Slashdot Mirror
Inside the Secret War Against Internet Spies
ahess247 brings us a lengthy BusinessWeek story on the increasing amount of attacks against the US government's online presence as well as its contacts in the private sector. Hackers are gaining a greater awareness of where valuable data might reside, and that awareness is leading to more precise, more sophisticated attacks. Quoting:
"The U.S. government, and its sprawl of defense contractors, have been the victims of an unprecedented rash of similar cyber attacks over the last two years, say current and former U.S. government officials. 'It's espionage on a massive scale,' says Paul B. Kurtz, a former high-ranking national security official. Government agencies reported 12,986 cyber security incidents to the U.S. Homeland Security Dept. last fiscal year, triple the number from two years earlier. Incursions on the military's networks were up 55% last year, says Lieutenant General Charles E. Croom, head of the Pentagon's Joint Task Force for Global Network Operations. Private targets like Booz Allen are just as vulnerable and pose just as much potential security risk. 'They have our information on their networks. They're building our weapon systems. You wouldn't want that in enemy hands,' Croom says. Cyber attackers 'are not denying, disrupting, or destroying operations--yet. But that doesn't mean they don't have the capability.'"
Northrop-Grumman or General Dynamics or any D.o'D. approved private contractor can post anything they like about future combat systems on their websites, and even sell secret weapons systems to Saudis or the UAE or anyone else who can buy, but for anyone else to do it is an infringement of national security.
Also, the private contractors can preferentially hire non-nationals, who work diligently and are key to the development of these systems, instead of American citizens who might be disturbed at the nature of what the private contractors are doing in the name of national security, but that's the free market.
So, if I remember correctly, didn't something happen in Germany in the 1930s that caused its brightest physiscists to flee? And didn't the same imperial hubris that caused Germany to persecute the people who might have made it an economic power after WWI really cause it to enter- and lose- WWII?
Just askin'. I just wondered what the Party line was these days. http://spacetimecurves.blogspot.com/2008/04/pearl-clutching-by-master-race.html
"Flyin' in just a sweet place,
Never been known to fail..."
For every defense there is an attack, and every attack a defense. These military types should know this better than anybody else. It's a battle they should be prepared to fight as it was only a matter of time before it happened. And of course, it will cost yet more resources to mount this defense (or as the case may be, an attack against the attackers) and somebody is going to have to pay for it. As always, technology is a double-edged sword.
"Taboo, like anything else, goes in and out of style."
Spies use any means available to find information. If the Internet helps, they'll use it. That does not change their ornithological classification, or make them more specialized in one key area.
Also, spies would rather have infrastructure INTACT, so they can exploit it easily. They are lazy humans, like you.
The dangers of knowledge trigger emotional distress in human beings.
And if these spys are doing a good job, it'd be awfully hard to catch em. Of course if this is any indication it couldn't be terribly difficult to gain access to sensitive information.
Prediction: The real iPhone killer is going to be sex robots from Japan. Think about it.
When I worked at Boeing (and before that the Army) - if you had secret plans, you didn't keep them on a box that was open to the Net.
The problem is that they're not even following their own rules - Win boxen have never been approved for holding Net-connected data - only in a stand-alone environment are they even considered, and even then in a secure room with full security protocols enforced.
We used to lock down our drives too. In locked cabinets. When we went home.
-- Tigger warning: This post may contain tiggers! --
Back in Reagan's day, our intel folks managed to slip the Soviets a surprise that would have made Jokey Smurf proud with their bundle of purloined technology.
...when you're writing a game...tweak the difficulty of "Easy" to something [your mother] can cope with. -- onion2k
It seems they have spies blogging as well. For instance, Slashdot is clearly backing North Korea. They have worked out a deal with Kim for exclusive rights to his Looney Toons collection.
"I guess I'm gonna fade into Bolivian."
It's ludicrous that the U.S. military faces an serious threat. They should/do have their own private network that is disconnected from the internet. Due to an air gap they should be completely impenetrable. Public infrastructure like the power grid should be the same. They are either complete morons or, they think we are morons and want bigger budgets. You decide.
Some of this is no doubt spear-phishing. (Deploying newly-retuned spyware selectively against a target rather than globally, so it slips past signature-based malware detectors.) But I'd bet that most of this stuff is based on the malware developed for botnet-spamming and DDOSing, regular Phishing, etc.
We have a multibillion-dollar industry based on corrupting computers and stealing selected information from them, which the governments have virtually ignored while its techniques were honed. Now their own military secrets are the target of a similar attack. Any bets on whether it is built on the same code base.
Too late now, guys. The enemies' cyber-warfare departments now have the technology.
But I bet that, if you start finding and closing the barn doors even after most of the horses are gone, you'll find enough fingerprints and tire-tracks to trace down who did it. Hunt them down and take them out, and you'll eliminate a bunch of the talent that would otherwise be developing the technology further.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Western civilization was saved from the abyss.
Who doesn't think these things happen all of the time. I would be upset (in a general way) if our enemies didn't try that sort of stuff. And sneaking in via the side door. And the hot secretary. And countless other bits of espionage craft. Keep up the firewalls men! Loose lips sink ships. Watch them commies, you never know what to expect. Let's have another iPhone article, shall we. It's been maybe 24 hours since the last one. I'm getting bored.
Faster! Faster! Faster would be better!
I realize this is heresy for some, but the mesh network was designed and makes sense for a *national* network. Meshing internationally keeps costs down, but it is a really bad idea from a security point of view.
Why not have point to points with certain nations/regions of the world? Connection with these nations continue on the condition that they only route traffic to the US that originates on their national network. There are ways around any architecture, of course, the point is to give you an enforcement mechanism.
Drastic measures, considerable re architecture, etc, needs to be put on the table. Allowing this carte blanche espionage is just absurd. I believe the US still has enough weight to throw around to force something like this through, and it could pick up some key allies in the effort, too.
As the government adds more private contractors to the feeding trough the attack/exploit surface area grows logarithmically. And they has less and less control and verification over that expanding surface area. A socialized military industrial complex would be more secure!
How do you think the metagovernment will prevent hacker attacks?
I suppose governments can't go completely virtual until we can figure out how to make them hacker-proof.
Is complete openness in the code and systems enough to counter hackers? And/or can we suppose there will be a lot of white hats in favor of, and thus protecting, an open source government?
Why these Defense contractors are using unencrypted email, and Access to "to manage big batches of data.?"
Spy sappin' mah data!
ROMANES EUNT DOMUS
The end of the Cold War was a huge threat to careers and funding in the CIA, military and govt contractors. Need those Iraq wars, terrorists and hackers to keep the whole war machine going.
The military industry is not the only one that works this way. The medical industry is catching on too (bird flu) and now the whole greenwashing industry (global warming etc).
Engineering is the art of compromise.
They are so hard to find. And the keep stabbing me in the back :'(
Seems to me the only reason your on the web with this crap story over and over is to scare citizens and take away more civil rights. If your trying to keep something secret, don't publish it on the web.
And BusinessWeek maybe you should go back to focusing on Executive Life, instead of publishing fascist propaganda for the government.
The REAL internet spies! http://www.monkeyblah.com/content/img/19fmedic.jpg
Timely and new sensitive data, and various top secret technology always seem cool enough to make the front pages of such espionage stuff. But I'm suprised they aren't speaking of some more mundane channels of attack.
Wasn't "The military marches on its stomach." some historical quote that was attributed to Napolean? Anyhow, where I'd keep an eye out for cyber vulnerabilities is in the logisitics chain. All it'd take is someone to get into the requisitions, inventory, and procurement channels and they could make all hell break loose. Frozen fish in the place of ammo, livestock sent to some other place, 100 screwdrivers and bomb fuses to an office that only does paperwork, etc. Not only can such things waste resources or man hours to correct, but it can cause negative economic consequences for contract vendors. Stupid shit like that could get old really fast.
Hopefully the military brass has enough sense to ensure strong verification when dealing with civilian contractors in the supply chain (and via internal supply channels). Also there should be some means to ensure the trustworthiness of supply contractors, as some purchase orders might have the possibility of indicating potential for action, etc.
On the other hand, this would potentially be a great way for the U.S. to attack any adversaries too. The more bureaucratic, thick, and mundane an organization is - the more opportunities for logistics data mayhem. False requests will tend to look more "reasonable" under such systems.
I would have though that emails of this nature would be:
1) encrypted since they are sensitive themselves and at the very least
2) signed with a GPG or PGP signature that allows verification of the author.
Email encryption.
http://en.wikipedia.org/wiki/E-mail_encryption
They can even do it for Free.
http://www.mozilla-enigmail.org/
or buy a PGP solution from someone
http://en.wikipedia.org/wiki/Pretty_Good_Privacy
But I guess setting up a few signature servers and basic processes that control "secure email" would be to much of a hassle for people sending around their holiday pictures...
Besides what do I know I just searched google for 2 min, and they are the US government....
Hmmm... Maybe thats the problem. If its not a $10 Billion boondoggle with some cool codename then the Defense industry wouldn't exist in the first place. (That and maybe the US would stop having to invade small middle eastern countries to justify its military spending).
(http://en.wikipedia.org/wiki/Boondoggle_%28project%29)
----- "Profanity is the one language that all programmers understand."
They're not prepared to pay enough or offer the kind of work environment that attracts people who could prepare an adequate defense. If I have the choice of working somewhere enjoyable doing interesting work making six figures or combatting anal-retentive paper pushers in a cubicle underground just trying to get simple firewalls configured for half that, which job do you think I'll chose?
"Think about how stupid the average person is. Now, realise that half of them are dumber than that." - George Carlin
Article diverts attention from the real issue. Attacks are going to happen, the fact that there are so many that penetrated reveals a lack of policy enforcment by the government applied to the contractors. Fed government should also be smart enough to remove secret work from a remote networked machine. This article shows the US's pompous attitude towards IT.
Trying to install linux on my microwave, but keep getting a kernel panic...
This is probably an inside job to make anti-Chinese FUD, along with instigating Tibetan separatist movement.
Why are any of these sensitive networks connected to the Internet? Its just the ultimate in stupidity. Like the hackers who broke into the power grid in a day. Why the hell is the power grid being hooked to the Internet? They may as well install webcams in all the Pentagon offices so we can see what they are doing all day.
Why the hell are these computers connected to the internet? (Ditto for computers controlling power plants and the power grid.)
That's exactly what the slashtards (you included) have missed. The Chinese aren't getting a significant amount of classified material. They are, however, mining terabytes of sensitive but unclassified information to put together a very sophisticated picture of our weaknesses. Hopefully they don't intend to attack, but the next war will be the same as WWII ... a war in the pacific over oil resources.
"Secret," my left nut.
USAF is putting it's scare-tactic recruitment propaganda on during prime-time TV, replete with all the current buzzwords.
I love the way the article makes figuring this email out sound like rocket science. "three cyber security specialists" worked out the path the email took, as if no-one else can read Received lines. (Yeah, sure, sometimes there are forged Received lines added to confuse the issue, but IME they're virtually always easy to spot.) And, oh my goodness, 3322.org is registered in Changzhou, China! As anyone who nows how to use whois (or even simpler, web sites like samspade or domaintools) could determine in 30 seconds.