as the lab systems compromised represented lossess to already-tight budgets.

      Things have changed since that time. Infosec is changing... at least at NASA. There are new attitudes, new requirements, new regulations. I've still got my own concerns and criticisms of the state of things. It's far from perfect, to say the least. But there is change. We'll see how well it holds.

    6. Re:Say it with me again folks... by Anonymous Coward · · Score: 0

      Your analogy is reasonable but there is another factor at play here.

      I am a US citizen. I pay taxes, vote, do things most other US citizens do. As someone who works in IT, I find the instances of our government being hacked, downright embarassing. These occurrences happen because of policy. Plain and Simple. How hard is it to restrict web accessible data to X # of sites?? REALLY.....

      Now, has it crossed my mind to take intiative and pro-actively security test these sites on the web? Yes. Do I fear what would repurcussions might happen to me if I merely attempted this? Yes. Mind you my intent is to test for security holes in systems holding US Government data. Nothing more. I don't care what is behind them. Just that they are secure. Call it 'White Hat', 'Ethical' or whatever 'Hacking', but if my TRUE purpose is that of the Noble cause of providing better security for MY Country, how is that wrong???

      Sadly, My government would never believe such a thing. They have and will always view its Citizens as enemies when unasked assistance is provided in compensation for their shortcomings.

    7. Re:Say it with me again folks... by Anonymous Coward · · Score: 0

      According to computer ethics you must take into account all the people who screw when a moral/ethical problem presents itself. Fine, the guy broke into some computers that weren't his and hes wrong. But here at slashdot (and in computer ethics) we would like to know why NASA (and several computers at a Naval Base) had its computers not only web accessible, but also poorly secured. If your house get robbed in that awful metaphor, what will you tell your wife. 'Sure I told him how to break in, but its not my fault...'

      This case is extremely pathetic. Alot about Gary Kckinnon has been in the news for the past year. The guy (recently unemployed) hacked nasa from his ex-girlfriend's, aunt's 56k line with some generic windows remote log-in (Gui - for christsake). He was convinced that he found evidence of US space armies ("non-terrestrial officers") in files most likely refering to officers AT SEA. He eventually was caught because he would open up notepad on wind0ze computers and leave joke messages about how the govt was lying and had space troops. COME ON! This guy beat NASA and the Pentagon. In Britian there was actually a movement to save him from extradition cause he was obviously a moron and wouldnt know how to do harm even if he wanted to. $100,000! Imagine what an even moderately skilled hacker could do.

      Take a basic ethics and security class before you come a lecturing.

      An old interview detailing everything:
      http://www.guardian.co.uk/weekend/story/0,,1523143 ,00.html#article_continue

      Enjoy these Reg links as well:
      http://www.theregister.com/2005/07/27/mckinnon_ext radition_hearing_begins/
      http://www.theregister.co.uk/2005/07/11/mckinnon_i ndictment_snafu/

    8. Re:Say it with me again folks... by Beryllium+Sphere(tm) · · Score: 2, Interesting

      >the inflated monetary loss estimates. Totally irrelevant.

      If the estimates are inflated, something which has been known to happen, then the misstatement diverts law enforcement resources and can influence sentencing. Petty larceny and grand larceny are separate crimes for a reason.

      >If I secure my house with a 100 year old skeleton key lock and also place a big sign in front of the house that says "Door key under welcome mat, $100,000 US in freezer behind ground beef", I may be stupid

      Your insurance company will come up with a better word than "stupid".

      Obviously neligence by NASA doesn't excuse an illegal breakin. The point everyone's trying to make is that the illegality of the breakin doesn't excuse NASA's negligence.

    9. Re:Say it with me again folks... by Jedi+Alec · · Score: 1

      If you're a script kiddie who's keen on a *.gov address for your IRC bot, keep that in mind.

      You know, I'm not a script kiddie and I tend to be on the defending side when it comes to dealing with obnoxious things on IRC, but if you're going to flood a channel you might as well use a bunch of bots sporting fbi.gov addresses...

      --

      People replying to my sig annoy me. That's why I change it all the time.
    10. Re:Say it with me again folks... by Anonymous Coward · · Score: 0

      What? Vlad the Impaler certainly is from Romania, but he got his name from primarily impaling the Turks trying to invade Wallachia (a part of Romania, historically, Romania is divided into 4 counties: Transylvania/Erdély, Wallachia, Moldavia and Bucovina), not random thieves.

  29. Comment removed by account_deleted · · Score: 1

    Comment removed based on user account deletion

  30. Re:its hardly Hackling when the PW is merely 'joe' by Anonymous Coward · · Score: 0

    > Universally all poorly skilled with high tech in my opinion.

    Apologies to Ron White, but could you please tell me how that is true if they are fairly consistently able to launch a manned vehicle into outer-fucking-space? And land it back on Earth, too? I hear about NASA's supposed incompetence from sideliners like you all the time. Explain how they still manage to launch shuttles and Mars missions.

    Do you really think implementing a good password policy requires the same level of skill as hurling a hundred tons into the air on the back of a massive controlled explosion?

    Maybe the real engineers and scientists have more important things to worry about. Maybe a real software engineer needs to make secure authentication/authorization easy enough so that end users will actually care to use it properly. Now, there's a problem that requires real skill, but you're obviously just going to sit back and laugh at your flawed perception of their incompetence instead of designing a solution.

    Rocket scientists should only have to worry about rocket science, and their efforts will tend to lean towards rockets, not passwords. While you sit around trying to secure your Gentoo box with the latest ebuild in the portage snapshot that enables WHIRLPOOL password hashing, there are people at NASA thinking about how to defend Earth from asteroid impacts. The IT department should worry about their user authentication methods, not them.

    Maybe NASA needs a new IT department, but I think we can keep the rest of the departments for now.

  31. Paraphrased for Joe Six Pack by Alchemar · · Score: 2, Insightful

    Your Honor:

    This kid broke into my house and stole a six pack of beer, but now I don't feel safe in my house anymore, so for actual damages I am including the cost of a house in a lower crime area with private security guards. The kid's dad originally bought the beer so I didn't include the cost of the beer in the total.

  32. Red Nets by Amazing+Quantum+Man · · Score: 1

    Yep, having set up a red net, the very FIRST thing you do is pull the plug on the internet.

    --
    Fascism starts when the efficiency of the government becomes more important than the rights of the people.
    1. Re:Red Nets by jafac · · Score: 1

      Well, there's also the issue of the people who USE the system, not being properly trained on Information Protection. Quite often they'll raise a big stink about "secret" information, that's really just "proprietary" to a contractor (FOUO). Such information is under administrative control, and when it's compromised, the contractors will scream holy hell, because that's their trade secrets. But it's often mixed in carelessly with other data that's not FOUO, and it's often hosted on systems that are not designed to be all that secure.

      However, there's a recent DoD NOTAM that says all these internet-facing machines are going to have to get PKI, (ie. smartcard login required) - so, the hackers' jobs are going to get a lot more difficult. In about 20 years when these systems can all be upgraded. :)

      --

      These are my friends, See how they glisten. See this one shine, how he smiles in the light.
  33. The government that couldn't build a database by titusdwight · · Score: 1

    The Department of Homeland Security has spent millions (some reports have it as high as 100 million) to build a database that will share terror information. So far they have nothing that even works in a Beta state much less a working program. And we're supposed to be shocked that these folks can be hacked. I read an article about it on http://www.adamswickle.com/

  34. shameless WKRP spoof by Anonymous Coward · · Score: 0

    I swear, I thought pigeons could re-enter....

  35. Manually communicate? by yamamushi · · Score: 1

    Can someone please explain to me how they would manually communicate with a spacecraft, as opposed to using a computer system? What is the difference?

    --
    - Aetheral Research -
  36. Project Gutenberg by Anonymous Coward · · Score: 5, Informative
    1. Re:Project Gutenberg by houghi · · Score: 1

      Mode parent up.

      --
      Don't fight for your country, if your country does not fight for you.
  37. Pfffffffft by lewp · · Score: 1
    It seems everyone else has been busy hacking into government systems while I've been wasting my time playing Warcraft.

    The joke's on them. They're going to jail, and you've got all the epics!

    --
    Game... blouses.
  38. "New"s by Yirimyah · · Score: 0, Redundant

    I saw this in the mainstream media about 4-5 days ago. Frankly, I assumed that this article refered to a different person. WD, guys.

  39. There has been crime commited on both sides. by A+beautiful+mind · · Score: 3, Interesting

    The romanian kid is obviously a script kiddie and obviously he deserves some kind of punishment.

    Another crime is commited here though, which is denying this kid a fair trial.

    The previous case with the UK script kiddie was indication enough that things are terribly wrong. The FBI is banking on the general public's unawareness on computers. That Gary guy accessed some US govt. server with a default windows password or something like that, was it? Yeah fitting punishment of life in prison NOT. The FBI throws around ridicioulus numbers as to justify the harsher penalties, but the truth is, the guy is responsible for very little damage, even though the system had to be reinstalled etc, BECAUSE the system was so insecure in the first place that it should have been replaced in the first place! The wast majority of the costs are the due to their own stupidity. The equivalent case would be a car crashing into a skyscraper and the skyscraper collapsing. Yeah, sure the driver is at fault for driving badly, but he's no way responsible for the collapse of the skyscraper in any sense except direct physical!

    The amount of damages is seriously overinflated aswell, others have pointed to Bruce Schneier about it. You can't claim millions of dollars of damages when "you" (the FBI) went around and handled the whole thing the wrong way! Yeah, I might expect a citizen not to have a clue about computers and buy these stories, but the FBI has a responsibility not to talk out of its ass.

    Similarly, in this new case, damages are overinflated and, yeah the kid broke into the system, but the one who caused the damages which caused problems at NASA is the idiotic MORON who designed the system in the first place. These stupid hacker stories are designer/maintainer problems and the FBI should damn well recognize this, because they have the technical expertise in order to do so.

    But they are not doing this. In light of this I'm a pretty serious proponent in urging the non-US countries of the world of suspending ALL extradiction treaties (which should have happened right after Guantanamo rights abuses went public) with the USA until we can be sure that justice is served, not some scaremongering directed at the domestic public of the USA.

    It has to be mentioned that I'm pretty pissed about it, since it sort of hits home. Arad, where the guy is from is a historical hungarian town which now belongs to Romania. There is a good possibility that this guy has hungarian origins and as a hungarian I'm
    a.) scared about the bullying the USA comes up with
    b.) even if the guy extradited is an obvious moron. I would think he'd deserve something in the amount of 2 years probation judging by the cases I'm familiar with, not extradition to a foreign country and dumped in a pound-my-ass prison for life. The USA prison conditions are despicable, but that's another story.

    --
    It takes a man to suffer ignorance and smile
    Be yourself no matter what they say
    1. Re:There has been crime commited on both sides. by Anonymous Coward · · Score: 0

      just a small note for those that believe everything they read: Arad is not a hungarian town and never was. That geographical area was briefly occupied by the Austro-Hungarian empire but the hungarian population in Arad is probably arround the 7% average applicable to Romania.

    2. Re:There has been crime commited on both sides. by b374 · · Score: 0
      Arad, where the guy is from is a historical hungarian town which now belongs to Romania.

      Get your geography and history straight before posting such information. Straight from Wikipedia:

      The municipality of Arad is home to 183,939 inhabitants, the ethnic breakdown of the city is as follows: * Romanian: 142,968 (82.72%) * Hungarian: 22,503 (13.02%) * [...] Arad was mentioned in documents for the first time in the 11th century. The Mongol invasion of the Kingdom of Hungary in 1241 showed that defensive fortifications were needed and in the second half of the 13th century stone fortresses at Soimos, Siria and Dezna were built. The Ottoman Empire conquered the region from Hungary in 1551 and kept it until the Peace of Karlowitz of 1699. After 1699, the city was ruled by the Habsburg Monarchy. According to 1720 data, the population of the city was composed of 177 Romanian families, 162 Serbian and 35 Hungarian.
    3. Re:There has been crime commited on both sides. by wolf369T · · Score: 0

      Yup, I was born there and I lived in Arad in the first 18 years of my life, I'm telling you, it's a Romanian city allright.

    4. Re:There has been crime commited on both sides. by A+beautiful+mind · · Score: 1
      Arad is not a hungarian town and never was. That geographical area was briefly occupied by the Austro-Hungarian empire but the hungarian population in Arad is probably arround the 7% average applicable to Romania.
      I'm getting pretty tired of baseless nationalism. It is pretty despicable the way people are trying to rewrite history when dealing with the consequences of WW1.

      Currently you could say that the 15% hungarian minority in Arad makes it pretty "romanian", and I guess you were right, but you don't have to "romanize" the history. The fact is that after WW1 the border region of Romania/Hungary has seen a lot of forcible migration of romanians to that area to prevent any attemps by the hungarians to stake claims on Transylvania ever again.

      Here is a relevant excerpt from wikipedia:
      As a political entity, Transylvania proper - the lands beyonds the Apuseni Mountains - became a part of the Kingdom of Hungary in the 11th century. It then successively became an autonomous principality under Ottoman suzerainty in 1571, a part of the Habsburg Monarchy in 1711 (Austria-Hungary after 1867), and a part of the Kingdom of Romania after World War I
      Arad county (in which Arad the city is in), being part of Transylvania, is one of the counties bordering today's Hungary.

      I pretty much don't care how you justify that the ownership of Transylvania, which makes up around 1/3rd of current Romania, was aquired in the WW1 peacetalks* through a territory grabbing binge, as long as you stick to the facts. What would be the problem saying that "yeah, this land was not originally romanian, but we got it for being on the right side in WW1"? The USA doesn't try to justify aquiring Alaska from the Russians with any ideology and neither should you in the case of Transylvania.

      *Although I'd like to add that lots of troubles would have been spared if the conclusion of WW1 wouldn't have been forcible dictatum. The result of the dictatum was Hitler's rise to power in Germany, the splitting of the Czech Republic and Slovakia, the ethnic problems and wars due to that and fragmenting of Yugoslavia, and the ethnic problems surrounding Hungary with 5 million Hungarians next to it's borders.
      --
      It takes a man to suffer ignorance and smile
      Be yourself no matter what they say
    5. Re:There has been crime commited on both sides. by A+beautiful+mind · · Score: 1

      Didn't I say historical? Reading comprehension, zero. Check my reply to the other uninformed post.

      --
      It takes a man to suffer ignorance and smile
      Be yourself no matter what they say
    6. Re:There has been crime commited on both sides. by hritcu · · Score: 1
      Arad, where the guy is from is a historical hungarian town which now belongs to Romania.
      Well, if everybody was to judge like this then the whole Pannonia is a historical Romanian province, which now belongs to Hungary (map from 82BC). Just be more careful with affirmations like this.

      There is a good possibility that this guy has hungarian origins
      Just by looking at his name (Faur) you can tell this guy is Romanian.

      Finally, he is a Romanian citizen and it's very unlikely that he will be extradited. Yes, Romania does have a extradition convention with the US from 1924, which become valid by the Constitution change in 2003. However, the list of crimes that this convention covers does not include breaking into computer systems (it was signed in 1924 so quite normal).
      --
      If you don't fail at least 90 percent of the time, you're not aiming high enough. (Alan Kay)
    7. Re:There has been crime commited on both sides. by Calinous · · Score: 1

      The Hungary as of today has as little in common to the Hungary of the 11th century as the Roman empire have with the Italy. As all of Transilvania was conquered at some time by the Romans, then Transilvania should belong to Italy. It is true that there is an important hungarian minority in Transilvania, but there is an even more important majority of romanians in Transilvania. And by the way, some of the Transilvania was grabbed back by the Hungary in the 2nd World War. If the second world war would have played the other way, Arad would have had a minority of some 60% romanians.

    8. Re:There has been crime commited on both sides. by Calinous · · Score: 1

      Yes, it sorts of hits home... Cluj-Napoca, where I am (just 200km from Arad) is an historical Roman city, which now belongs to Romania, but in the past was invaded by Hungary. Anyway, judging by the name of the guy, he might be of gipsy origin - his name, Faur, means blacksmith (it is possible to have had a hungarian name and changed it directly in romanian - things like this happens)

    9. Re:There has been crime commited on both sides. by radu.stanca · · Score: 1
      It has to be mentioned that I'm pretty pissed about it, since it sort of hits home. Arad, where the guy is from is a historical hungarian town which now belongs to Romania. There is a good possibility that this guy has hungarian origins and as a hungarian...
      Historical hungarian town??? Arad was always a romanian town, even when Transilvania was under habsburg monarchy, where did you came up with that fact?
    10. Re:There has been crime commited on both sides. by Anonymous Coward · · Score: 0
      Arad county (in which Arad the city is in), being part of Transylvania, is one of the counties bordering today's Hungary.

      No, Arad is not in Transylvania. 2/3 of the town is in the historical province of Partium, and 1/3 (the neighbourhoods south of Mures) is in the province of Banat.

      But most incompetent Romanians use Transylvania as a generic terms for all romanian territories that were once part of Hungary, and this "knowledge" trickles into Wikipedia -- that article is hopelessly inaccurate in many ways; the rule of thumb is to never use Wikipedia for any non main-stream stuff; it may be a great reference for Harry Potter stuff, it's not so good for history.

      And no, faur is not a gypsy word. It's of latin origin and the exact equivalent of the french surnames Lefevre, Lefebvre, etc.

    11. Re:There has been crime commited on both sides. by Anonymous Coward · · Score: 0

      Arad has surprisingly good Google Maps coverage

    12. Re:There has been crime commited on both sides. by scorilo · · Score: 1

      I really think this is bunch of NASA BS. When a US Marine killed a Romanian pop star in Bucharest, the US Embassy took parachuted him back to US where he was subjected to a mock trial, instead of allowing a trial in Romania.

      AFAIC, the script kiddie should not be extradited and Romania should show some cojones, but they probably won't. He shouldn't even have been charged in Ro. The one who should be charged is the person responsible for security at NASA.

      "Arad, where the guy is from is a historical hungarian town which now belongs to Romania"
      if we are to believe the wikipedia Arad entry
      1. in 1720 "the population of the city was composed of 177 Romanian families, 162 Serbian and 35 Hungarian"
      2. in 1910 "the town had 63166 inhabitants: 46085 (73%) Hungarians, 10279 (16,2%) Romanians, 4365 (7%) Germans"
      This leads me to believe that Hungary stole Arad from Romania and killed most Romanians over time; Arad then came back to Romania along with the rest of Transilvania.

      --
      "One of the symptoms of an approaching nervous breakdown is the belief that ones work is terribly important." -BRussell
  40. Chuckle, chuckle... by DaedalusHKX · · Score: 3, Funny

    I've worked both private and public research before, the reason that you can keep your network private, is because most privateers can simply buy government sponsored research that suits them, have it paid for by the government, and later have the results they bought "classified" as "top secret" or "of national security interest".

    I've been there, i've seen that, done that, got tshirt and beer mug... They're just crucifying kids, because inquisitive minds, for better or worse, when coupled with direct action (they didn't wait for 20 years for anyone's approval) scare the crap out of the dictatorial regimes of the world, our dear old US included.

    "In a democracy, you vote first, and take orders later, in a dictatorship, they spare you the trouble of choosing your tyrants and th wasted energy used up voting." ~unknown

    --
    " What luck for rulers that men do not think" - Adolf Hitler
  41. Common sense by c-reus · · Score: 2, Insightful

    It's simple -- you just don't hack government computers. Way too much trouble when you get caught for that. Everybody knows that.

    At least everybody *should* take note of that.

    1. Re:Common sense by mandelbr0t · · Score: 1

      I'm sure everybody here has seen the ST:TNG episode where walking on the grass carried the death penalty. AFAIK, the point of law is that the punishment fits the crime. If I write a Proof-of-concept of a vulnerability in a system with the intent of showing that it's not worth buying as the manufacturer has failed to provide a product of useable quality, and there is no clear law indicating that such writing is illegal, then I shouldn't be punished for writing it. I also shouldn't be punished for distributing it; that's my goal as a writer. There are notable exceptions; distributing hate literature is illegal in Canada, USA and all of Western Europe. (I'm sure the scope is larger)

      At this point in time, I'd say that there's a huge area of poorly defined behaviours that simply can't be made illegal with the current laws. You say "free commerce" and I say "spam". You say "cracking", I say "I'm just making consumers aware." You say "borrowing", I say "plagiarism" (or "break-and-enter"). Until there's clear jurisdiction and clearly defined illegal 'net-behaviours', and a clear chain of evidence proving said net-behaviours, it's just a jungle. I certainly don't condone distributing proof-of-concept virii, but there's certainly a philosophical justification for it.

      I also don't want the USA to be the only police. I don't know what legal and political things have to happen to make the 'net less of a jungle, but I know they won't happen tomorrow. I also know that everything is a he-said, she-said situation right now, and the people who claim to be making laws for "the greater good" are responsible for a great deal of unwarrented discrimination to show just how powerful they are.

      mandelbr0t

      --
      "Please describe the scientific nature of the 'whammy'" - Agent Scully
  42. Get a spin doctor by MMaestro · · Score: 1
    Seriously. Its really not THAT hard to BS cases when you're talking about literally thousands of different factors. Just go down the usual list.

    1. Calling in and paying the IT guys. Assuming its not covered by insurance/protection plan/special contract, you're looking at thousands of dollars worth of fees right there. NASA doesn't exactly run on closet full of servers converted from unused PCs that can be wiped on a whim just because a hacker got in.

    2. Downtime. Whats that? Your staff of hundreds/thousands of researchers across the globe can't do their work because the system is down? Too bad! You still have to pay them even though they're sitting on their asses clicking the refresh button on their browser so that easily costs a couple hundred thousand there.

    3. The inevitable "WTF NASA?! Upgrade your computer systems so this will never happen again even though it'll cost millions and take months to complete!" outcry. Just look at the reaction from /. to get an idea of how loud it'll be once the mainstream media picks up on this.

  43. ITS A TRAP! by Anonymous Coward · · Score: 0

    Now, there are some mission associated systems that are accessible from the internet which are storing spacecraft data. Here's one that has datasets from the acceleration system on the International Space Station:

    http://pims.grc.nasa.gov/html/ISSAccelerationArchi ve.html [nasa.gov]


    Don't go there, its a trap to catch the hackers!1!one!eleven!
  44. Let me get this straight... by alexhard · · Score: 1

    systems had to be rebuilt and scientists and engineers had to manually communicate with spacecraft, resulting in $1.36 million in losses for NASA and nearly $100,000 in losses for the Energy Department and the Navy, prosecutors said. They first build insecure systems...then complain when they have to spend money fixing them? wtf? They can't actually be that stupid, can they?
    --
    Infinite time means everything that can happen, will. You being you is absolutely incidental. You do not exist.
  45. Mod parent up by Anonymous Coward · · Score: 0

    Very insightful

  46. But wait a minute.. by Roy+van+Rijn · · Score: 1

    Because NASA didn't secure their computer properly and have to do it again (costing some money) they are going to have some teenager take the blame..!?

    The whole internet is based on getting information from systems, and if NASA is providing this information its their fault... :P

  47. Good! by crhylove · · Score: 1

    I think most of the scientific data available from our space program should be immediately available to the public anyway! Now, is this just read access, or is somebody able to ruin the data?

    rhY

    --
    I hold very few opinions. I hold information based on observation and fact. If you wish to disagree, please use facts.
  48. Show me the risk assessment by Anonymous Coward · · Score: 0

    ALL IT managers sign off risk assessments. In this day and age, people know what they must do to protect assets , including viable backups. Otherwise you have contributory negligence, and the manager in charge should be fired.

    Chances are, that the security configuration database is crap, and there are cowboys plugging in stuff left right and centre, and doing their stuff minus change control. Someone buckled, and gave out the admin password, with a free pass to the server room, to some hotshot who can do things fast (minus certain checks and balances), proves he/she is a 'doer'.

    This indicates a systemic failure in security processes, and some 'yes' toadies that undermine security. If the culprits supeona the right information, one expects the embarrasment will case whatever suit to fold straightaway, especially as it may have long been compromised well before something else was noticed.

  49. Lets say they did say how to fix by Anonymous Coward · · Score: 0

    If that wasn't all that was done, would this person be responsible for leaving the hole open? Because it would be spun that that was what the hacker was doing: giving them false information.

    Wouldn't it be better to leave a message "your security sucks dude" and let them look for the ways in which is was hacked?

    Alternatively, they could pay the hacker some dosh to tell them how their security was hacked. Unlikely to be taken up on given the US's attitude: it is likely that they'll use that either to get you in to the country (and thence to Gitmo) or prove that you are blackmailing them.

    From the hackers point of view, there is no upside.

    From the hacked there is a small upside but again, given their identity, it won't be used positively.

  50. He is NOT going to be extradited by hritcu · · Score: 1

    He is a Romanian citizen and it's very unlikely that he will be extradited. Romania does have a extradition convention with the US from 1924, which become valid by the Constitution change in 2003 (before that no Romanian citizen could have been extradited by the Constitution). However, the list of crimes that this convention covers does not include breaking into computer systems (it was signed in 1924 so it's quite normal). And this would not be the first time when these kind of things happen, there were other cases when the US authorities needed to give up. -- Link to an article about this in Romanian

    If he is found guilty in Romania he risks several years in jail. Romanian laws are quite mild, in particular against this types of violations (compared to the absurd ones in the US). He didn't kill anybody, so 54 years in jail would be more than the maximum you can get in Romania for murder (25 years).

    --
    If you don't fail at least 90 percent of the time, you're not aiming high enough. (Alan Kay)
  51. Damn by xrak · · Score: 1

    Damn, I didn't know that Gary got extradited in the end, I've been following the case since '02/'03 -- but completely forgot about it over the past couple of months. eek!

  52. Flawed logic by evanfrey · · Score: 1

    "Because of the break-ins, systems had to be rebuilt and scientists and engineers had to manually communicate with spacecraft, resulting in $1.36 million in losses for NASA and nearly $100,000 in losses for the Energy Department and the Navy, prosecutors said."

    This is B.S logic. If I don't have proper locks on my house and someone breaks in, do I blame the thief for my having to purchase locks for my house post break-in.

    If the systems were secured to begin with, this would not be an issue.

    --
    :(){ :|:& };:
  53. Do you always greet visitors like that? by Anonymous Coward · · Score: 0

    It is also likely to see you in jail for murder 1.

    Unless, knowing you're a nut, I take an assault rifle in with me and kill you first. After that, you have NO possessions. I may not get to keep them either, but only because other people with guns will take them off me.

    1. Re:Do you always greet visitors like that? by Anonymous Coward · · Score: 0
      It is also likely to see you in jail for murder 1.


      "Murder 1"? Not only are you stupid, but you don't even know the law. He *might* get second degree murder, but anticipating the stupidity of the situation that somebody like you would precipitate he'd probably get manslaughter or left off the hook entirely. This is why I'm all for "no retreat laws"... so that people like you are rightly removed existence, hopefully before procreating.

      In Texas he'd get a medal for cleaning scum like you out of the gene pool. In Indiana (my state) he'd get a slap on the wrist.

      Unless, knowing you're a nut, I take an assault rifle in with me and kill you first. After that, you have NO possessions. I may not get to keep them either, but only because other people with guns will take them off me.


      Right.. I think a .177 pellet rifle is more your speed. Log off daddy's computer, junior.
  54. Re: Arad by calculadoru · · Score: 1

    Hey, cool, flamewar everybody, let's fight WWI + WWII all over again!

    Way to go Slashdot.

    --
    The power of accurate observation is commonly called cynicism by those who have not got it. -- G.B. Shaw
  55. dm by Anonymous Coward · · Score: 0

    Depeche Mode GP!

  56. Re: Arad by A+beautiful+mind · · Score: 1

    I guess I was being careless in underestimating the nationalism. If I would have known that some romanians will completely ignore what my post was about and nitpick on stupid nationalistic details then I'd have just omitted writing down that sentence.

    It's way off topic here and I generally refuse to get involved in petty squabbles. I don't care about nations or countries or borders, but about humans and I would have thought europeans would have gotten tired with the infighting.

    --
    It takes a man to suffer ignorance and smile
    Be yourself no matter what they say
  57. a word or two from captain obvious by louden+obscure · · Score: 1

    it's not rocket science...

    --
    Serenity now, insanity later.
  58. THIS WAS MY COMPUTER!!! by Anonymous Coward · · Score: 0

    aaaaAHAHAHHAHAHAHAHAH!! I work for NASA and it was my computer that was hacked into! EAT SHIT IN JAIL YOU LITTLE BASTARD! He didnt do anything useful or glamorous. The computer was a rack-mount low-atmosphere (expensive) aircraft computer eventually to be used for radar data processing. One day i came to work and the machine was gone and my PI said that the computer had been hacked and the network security people had come and taken it. We got it back eventually but it put our project behind schedule by a month as the computer had an expensive reciever card plugged into it which i needed to continue development. It must be the same guy im assuming because it happened at the same time and the ip was in eastern europe and i know our network folks and they yack about intrusions n gossip n things and i havnt heard about anything since then. GUESS WHAT ASSHOLE WE TOASTED YOUR GANG-RAPE FATE OVER BEERS AT THE CHIPOTLE IN GREENBELT FRIDAY YA DICKWAD HAHAAHAH!! WHY DONCHA WRITE A HAx0R MANIFESTO ON SOME TOILET PAPER YOU FUCKING CLOWN!! Funny funny FUNNY!! hellOOo anonymous posting! :D

  59. Re:Hacker Crackdown - Snippet from book by ZDRuX · · Score: 1

    The follow is the snipper which the OP mentioned to see how they come up with these ridiciolous ammounts. Its with regards to a stolen document from one of the Telco's, which was later found to be available from any local library.

    -------------
    The E911 Document was also proving a weak reed. It had originally been valued at $79,449. Unlike Shadowhawk's arcane Artificial Intelligence booty, the E911 Document was not software -- it was written in English. Computer-knowledgeable people found this value -- for a twelve-page bureaucratic document -- frankly incredible. In his "Crime and Puzzlement" manifesto for EFF, Barlow commented: "We will probably never know how this figure was reached or by whom, though I like to imagine an appraisal team consisting of Franz Kafka, Joseph Heller, and Thomas Pynchon."

    As it happened, Barlow was unduly pessimistic. The EFF did, in fact, eventually discover exactly how this figure was reached, and by whom -- but only in 1991, long after the Neidorf trial was over.

    Kim Megahee, a Southern Bell security manager, had arrived at the document's value by simply adding up the "costs associated with the production" of the E911 Document. Those "costs" were as follows:

    1. A technical writer had been hired to research and write the E911 Document. 200 hours of work, at $35 an hour, cost : $7,000. A Project Manager had overseen the technical writer. 200 hours, at $31 an hour, made: $6,200.

    2. A week of typing had cost $721 dollars. A week of formatting had cost $721. A week of graphics formatting had cost $742.

    3. Two days of editing cost $367.

    4. A box of order labels cost five dollars.

    5. Preparing a purchase order for the Document, including typing and the obtaining of an authorizing signature from within the BellSouth bureaucracy, cost $129.

    6. Printing cost $313. Mailing the Document to fifty people took fifty hours by a clerk, and cost $858.

    7. Placing the Document in an index took two clerks an hour each, totalling $43.

    Bureaucratic overhead alone, therefore, was alleged to have cost a whopping $17,099. According to Mr. Megahee, the typing of a twelvepage document had taken a full week. Writing it had taken five weeks, including an overseer who apparently did nothing else but watch the author for five weeks. Editing twelve pages had taken two days. Printing and mailing an electronic document (which was already available on the Southern Bell Data Network to any telco employee who needed it), had cost over a thousand dollars.

    But this was just the beginning. There were also the *hardware expenses.* Eight hundred fifty dollars for a VT220 computer monitor. *Thirty-one thousand dollars* for a sophisticated VAXstation II computer. Six thousand dollars for a computer printer. *Twenty-two thousand dollars* for a copy of "Interleaf" software. Two thousand five hundred dollars for VMS software. All this to create the twelve-page Document.

    Plus ten percent of the cost of the software and the hardware, for maintenance. (Actually, the ten percent maintenance costs, though mentioned, had been left off the final $79,449 total, apparently through a merciful oversight).

    --
    The magical number is: 09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
  60. Crossing the line by Douglas+Goodall · · Score: 1

    A while back I was working for a large financial institution as a security consultant. They asked me to prove my abilities by breaking into a well known site and proving I did it. I told then that I knew the owner of a large site and could get permission to try. They abviously weren't satisfied with my approach, and they layed me off and hired a "real hacker". Later they called my wife and told her that they had made a mistake, and sholdn't have gone anywhere near one. In the long run, you make decisions about what you will do and what you won't. If you are a person of character, people do notice. Although I appreared to get the small end of the stick in this deal, my reputation with Fair Isaac remains that I am an honest software engineer who wouldn't cross the line. They had been showing great trust in me for quite some time as I had been hosting their domain and email gateway from the Internet to usenet at my business for over a year. I am really tired of hackers getting jobs with prominent agencies. They are not the cream of the crop, they are the scum on top.

  61. Woah! by bdulac · · Score: 1

    It sounds like it's easier than thought to hack into government agencies if there are so many people being indicted for it.

    --
    Peace is not the absence of trouble but the presence of God.
  62. or deliver them some sushi by Anonymous Coward · · Score: 0

    Or you could dial 1-800-ruskisushi and have it delivered with extra pollonium 210 ontop

  63. I guarantee by comperr · · Score: 1

    I guarantee that no hacker broke into the NASA computers, did anything malicious, or harmful. No hacker was ever indited. Based in literarymagic.com/d/hacker NOT ONE HACKER ever DID ANYTHING WRONG. They all were evil crackers.