Slashdot Mirror
Sophisticated, Targeted Breakins Uncovered
Ichabod writes "Sophisticated computer criminals stole data from Unisys, Booz Allen, L-3 Communications, Hewlett Packard, and Hughes Network Systems. It sounds like they used a combination of social hacking and undetected low-profile malware (reportedly NTOS.exe) to steal and encrypt sensitive data, and compromised Yahoo accounts to store and retrieve it. An international investigation appears imminent. And yes, unfortunately Reuters calls the criminals 'hackers,' further besmirching the once-revered title."
Security is only as good as it's implementation. These articles seem to get the same responses everytime. I would love to see /. act like a think-tank sometime and really come up with some solutions.
..is that they'd use Yahoo! Mail to retrieve the data. Gmail offers more space. Hrm. Poorly researched.
The article is rather light on details. My first thought is to wonder how, after all this time, they finally managed to figure out that their systems were compromised.
My second thought is to wonder if it's even true or if this is just spin-hype for Trend.
My third thought is to objectively note that this is probably not an isolated incident. If this particular incident is this big then, in all likelihood, there are hundreds or even thousands of other compromised systems which haven't been diagnosed.
My fourth thought is "Haha!"
the NPG electrode was replaced with carbon blac
I don't think you have to worry about the term 'hacker' being besmirched any more. It, like several other terms have entered the mainstream vernacular. If you really care about the terminology that much, invent a new term for what was the original 'hacking'. It is far too late to close the barn door on the hacker misconception.
Out of modpoints but really liked a post? 1BDkF6TtmmeZ3yqXbz9yhdYVqRYnwFoXDj
and "A Department of Transportation spokeswoman said the agency couldn't find any indication of a security breach." awesome!
See, hackers get a bad rap. These folks were kind enough to encrypt the sensitive data they found, so that no outside parties could get a look at personal records.
contact the editors about it politely.
"Thanks for all the money you paid to us. We've used it to buy off ISO among other things" -Microsoft
At least in the old days, we used to call it "social engineering" and hacking meant any kind of programming outside the obvious. That included getting machines to fork over security credentials, but that meaning was a subset of the broader term, which meant both a cheesy quick fix ("what a hack!") and a dancelike circumnavigation of inherent limitations to produce a semi-elegant but sturdy fix ("kernel hackers drink coffee black").
technical writing / development
The Security Fix Blog
Best Slashdot Co
I know the pro windows crowd will jump up and down but I hope they will hear me out.
1. Windows is the most popular OS on the planet. Just for shear number of systems it is most hacked.
2. Windows is harder to lock down than most other OSs. That is often because software expects to be running with admin rights.
I am trying to figure out how no one noticed these programs trying to make connections to the outside world. My guess is that they where not expecting a Trojan. Heck we got hit by a worm at my office. It didn't get through our firewall at all. Somebody brought a notebook in and connected it to our network.
It only infected three machines but it was a good cheap lesson for us.
See my blog http://ilovecookes.blogspot.com/ for light hearted technical information.
Using their evil databases to identify trends and patterns.
"God fights on the side with the best artillery." - Napoleon, Marshal of France - speaking truth to power
Put job ads in front of disgruntled employees and ask them to create accounts to apply -- then watch as they merrily type in their favorite usernames/passwords into your cracker system. Easy as pie...
21st-Century-Citizen
Wouldn't it be nice if we could get more data on these security breeches? The articles are so lite weight. What technique? What data? I think the more we learn about these problems, the more bullet proof we can make our systems. We are at a disadvantage in that the criminal understands the vulnerability and can exploit it over and over again.
Sammy at IT/Personafile
"What is most worrying is that this particular sample of malware wasn't recognized by existing antivirus software. It was able to slip through enterprise defenses," said Yankee Group security analyst Andrew Jaquith, who learned of the breach from Morris. "This is a serious threat. It shows how sophisticated hackers have become," Haro said.
This is not sophistication.
1. Take any virus/trojan that is recognized by antivirus software.
2. Put it through an executable compression package to make its code vary from what it used to be on the hard drive or in memory.
3. Viola! Your malware is now stealthed from any antivirus program.
Either that was rather simple or I am a seriously dangerous hacker.
Big apple, new Yorik, undig it, something's unrotting in Edenmark.
Main Entry: hacker
Pronunciation: 'ha-k&r
Function: noun
1 : one that hacks
2 : a person who is inexperienced or unskilled at a particular activity
3 : an expert at programming and solving problems with a computer
4 : a person who illegally gains access to and sometimes tampers with information in a computer system
I am pretty damn sure that the thieves in question meet both #3 and #4, hence they are 'hackers'. I probably would not waste time bothering Reuters to complaining that not all hackers are evil. They used the word correctly.
See, it's a win-win situation - the criminals did everything smoothly without leaving a trace, and at DoT it looks like nothing happened!
Slashdot: Failed Car Analogies. Amateur Lawyering. Anecdote Battles.
I didn't think it could get more sophisticated than the classic Breakin 2.0: Electric Boogaloo. Bravo, hackers!
What's with the whining about the word "hacker," anyway? Talk about beating a dead horse.
Rob
I know the pro windows crowd will jump up and down but I hope they will hear me out.
Uh....the huge pro windows crowd on slashdot?
My solution -- never let group #2 touch a computer again. Ever.
Congratulations you just put group #1 out of work.
I think the invisible hand of the market has its middle finger extended
--A wise old fart named SC0RN
The problem is that this, like most other effective security schemes, is expensive.
Companies won't implement more security than is cost-effective. Their decision making process is going to be driven directly by the perceived odds of being broken-into, times the cost of a possible breakin. They're not going to spend more money than that.
I doubt there are really going to be any serious (multi-million or -billion dollar) consequences for any of the companies involved. Maybe a few people will get fired and some new procedures will get written into some document that nobody reads, but there's not going to be a major bloodletting. (These companies run the government, in the most literal sense.)
When you see a F500 company absolutely taken to the cleaners -- totally bankrupted -- due to an IT-security mishap, then you'll see real security implemented. But until then it's just going to be a lot of after-the-fact patching-up and good 'ol "security theater." And a lot of blaming the messenger. That's always cheap.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
Quality on par with digg? I don't even know how to respond. Maybe you wanted to Quantity on par with digg. The moderation and answers here are far more insightful and not nearly as biased as the ones on digg.
Welcome to the Panopticon. Used to be a prison, now it's your home.