Slashdot Mirror
Sophisticated, Targeted Breakins Uncovered
Ichabod writes "Sophisticated computer criminals stole data from Unisys, Booz Allen, L-3 Communications, Hewlett Packard, and Hughes Network Systems. It sounds like they used a combination of social hacking and undetected low-profile malware (reportedly NTOS.exe) to steal and encrypt sensitive data, and compromised Yahoo accounts to store and retrieve it. An international investigation appears imminent. And yes, unfortunately Reuters calls the criminals 'hackers,' further besmirching the once-revered title."
Security is only as good as it's implementation. These articles seem to get the same responses everytime. I would love to see /. act like a think-tank sometime and really come up with some solutions.
..is that they'd use Yahoo! Mail to retrieve the data. Gmail offers more space. Hrm. Poorly researched.
The article is rather light on details. My first thought is to wonder how, after all this time, they finally managed to figure out that their systems were compromised.
My second thought is to wonder if it's even true or if this is just spin-hype for Trend.
My third thought is to objectively note that this is probably not an isolated incident. If this particular incident is this big then, in all likelihood, there are hundreds or even thousands of other compromised systems which haven't been diagnosed.
My fourth thought is "Haha!"
the NPG electrode was replaced with carbon blac
who has'nt hacked a big company yet? that shit is easy as pie..
I don't think you have to worry about the term 'hacker' being besmirched any more. It, like several other terms have entered the mainstream vernacular. If you really care about the terminology that much, invent a new term for what was the original 'hacking'. It is far too late to close the barn door on the hacker misconception.
Out of modpoints but really liked a post? 1BDkF6TtmmeZ3yqXbz9yhdYVqRYnwFoXDj
and "A Department of Transportation spokeswoman said the agency couldn't find any indication of a security breach." awesome!
See, hackers get a bad rap. These folks were kind enough to encrypt the sensitive data they found, so that no outside parties could get a look at personal records.
contact the editors about it politely.
"Thanks for all the money you paid to us. We've used it to buy off ISO among other things" -Microsoft
At least in the old days, we used to call it "social engineering" and hacking meant any kind of programming outside the obvious. That included getting machines to fork over security credentials, but that meaning was a subset of the broader term, which meant both a cheesy quick fix ("what a hack!") and a dancelike circumnavigation of inherent limitations to produce a semi-elegant but sturdy fix ("kernel hackers drink coffee black").
technical writing / development
The Security Fix Blog
Best Slashdot Co
Why don't these folk seriously consider locked down implementations of Linux ? It's security model is so much better that Winbloz.
I know the pro windows crowd will jump up and down but I hope they will hear me out.
1. Windows is the most popular OS on the planet. Just for shear number of systems it is most hacked.
2. Windows is harder to lock down than most other OSs. That is often because software expects to be running with admin rights.
I am trying to figure out how no one noticed these programs trying to make connections to the outside world. My guess is that they where not expecting a Trojan. Heck we got hit by a worm at my office. It didn't get through our firewall at all. Somebody brought a notebook in and connected it to our network.
It only infected three machines but it was a good cheap lesson for us.
See my blog http://ilovecookes.blogspot.com/ for light hearted technical information.
Using their evil databases to identify trends and patterns.
"God fights on the side with the best artillery." - Napoleon, Marshal of France - speaking truth to power
Put job ads in front of disgruntled employees and ask them to create accounts to apply -- then watch as they merrily type in their favorite usernames/passwords into your cracker system. Easy as pie...
21st-Century-Citizen
Wouldn't it be nice if we could get more data on these security breeches? The articles are so lite weight. What technique? What data? I think the more we learn about these problems, the more bullet proof we can make our systems. We are at a disadvantage in that the criminal understands the vulnerability and can exploit it over and over again.
Sammy at IT/Personafile
Nowadays I do my banking at WaMu, get a daily paper from WaPo... What next, I'll be reading SlaDo?
"What is most worrying is that this particular sample of malware wasn't recognized by existing antivirus software. It was able to slip through enterprise defenses," said Yankee Group security analyst Andrew Jaquith, who learned of the breach from Morris. "This is a serious threat. It shows how sophisticated hackers have become," Haro said.
This is not sophistication.
1. Take any virus/trojan that is recognized by antivirus software.
2. Put it through an executable compression package to make its code vary from what it used to be on the hard drive or in memory.
3. Viola! Your malware is now stealthed from any antivirus program.
Either that was rather simple or I am a seriously dangerous hacker.
Big apple, new Yorik, undig it, something's unrotting in Edenmark.
Main Entry: hacker
Pronunciation: 'ha-k&r
Function: noun
1 : one that hacks
2 : a person who is inexperienced or unskilled at a particular activity
3 : an expert at programming and solving problems with a computer
4 : a person who illegally gains access to and sometimes tampers with information in a computer system
I am pretty damn sure that the thieves in question meet both #3 and #4, hence they are 'hackers'. I probably would not waste time bothering Reuters to complaining that not all hackers are evil. They used the word correctly.
Yahoo offers "unlimited" mail storage. Maybe not with new accounts, but several of mine do.
God spoke to me.
See, it's a win-win situation - the criminals did everything smoothly without leaving a trace, and at DoT it looks like nothing happened!
Slashdot: Failed Car Analogies. Amateur Lawyering. Anecdote Battles.
This battle was lost ages ago, yes I actually used to care about it, too. Why? I have no idea. It's clear from context what the word means. Context includes who you are talking to, what you're talking about, etc. There are many examples of words with this issue in English, especially with words that relate to computing and technology. Who cares if the average guy thinks hacker means someone who breaks into computers? To him, that's what it means, and he can talk to other people and they'll understand him. Hell, I'd understand him. Look people, it's a word, a sequence of lines, a certain sound that vocal chords produce, whatever. Why do you care so much about these things?
the NPG electrode was replaced with carbon blac
The only people who ever "revered" it are the only one's who care that there's a difference anyway. What William Gibson dreamworld are you living in where average people used to spend their off-hours talking about how much they revere "hackers"?
I didn't think it could get more sophisticated than the classic Breakin 2.0: Electric Boogaloo. Bravo, hackers!
What's with the whining about the word "hacker," anyway? Talk about beating a dead horse.
Rob
Good one.
But from reading TFA, you might think "*yawn*, some big companies got hacked, who cares."
I don't know about DoT, but a lot of government services are being run by Booz Allen and other contractors. I called up some Federal agency hotline a while back and got a greeting like "Welcome to the US Dept. of XYZ hotline, run by Booz Allen. Please call back [during a time of day that is impossibly inconvenient in your time zone]." Think of them like Halliburton, only in Washington D.C. instead of Iraq.
If any outsourced Federal agencies handling citizen's personal information got hit, this problem *could* be more relevant to the average joe than they would think from reading TFA.
But it will be hard to find out, because those agencies' spokespersons will only be able to say something stupid, like: "the agency couldn't find any indication of a security breach".
Isn't it a bit like "spam"? Someone comes along and calls junk mail spam and the next thing you know everyone uses the word to denote junk e-mail rather than the meat product. And Hormel tried (and still does in some ways) to get people off the term? How many of you really care about your (non)use of the word "spam"?
And so it is with "hacker". Public doesn't give a shit. You say hacker and they know "bad computer guy". Just like "spam" is "bad e-mail".
And like I'd say to Hormel, just give it up. The fight is long since lost.
So it goes.
I know the pro windows crowd will jump up and down but I hope they will hear me out.
Uh....the huge pro windows crowd on slashdot?
I have the solution to all of our security concerns.
There are two types of people in the world:
- those who care about computers
- those who don't
Chances are the first group are experts (of varying degrees). The second group are most likely the "vulnerable" ones (in terms of social engineering).
My solution -- never let group #2 touch a computer again. Ever.
FLR
The word `Gay' still means happy. It just has another meaning, too.
At least in the olden (DOS) days, when McAfee came upon a pklite'd executable, it would unpack and scan the unpacked executable. I would hope that current antivirus programs would do the same.
Even if the virus scanner scans for pklite'd executables, you can always write your own unique executable compressor or modify an existing one until your executable is non-detectable.
Virus scanners are like front door locks. Any serious cat burglar is just going to grappling hook to the roof and cut a hole through strait into the attic bypassing the door lock entirely.
Big apple, new Yorik, undig it, something's unrotting in Edenmark.
hahaahahahahahahahaha
hahahahahahahahaaa
I believe the sophistication is question is the combination of the targets, the undetectible malware, and the delivery method. Not the malware itself.
So the sophistication was the delivery method -- email! Now my Grandma is a hacker too!
Big apple, new Yorik, undig it, something's unrotting in Edenmark.
The solution is to establish a pattern of what account at what workstation accesses what information from what servers at what times.
Then any deviation from that pattern is flagged and investigated.
Why is Alice in Accounts Receivable searching the HR server?
Why is Alice logged into Bob's machine in HR?
Why is Alice logging in at 1am?
I have watched both BitDefender and Kaspersky open those executable compression packages. I don't have BitDefender in front of me, but during scans it logs the quantity of "packed" files that it has unpacked. It seems reasonable to assume that most of the rest of the AV companies do the same.
It's arguable that the AV products are always able to open up every variation of these things, but it's incorrect to say that simply enclosing your malware inside one automatically makes it undetectable.
hacker : criminal :: freedomfighter : __________
Privacy is terrorism.
> He's the only source of this deliberate dodge
was supposed to read:
> He's NOT the only source of this deliberate dodge
Clearly I'm having some language problems today, too.
Oh sure, it sounds like a good idea... but I bet you'd get tired of people from group #2 asking you print out copies of facebook for them.
I agree that one key aspect to Security is its implementation. Unfortunately, in the U.S. the normal education program either ignores or (at best) gives a rather limited education in the matter of Security. The reason for this is because our legal system actively (and strongly) discourages research into Security. In some cases, classes have been explicitly shut down by corporations (and they are purported to not only have audited such classes, but threatened not to employ any student which has an offending class on their transcript).
The end result is what we have today. Nearly all of C.S. graduates are at best underprepared to properly understand Security, let alone implement secure solutions. I daresay 90% (at least) of todays students are what I would call "button-pushers" in this area. They take canned things, put them together, and call them "secure" without really understanding what they are doing, or how it works. Or what the attack vectors are or how to improve things.
Conversely, the people who are really exploring security are the ones who do it on their own, and so-called "hacking" is one key aspect of their education.
The bottom-line is that we have a system which generates better blackhats than whitehats.
This is unlikely to change in the near future, if at all. Be prepared to see more of these exploits. Corporate IT will be woefully unsuited to deal with it unless, and until, people are better educated in this matter.
Quality on par with digg? I don't even know how to respond. Maybe you wanted to Quantity on par with digg. The moderation and answers here are far more insightful and not nearly as biased as the ones on digg.
What is not insightful is pointing out that modern virus scanners can unpack some forms of executable compression. I promise, there are easily made custom forms of compression they are not familiar with unpacking, which is the whole point -- only takes one hole to sink the ship and only takes a person with a blunt instrument to make a hole.
Big apple, new Yorik, undig it, something's unrotting in Edenmark.
You're right, there won't be any serious consequences. There usually aren't.
But the only problem with my proposal is that it takes THOUGHT and PLANNING. It cannot be retrofitted to an existing network. (unless you're really lucky)
The networks have to be constructed so that each point can be monitored. Instead, most networks grow "organically". As connections are needed, they're added. Without any plan. Just get the connections in now.
The same with servers. The last place I worked had a server in the DMZ cabled directly to another server behind the firewall. They did that because it was "easier" for them to handle that way.
Monitoring and security aren't considered when building a network. And until they are, social engineering attacks such as this will continue to happen. And continue to succeed.
check out steven levy's 1984 book 'hackers'
"Internet security firms began to release patches to fight the malicious software on Monday night."
"Hey, dammit, don't close that barn door now, we're trying to put the horses away!"
Welcome to the Panopticon. Used to be a prison, now it's your home.
Revisionist history a little?
There is no revision of history when someone points out hackers ARE NOT criminals nor that they intentionally damage systems. The first tyme "hacker" was used derogatorily was in the 1980s, before then Hacker meant "simply referred to a person who was capable of creating hacks, or elegant, unusual, and unexpected uses of technology."
The concept of hacking entered the computer culture at the Massachusetts Institute of Technology in the 1960s...
But there are standards for success as a hacker, just as grades form a standard for success as a tool. The true hacker can't just sit around all night; he must pursue some hobby with dedication and flair. It can be telephones, or railroads (model, real, or both), or science fiction fandom, or ham radio, or broadcast radio. It can be more than one of these. Or it can be computers.
Steven Levy has written a good book on what and who hackers are, Hackers: Heroes of the Computer Revolution
FalconShould there be a Law?
slashdot != think-tank
slashdot == drunk-tank
Flexible bare-metal recovery for Linux/UNIX
Yes, but therein lies the problem I've always seen with the term that the tech community would prefer people use, i.e. that "cracker" already has a slang definition, and most people in the world will have reactions ranging from confusion to effrontery at the notion that their computer system was compromised by a bunch of rednecks.
I don't think there's much of a chance people confuse someone who's proficient with something like a computer and a white Southerner or redneck. Hack also has another meaning, a hack used to also mean a journalist, reporter, or writer.
FalconShould there be a Law?
1. Windows is the most popular OS on the planet. Just for shear number of systems it is most hacked.
Yea, I went into a Mac store, not an Apple store, and asked about antivirus and firewall programs and the worker I talked to said Macs don't get infected and don't get broken into. I tried to tell him the only reason is because the people who do such things target OSes with big market shares and that when Macs get big enough a share they will be targetted. He just kept saying OSX is immune.
While I like Macs and believe they are more secure than Windows for the average user, unlike what this guy was saying, Macs will be cracked
FalconShould there be a Law?
some stupid pussy complaining about speeeling
FTFA:
In this case, we are safe assuming "personal computers" == Windoze. Big dumb companies put that crap on people's deskstop.
The lesson learned again is that corporate security is only as strong as it's weakest link. If you let Windoze retrieve your data you have no secrets.
Friends don't help friends install M$ junk.
I want my personal box to be as easy and hassle free as possible so I run windows and only windows.
Sounds like you want a Mac.
Say what you want about bloatware, but it's nice to buy a piece of hardware and have it just work.
I've bought 4 new PCs for myself running some version of Windows, two were from Gateway, one from HP, and the other one is from Microway. The one from Microway is the only one of the four that I did not have trouble with either the hardware or the OS, which is NT4.0. One of the Gateways and the HP had to have their motherboards replaced before they were a year old as well the hdd for each. The LCD on the other Gateway cracked a few mnonths after getting it. Also with both the first Gateway and the HP I had to reinstall Windows a few tymes.
I have also bought two USED Macs. The first one was an SE30 I bought in 1992, it lasted until the floppy drive died in 2000. That was the first hardware problem I had with it, and I didn't have any trouble with the OS. The second is a PowerMac 7300/200 I got a few months later, in 2000. It lasted until January 2006 when it didn't power up. Again that was the first hardware problem and it didn't have software problems either.
It's nice to install a program without having to recompile the kernel.
You don't need to recompile the OS on Macs either.
It's nice to have a box I can actually buy decent games for.
Now that's one thing lacking on Macs, there are a lot of games for Macs but not nearly as many as for Windows.
FalconShould there be a Law?
And yes, unfortunately Reuters calls the criminals 'hackers,' further besmirching the once-revered title."
You mean after they've been doing this for 20 years, there's still somebody left who cares about it?
Everyone knows Windows users aren't that sensible!
Yeap! A relatively long haired one. I even like The WELL.
FalconShould there be a Law?
Because it was our word first
If you mean first for technolgy and computers, yes, but "hack" had been used for a long tyme to mean someone else. In the 1920s, I believe, "hack" meant someone who was a journalist, reporter, or writer. I'm not sure but I think "hack" was used in the 1941 movie "Citizen Kane" , meaning reporter.
FalconShould there be a Law?
I don't understand why Reuters didn't call them Muslims. It seems better to further besmirch an even more besmirched title.
<bart
The problem with all form of security is that user will want it to very secure at first but after few times either locked out or something they will let down their guard and allow their system to be open for the sake of convenience or other reasons. Only near draconian measures or absolute control of all systems and network activities will stop this. Bad employees or even management will exist everywhere, look at the FBI with Robert Hansen, so trying stopping "evil" employee at lesser organization will be hard.
My worst offenders are the clueless users that, against your written rules and recommendations, uses simple passwords or open files in emails that infect their system and I get to see it as junk on my network.
When the obfuscation occurred in the '80s, nobody fought or argued against it hard enough.
Then the movie! Blame it all on Angeline Jolie!
Bad guys victorious by default!
The only thing new in this world is the history that you don't know.[Harry Truman]
I know a bit about Dale Drew, if you google him you will see he is an ex law-enforcement snitch with very little real security or technical expertise. From my experience with Dale he is at best incompetent. I hope he loses his job for his shoddy security work (incidentally L-3 is also a spam sewer as well.)
from today:
1.) IT: Sophisticated, Targeted Breakins Uncovered
2.) Bionic Hand Makes it to Market
3.) First Robotic Drone Squadron Deployed
Poor skilled crhackers will pwn a bionic hand. Then the bionic hand will hack them into getting root on the UAV squadron. Then $300 will be demanded for returning control of the AGM-114 and Paveway II loaded UAVs.
If you need text styles to communicate then you don't have a message.
n/t
And you know what they say when you assume...
Read the article more carefully next time.
I feel a quiz coming on.
Q. Is it *game over* when the bad guy can execute code on your computer?
A. Duh
B. No because I have a virus checker and its supposed to keep me safe from everything.
Q. Do virus scanners provide a false sense of security?
A. Duh
B. No, they provide a real service and keep my computer safe from getting viruses... How I let that virus on to my computer in the first place doesn't matter because I have a virus scanner.
Q. Once a computer has been rooted can anyone with a straight face make any reasonable determination of what has been accessed or stolen?
A. Ah....no!
B. Of course, anythings possible.
Given the targets and, more importantly, the specificity of the described attacks, I would almost bet money that - if ever caught - it will be found that the break-ins were funded by and/or committed by the foreign intelligence branch of another government.
0 5) was created.
Especially notable is that L-3 Communications (note: NOT Level3 Networks, an entirely unrelated company with an unfortunately similar name) was attacked. L-3 is a major, major contractor for highly classified work with the Department of Defense. Other organizations on the list are less prominent but nonetheless important players in U.S. defense electronics.
It has been long recognized that virtually all opposing foreign governments (except, interestingly, North Korea) have active electronic and communications espionage programs against both the U.S. government and leaders in scientific and engineering fields. This is in fact the main reason that the rather silly-named U.S. Cyber Command (http://www.af.mil/news/story.asp?storyID=1230305
Fuckers laid me off when they completely flubbed a huge contract. It was a multi-team effort, with my team as the lead. But the big wig in charge led one of the other teams. He kept picking the other team's suggestions over my team. Well, the company lost the contract (some $900 mil).
And better yet, the branch office I worked at is going to be shut down because the fort they support is being shut down! (Partly due to the poor implementation of their plan)
cue Nelson, bitches!
Nah, I'm not bitter or anything. My whole team was trashed due to a few idiots; the winning company had basically 80% of our ideas. And now I've been doing manual jobs for years.
Fuck Booz Allen. Guess it's time to move out of the west coast. I hear that there is something called snow in the northeast.
Vote monkeys into Congress. They are cheaper and more trustworthy.
When you're asked in a job interview to hand over your user/pass or trade secrets, would you do it?
I was actually asked in a job interview if I'd mind "taking some work from the old plant with me". I refused, called the interview over and went out. 2 days later I got the call that I was hired. Not despite refusing, but because. Actually I was one of the few that did, and the most qualified of those that did.
It's amazing how few people actually think ahead. When a prospective employer asks you to bring along some info, what they do is test your integrity. Because they know, if you don't mind bringing information to them, you certainly won't mind taking it with you again when you leave. And usually you move up the ladder, not down, when you're switching jobs, so the info you bring is by no means as valuable as the info you'll take when you leave.
Honestly, I was surprised that there were appearantly quite a few who didn't have any problem stealing IP from their former company...
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
From http://www.ibiblio.org/pub/linux/docs/HOWTO/Advoca cy
Merriam Webster mw1.merriam-webster.com/dictionary says that variant of hack dates from the 1600s and comes from the British word `hackney', or taxi driver.
OneLook Dictionary Search, as a quick reference, lists 8 definitions of hack as a noun, 8 as a verb, and 1 as a surname. A surname? Depending on a person's disposition I imagine someone with a last name of "Hack" could have a lot of fun, or a lot of grief. Looking at all the results; there's catagories for Art, Computing, Medicine, and seven other catagories; I'm kind of surprized there's so many. I haven't clicked on all the links but I'm thinking they probably share the same basic meanings.
FalconShould there be a Law?
Social engineering, not "social hacking", you gormless fool. Sheesh.