Slashdot Mirror
Sophisticated, Targeted Breakins Uncovered
Ichabod writes "Sophisticated computer criminals stole data from Unisys, Booz Allen, L-3 Communications, Hewlett Packard, and Hughes Network Systems. It sounds like they used a combination of social hacking and undetected low-profile malware (reportedly NTOS.exe) to steal and encrypt sensitive data, and compromised Yahoo accounts to store and retrieve it. An international investigation appears imminent. And yes, unfortunately Reuters calls the criminals 'hackers,' further besmirching the once-revered title."
Security is only as good as it's implementation. These articles seem to get the same responses everytime. I would love to see /. act like a think-tank sometime and really come up with some solutions.
The article is rather light on details. My first thought is to wonder how, after all this time, they finally managed to figure out that their systems were compromised.
My second thought is to wonder if it's even true or if this is just spin-hype for Trend.
My third thought is to objectively note that this is probably not an isolated incident. If this particular incident is this big then, in all likelihood, there are hundreds or even thousands of other compromised systems which haven't been diagnosed.
My fourth thought is "Haha!"
the NPG electrode was replaced with carbon blac
I don't think you have to worry about the term 'hacker' being besmirched any more. It, like several other terms have entered the mainstream vernacular. If you really care about the terminology that much, invent a new term for what was the original 'hacking'. It is far too late to close the barn door on the hacker misconception.
Out of modpoints but really liked a post? 1BDkF6TtmmeZ3yqXbz9yhdYVqRYnwFoXDj
Actually, the so-called hackers thought that "Do No Evil" was a command to those using Google's services. As such they went elsewhere.
In all seriousness, I'd be willing to bet that they used compromised Yahoo! accounts for a few reasons: yahoo users are generally less computer-savvy (read: easier to compromise), they probably use gmail accounts themselves so they didn't want to draw attention there, and google has been rumored before to keep e-mails even after being deleted from the account.
"What is most worrying is that this particular sample of malware wasn't recognized by existing antivirus software. It was able to slip through enterprise defenses," said Yankee Group security analyst Andrew Jaquith, who learned of the breach from Morris. "This is a serious threat. It shows how sophisticated hackers have become," Haro said.
This is not sophistication.
1. Take any virus/trojan that is recognized by antivirus software.
2. Put it through an executable compression package to make its code vary from what it used to be on the hard drive or in memory.
3. Viola! Your malware is now stealthed from any antivirus program.
Either that was rather simple or I am a seriously dangerous hacker.
Big apple, new Yorik, undig it, something's unrotting in Edenmark.
Main Entry: hacker
Pronunciation: 'ha-k&r
Function: noun
1 : one that hacks
2 : a person who is inexperienced or unskilled at a particular activity
3 : an expert at programming and solving problems with a computer
4 : a person who illegally gains access to and sometimes tampers with information in a computer system
I am pretty damn sure that the thieves in question meet both #3 and #4, hence they are 'hackers'. I probably would not waste time bothering Reuters to complaining that not all hackers are evil. They used the word correctly.
Slashdot: Failed Car Analogies. Amateur Lawyering. Anecdote Battles.
Perhaps its irrelevant what it once was. A hacker now is a bad guy. Trying to re-educate the massive public mindset for the sake of some historical correctness, seems like a futile experience. Eventually 99% of the population won't know or care the origin.
It's like complaining about the word "gay" being used by teenagers and not referring to a homosexual or when people say "Mac O.S.X" instead of Mac OS Ten
The only people who ever "revered" it are the only one's who care that there's a difference anyway. What William Gibson dreamworld are you living in where average people used to spend their off-hours talking about how much they revere "hackers"?
Get over it. Language evolves and so has the accepted meaning of the term hacker. It is like how the word gay used to mean happy.
I would only have a problem with the term "hacker" if my mind were too feeble to grasp the concept of a homonym.
Gah, not to get into a huge flame war here, but I seriously don't understand why there's this association of liking/using windows and being some kind of computer moron.
/. people do, and either downplay it or deny it. Now I'm not saying that unix type OS's don't have their place - I use solaris and linux at work for coding and my servers generally run openBSD. BUT I want my personal box to be as easy and hassle free as possible so I run windows and only windows. I don't consider myself to be a windows victim and it's not a choice I made just because that's what came with the box. Say what you want about bloatware, but it's nice to buy a piece of hardware and have it just work. It's nice to install a program without having to recompile the kernel. It's nice to have a box I can actually buy decent games for. And no...I haven't reinstalled every two weeks since I bought it and yes, it is still working and not overflowing with disease and spyware.
Let me put it right out in the open here - I like and use Windows. In fact, I'd wager that a large number of
Look, I'm not trying to defend every aspect of the OS - clearly there are some issues. But as I get older and more impatient, I'm starting to see windows as the more attractive option simply because there are some things that they got very, very right. Namely the fact that they put so much emphasis on usability.
Anyway, my long winded point is that not all windows users are stupid or just stumbled upon windows by accident. I know it's fun to bash things senselessly, but let's grab a little perspective here. Windows is not the devil, it's just not perfect. Nothing is.
...no two people are not on fire.
The problem is that this, like most other effective security schemes, is expensive.
Companies won't implement more security than is cost-effective. Their decision making process is going to be driven directly by the perceived odds of being broken-into, times the cost of a possible breakin. They're not going to spend more money than that.
I doubt there are really going to be any serious (multi-million or -billion dollar) consequences for any of the companies involved. Maybe a few people will get fired and some new procedures will get written into some document that nobody reads, but there's not going to be a major bloodletting. (These companies run the government, in the most literal sense.)
When you see a F500 company absolutely taken to the cleaners -- totally bankrupted -- due to an IT-security mishap, then you'll see real security implemented. But until then it's just going to be a lot of after-the-fact patching-up and good 'ol "security theater." And a lot of blaming the messenger. That's always cheap.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
Quality on par with digg? I don't even know how to respond. Maybe you wanted to Quantity on par with digg. The moderation and answers here are far more insightful and not nearly as biased as the ones on digg.