Slashdot Mirror
DHS Injects Itself With DDoS
An anonymous reader writes "Here's a story about what can happen to any enterprise IT department that overestimates the intelligence of its users. Only in this case, the enterprise in question is the U.S. Department of Homeland Security. The spokesman says there's no Jack Bauer mentality. No kidding!"
sounds like a bad case of misconfiguration to me.
lol, happened at college all the time
you get 5-6 idiots that reply to all
then you get 50-60 idiots telling them not to reply to all
and 50-60 more idiots trying to have a conversation to the first 5-6 idiots
Well, I'm taking the DHS off my list of government organizations to be scared of. Considering recent news regarding the DoD, It's pretty much down to the CIA and the NSA, and I have my doubts about their competence.
My tinfoil hat may be unnecessary after all.
"The cup is in turn designed for holding hot or cold liquids, and has an open rim and closed base." --US Patent #5425497
It's gonna be a long 16 months.
--
make install -not war
take care
If you must moderate, please moderate as irrelevent, not something bad, because I'm sure someone will find this interest
I yearn for the simpler days, when DOS came on floppy disks, rather than medical instruments.
... and then they built the supercollider.
Sounds more like they could use a Chloe mentality. She, at least, never overestimates the intelligence of other users.
Kind of sounds like Bedlam DL3 all over again.
"Here's a story about an IT disaster. No, we're not going to tell you what's actually in the article. Now please allow me to reference some trite television show. No kidding!" Worst. Summary. Ever.
You can be scared by something.
Governmental organizations are things you are afraid of.
Drop the personality disorder and patch me through.
---
I liked Chloe so much that I have a Cygwin alias for ssh into my VPS. It is, of course, damnitchloe. Really its more like damTAB but I get a chuckle every time I see it.
I can also watch Season 7 of 24 in a command line, due to an extremely efficient homebrew compression scheme. Observe:
ruby -e "(24 * 6).times do puts 'Damn it'; end"
Help poke pirates in the eyepatch, arr.
It must suck to be that guy right about now!
I've had things like that happen before. Even after the misconfiguration is fixed, it can still take hours or days for all the messages to clear out.
Definitly grounds for being taken out back and given a bullet to the back of the head (terminated).
Honestly. I've seen this at least three times in my life -- once at college and once each at two different places that I've worked, both places filled with engineers and programmers (often the source of the idiotic "stop replying" messages).
It always starts with some idiot replying to everyone to ask not to be "unsubscribed," and then it goes berserk from there in *exactly* the pattern that the parent post describes.
What makes DHS so special that it wouldn't have managers, accountants, and other non-technical paper pushers to get the whole thing going? *pfft* "Jack Bauer," indeed.
If it's for-profit but free, you're not the customer -- you're the product (e.g., the Slashdot Beta's "audience").
Stop!
Grammar time.
If it's for-profit but free, you're not the customer -- you're the product (e.g., the Slashdot Beta's "audience").
That they can and will build a better/bigger idiot. Go figure? Go DHHS! *sarcastic rooting*
"So long and thanks for all the fish."
It certainly doesn't surprise me that the US Government initiated such a ridiculous faux pas. Remember, these are the same people who run the DMV. And I have serious doubts about the competency of anyone in the IT field who would choose to work for the government.
No way to patch a PEBKAC problem!
if they would open an unsecure document sent to thousands of people, or to a mailing list?
I guess I might imagine someone sending to individuals on the list, posing as someone else (on the list?) connected to them...
Several were group email accounts at Security Operations Centers, NOCs, and I think I saw a few power plants as well(one woman said that is was the "Command Center", speaking about the operations center at a major insurance company. Not to mention I'm still getting unanswerable emails back from email servers giving me the exact email address. I'd estimate I have around 1000 sets of contact information for people in the security industry, how many of those are actual LOGINS as well?
I'll put up a page with a breakdown of the information in the next week, then maybe Slashdot will put up my submission "DHS Email List Exposes Private User Data".
~Sticky
/Grousing about rejected submissions is typically offtopic.
//Which is why I said some other stuff first.
"Now you see that evil will always triumph, because good is dumb"
He said "gullible security professionals," :-)
I do not believe in karma. "Funny"=-6. Do good and forbid evil. Yours, Oft-Offtopic Flamebaiting Troll.
This happens where I work all of the time.
.doc format that needs to be filled out and returned.
1) Manager sends out an email with some attachments. One of which is a form in
2) Employees fill out the form and then hit "Reply to all with history"
3) Thousands of emails circulate throughout the company with about 9.9 megabytes of attachments each.
4) Mail server crashes
5) Profit!
The sad part is we're an engineering firm and everyone should know better.
Although it still doesn't beat the time someone tried to sell World Series tickets to the first person that emails him after exactly 2:17 pm!
While this downtime may have caused millions of dollars in lost productivity, possibly damaging out nations security depending on the severity of the outage, at least we got to see that even DHS drones, beneath their hard candy coating, have a soft, chewy interior that jokes about the weather and tries to avert a massive reply to all DDOS by replying to all. Oh wait.
What is that, something like: "diarrhea of the instant message shorthand"?
If you mod me down, I shall become more powerful than you could possibly imagine.
u have 2 put it in the subject
We have about 100,000 employees, are an all-MS (Exchange/Outlook) shop, and had something similar happen. Someone sent a notice out to most of the organization by picking a wrong distribution list. Lots of people replied to all saying "I don't want your notices; take me off your list." Lots of people replied to all saying "You shouldn't reply to all to get off the list." One poor lady replied to all "Take me off the list." Then she realized she shouldn't have done that and tried to recall her message. All the time, she had read receipts turned on for all her email by default. Between the replies and the receipts and all the people responding to all just to tell her to quit sending emails, this one user was getting over 100,000 emails a day. I helped her write a rule to delete them all while the Exchange admins killed the original distribution list, but that created a situation where she was getting 60,000+ bounce notices a day. Eventually, it tapered off. For a while there, though, she couldn't do a damn thing. She was about the worst case I heard of but everybody suffered to at least some degree. Not a fun time. I'm awfully glad our little screw up never hit the computer press. :-)
This was too funny, I was reading these messages all morning. So many completely stupid people sending messages out with their title, agency, often phone numbers, etc. Some having fun with it and a whole bunch going "stop sending e-mails!" The best was the official reply that came a few hours in, which said "please don't use 'reply all.'"
Even better was that anyone in the world could send to the mailing list, it didn't even check to see if you were subscribed before sending your message out. Trust me, I tried it. You also get a few hundred more e-mail addresses and all kinds of internal company details from the out-of-office replies (e.g., "I'm on medical leave, contact so-and-so at x1234").
Now, it was no big surprise, I do security in the federal government and so I know how clueless so many of my coworkers are. But it was hilarious to watch it all play out so publicly and persistently; it just kept going throughout most of the day.
Nice to see the company itself has a sense of humor...
"For every right, an equal responsibility..."
Jack Bauer knows how to use his technology. He's a really smart guy who knows how to send emails and pictures and files over his (or any) pda. I wish DHS were that smart.
They're using their grammar skills there.
What a bunch of idiots. How can you expect these people to be responsible for anything else if they can't deal properly with their own computer security and systems?
Obviously competent people are not working at DHS and these people need to be replaced.
This what is called as Unintentional attack denial of service aka human error