Slashdot Mirror
Pentagon Hid Magnitude of Data Loss From Recent Breach
blueton tips us to a brief story about recent revelations from the Pentagon which indicate that the attack on their computer network in June 2007 was more serious than they originally claimed. A DoD official recently remarked that the hackers were able to obtain an "amazing amount" of data. We previously discussed rumors that the Chinese People's Liberation Army was behind the attack. CNN has an article about Chinese hackers who claim to have successfully stolen information from the Pentagon. Quoting Ars Technica:
"The intrusion was first detected during an IT restructuring that was underway at the time. By the time it was detected, malicious code had been in the system for at least two months, and was propagating via a known Windows exploit. The bug spread itself by e-mailing malicious payloads from one system on the network to another."
The DoD doesn't need Windows, we need bunkers.
"The fight for freedom has only just begun." - Geert Wilders
Who will protect us from the Pentagon?
What changed under Obama? Nothing Good
So they snuck in through broken Windows?
BSD
Let me show you it.
What is it with you people? Is there no such thing as a state secret anymore? Should the Pentagon just list all its secrets on its Web site and get it over with? Let's just post all the targeting information, launch codes, encryption keys, advanced weapons and defense systems. etc. Let's just post it all on .mil in the interest of openness.
Not everything is a scandal folks! Nothing to see here, move along.
Slashdot "libertarians": Small government for me, big government for those I disagree with. -1, I disagree with you
This is Slashdot. The data wasn't stolen. It was copyright infringed.
When will everyone learn the difference?
The solution is obvious: sic the Mafiaa on the attackers.
The prime requirement from the constitution for the federal government is to protect our country, & yet they can't be bothered to patch known holes in their systems :-(
The DoD Uses Windos???? This sounds like a Court-Martial-able offense!
In all seriousness, if it was a Windows exploit that had been known for months, there should have also been a fix I would think. So is the Pentagon not installing their security updates or what? This is ridiculous.
This author takes full ownership and responsibility for the unpopular opinions outlined above.
It was the British, I know this becau.. LINE TERMINATED.
OK, all you government workers - especially those in the military, CIA, or NSA that are running Windows on open networks.
Compose a few Microsoft Word documents about a planned nuclear attack on Beijing on the opening day of their olympics. Make it sound nice and juicy, say a few things about ICBMs, nuclear submarines just off their coastline. Mention the proposed megatons and expected damage. Talk about a free Taiwan
Let them chew on that.
We're paying the Pentagon and the spy agencies over $500 BILLION a year. That's well over $3 TRILLION spent "protecting" us since the 9/11/2001 "wakeup call" that should have told us national security isn't merely a big army. The Vietnam War cost "only" about $600B, during the height of the Cold War.
Feel safer?
--
make install -not war
I for one am thrilled to see these idiots get F'd in the A... Incompetence always catches up with you eventually.
I guess that upgrade to Vista didn't go to well for you guys, huh?
I think it is time for any signifcant secrets to be inside a separate network with a different operating system-- and one that is built from the ground up to be secure from buffer over run attacks and similar performance enhancing flaws.
She was like chocolate when she drank... semi-sweet at first and then increasingly bitter.
Sysadmins must apply patches IF AND ONLY IF they are army approved.
Sounds decent so far, hmmm?
The army has some committee that regularly decides which patches to approve.
Still not too bad, hmmm?
The committee approves patches for things that are being actively exploited.
Ponder that one for a moment. It means that every security hole will be exploitable on the army networks. Every security hole gets a chance, since "not exploited yet" means "not a problem".
Me Chinese,
Exploit SOCKS
Me Put Malware
On Your Box
Me Chinese,
Go To Town,
Me Pull Fast,
Your Data Down
Me Chinese,
Make Cheap Shoe
Take You Secrets
Laugh At You
Me Chinese
Let You Think
Here You Go
Bring You Drink
Me Chinese,
Me Play Joke
Me Put Pee-Pee
In Your Coke
The solution is obvious: sic the Mafiaa on the attackers
That didn't work when the US tried it on Castro. (But the mafiosi DID laugh all the way to the bank.)
The Mafia is very overrated as a tool for governmental clandestine activities.
They're CROOKS! DEAL with it!
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Gary McKinnon is accused of cracking into 97 United States military and NASA computers in 2001 and 2002.
He talked of blank MS passwords and using a tiny Perl script.
So maybe you do not crack or hack MS Pentagon computers but just surf on in.
http://news.bbc.co.uk/2/hi/programmes/click_online/4977134.stm
You know, one time we had a box DoS, for 12 hours. When it was all over, I walked up. We didn't find one of 'em, not one stinkin' Asian ip.
The smell, you know that Microsoft smell, the whole box. Smelled like... owned.
Domestic spying is now "Benign Information Gathering"
there's millions more viruses like that comin' ... heck, they could send a hundred thousand a day, we'd clean 'em out, and there'd be more getting e-mailed in to take their place ...
Is it one Microsoft hasn't patched? Was it on Vista or XP or 2000? Was it something that could have been prevented by system or user settings? Why was Outlook not switched to plaintext only to prevent malicious code from propagating?
This sounds more like an inept IT department than anything, and considering government pay grades if you aren't in _the_ top tier it wouldn't surprise me if that was the case really.
And to all you anti-Windows pro-Linux guys: How many groups of hackers does your OS have dedicated to breaking it? Microsoft damn sure has its flaws and issues, but most Windows exploits are found simply because Windows is _everywhere_ in the real world.
There is a reason NTFS was number two on the Slashdot FS poll, and it isn't because Windows and everything associated with it is total garbage. The 'open source attitude' is supposed to be about choice and sharing, not about elitism.
Sure, the default settings on Linux are more secure than on Windows. Linux is also not designed with the common man in mind. You shouldn't be surprised, especially IT guys, with how much of the problems with Windows are because of the marketing department rather than the actual coders. If the recent internal e-mails can't show that to you (what with the majority of the company bitching about how bad Vista was and how it shouldn't be released) then you are going through life blind.
Oh and yes, I use both Linux and Windows. Both have their uses. You don't throw out a screw driver when you get a power drill, and you don't throw out a ruler when you get a tape measure.
It's not the Chinese People's Liberation Army. It's the People's Liberation Army of China. The Chinese People's Liberation Army is a bunch of wankers.
Fascism trolls keeping me up every night. When I starts a preachin', he HITS ME WITH HIS REICH!
Two months to catch a bug that is transmitting itself as a malicious payload
on the network?
What do you want to bet that their security manager has a phd and worth
every penny he makes.
Got Code?
Comment removed based on user account deletion
Woosh!!
Mafiaa == RIAA + MPAA
Mafiaa != Mafia
why the hell is any DoD network connected to the Internet????
Jesus saves souls and redeems them for valuable cash prizes
Why did I lol when I read that?
Here's the thing.... even putting the hyperbole in the title aside, Microsoft really does suck , and at so many many many levels.
.
I am in my 30's and I have been using Microsoft all my life, since I was about 9 years old (I started using computers when I was 7). I build their machines, I repair them, I even program them too. I also attempt to provide security on them as well. So I have been involved with Microsoft about as long as some people have been married. So I believe that I am entitled to get drunk occasionally and rant about the "Ex" for awhile. I earned it, so to speak.
Have people noticed that Microsoft is like a little sickly Boy in the Bubble? You have to protect him at all times.
You have to put up a router and a firewall at a minimum to protect your little herd of MS machines. Keep them safe from the big bad wolves and all that. Of course, these days you also need to have some really good routers with IDS, gateway anti-virus, etc. to do it even better. But that is not enough. Those little guys can get into trouble just "looking" out on the Internet. So you need anti-virus, anti-phishing, anti-spam, anti-spyware, anti-malware, etc.
When the Internet first started coming out, I remember telling people it would be cold day in hell before I hook my computer up to an unknown network in which anybody could send packets to my machines. Obviously, I had to get over that "shyness" and learn to adapt or die. However, since then, I have had to invest enormous amounts of time and energy and cold hard cash into preventative measures to keep my own Microsoft OS's from being hijacked by any asshat on the Internet.
There is billions being made, that's with a B folks, in 3rd party solution providers that specialize in providing the security solutions just to cover the fact that Microsoft can't code security if their "life depended on it".
Now that the Pentagon is using them, it would seem that in a roundabout way, Microsoft's life IS depending on it.
We can bash Microsoft all we want, and talk and talk and talk about it. What it really comes down to though, is that Microsoft just may not be a secure enough environment for our National Security apparatuses to be using. If we have to work that hard at it, with that many vendors, and have that many points in which someone can screw up and leave machines vulnerable, then we need another solution
On another side note, where the HELL are those super secured networks I keep hearing about that my tax dollars paid for huh? Apparently, the Pentagon's networks must be in really bad shape too. You would think that trillions of dollars could provide some pretty secure networks, communication infrastructures, and operating systems.
All that "bashing" on my part aside, Microsoft may make a decent OS for the little guy. The mom and pops at home with their families. Let's face it, it is easier to use then Linux, otherwise Linux would have a greater market share. Let's just not use it inside the Pentagon OK?
Shouldn't the govt' be using their own version of linux and not M$ windows.
Woosh!!
Mafiaa == RIAA + MPAA
Sorry. Missed the extra "a". (Should have been all-caps, though.)
Mafiaa != Mafia
Where'd you get that idea? I was under the impression that the RIAA is a direct descendant of the jukebox protection racket / Crosby organization. (That's what makes the "MAFIAA" coinage so poignant.)
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
It reminds me of the Doonesbury comic years ago about Reagan's SDI shield, that was going to protect us from Soviet missiles by a single, always-perfect shield of protective devices. The comic was drawn in crayon, as I recall, with the voice of a little girl explaining that the world was beautiful because SDI was protecting us. Then in the last frame it said something abrupt to the effect of "Oops, one got through. Bye."
What makes this story so scary isn't just that something got broken into, it's the thing in the back of all our minds that says "my goodness, is that the place where All Knowledge of Everything is centrally stored?" Bad enough when someone breaks into your computer and gets all your bank accounts or passwords, but when someone breaks into The Government and gets all knowledge of launch codes, defensive systems, registries of guns in the US, files on who sympathizes with who, files on who calls who, etc. ... well, that info collected with the intent of defending us might suddenly be a liability.
That's why things like the telecom phone tapping, national IDs, etc. are so troublesome. The mere centralization of information at all for any reason is a risk that the Bush administration has been ignoring, working instead (for all we know, none of this being auditable) to pile all of everything in one fragile place. The founding fathers kept trying to decentralize things and minimize what in modern computer terms we'd call "single point of failure". They distributed power in a way that made it hard to just break in and take control, right down to making sure there was not a single head of government. It's too bad that in all the puffery we hear spouted about Constitutional original intent, the modern Republican leaders don't show more care about that kind of original intent.
Kent M Pitman
Philosopher, Technologist, Writer
Could the "compromised" data have actually been Honeypot data? http://en.wikipedia.org/wiki/Honeypot_(computing)
I am not an admin, but I recall working at a tech company whose admin operated a very realistic Honeypot setup complete with changing scripts that generated bogus logfiles and scripted users that logged in and out of several "windows boxes" running in VMs off an otherwise unused server (with no real data and not on the same network as the real servers).
He said it served as a canary in the coal mine, but it was certainly not the first or last line of defense.
The Pentagon is only the single largest office building on the planet with a workforce of tens of thousands of civilian and military personnel.
It is highly probable that any classified data is NOT on PC's connected to the same network that has access to the Internet.
But, I could see some non-classified windows boxes with Internet access such as the ones our favorite stereotypical secretaries (who competitively install every kind of of smiley and intellimail app they can find) as being the ones the email the malicious code to each other.
-Still, I wonder what was "taken"?
What would really concern me is if they penetrated Ft. Meade or somewhere more important. http://en.wikipedia.org/wiki/Ft._Meade
Comment removed based on user account deletion
It wasn't bad in WWII, from what I've heard.
I see your informative link, and raise you a pithy comment.
Gee, they cracked a public server? Who gives a crap.
"God fights on the side with the best artillery." - Napoleon, Marshal of France - speaking truth to power
Twenty thousand people work in the Pentagon, the bulk of them secretaries, flunkies, gophers, paper pushers and form filers. They have, naturally, a plain old typical big business e-mail system for sending memos back and forth about whether the proper signatures have been affixed to form eight six four nine nine stroke seven aitch. This is what got hacked. To the extent "sensitive" data was compromised, it would be stuff like the Assistant Associate Deputy Secretary's daily conference call schedule, which is "sensitive" in the sense that in the remote chance that someone wants to assassinate him they'd find such data mildly useful.
There is of course also a serious network of computers at the Pentagon which handles serious military secrets. It doesn't run Windows. It isn't physically connected to the Internet. The Chinese can't touch it.
This is a silly FUD nonstory. There's no reason for the Pentagon to treat random secretarial computers with the same attention to security as they give classified computers. It would be very expensive, and my taxes are high enough already, thank you.
It is entirely possible to create a distributed model where local areas manage their permissions, it's managing the volume of permissions that is the challenge. For some bizarre reason, people who set these things up always insist on a "one large pot" model, whereas X500 has a perfectly viable distributed access control model (sorry for those who squeek "LDAP is God" at this point - there is a reason why "LDAP" starts with an "L", thank you).
..
The nice thing about a distributed model is that it's much less failure prone. It allows components to come online and offline without tearing down the whole mesh with it.
Applications aplenty: UK NHS (National Health) database: keep the info where it is stored and make sure there is some overall schema (a challenge in itself which explains why the central government intranet (GSi) still doesn't have a decent overall directory), identity (assuming someone can come up with a safe container at all it would mean one rogue member of staff would expose the whole country) etc etc. Is it THE solution? Nope. But fully centralised has already proven to be exactly the wrong approach, so I'm throwing some spanners into that one
Just my opinion..
Insert
It would not be the first time that a government has gone to great length to convince others that the stolen data they have is real, when really it is not, rather it is carefully crafted misinformation designed to fubar any project or plans it is used in.
Shouldn't the Gov't already know that Windows security is as effective against hakers as wet Kleenex is against a Mack truck?
Microsoft likes to spend money on selling the same pile of shit packaged in a new wrapper, instead of producing anything actually useful.
This is what happens when Government officials have a threesome with Ballmer and Gates.
Knowing Google's lust for data collection, the Soviet Union is still alive and well inside the psyche of Sergey Brin....
Critical Systems should be closely monitored to find any unknown/un-authorized changes. Also going one step further, unknown binaries/scripts can be proactively denied execution and one of the company which offer this solution is Solidcore.
.. and to the typical American ... out of sight out of mind. Or in other words, WE STILL DON"T KNOW what all this secret information is but it apparently makes the hackers smarter than us about us.
Thanks Homeland security......good job.
Prior to W. we required out gov. to have SECURED OSs. Once of the few places that had Windows was the reagan, and IT ran in circles (figures). The pushing of Windows on all forms of gov. has been from The white house. What a disaster. Even DHS standardized on it. I have worked with 2 of the top ppl from DHS back in 2002 (prior to their being pulled into DHS) and no doubt that they used Windows. They were tech idiots back then, and they are still idiots.
I prefer the "u" in honour as it seems to be missing these days.
Many of these systems would be communications between DOD and weapons builders. No doubt that there is more than just idiot chit-chat that was in the email. It would include a number of details of our new weapons. Now, it may not include full specs, but in parts, it speak about various aspect of it. Once spoken about that, allows others to try and guess. They will try to guess how to duplicate AND how to defend against it. Worse, it may speak of known weaknesses that we have. Perhaps china finds out that the ABL has a certain frequency of laser, as well as length of time that it runs. That would enable them to build shielding (mirrors of a certain thickness) against it. Perhaps in these email, data about China is mentioned. Now, they may put 5 and 5 together and figure out where the pigeon is. All in all, information IS power. And it is ALL valuable.
I prefer the "u" in honour as it seems to be missing these days.
Their network admins should be fired on the spot, that's ridiculous.
Yes it is ridiculous and someone should be fired.
But why does everyone go after the grunts and not the department heads? After all it is the department heads to allocate the money and resources to do such things as watch the network.
The local admin might be over worked, under trained, understaffed and no hardware to accomplish this task. Don't be so quick to pounce on the network person. This is a management issue pure an simple.
This is exactly my point. If that's our protection, then any one piece of wire can break everything. And that means we are vulnerable to any accident, to any single mole who gets through, etc.
But moreover, the US could not possibly hire enough people to make this work. To have good computation on that "other Internet", we need to keep up with what others are doing elsewhere in the world. In the real world, thousands or perhaps millions of programmers are making a ton of software that is powerful and, yes, free. And our enemies can use it as well as our friends.
If our classified systems can use none of it, then we can't keep up. Because we have to pay enough people to recreate everything Richard Stallman and the Church of Free Software has built. That isn't likely. Forget the monetary value of it, the computational value of it is large. And so someone is going to download some of that onto the other net because they can't afford not to. That means it may have bugs and moles in the software. It won't all be possible to audit 100%.
And yet the warfare will be conducted on the internet, our internet. So if they're off safe in their internet, the government internet, the Good internet, the one full of only safe and friendly software... the one parents wish they could have their kids on.
Being on that safe internet, they won't be able to protect us. Not unless the yield of that good internet is software that comes back to ours. If it does, software has now made a round-trip from the Bad Internet, the Spock-with-a-beard Internet, where free software comes from, to the Good Internet, and then back to the Bad Internet. And who knows what viruses or deliberate "features" it can have carried in one direction and what data it can have steganographically carried in the other direction.
Rigorous separation of Good from Bad in a world that is connected is not protection. The problem is that we build technology to save us time and effort and to make sure we don't make mistakes. But technology makes mistakes too, because it's built by people. And it makes deliberate problems, too, if it comes from places where there are Bad People (if there even is such a black and white concept). And technology does something bad, it makes them much faster than we do.
Our safety used to be in that when we made mistakes, we made them slowly and in distributed fashion.
Kent M Pitman
Philosopher, Technologist, Writer
Given the value of data, at what point does diplomacy start to consider network intrusion to be an act of war. I mean, if they're going to treat physical and imaginary "property" to be equal under the law, then this sort of massive data intrusion becomes the equivalent of walking into a naval base and sailing away with a fully loaded aircraft carrier.
To read /. at work, of course!
!#@%*)anks for hanging up the phone, dear.
Slashdot, you're growing up.
you had me at #!
Even though having been a professional programmer since 1977, I was very fortunate that I never had to use f*ckrosoft untill the mid 90's when the company I worked for got cheap, dumped their X terminals, and gave us laptops upon which we then ran an X server.
Then I found out how the other half lived. Okay, granny and junior, but why did professionals put up with that sh!t?
Since then, I've said that anyone who uses S*ckrosh!t gets what they deserve.
... most Windows exploits are found simply because Windows is _everywhere_ in the real world.Good enough reason to run a non-Windows OS, I think.
Much could be done as indicated by many here on /.
....
...), taking credit, and assigning blame. If you try to fix the management mess in DoD you'll get the 33% fired or forced into a back office hole ... the situation would get much worse.
... then you are a dogma don-dummy.
DoD has bought into Alpha-security (A-Sec). A-Sec is when all things are controlled by being identical or bunker-consolidated.
It is like a single point of failure looking for a place to happen. Someone once told me (or I read) about the blackberry network with one or two critical nodes (points of failure/attack/access). MS-products on most all DoD desktops is another single node. Server/Network help-desk-script Admin is another node. Things done the same way everyday is another node.
Who's in charge in DoD? I figure, about 66%, of C*Os (even in DoD...) rose through the management ranks by social skills (golf, fish, drink, lies
In the USA there is (at most) one in three managers/C*Os that are worth their pay plus, the 66% ain't fucking worth a janitor's pay. The past 50 years decline of the USA into stupidity was caused by 66% (or more) of the politicians, plutocrats, corporatist, and clergy being dogmatic dimwits.
Two i.e.4U
All government problems are caused by lazy government employees, if you want to believe politicians and senior managers like Dummy Don Rumsfeld
All our financial problems are caused by all the money spent on poor people or the elderly on retirement checks and free medical care.
If you want to believe this bull shit, then kill your parents before they can retire, or consider a concentration camp (called a nursing home poject) for the elderly could make sure that retired people die on a state sponsored schedule to manage money better.
Economics and Financial problems are caused by governments and business institutions being uncontrolled and irresponsible to the public/society. Businesses for decades have been looting retirement funds, getting government bailouts, setting up loan, housing, energy crises for US tax dollars. The New USA Welfare-State for Corporations, the old USA is vanishing, because far to many USA Citizens believe that god and wealth has all the answers (I know they're all lies).
Unaccountable leaders are masters, and unrepresented people are slaves. How do US and EU fare?
Well, anecdotes don't count for much, but this is exactly 100% of my experience with your former employer:
On a vacation to Sault Ste. Marie when I was 11, my family, a family friend, and I went over the border in two cars. The first, my father, his fiancé, and my sister. The second, the family friend, my brother, and me. The first car goes through, no trouble. Our car pulls up to the booth, they check our ID and ask how we were related.
When they didn't like the answer, they told us to pull over into a nearby lot. An officer, a sour lady not more than 4'6", came over to us and took us inside her station. She made it clear that she suspected we were abducted children, and started yelling at the friend, and us, to come clean. Not once did she interrogate us separately. After about 5-10 min of this, she leaves us alone in the room (!) and goes to the adjoining building. Another 10 min go by, and we're bored, our friend's pissed, and his keys are on her desk (!). So, he takes his keys, takes us, and leisurely walks back to his car.
We then drive into Canadian Sault Ste. Marie for our 30 min Canadian vacation.
Your border service is very non-Draconian.
Comment removed based on user account deletion
It really does make what the NSA were doing look very suspicious and starts to look more like a domestic surveillance program searching for those who did not properly align themselves with the current administration. Opposition political leaders and political fund raisers, people who supported peace and not war, those that actually wanted to support the troops rather than just sending them off to bleed money out government and into the pockets of corporations whilst the soldiers bleed on the battlefield.
I wonder how much information got out about the corrupt nature of some of the practices going on in the pentagon that will later be used by the autocratic communist Chinese leadership to manipulate and control those in charge of the Us's national security. A whose who of those that will readily accept bribes regardless of the loss of life.
I bet there are a whole lot of people who now wish they had mandated the use of the NSA's SE Linux on desktops and file servers, the NSA really did now and attempted to do something constructive about the problems inherent in M$ windows before they were cut off by the corrupt M$ executive team and an equally corrupt republican administration.
Chaos - everything, everywhere, everywhen
Hell, it could have been the DoD paying these guys to say this in order to get more funding, or the Chinese government spreading disinformation, or these guys taking credit for someone else's hack, etc.
are you suggesting that we should open discussion about the potential ban on firearms?
The whole idea of putting all eggs in one basket (translated to all data in one database) is plain stupid, but I guess it'll require a change in law to make this sort of stupidity disappear. Until we make someone legally responsible for such data loss instead of permitting idiots to hide behind all sort of stupid excuses it ain't gonna change.
I refer you to the UK: the bright spark responsible for the debacle with those 2 CDs did apparently "resign". When you check what really happened is that he resigned to go to a more cushy job. Yeah, that will teach him..
No, I don't think they'll give up on the idea. That is, until data on senators and judges and members of congress starts seeping out, of course. IMHO it can't happen early enough.
Insert
Actually, if you look at the time on this, it was posted before any other comments that addressed the same topic, so it is in fact all of the other comments which are redundant. But I wouldn't expect you to be able to notice something that obvious. Thanks, ass-mod.
Yes, we are seeing the same things from different environments.
Plutocrats are all very damn fucking mentally and emotionally sick, thinking that "The USA Constitution" is a problem, considering the national corporate, political, and clergy organized subversion and treason crimes are lawful/just, because it will serve the best interest of the privileged class of plutocrats; While US/EU Citizens serve their whimsy and earthly money kingdom.
Unaccountable leaders are masters, and unrepresented people are slaves. How do US and EU fare?