World Bank Under Cybersiege In "Unprecedented Crisis"

JagsLive sends in a Fox News report on large-scale and possibly ongoing security breaches at the World Bank. "The World Bank Group's computer network — one of the largest repositories of sensitive data about the economies of every nation — has been raided repeatedly by outsiders for more than a year, FOX News has learned. It is still not known how much information was stolen. But sources inside the bank confirm that servers in the institution's highly-restricted treasury unit were deeply penetrated with spy software last April. Invaders also had full access to the rest of the bank's network for nearly a month in June and July. In total, at least six major intrusions — two of them using the same group of IP addresses originating from China — have been detected at the World Bank since the summer of 2007, with the most recent breach occurring just last month. In a frantic midnight e-mail to colleagues, the bank's senior technology manager referred to the situation as an 'unprecedented crisis.' In fact, it may be the worst security breach ever at a global financial institution. And it has left bank officials scrambling to try to understand the nature of the year-long cyber-assault, while also trying to keep the news from leaking to the public." Update: 10/11 01:15 GMT by T : Massive spyware infestations might be good cause to reevaluate the TCO of non-Windows systems on the desktop.

Comments

This was bound to happen.

[Anonymous Coward]

These days financial institutions consider IT (and other) security as something that costs them money, without giving them any benefit.

Will this wake them up?

I hear the question "Can we afford"? when talking about security in IT shops. The question that I am coming back with is "Can we afford not to"?

Just how many more banks machines are compromised? How about Federal and Local Government's machines and networks.

If you had enough financial data somebody could cause an economic collapse - I wonder what it would look like.

Re:This was bound to happen.

[g0es]

These days financial institutions consider IT (and other) security as something that costs them money, without giving them any benefit.

Will this wake them up?

I hear the question "Can we afford"? when talking about security in IT shops. The question that I am coming back with is "Can we afford not to"?

Just how many more banks machines are compromised? How about Federal and Local Government's machines and networks.

If you had enough financial data somebody could cause an economic collapse - I wonder what it would look like.

For most financial institutions their primary goal when it comes to information assurance is to pass audits. As you stated security is usually a cost center and they do what ever they can to keep that cost down. This generally means doing just enough work to make them compliant and as well all know, compliant != secure. I do not beleive these incidents will change anything unless the financial institutions are forced to a higher standard. I will continue to hope that they will see the light.

Re:This was bound to happen.

[wkk2]

Why wasn't all traffic limited to white listed addresses and that traffic limited to VPN connections using tamper resistant encryption hardware?

Re:This was bound to happen.

[ScrewMaster]

If you had enough financial data somebody could cause an economic collapse - I wonder what it would look like.

Probably something like this.

Re:This was bound to happen.

[dcollins]

"Will this wake them up?"

Highly doubt it. The problem with IT security breaches is that they're like earthquakes, flooding, or stock market crashes. They're too rare, too big, and too uniformly disastrous -- there generally won't be enough people left who remember it next time to do anything about it.

Re:This was bound to happen.

[conlaw]

It's not just financial institutions; every company I or a friend has worked for, has considered legal, accounting and IT "as something that costs them money, without giving them any benefit."

Obviously, we workers in those areas aren't making money for the company and it's virtually impossible to get them to understand how much money we have saved them by refusing to assent to a bad contract or by preventing the spread of malware by requiring strict adherence to the rules about what programs may be used on a machine.

As Pete Seeger wrote, "When will they ever learn?"

Re:This was bound to happen.

[ScrewMaster]

These days financial institutions consider IT (and other) security as something that costs them money, without giving them any benefit.

Will this wake them up?

I hear the question "Can we afford"? when talking about security in IT shops. The question that I am coming back with is "Can we afford not to"?

Just how many more banks machines are compromised? How about Federal and Local Government's machines and networks.

If you had enough financial data somebody could cause an economic collapse - I wonder what it would look like.

For most financial institutions their primary goal when it comes to information assurance is to pass audits. As you stated security is usually a cost center and they do what ever they can to keep that cost down. This generally means doing just enough work to make them compliant and as well all know, compliant != secure. I do not beleive these incidents will change anything unless the financial institutions are forced to a higher standard. I will continue to hope that they will see the light.

Under ordinary economic circumstances you would be absolutely correct, i.e., why should they care about security, leaks don't cost them anything. Right now, though, they're being hit in the parts of their anatomy they love best ... their wallets. Furthermore, as many people have pointed out the survival of banking institutions is as much a matter of perception as it is liquidity, and I know how I perceive the World Bank Group right about now. It doesn't take much for already-skittish investors and bank customers to start shifting their money elsewhere. In this case, WBG has taken a big hit in the trust department, and the only way out of this is to invest big in security, and hope people believe them when they say they've fixed the problem.

Re:This was bound to happen.

[ScrewMaster]

Because bankers are traditionally among the cheapest bastards on the planet. Rich people frequently are ... it's part of why they got to be rich in the first place. Furthermore, in the modern world the contents of a bank's hard drives are much more valuable than what's in their steel-lined vaults. I don't think they've fully come to grips with that, or they'd have spent more money on information security.

Re:This was bound to happen.

[Skal Tura]

Doesn't help if a whitelisted host is aswell infected. No single technique, or category of security is enough, it needs multi-tiered, multi-level security in cases such as this. All task specific.

Furthermore, there shouldn't be a single "full access" account, except for "root", and anyone working on root access would need to be required to work as a team of 2 or 3 persons, all coming from separate divisions/offices/departments, no prior contact, randomly chosen. Why?

Humans are always the weakest link in security, and if someone is being watched when working on a server maintenance, the second fellow could report such an incident. Offer an prize for bringing up if there's a suspicion, immediately bringing that server down, and even if it was a failed suspicion, there should be somekind of reward for just being suspicious.

This data is too critical to let any single person to have access in privacy. every action taken on the server should be logged, and automatic heuristic analysis done on it. Aswell, for all data in and out, network or removable media. It is all doable, given the right persons to do it, it's even cost-effective.

Automation is the key to cut costs.

There's plenty of methods to do something with high security, given creatively, sane, suspicious people planning for all of it.

My 2 cents.

Re:This was bound to happen.

[alexborges]

Youve seen the news?

Re:This was bound to happen.

[upside]

I'm sure you're right. The World Bank, however, is not a bank per se, more a non-profit organisation. Not saying' they'd be any better in terms of investing in IT security.

Re:This was bound to happen.

[Venik]

Banks and insurance industry treat IT as overhead and so they get what they pay for. Not to mention that most of these companies outsource IT support to the lowest bidder, which, in turn is either based in India, China, etc. or has subcontractors in these countries. The impact on security is not unexpected. I work with some of these guys on a regular basis and I am not particularly impressed with their technical skills or their adherence to security procedures. Not to say they don't have competent people, it's just their numbers are heavily diluted with amateurs.

Re:This was bound to happen.

[blhack]

PHBs don't understand logical security. They'll let you spend millions building a secure data center complete with armed guards and several layers of biometric security, but cannot understand why you need the same amount of money to buy security devices that only take up small amount of physical space.

My suggestion is that you spend a couple million building three redundant clusters of the most expensive IBM boxes you can find all to run the basic things you need like OpenVPN.

Re:This was bound to happen.

[jgtg32a]

While I do agree that security isn't were it needs to be, I don't think its really totally ignored. It only takes one little slip for it to all spill over. Wells Fargo IIRC there was 1 machine that didn't have its USB ports locked down and the "hacker" used that to steal the information. And I think it was Citigroup's data was stolen because someone grabbed it off of the mail truck. It wasn't encrypted but they were in the process of rolling encryption out to mailed data w/in the year. Then again TJX is an exception to the above.

Re:This was bound to happen.

[ScrewMaster]

I'm sure you're right. The World Bank, however, is not a bank per se, more a non-profit organisation. Not saying' they'd be any better in terms of investing in IT security.

Oh sure, but this kind of thing has been happening at financial institutions and other information-aggregators for some time now, and for pretty much the same reason.

Re:This was bound to happen.

[TubeSteak]

Furthermore, in the modern world the contents of a bank's hard drives are much more valuable than what's in their steel-lined vaults. I don't think they've fully come to grips with that, or they'd have spent more money on information security.

Insurance companies act as private regulators in a 'free' market.

Banks buy insurance for the contents of their vault, meaning their insurance company effectively dictates the minimum requirements for the bank's physical security. Higher cost security is balanced against lower insurance rates.

Physical security is a mature field.
Internet security is not and probably will not be for some time.

Re:This was bound to happen.

[TheMooose]

...their primary goal when it comes to information assurance is to pass audits.

This is exactly what I saw throughout the banking industry for 5 years. Most institutions hire out to a firm like Icons, Inc yearly for an automated scan that returns what amounts to a report card for the corporate officers to first overreact to and then utterly ignore. They turn it over to their developers who assure them the holes are closed and they forget about it until next year; when they undoubtedly receive a very similar report.

I have not seen many organizations who were willing to do more than what the FDIC or NCUA minimally require.

I fear it will take a *very* destructive event for them to get the message on their. Unfortunately it will be their customers or members who take the bigger beating in the long run as it's commonplace for them to simply pass on costs instead of taking responsibility for their actions or inaction. I'd suggest the FDIC and NCUA stop playing politics and take security seriously instead of pandering to the lowest common denominator. They seem to be the only real motivator that the institutions listen to.

My $0.02

Re:This was bound to happen.

[ScrewMaster]

As Pete Seeger wrote, "When will they ever learn?"

They've had centuries to figure this out. Apparently they still haven't. I feel safe in assuming that they never will.

Re:This was bound to happen.

[rickb928]

At the financial institution where I work, It and data security are considered core values, and have these defined ricks and benefits:

- Financial harm to partners of all types, resulting in potentially destructive financial impacts.

- Loss of prestige, damage to brand image, and ultimately loss of business with diminished profitability and potential business failure.

- Increased regulatory oversight, increased costs, and damage to brand image.

- Legal sanctions that can result in business failure.

This organization sees IT and data security as both a part of the business and a necessary function. As necessary as processing transactions and paying employees. It is a core value in more ways than I can disclose here, and there are several security officers high up on the org chart. Higher than my boss...

Not all organizations see it the same way. Now to get the l0sers to change their attitudes...

Re:This was bound to happen.

[FridgeFreezer]

Secure or not, most big boxes have backdoors anyway - they're not exactly documented but they could be stumbled upon, or, as is more likely with the Chinese, discovered whilst reverse-engineering the kit. Also, without spending vast sums of cash, there's no such thing as a secure WAN - unless your traffic goes from A to B on a sealed and tap-proof bearer (and even a direct point-to-point fibre can be monitored) there are hundreds of points of potential transparent intercept.

Re:This was bound to happen.

[catxk]

These days financial institutions consider IT (and other) security as something that costs them money, without giving them any benefit.

I'm not sure you have understood the World Bank as a financial institution. They are in the business of things that costs money without giving any benefit. It's what they do. And they do it good.

Re:This was bound to happen.

[socz]

I agree with you that compliant != secure.

For example, because I work with sensitive financial information I am required by law to take the GLB certification. http://en.wikipedia.org/wiki/Gramm-Leach-Bliley_Act

While I am certified and "learned" that i shouldn't be plugging in usb flash drives to my computer (hahaha) honestly, what's to stop anyone from doing so?

We have awesome technology and security solutions, but it's like my God Father's story on a Japanese Island, the CO would send his men every day to die trying to take a hill because that was his orders... fresh on the battle field they had no chance. They went through CO's daily. Their superiors don't have a clue as to what the situation really is because they are so far removed. The same thing here.

I got tired of trying to help (which is only bad if you never try at all) but using public upload sites (such as mega share) for VERY CONFIDENTIAL INFORMATION is ridiculous to me! It's sad that my GhettoBSD server at home is a more secure method of transferring files than some people's.

Then again, I'm not in IT so WTF do I know about security RIGHT???!??!

Re:This was bound to happen.

[jvkjvk]

Furthermore, in the modern world the contents of a bank's hard drives are much more valuable than what's in their steel-lined vaults.

Yes, but valuable to who? Do the banks lose any money if the info is hacked? If there is no financial cost to these break ins at the institutions where they happen why in the world would such a profit oriented institution spend any money beyond the bare minimum to ensure they aren't jailed for malfeasance (although I would argue that doing so in itself is malfeasance)?

I don't think they've fully come to grips with that, or they'd have spent more money on information security.

They will only spend more money on information security when it becomes DIRECTLY more costly or DIRECTLY more risky (e.g. probability of COST) to hold off. This news does nothing to counter my viewpoint - no actual loss occurred (no fines, no assets moved, no nothing) to the Bank itself. All actual loss occurred to the groups that had their data stolen. As long as institutions can say "Whoops!" and everything goes along it's merry way nothing will change.

Re:This was bound to happen.

[Artifakt]

What you're suggesting sounds almost like Military grade security, where there is often a 'two man rule', and no single person can be alone at the only terminals physically connected to certain assets. I'd amend your suggestion in just that way, not only is the data too critical to allow any single person to have any guarantee of privacy while it is accessed, there should be a positive lack of privacy, both via logging, and via physical presence of at least two operators or an operator and supervisor team, in the room. And of course, teams should be rotated frequently, physical ID systems used as well, meaningful background checks done, and so on.
        Remember, for some military situations, this is taken as far as 'immediate armed response' and "If you are here legally, you have given up your right to a civil trial" and even "If you open this door, you will die" rules. We're discussing going about half way to that level of security, for financial institutions that have enough significance in the modern world their collapse could effectively ruin just as many people's lives as a whole nation physically falling to an outside army. Probably a lot less than half way if you still allow some remote access, and particularly removable media use. If the low budget approach you suggest still looks too pricy to the businesses involved, it's a fair question to ask "Compared to what?"

Re:This was bound to happen.

[Skal Tura]

idk what military has really or does, security wise, what i described, i came up while writing.

I didn't particularly suggest low budget, just that financial institutions tend to be too precise for every euro or usd. Automation can cut costs a great degree.

Infact, reading your reply, i thought, maybe these assets SHOULD be protected by military? With finances, you can spread very bad devastation with a single flick of a button given too much access. Crumble the economy behind a nation, and their military will fall too, due to lack of budget.

Therefore, such an organization, should be considered as valuable as military, and as highly guarded as the highest security (nuclear warheads for example). Afterall, it's meaningless pennies on their scale of economics. Spending a million or two on that each month, that is. With military as assistance, they effectively get aswell subsidized for the protection.

However, we must also remember that DOD networks has been breached on a consistent basis, there was some documentary about it couple years back.

Physically it doesn't matter much where the servers locate, as long as it's secure location. There could be a NOC style command room with rotating staff, military supervised security practices, where when sysadmins work on a server, they watch a big screen which can be watched by everyone in the room. Military is very disciplined, therefore, even attempting to maneuver anything suspicious is a huge dare.

Re:This was bound to happen.

[JoelisHere]

This generally means doing just enough work to make them compliant and as well all know, compliant != secure.

Or doing less than enough work and more than enough lying to the auditors to pass an audit, passed audit != complaint.

Re:This was bound to happen.

[DiegoBravo]

>> For most financial institutions their primary goal when it comes to information assurance is to pass audits

Totally agreed. Now, thinking about why it is that way, I suspect several factors contribute but at least from my experience:

1) The security audits, despite low in tech quality, are a lot of burden to comply, being counterproductive: most of the times just struggle in order to provide the "look" of a more secure environment from the point of view of a lawyer... At end of the year, the institution really spent a lot of resources and/or time in order to be compliant, instead of working toward a really more security environment.

The auditors should try a bit to explain the involved security risks and not reducing all to disagreements with the silver-bullet policies like PCI.

2) The financial institutions have a longer than average experience in internetworking, so they carry a big inertia from legacy systems (for example, there is a prevalent idea that hackers can't harm SNA networks)... so it is difficult to make a case that the current internets are a lot different than 20 years ago and require a totally different strategy.

Re:This was bound to happen.

[TubeSteak]

This news does nothing to counter my viewpoint - no actual loss occurred (no fines, no assets moved, no nothing) to the Bank itself. All actual loss occurred to the groups that had their data stolen. As long as institutions can say "Whoops!" and everything goes along it's merry way nothing will change.

Reputation is an asset, especially in banking.
Banks and Corporations spend millions on advertising to build up their brand.

The World Bank has been having some rough times recently, Wolfowitz last year and now this.
When they get publicly embarrassed/humiliated/[adjective] it damages their reputation.
Though their reputation is intangible, the cost to repair the damage is not.

Re:This was bound to happen.

[gadget junkie]

Because bankers are traditionally among the cheapest bastards on the planet. Rich people frequently are ... it's part of why they got to be rich in the first place. Furthermore, in the modern world the contents of a bank's hard drives are much more valuable than what's in their steel-lined vaults. I don't think they've fully come to grips with that, or they'd have spent more money on information security.

That's only part of the answer. Burocrats, whatever their income, are also the most coward race on Earth, so they'd usually spend on security. the key point here is that to them computers are appliances: they know next to nothing about how they work.

The moment they need to know, like in this case, they usually revert to type: since computers were a problem, they'll try to avoid them, and the blame involved, by setting up some kind of "commission" to set up a "standard", ignoring the fact that a defined and documented standard is weak in the face of determined hackers.

Re:This was bound to happen.

[blair1q]

Physical security is a mature field.
Internet security is not and probably will not be for some time.

Sure it is. I've had this printed out and posted on the bulletin board behind my head for about 24 years now:

THE INTERNET IS NOT SECURE

That's all the maturity any Internet Security personnel need.

Re:This was bound to happen.

[bertok]

When I was studying computer science at university, I had read about all these fancy cryptographic techniques, and I imagined that banks were these encrypted, firewalled fortresses of IT security, monitored by the most competent, most vigilant administrators.

I was very wrong.

Let me tell you about my experience of IT security in banks.

A couple of years ago, I was sent to one of Australians largest banks. I was there for a 1 week engagement to install the latest virus scanner software on some servers. It sounded like a great opportunity to have a look at some high-end systems and see how they were managed. So I turn up in the morning, and start unpacking my laptop, when the project manager warns me:

"Don't plug your laptop into the network. We have to make sure you have the latest patches and AV first."

I fully understood his position, of course, they couldn't just let some random guy plug some a laptop into the network. It was a bank after all, security matters. I was Wrong. He corrected me:

"Oh no.. that's for your own protection! There's hundreds of viruses on this network, if you plug an unpatched machine into it, it'll be infected in seconds."

I was stunned. He wasn't even joking. I did plug my laptop in (which was well patched), and ran Ethereal for a few minutes, during which time I saw several viruses attempting to hack my machine. It was incredible. I've never seen that kind of attack rate anywhere, and I've been to large, unfirewalled university networks and school networks.

In fact, I didn't even really need to plug myself in. There was a WiFi connection available, with an easily recognisable SSID (the name of the bank). Of course, it was unencrypted, unsecured, and plugged directly into the desktop LAN.

Next, I got a tour of the data center, which was an eye-popping experience in itself. The bank had recently invested in fancy new retina-scanning door locks. It looked like it was straight out of a James Bond movie. However, it was taking too long to program in every person who needed access into the system, so they had simply propped the door open with a bucket. The inside of the room was just as scary. I walked past DOS machines, Windows 95 "servers", and I saw at least one NT 3.x machine. This was in 2005.

Eventually, I got around to planning the AV software upgrade. Except it wasn't. It was first-time-install, because the majority of their servers had no AV. The amount of work required to verify compatibility during for a the rollout was deemed too expensive, and I never did get to install the AV software. They did buy the licenses though, so it's entirely possible they installed it themselves. It's possible, but I wouldn't bet on it.

Re:This was bound to happen.

[jhol13]

I do not beleive these incidents will change anything unless the financial institutions are forced to a higher standard.

I sincerely hope you mean subprime (and "futurea") ...

Re:This was bound to happen.

[m0rph3us0]

Please explain how having financial data could cause an economic collapse?

Is this similar to the Lehman Brothers theory that if no one knew they had no assets they would not have sold their stock?

Are you saying that not knowing which nations are bankrupt is a good thing?

Re:This was bound to happen.

[1lus10n]

I tend to think the reason that data or "logical" security is not viewed as mature is more linked to the dynamics of the situation.

Steel from a Bank in the US, EU, Canada etc from a location in North Korea, China, Venezuela etc. Even if you get caught your probably not going to jail. Further than that there is no physical limitation. Physical limits are harder to overcome in terms of cost, time, visibility etc than logical limits will ever be.

(ie the wild west was the wild west not because they didnt know how to secure things, but because people were still willing to risk stealing things despite the cost. The barrier to entry is that low in logical security.)

Re:This was bound to happen.

[francium de neobie]

It looks like no major financial damage has been done yet.

When someone has finally squandered a few trillion dollars from banks, they'll begin to notice...

Re:This was bound to happen.

[chishm]

A couple of years ago, I was sent to one of Australians largest banks.

Which bank?

Re:This was bound to happen.

[dcollins]

"They happen DAILY and are attempted every second of every day."

Not actual breaches at a specific company where you're working. If the brass at Company A only deals with one massive data-theft every 20 years, then they can ignore the whole issue for pretty much their whole career.

And so they will.

Re:This was bound to happen.

[Locomorto]

Commonwealth Bank! *Note to non-australians: This is a joke, or atleast, I hope it is. It has to do with their advertisements, which use that catch phrase.

Re:This was bound to happen.

[SlashDev]

If you're able to surf the web, I don't care how resistant your encryption is, you are basically toast!

Re:This was bound to happen.

[Eunuchswear]

THE ROAD NETWORK IS NOT SECURE

So we can't transfer money by road?

Re:This was bound to happen.

[Eunuchswear]

ignoring the fact that a defined and documented standard is weak in the face of determined hackers.

Argument for security by obscurity?

You'd prefer to roll your own security, rather than using defined and documented standards?

TLS is easy for determined hackers to break because it's defined and documented?

Re:This was bound to happen.

[Eunuchswear]

Secure or not, most big boxes have backdoors anyway - they're not exactly documented but they could be stumbled upon

[citation needed]

Re:This was bound to happen.

[MonoSynth]

What happens when their reputation is ruined? Will we vote for another World Bank? Will an almost-bankrupt African (or Northern) country decide to work with another World Bank to fix their economy?

Re:This was bound to happen.

[Knuckles]

THE ROAD NETWORK IS NOT SECURE

So we can't transfer money by road?

We can, but we better use the proper precautions.

Re:This was bound to happen.

[ultranova]

Offer an prize for bringing up if there's a suspicion, immediately bringing that server down, and even if it was a failed suspicion, there should be somekind of reward for just being suspicious.

So basically, you are suggesting rewarding making false accusations against unfamiliar people and bringing down the servers needlessly. Gee, I wonder what unintended side-effects that could have ?

Re:This was bound to happen.

[Skal Tura]

Punishment for obvious abuse would be a necessity, thinking beyond of written text is allowed, even recommended.

Re:This was bound to happen.

[fractoid]

Generally airing your clients' dirty laundry in public is a great way to not get re-hired (or to get sued for breach of confidentiality). Just sayin.

Re:This was bound to happen.

[FridgeFreezer]

Well I'm not about to document something like that in any further detail, at best it would get me fired. Do you really believe that the big network boxes have nothing in their vastly complex OS other than what's documented for the end user? If you were writing the OS for a beastie like that you'd at least stick a few "factory" commands in there to help unravel things when the customer stuffed it right up.

As for the relative security of any external link, I work on those links from analogue private wires to terabit fibres and haven't found a properly secure transmission medium yet - probably why people are so very keen on the whole quantum thing.

Re:This was bound to happen.

[ultranova]

Punishment for obvious abuse would be a necessity, thinking beyond of written text is allowed, even recommended.

So basically, if a world bank employee suspects something and reports it, he may be punished or rewarded for it, depending on someone else's opinion on what is or is not obvious. This means that only those who are after the reward - the people who are most likely to be dishonest - will bother, as everyone else will be deterred by the potential punishment.

Re:This was bound to happen.

[Skal Tura]

yet again you are a showcase example of unability of thinking beyond written text.

Obvious abuse would be something like, reporting very same kind of incident for the 3rd time around, or something which clearly is not a suspicious activity.

Re:This was bound to happen.

[ultranova]

yet again you are a showcase example of unability of thinking beyond written text.

Then perhaps you should express your ideas in the text itself so I don't have to try to guess what undoubtedly ingenious thoughts you didn't bother writing down.

Obvious abuse would be something like, reporting very same kind of incident for the 3rd time around,

So an employee can get two rewards for false alarms, after which it is in his best interests to ignore any further suspicious activity ?

or something which clearly is not a suspicious activity.

And who judges what is or is not "clearly not a suspicious activity" ?

Try to understand: a system which gives out punishments must define the conditions under which it gives them out exactly, because otherwise it will degenerate into arbitrary decisions or outright abuse of power by those who have it, and ass-covering by everyone else. That is why the real-life laws are so complex: they must try to define exactly what is punishable and what is not.

In the system you've described, an employee who notices something suspicious would best serve his own interests by pretending to not notice.

Re:This was bound to happen.

[Corbets]

Reputation cost?

Opportunity cost when a competitor gets ahold your intellectual property?

Remediation/repair cost? (nowhere near as significant as the first 2)

Believe me, this shit ain't free, and execs know that. TubeSteak pointed out in another post that IT-Sec is not a mature field, whereas physical security has been evolving for millenia. This lack of maturity, this lack of pervasive knowledge on best security practices, is probably why vulnerabilities in their networks still exist. A few mistakes by those of us on the line, and bam, there are holes available for exploitation.

Throwing money at a problem doesn't fix it, sadly, and execs are smart enough to know that. There's a lot of complex issues at work that need to be changed everywhere within the company. Given the amount of money major financial institutions spend on this stuff, I can assure you, they don't just say "Whoops!" and send everything along the way.

Re:This was bound to happen.

[daveryan]

Considering how dirty the laundry actually was, sometimes you just don't want to get re-hired to clean it. Even in these credit crunch times, some jobs are too shitty.

Re:This was bound to happen.

[Eunuchswear]

If you were writing the OS for a beastie like that you'd at least stick a few "factory" commands in there to help unravel things when the customer stuffed it right up.

Would I? I don't think so. Certainly nothing that didn't need physical access to the machine. If the customer "stuffs it up" he can hit the reset button.

As for external link security - of course there is none. That's why you use encryption, right?

Re:This was bound to happen.

[FridgeFreezer]

I think you're gonna need a bigger box. I'm not blowing smoke up your arse here. Here's a clue - the US Government places restrictions on the available encryption capabilities of all network equipment sold in certain geographies.

Encrypting anything over an external link still has the flaw that you have to handshake/authenticate over that link (or some other equally easily monitored link). If any currently available encryption was up to much, no-one would be that interested in quantum cryptography, which is just about the only way to guarantee stuff hasn't been intercepted. Saying current encryption is OK is like saying DRM has stopped piracy.

Re:This was bound to happen.

[chishm]

As pointed out above, it was intended as a joke. The Commonwealth Bank is Australia's largest bank, and a few years back used the catch phrase "Which Bank? Commonwealth Bank" in their advertising.

I don't actually want to know which bank it was. Ignorance is bliss and the banks are all probably as bad as each other, but I can still pretend that my bank is well-behaved and secure,

Re:This was bound to happen.

[fractoid]

Oh. *smacks head* I c wot u did thar.

In my defense I was kinda slightly quite drunk at the time. ;) Also that bank ad was slightly before my time.

Good

[ShieldW0lf]

Sounds good. Hope it ends up on Wikileaks. I predict there will be some highly deserving people burnt at the stake if that information gets out to the public.

Re:Good

[iplayfast]

I expect the slashdotting will have an effect :)

Re:Good

[ShieldW0lf]

Do you know what was in the files that were stolen? Can you name names and numbers? Can you give me a list of participants?

No. So, shut the fuck up. The only thing that's been made public is that there was a breach. Not what the breach revealed.

Re:Good

[John Hasler]

Perhaps. More likely, though, the information taken was stuff that could be (and probably was) used for insider trading when it was fresh but is quite boring and useless now.

I Hope They Destroy This Monster

[Philip K Dickhead]

It is an evil instrument, of human enslavement and degradation.

It is empire, with shackles of dependency and credit.

It kills children by starvation, as it extracts demands for medicines.

It is Satan's rectum, poised over the third-world.

Re:I Hope They Destroy This Monster

[grub]

It is Satan's rectum, poised over the third-world.

Best slashdot line in ages.

Re:I Hope They Destroy This Monster

[DrVomact]

I agree that the Internet is evil, but don't you think we should give it just one more chance?

Re:I Hope They Destroy This Monster

[nacturation]

In communist China, does Satan's rectum poise over you?

Re:I Hope They Destroy This Monster

[Anonymous Coward]

So that's what that infamous picture was of.

Re:I Hope They Destroy This Monster

[Michael Restivo]

In support: I am a social scientist who does research in the world-system tradition. With my co-authors, we continue to find support for the idea that World Bank structural adjustment programs in developing nations increase, among other things: deforestation, species loss, and other degradation of the natural environment; adverse health outcomes, including higher rates of infant mortality; and generally, increases poverty, or at least economic stratification within a nation.

What continues to surprise me is that people remain unaware of the existence of dependent relations between nations, the exploitation inherent in the system, and the real harm it causes.

Best regards, -m

Re:I Hope They Destroy This Monster

[Mr. Firewall]

...or at least economic stratification within a nation.

Translation: "Increases opportunity, which SOME people make good use of... others don't."

Re:I Hope They Destroy This Monster

[tbannist]

Actually, I pretty sure that's a code for "The rich get richer and everyone else gets trod upon".

It's also true that some people make good use of that opportunity, the real truth is that most people will experience a decrease in their opportunities.

Re:I Hope They Destroy This Monster

[ultranova]

...or at least economic stratification within a nation.

Translation: "Increases opportunity, which SOME people make good use of... others don't."

That is partly correct. Economic stratification means that economic resources are allocated less evenly, which in turn means that the elite becomes richer and the rest poorer. This means that being part of the elite has bigger pay-off than in a less stratified society, so in that sense it does increase opportunity.

However, your implication that the people who aren't part of the elite only have themselves to blame for their situation is incorrect: by definition, only a small fraction of any given group of people can be part of the elite, so most members of a society lose when it becomes more stratified.

And yet this is not the whole story either. Since increasing stratification also increases the pay-off of being part of the elite, it also gives a bigger incentive to work towards that goal. If the society is otherwise well-functional - corruption is low and social mobility is high,which means free (tax-funded) education and social safety nets to allow easy upwards mobility and risky ventures such as starting a new business - then increased ambition will enrich it as a whole. This means that even the losers benefit, since while their relative position in their society is lower than it would be in a more equal one, their absolute position is higher.

The question is: what is the optimal level of stratification which best benefit the majority of the society's members, rather than just the elite ?

Well . . .

[arizwebfoot]

while also trying to keep the news from leaking to the public

Oops

--
Oh Well, Bad Karma and all . . .

so the chinese orchestrated the market meltdown

[circletimessquare]

previously, i thought the markets were melting down due to gay marriage

perhaps this is the obvious run up to 2012 and the end of the mayan calendar

paranoid schizophrenics, want to help me out here?

Re:so the chinese orchestrated the market meltdown

[MindlessAutomata]

Psychologically, you don't need schizophrenics, and their paranoid delusions are probably too far out there to be what you're looking for. Just stop with someone with delusional disorder.

Re:so the chinese orchestrated the market meltdown

[Gizzmonic]

Help out? Why, I'd love to!

Jesus is coming...in his magic spaceship. Holy Lord will unleasher...rivers of blood will melt..aAAAAGgGH AAGGGH MY FACE! STAY AWAY FROM MY FACE! ...

Hey mister, ya got 50 cents for bus fare?

Re:so the chinese orchestrated the market meltdown

[megamerican]

The people who are delusional are the ones who think you can fix the problem of inflation with more inflation.

There has been talk about closing down the international markets and starting a new Bretton Woods type agreement. Of course this new agreement has probably been written and just waiting for this crisis, just like the PATRIOT ACT was written before 9/11 and the current bailout bill was written back in March.

It is great to know that the institutions that helped create this mess are now the ones who will pose as the saviors of it. If you think that its accidental then you may be the one who is delusional. There was plenty of people warning about this crisis for many years (click the link in my signature to find them). Those people aren't some genius prophets, they just stated the obvious.

Remember that the primary function of government is to pretend to fail.

Re:so the chinese orchestrated the market meltdown

[avanderveen]

paranoid schizophrenics, want to help me out here?

I believe what you're describing is Fox News. Oh wait, and they're the source of the article. Hmm.

Credibility of journalism and reporting: 0.

Amount I trust Fox's version of the story: 0.

Personally, I'm going to wait until some sort of legitimate news organization gets some data. Preferably one that doesn't like to fear monger about other countries based on political biases.

Re:so the chinese orchestrated the market meltdown

[ScentCone]

Preferably one that doesn't like to fear monger about other countries based on political biases.

So, you prefer CNN or NBC or ABC or NPR or CBS, who fear monger about this country based on political biases? I mean, just so we're clear.

Re:so the chinese orchestrated the market meltdown

[FiloEleven]

The people who are delusional are the ones who think you can fix the problem of inflation with more inflation.

Well said!

(Nothing intelligent to add here, move along.)

Re:so the chinese orchestrated the market meltdown

[megamerican]

Thanks. Although it seems that one man's insightfullness is another man's flamebait.

Funny the Email is referencing External webmail

[phantomcircuit]

Well of course I can't be certain but this appears to be ntohing more than a breach of their email system (encrypt your damn email people).

From the leaked memo "MD and CIO has directed that all external Webmail accounts be disabled immediately for all staff who have not changed their passwords yet"

Re:Funny the Email is referencing External webmail

[piemcfly]

"a minimum of 18 servers have been compromised," including some of the bank's most sensitive systems â" ranging from the bank's security and password server to a Human Resources server "that contains scanned images of staff documents."

seems like a lot more than an email server to me.

In the official report it says:

We do know that 3 main servers have been breached (...) an HR server that contains scanned staff documents (...)
As of 09/09 we have determined that 5 of the compromised servers contain sensitive data

Re:Funny the Email is referencing External webmail

[Anonymous Coward]

Uhh you fail at reading, from TFA:
"In plainspeak: "They had access to everything," says the source. "They had the keys to every room at the bank. And we can't say whether they still do or don't until we fully and openly address what's happening here."

Re:Funny the Email is referencing External webmail

[deets101]

I guess that "Elf bowl" tournament was a really bad idea!

Re:Funny the Email is referencing External webmail

[psydeshow]

Email is all you need in a lot of systems. As in "Forgot your password? Click here to reset it." and a new password gets sent to your email address.

Game over.

Oddly enough, email accounts should have much stronger protection than just about anything else.

Re:Funny the Email is referencing External webmail

[nmos]

From the leaked memo "MD and CIO has directed that all external Webmail accounts be disabled immediately for all staff who have not changed their passwords yet"

Not to worry, I've already emailed them with a handy link to click on to log in and confirm their identities. They'll all be secured shortly.

Fox is like the National Enquirer

[NobleSavage]

I'd really like to read about this from a source other than Fox news.

Re:Fox is like the National Enquirer

[eln]

Hi.

Apparently, the World Bank is under cybersiege in an "Unprecedented Crisis". Turns out they've been hacked repeatedly, apparently from China.

I have a 5 digit Slashdot ID, so I think you can count on me being a reliable source. I got the information from a Slashdot story as well, so you can be pretty certain it's completely accurate.

Re:Fox is like the National Enquirer

[Migraineman]

C'mon, Fox News isn't just great, it's sensational!

Re:Fox is like the National Enquirer

[binaryspiral]

I'd mod you up, but I read on Fox News that Slashdot was full of Chinese hackers.

Re:Fox is like the National Enquirer

[DaveV1.0]

Let me guess, you would believe it if it were on MoveOn.org, right?

Re:Fox is like the National Enquirer

[dmeranda]

> I'd really like to read about this from a source other than Fox news.

You are, it's called /. -- It's about the furthest thing from Fox you can find.

And if you wait a few moments until the global news oligopoly passes the story to all the other rags it owns, you can read the exact same text elsewhere too: http://news.google.com/news?hl=en&q=world+bank+computer+intrusion

Oh, I'll one-up-you on the Troll...at least it's not the New York Times; there's a chance that this story is not made up fiction.

Re:Fox is like the National Enquirer

[msuarezalvarez]

Wow. The way you skillfully explained the joke for the idiotic audience is simply awe inspiring!

I can only guess you have authored at least half the the last 10 years of Hollywood films, haven't you?

Re:Fox is like the National Enquirer

[doomicon]

To add more credibility, I concur with my fellow poster with my 4 digit ID.

Re:Fox is like the National Enquirer

[iplayfast]

I'd mod YOU up but I heard that moderators were full of Chinese hackers.

(oops did just say that out loud?)

Re:Fox is like the National Enquirer

[xerxesVII]

That's pretty clever, BountyX! Too bad I don't have any mod points for you.

Re:Fox is like the National Enquirer

[relguj9]

The Fox Enquirer.. I like it.

Re:Fox is like the National Enquirer

[ScrewMaster]

And I'd mode you up, but I heard that the moderators are Chinese hackers.

Which would probably explain a lot.

Re:Fox is like the National Enquirer

[ScrewMaster]

Yes, well, all that 4 digit ID means is that you've wasted that much more of your life than I have.

Re:Fox is like the National Enquirer

[kungfugleek]

And I'd hack up chinese mods, but I heard you're full of crackers.

Re:Fox is like the National Enquirer

[CRiMSON]

Being a 4 digit Slashdot ID, I can honestly tell you my comrade above me has no idea what he's talking about.. move along nothing to see here..

Re:Fox is like the National Enquirer

[Electron]

I'm just here to say these two young slashdotters have definitely seen the truth, though they still have a lot to learn from us 3 digit IDers.

Re:Fox is like the National Enquirer

[DrLang21]

When I saw that it was from Fox News, I thought it was April 1st.

Re:Fox is like the National Enquirer

[An ominous Cow art]

My id has only three distinct numbers, can I be an honorary 3-digiter?

Re:Fox is like the National Enquirer

[Greyfox]

Ni hao! I has MOD POINTS for sale! +1 insightful 5 dowwah! Oh no, I posted in the article!

Re:Fox is like the National Enquirer

[Electron]

I shall send word of you to the Council.

Re:Fox is like the National Enquirer

[NeoSkandranon]

Slashdotters need to realize there is a diminishing return on the credibility that goes along with low UID.

After all, at some point it means they're old enough to maybe be going senile ;)

Re:Fox is like the National Enquirer

[ocularDeathRay]

I am only posting this as a way to see how many digits MY slashdot ID has.

Re:Fox is like the National Enquirer

[keithjr]

And I'd mod you up, but I don't have any mod points.

They were stolen by Chinese hackers.

Re:Fox is like the National Enquirer

[Hyppy]

at least it's not the New York Times; there's a chance that this story is not made up fiction.

I KNEW that the whole NSA domestic spying thing was a crock of shit! Silly New York Times, making up and then breaking sensationalist crap like that.

Re:Fox is like the National Enquirer

[northstarlarry]

Strongly agree. There is no other article found in a google news search for relevant terms. This has a distinct aroma of bovine excrement to me.

Re:Fox is like the National Enquirer

[dillon_rinker]

I confirm that this story is true. I read about it in the parent comment.

Since my /. ID is even lower than the parent commentor's, this is an even stronger verification of the story's accuracy.

(P.S. This is how actual journalism works.)

Re:Fox is like the National Enquirer

[Quiet_Desperation]

You are, it's called /. -- It's about the furthest thing from Fox you can find.

You're right. Fox News manages to actually have an accurate summary once in a while. :)

Re:Fox is like the National Enquirer

[qzjul]

one of the factors of my ID is a 4 digit prime...?
4273 !
hard to compete with these god's of low-numberage...

Re:Fox is like the National Enquirer

[qzjul]

err make that 4723... incidentally the typo is prime as well!

Re:Fox is like the National Enquirer

[aonic]

lower numbers of digits in the UID would me a lot more if they were displayed in binary.

Re:Fox is like the National Enquirer

[sanjacguy]

Actually yes. Wouldn't an equilibrium point of bias be better?

Re:Fox is like the National Enquirer

[R2.0]

"I'm just here to say these two young slashdotters have definitely seen the truth, though they still have a lot to learn from us 3 digit IDers."

I dunno - I had a discussion with a 2 digit UID owner yesterday and I think he was senile.

Re:Fox is like the National Enquirer

[doomicon]

More than you know... this is my second account, forgot my first registered account info way back when and re-registered... lol!

Re:Fox is like the National Enquirer

[RiotingPacifist]

I find the pining the blame on china fairly amusing, giving that only 2 attacks came from there, surely the attack came from wherever none of the attacks. Im guessing the guys hacking into the world bank arnt skript kiddies and would launch all their attacks from botnets to make sure they dont get caught. What worries me is that TFS makes it sound like they knew about the break ins but didnt shut the system down, I mean if you found your bank had been broken into surely you wouldn't just keep business as usual on Monday.

However because i cant find a reputable source carrying this story I'm not sure this is the case.

Re:Fox is like the National Enquirer

[BountyX]

Comon redundant? I was trying to be overly obvious in true fox style reporting.

Re:Fox is like the National Enquirer

[RiotingPacifist]

No because its generally complete bollocks.
The whitehouse was giving them the angles for their "news" stories for months!
Fox banned The Simpsons ripping into Fox News because "viewers may confuse the clip for real news"
They cut to commercials when a 12 year old south Oestetian disagrees with their "facts" (she was fucking there)
Bill "we'll fucking do it live" O'riely thinks he needs to clarify to his viewer that black people eat (wtf did they think before)

This isnt just about being partisan, it's about not liking shitty "news" sources ( huffington post / salon / 236 are no better)

Re:Fox is like the National Enquirer

[kevinwal]

I concur with your protestations despite other concurrences.

Re:Fox is like the National Enquirer

[zapakh]

I wondered where the 2-digitters had gone.

Re:Fox is like the National Enquirer

[Samizdata]

Hello, Slashdot Customer Support? I would like to report GreyFox (87712) for mod point spamming? He also offered me the lowest cost to powerlevel me down to a 4 digit User ID. Please ban him.

Re:Fox is like the National Enquirer

[monk]

I have a 5 digit Slashdot ID, so I think you can count on me being a reliable source. I got the information from a Slashdot story as well, so you can be pretty certain it's completely accurate.

I have a 4 digit Slashdot ID and I vouch for the absolute veracity of the parent, so don't bother fact checking, or I'll go crying to one of the 3 digiters and they'll show you what for.

Re:Fox is like the National Enquirer

[MerlinX420]

I feel dumb for reading this site for SO many years but never created an account till this year. Just wondering what my ID is so I gotta post sometime. (Just looked and it's over 1.3 mil. I really waited to long to make an account!)

Re:Fox is like the National Enquirer

[ScrewMaster]

To be honest, had I been aware of this place back then, I'd have wasted just as much time. Oh well. Better than watching Fox News, I suppose. At least here I occasionally learn something interesting.

Blaming the Chinese is useless

[Progman3K]

First thing I would do is launch my attack from a compromised host in country X while being in country Y

Re:Blaming the Chinese is useless

[Anonymous Coward]

First thing I would do is launch my attack from a compromised host in country X while being in country Y

Lastly, I would blame China. With most countries bring in a financial crisis, China would take the fall and bail us out.

Re:Blaming the Chinese is useless

[Nerdfest]

Sure, that's that they'd expect you to think.

Re:Blaming the Chinese is useless

[fprintf]

You fell victim to one of the classic blunders! The most famous is "Never get involved in a land war in Asia," but only slightly less well known is this: "Never go in against a Sicilian when death is on the line!" [laughs maniacally, then falls over dead]

Re:Blaming the Chinese is useless

[koafc2]

These countries X and Y are new to me. I will endeavour to visit them when possible.

Re:Blaming the Chinese is useless

[RiotingPacifist]

palin has an account on Slashdot?

Re:Blaming the Chinese is useless

[Progman3K]

Yes, but they would know that you would think that, and you would know that they know that you know that...
They'd know that you know that they know that you know that they know that you know that and knowing that...
You know what? Never mind...

reputable source?

[Bearpaw]

Does anyone have a link to a story on this from a reputable news source?

Re:reputable source?

[Anonymous Coward]

I believe GP said a reputable source.

Re:reputable source?

[Carewolf]

can you support the position that they are not a reputable news source?

Yes

citations + evidence please.

http://www.foxnews.com/

Re:reputable source?

[Hyppy]

Anonymous Coward wrote:

citations + evidence please.

Comedy gold.

Another financial crisis?

[Alex777]

It seems like banks find new ways to have crises every week.

Re:Another financial crisis?

[Elektroschock]

It seems like they talk about other negative news which don't mean a thing to overshadow the real bad news.

Ooh... Fox News says the IP address is from China!

[MarkvW]

Does the IP address indicate a Chinese intrusion, or is that just a spin?

0wn3d

[modemboy]

Damn, they got owned completely, 3 different times. Someone in their security department needs to get a clue. Somehow their offsite data store got accessed, then an IT consultant worker key logged them, and finally they got in again through a third party and escalated to admin rights.

3 different attack vectors, all completely successful. That is just kinda pathetic...

Re:0wn3d

[necro2607]

Frankly, it doesn't surprise me. As far as I've ever determined, if someone with extremely sophisticated knowledge of computer networks and OSes wants to get into a system, they will find a way. Especially a country with the population of China - can you imagine the size of computer-based espionage departments they could have going no problem? I used to know guys who were insanely skilled with finding exploits by just browsing through source code. I thought it was insane - I'd never know how to figure that out, but they would always find some minor flaw that was exploitable. Imagine a freaking team dedicated to doing that. Or even a team that takes network hardware components that are known to be used by this bank (that information can be easily gained via social engineering, no question). Reverse engineer the network hardware's firmwares etc., or even better, social-engineer the manufacturer to get in-detail system specs. I mean.. seriously, I'm not surprised at all, because someone (or some group of people) who's determined, organized and skilled enough could break into any damn system they wanted. That said, it's still fucking horrible and frustrating that such ultra-sensitive data is basically a "free-for-all" for someone for the past year or however long.

Re:0wn3d

[hesaigo999ca]

When you think they decide the worlds economy and how things relate on an international level,
it is VERY pathetic and scary at the same time!

Re:0wn3d

[HappySmileMan]

Or even a team that takes network hardware components that are known to be used by this bank (that information can be easily gained via social engineering, no question). Reverse engineer the network hardware's firmwares etc., or even better, social-engineer the manufacturer to get in-detail system specs.

They don't need to reverse engineer OR social engineer, They just need to make an outright demand.

http://www.yomiuri.co.jp/dy/business/20080919TDY01306.htm

Of course this hasn't happened quite yet?

Re:0wn3d

[ScrewMaster]

can you imagine the size of computer-based espionage departments they could have going no problem?

Yes well, maybe it turns out that this newfangled Internet-thingy wasn't such a good idea after all. History will be the judge.

Re:0wn3d

[IchNiSan]

OR, maybe the world bank just bought some "cisco" security devices. You know, the ones made in china?

Re:0wn3d

[chord.wav]

OMG! The Mariachi Virus!

does anyone else think

[nimbius]

its suspicious that fox news, arguably one of the least reputable news agencies on the planet, has been tapped as the groundbreaking authority on this story?

wondering if this will come with a CERN alert any time soon.

Surprising?

[InvisblePinkUnicorn]

Do they realize yet why painting a giant target on the ground is a bad idea?

Before anyone mods the parent down....

[Anonymous Coward]

Jim Rogers, Adventure Capitalist and Fox News business commentator, has said the same thing. What I'm trying to say is that the parent is not some leftist nut.

Re:Before anyone mods the parent down....

[Angostura]

Actually, I never assumed for a moment that the parent was a left wing nut. I assumed he was a right wing nut. There is a certain section of conservative opinion that believes any international multilateral body (I'm looking at you, U.N) is the spawn of satan.

Re:Before anyone mods the parent down....

[riceboy50]

Oh good, at least the "nuts" agree for once then! :)

Re:Before anyone mods the parent down....

[flitty]

The World Bank and the IMF are infamous for requiring Countries to De-Nationalize resources, requiring that foreign Nationals can buy up once publicly owned companies, and turning social Democracies into lasse-faire capitalist countries in return for their "aid". See: Poland, Indonesia, Chili, Argentina, South America, etc. This usually causes real wages to fall, unemployment to increase, and the reduction of land ownership by locals.

Re:Before anyone mods the parent down....

[megamerican]

That's not at all what actually happens. You should read John Perkins' book Confession of an Economic Hitman

You can find interviews of him explaining it all over the internet. It has nothing to do with "lasse-faire" capitalism.

The IMF/World Bank gives a country (normally with a valuable natural resource) a loan it knows it can't pay off to build infrastructure that benefits only a few big corporations, normally foreign. Once the country defaults, the banks get the country to sign over its infrastructure and natural resources to them and other corporations.

That isn't capitalism of any form. It is legalized theft.

Re:Before anyone mods the parent down....

[EastCoastSurfer]

That isn't capitalism of any form. It is legalized theft.

But, but...it's more fun to blame it on capitalism. Oh, and Bush.

Re:Before anyone mods the parent down....

[reidconti]

The World Bank and the IMF are infamous for requiring Countries to De-Nationalize resources, requiring that foreign Nationals can buy up once publicly owned companies, and turning social Democracies into lasse-faire capitalist countries in return for their "aid". See: Poland, Indonesia, Chili, Argentina, South America, etc. This usually causes real wages to fall, unemployment to increase, and the reduction of land ownership by locals.

Yeah, Poland's really been hurting the past 10 years.

Re:Before anyone mods the parent down....

[JesseMcDonald]

You never said exactly what forces this country to accept the loan. If the IMF/World Bank know the country can't pay it off, then the country itself should know that as well. If it takes the loan anyway, and later defaults, then the sale of its infrastructure and resources to pay the balance of the loan is a perfectly natural and just compromise, and not in any way a form of theft.

Re:Before anyone mods the parent down....

[R2.0]

No, there's a fundamental difference.

Right wingers have an objection to throwing money into third world shitholes with no possibility of it's return and no possibility of it doing any good for the people of the countries.

Left wingers have an objection to throwing money at developing countries with strings attached, because it is inherently paternalistic and materialistic. the money should be granted as aid with no strings, not loans.

Either way, both the World Bank and the IMF have failed at whatever charter they ever had, and need to be dissolved.

Re:Before anyone mods the parent down....

[ardle]

It's reasonable to assume that it's the only loan going.
Unless you're willing to borrow from Russia, join the axis of Evil and face economic sanctions (of course, being part of Russia's "sphere of influence" has a non-monetary price too).

Re:Before anyone mods the parent down....

[Foobar of Borg]

That isn't capitalism of any form. It is legalized theft.

Well, when people talk about "capitalism" now, they are usually referring to corporate mercantilism. We don't really have capitalism. What we have is similar to the system foisted on the world by monarchs hundreds of years ago so they could enslave other people and plunder their resources.

Re:Before anyone mods the parent down....

[JesseMcDonald]

From the sound of it, the country should know that accepting the loan (even if it's the only one available) would be worse than going without.

They certainly can't be worse off after turning down the IMF/World Bank's loan offer than they would have been had the offer never been made.

Re:Before anyone mods the parent down....

[jambox]

Well yes it has actually! Only the EU has come to their rescue, otherwise they were going nowhere fast. In fact, I can't really think of a single nation whose economy has taken a real boost after "help" from the WB/IMF. Seems to me that if you can't get into the WTO, you're boned.

Re:Before anyone mods the parent down....

[oreaq]

Actually, I never assumed for a moment that the parent was a left wing nut. I assumed he was a right wing nut.

Maybe he's just your average middle of the road nut.

Re:Before anyone mods the parent down....

[Temujin_12]

Actually, I never assumed for a moment that the parent was a left wing nut. I assumed he was a right wing nut.

Actually, judging by the IP range of the source of the attacks, I think were most likely dealing with a "east wing nut".

Re:Before anyone mods the parent down....

[Angostura]

Thank goodness then that we are all moderates here.

Re:Before anyone mods the parent down....

[FiloEleven]

This is an excellent point. I would like to hear if any arm-twisting is going on to get these countries to sign on, or if it is their own greed or lack of foresight that leads them into such a trap.

I have no doubt that it is a trap, however. There are ugly things roaming the world today.

Re:Before anyone mods the parent down....

[JesseMcDonald]

I don't particularly doubt that it's intended as a trap either. However, if random posters on Slashdot know that it's a trap, wouldn't you expect the leaders of the countries involved to also be wary of that possibility?

I expect the AC is near the truth; they take the loans because they (the leaders) reap the benefits while others pay the price. That, however, is not the fault of IMF/World Bank; they merely provided the opportunity. If they weren't available some other organization would be found, or created, to fulfill the same role.

Re:Before anyone mods the parent down....

[dave562]

John Perkins is informative, but I saw him speak in San Diego and something about him just struck me as being off. He rails on about how corporations are the problem, then in the next breath talks about needing to work with corporations to change things. Maybe he agrees with the system itself but disagrees with the people running it.

Re:Before anyone mods the parent down....

[Philip K Dickhead]

Go to Germany. Full of Poles, looking for cheap jobs. Wrecking the labour market.

Oh, and I can't go to a cafe or bistro in central london, without lovely Polish girls waiting the tables. Cos at home the alternative is close to prostitution.

Re:Before anyone mods the parent down....

[demachina]

"You never said exactly what forces this country to accept the loan."

Just a guess... if the politicians accepting the loan are thoroughly corrupt, which most politicians are, their plan is to siphon off a large percentage of the loan, as it comes in to their country, and store the proceeds in to Swiss bank accounts. After that they don't care if the their home country can't pay off the loan they are rich globe trotters, gambling in the best casinos and serviced by world class hookers. They never go back to the bankrupt third world shit hole they destroyed to get rich. One of Wolfowitz's big themes when he was running the World Bank was corruption and that corruptiom had to be rooted out before money flowed to a country. I don't think he was very successful at that since it turned out he had his own problem with corruption, giving a high paying job and raises to his mistress. And of course the Bush administration in which Wolfowitz served has proved to be one of the more corrupt administrations in U.S. history. Corruption is hard to fix when everyone is doing it.

I'm quite curious what the IMF and World Bank would say about the U.S. economy in recent weeks. The massive nationalization of the U.S. economy would seem to be totally contradictory to the rhetoric the U.S., through the World Bank, has spewed at the third world for decades. The U.S., U.K and many first world countries seem to have rushed to state capitalism(a.k.a. Fascism) or Socialism almost overnight in seizing control of major banks, massive attempts at market manipulation, etc. It appears free market reforms are only appropriate for economic crisis in the third world. As soon as their was a real crisis in the first world they rushed to the nationalization to solve it, something they have railed against elsewhere forever.

As an aside I learned just the other day one of the top executives at Lehman Brothers whose collapse triggered the current panic is George H. Walker IV. He is George W. Bush's cousin. His name sake, George Herbert "Bert" Walker, is one of the patriarchs of the Bush clan and rumored to have been a first class schemer. The Bush's are all named George Herbert and George Walker in tribute to him because he started them on their rise to power and riches. There is irony that one of George W's cousins is central to the economic collapse that he is using to turn the U.S. in to a Fascist/Socialist economy (Fascist if the Republicans are in power, Socialist if its the Democrats that takes the reins).

Re:Before anyone mods the parent down....

[HornWumpus]

If it comes to that it's Fascist ether way.

Fascism has always been a flavor of Socialism.

The Rebublicrates are all the same.

Re:Before anyone mods the parent down....

[demachina]

"Fascism has always been a flavor of Socialism."

True but in a classic sense Fascism is designed to pander to the rich and powerful, as long as they are loyal members of the party in power. Socialism is supposed to focus on the needs and well being of workers. So far, in practice, Socialism usually ends up pandering to the well being of the politicians and bureaucrats in power along with deadbeats who dine at the state's welfare teat, and get a free ride, while people who actually work are taxed in to poverty to support all the people who aren't working.

Its quite an interesting time for this crisis to be occurring, with Bush and Paulson engaged in a blatant power grab, and trying to create a Fascist regime just as they are about to be pushed out of office in January. It appears they will be replaced with someone they despise, Obama. The only two things I can think of is they were planning to transfer as much money as possible to their friends before Obama takes power leaving him in charge of broken and destitute country where he is certain to fail and be thrown out in four years, or they are planning to use the crisis to eventually declare martial law to prevent Obama from taking office or just rig the election so McCain wins. Phil Graham, McCain's economic advisor and probable Treasury secretary, has Fascist written all over him.

By my definition if the Republican's are running it, its likely to look a lot more like Fascism and if its the Democrats its a bit more like classic Socialism. As best I recall workers actually did quite well under Nazism as long as they didn't run afoul of the police state and end up in an oven, and until their country was turned in to rubble.

Re:Before anyone mods the parent down....

[HornWumpus]

Classic Socialism always winds up looking exactly like Fascism anyhow.

It's just in classic socialism they create the new powerful class (fearless leaders) they pander to. In Fascism they let some of the cooperative rich retain some power, but always keep them uneasy so they remain cooperative.

I can't see it coming to that in less then several generations. We're just too ornery and well armed right now. If the union failed it could happen in a few places.

If Bush declared martial law and tried to retain power one of his own security staff would off him.

But the powers that be won't allow Bush to go off the rails. They own Obama just as wholly anyhow.

It won't get really ugly until the dollar finally tanks. We can thank FDR for that when it happens.

Even then we should still weather the mess so long as we remain armed to the teeth.

All political power comes from the barrel of a gun. (Mao)

Re:Before anyone mods the parent down....

[1lus10n]

In other words they require people to work and add value rather than having the government hand shit to them for free.

Sounds like a plan, where do I sign up ?

Re:Before anyone mods the parent down....

[Lost Engineer]

Usually the leaders. Poor, resource-rich countries tend to be run by oligarchs, monarchs or dictators who are perfectly happy redirect the loan money to themselves and then flee the country when opinion turns against them.

Re:Before anyone mods the parent down....

[ultranova]

That isn't capitalism of any form. It is legalized theft.

Actually, it is pretty much the definition of capitalism: using your capital to get more of it. That it is also legalized theft is not relevant; and besides, being a Robber Baron is a time-honoured capitalist tactic.

Re:Before anyone mods the parent down....

[JesseMcDonald]

The U.S., U.K and many first world countries seem to have rushed to state capitalism(a.k.a. Fascism) or Socialism almost overnight in seizing control of major banks, massive attempts at market manipulation, etc. ... As soon as their was a real crisis in the first world they rushed to the nationalization to solve it, something they have railed against elsewhere forever.

I expect that it's a lot easier to back a long-term solution when you're not up for reelection by those who will experience firsthand the short-term turmoil that inevitably accompanies the restructuring of a credit-addicted economy onto a more stable foundation. An investor must be concerned with long-term stability, whereas a politician only need care about appearances. These first-world leaders are speaking as investors with regards to developing economies, but as politicians at home.

Re:Before anyone mods the parent down....

[ardle]

Maybe we'll see what happens in the future: some countries have maybe learnt their lesson and hopefully others can learn without making the same mistakes.
I'm not suggesting that the World Bank is corrupt, rather that they open the door to corruption. They are more likely to grant a loan to countries that allow inward investment (common sense) but those "inward investing" companies do not necessarily give a country the best deal.
Good example is the Volta Dam in Ghana (a producer of "fair trade" cocoa but not Aluminium, in spite of quite large resouces). The World Bank warned Ghana's government that the deal they were getting from Kaiser Aluminium might not help their economy but then gave them the loan anyway. Within a few years, the country was bankrupt (they got a dam - run for the benefit of Kaiser - plus some roads, buildings and monuments for their trouble).
Should the World Bank have given the loan? It's tricky - would Ghana be worse off if they hadn't?

Re:Before anyone mods the parent down....

[moortak]

and if you can get into the WTO you are still boned

Dear World Bank

[Anonymous Coward]

I hear you have an opening for a security expert...

Re:Dear World Bank

[Narnie]

I know this one admin from SF that's a real whiz about network security. They even fired him for it.

Re:Dear World Bank

[Kazymyr]

Also:

Dear World Bank, I hear you have an opening for a CEO.

Re:Dear World Bank

[blhack]

I know this one admin from SF that's a real whiz about network security. They even fired him for it.

I still haven't gotten a read on how the community feels about this guy. Personally, I feel for him. He lived, breathed, and slept that network. It was his life, and the thing worked goddamned well.

It was only when a bunch of idiots that shouldn't have been muddling about in his routers started to that things got weird.

Dr. Evil?

[Gotung]

So this story coming out at the same time as a world-wide financial crisis.

Has hollywood finally become reality? Is there some scarred super-villain out there somewhere petting a hairless cat laughing like a maniac as the world falls into economic ruin?

Re:Dr. Evil?

[PolygamousRanchKid]

Is there some scarred super-villain out there somewhere petting a hairless cat laughing like a maniac as the world falls into economic ruin?

No, is he a good-looking WASP, attended St. Paul's School and Yale (or maybe Lawrenceville and Princeton), and he made a shit-load of money while his bank was going to Hell in a hand-basket.

And he is petting a pure bred golden retriever.

He is not laughing, but chuckling, because you get to pay the tab.

Re:Dr. Evil?

[Dr. Evil]

Mr Polygamousranchkid.

Before you go to bed, I suggest you count the number of sheep in your coral. You might find that there is one more there than you would expect.

Simple solution

[InsaneProcessor]

The simple and total solution is to disconnect any country that has these attacks and do not re-connect until the government of that country solves their problem. I am sick and tired of China blocking content from their own citizens but, allowing illegal activity to the outside world. They need to be shut down.

Re:Simple solution

[somnum]

You'd need to have every country in the world agree to that in order for it to be effective, and that's simply not going to happen.

Re:Simple solution

[gzipped_tar]

Disconnect me? Does that mean, er, I could no longer read Slashdot?

First post???

[hesaigo999ca]

As the possible first post, I want to make sure no one thinks this is in anyway related to the markets crashing, as it stands if china did originate the attack, they are losing as much as the USA right now, and are still losing dealing with their own problems(with the food illnesses).
I was one to believe that Chinese were doing a lot of hacking on purpose to advance in cyber tactics, however this move if were caused by them, ended costing them more then it returned.

It may more have been a Russian hacker rerouting through china using tor or something.

Re:First post???

[New_Age_Reform_Act]

Probably.

Russia is almost immune to this crisis.

Re:First post???

[smooth wombat]

Russia is almost immune to this crisis.

I hope you were being sarcastic because Russia is nowhere near immune from what is going on. In fact, they keep closing their stock market because of what's going on.

Re:First post???

[hesaigo999ca]

I guess this means if the market was closed then no trading went on,
therefor no prices were able to go up OR DOWN???

It really is

[snspdaarf]

I still look at the FoxNews web site, but damn, one has to pick through a lot of crap to find information. It seems to be more gossip than anything else. I keep expecting to see a hot story about Brittney Speers' lovechild with Bat Boy.

On the other hand, almost all news outlets seem to want to lead the parade down to the circus side show, so maybe they are just a sign of the times.

Good night, Chet. Good night, David.

Security?

[cdrguru]

Face it, no matter how secure a system is, if it is usable by humans it can be breached. Easily.

There is anywhere from a 100 to 1000 hackers/crackers/slimeballs out there that are ready and willing to take on each and every system. Ones that claim to be "secure" are just a bigger target. There is no such thing as a completely "secure" system that is usable and accessible by ordinary humans. True security would require controlled physical access, multiple authenticating factors, and so on. None of this is going to happen for an accessible system usable by "ordinary humans".

About all that is realistic is to minimize the damages. Face the fact that if you are a target you are going to lose. Try not to lose too much.

Prosecution of the break-in? Forget it. It's the Internet. It is International. If it looks like it is coming from China, it could be real or it could be a proxy. There are no effective International laws that will assist in any sort of prosecution. There is no supra-national police force that will break down the door of the cracker and haul them away. Nothing is going to happen. Unless the guy is a complete idiot that brags about it.

Re:Security?

[RiotingPacifist]

There is anywhere from a 100 to 1000 hackers/crackers/slimeballs out there that are ready and willing to take on each and every system.

Im not sure if you mean there are 100 times as many hackers as systems or that there are only 1000 hackers in the world, either way this marks the point where I stopped taking your post seriously

Ones that claim to be "secure" are just a bigger target. There is no such thing as a completely "secure" system that is usable and accessible by ordinary humans.

True security would require controlled physical access, multiple authenticating factors, and so on. None of this is going to happen for an accessible system usable by "ordinary humans".

Why should the world bank allow complete system access to ordinary humans?

About all that is realistic is to minimize the damages. Face the fact that if you are a target you are going to lose. Try not to lose too much.

With a sane system of authentication, you can prevent anybody from outside your buildings gaining full access to your systems, at most they could get access to what you need to let particular users have. Now a determined hacker may be able to use a fresh exploit to get more access than they should, but that should set of some alarms (if your running a bank, possibly actual alarms).

Re:Security?

[pravuil]

I really hate bashing Microsoft at this point. I'm not going to. I will say this and leave it at that. Security within Windows can be problematic if you don't properly setup your permissions. Hacking the registry helps but you either have to rely on Windows update or a third party for any real fix. You really need someone who knows what they are doing though to do it effectively. Antivirus and firewalls don't cut it all the time when you have poor policy practices. That's true for any system.

I hate suggesting this but the US government needs to implement Linux or something similar in all their security critical systems. Linux is great for setting up local repositories for local networks.

Re:Ooh... Fox News says the IP address is from Chi

[djupedal]

> Does the IP address indicate a Chinese intrusion, or is that just a spin?

Just a spin. Look for WB information to be sold soon on Craigslist Seoul.

Just makes me wonder..

[vaedur]

Why networks with such sensitive data have internet access. I know it makes it easier and accessible, but shouldn't something this important be used for internal record keeping? I know that's usually not possible, but the fact everything is online will come back to bite everyone.. To quote Forest Gump "then something bit me in the buttock.. they say it was a million dollar wound, but the government must keep that money, cause i didn't see any of it...."

As much as I love alliteration...

[danwesnor]

Fox needs to learn the difference between a siege and an invasion.

Sensitive data?

[Bromskloss]

sensitive data about the economies of every nation

What's so sensitive about the economy of a nation that it must be kept secret, thereby not even allowing the nation itself (the people) to know about it?

Re:Sensitive data?

[RiddleofSteel]

Hiding the fact that they've been planning the current economic collapse with the Fed for years in order to rule the World, Duh!

Re:Sensitive data?

[jabithew]

Well, the true cost of Gordon's PFI deals could get out and undermine his reputation for economic competence.

Fortunately he has nothing to worry about as the global economy has collapsed and already outed him.

Re:Sensitive data?

[phorm]

What's so sensitive about the economy of a nation that it must be kept secret, thereby not even allowing the nation itself (the people) to know about it?

Uh, passwords, bank account numbers, and all sorts of info that would let people walk away with money that wasn't theirs?

Re:Sensitive data?

[FiloEleven]

When the wealth in a country is created not through the trade of goods but through manipulation of the money supply, this fact must be kept from being understood by the majority of its people. Confidence in the money supply and markets is everything. If the people doubt the value of their currency, you get panic, bank runs (as people try to exchange their paper scrip for something of real value), and a crash of not only the markets but of the monetary system.

This is what they are afraid of, and this is what will happen anyway sometime down the road. Be prepared for it in the US as well: the reason for the current credit freeze is because banks want cash in the vaults to alleviate the bank runs that they fear are coming.

Re:Sensitive data?

[khallow]

Why aren't you publishing your bank accounts, credit card numbers, private government id numbers, dates you won't be home, etc? That's all relevant data to the economy of whatever nation you happen to be in. The answer is because revealing that data would violate your privacy. In a similar fashion, I imagine the World Bank has a lot of information that is entrusted to it by private parties. You don't have a right to know that private data.

Re:Sensitive data?

[ddelmonte]

er. other countries knowing your country's financial information?

Seriously, I was a long time World Bank staff member - who left in disgust. I was in charge of some geographic regions' IT services.

Whatever you think of the "Big Bank", they have some incredible people on the ground, who really care for people in the countries in which they work. For example. people who try to stop deforestation while corrupt country officials are accepting private contracts, and people who, while waiting for road projects to be built, bought villagers bicycles out of their own funds. They also have people who couldn't care less, and want to pump out cash so they can look good on their annual performance reviews. So the place is at best mixed.

What it has done is to put out the word that poverty, illiteracy, nutrition and ill-health are global problems, and new industries (NGOs) have emerged that may be a better resource for the countries that the Bank itself. However, neither the Bank nor NGOs have any oversight, so that's hard to determine.

With regard to IT, and why I left in disgust - there were real experts there - people who know more about global IP services and building security services than any place I know (except for /. where everyone is an expert).

But gradually these people were sidelined by bureaucrats who didn't know shit from shinola with regard to IT, systems, and services. One security expert committed suicide. Others just gave up sadly and went on to other things.

They picked stupid technology, locked down systems so they did nothing innovative or helpful to the staff, but allowed hackers in. And they paid - and continue to pay - hundreds of millions of dollars for this crap. It sickens me. Truly.

The management of this group should all be fired. The last CIO was in deed fired but it was too late to prevent this damage.

grrrh

What is banking?

[Colin Smith]

It must be extremely expedient for Western governments to punish recalcitrant governments in the developing world by withholding World Bank and IMF "assistance"; and conversely reward compliant ones.

This is the nature of all (fractional reserve) banking.

Have you noticed the calls for co-ordinated action? For a world response? Next it'll be a world council.

 

Shameful

[Bromskloss]

bank officials [...] trying to keep the news from leaking to the public.

They should be slammed for that! Trying to cover up their mistakes. Shameful.

More Targeted Attacks

[duplo1]

I'm really not surprised to hear this. According to Verizon Business' 2008 Data Breach Report, 46% of reported attacks, while somewhat opportunistic, are directed towards a specific victim with knowledge of how to exploit a specific weakness. While only 15% of the reported attacks were fully targeted, I strongly believe that this number will rise. With usage of social networking sites on the rise (think Linkedin.com), it really isn't difficult to identify well-placed targets within an organization. Find enough information about an individual, make contact, gain a level of trust, and owning them at work can be trivial. From this point, the attacker can use the victim's trusted relationship in the company (e.g., electronic access) to proceed to take ownership of the network.

Re:Time for an upgrade . . .

[TinFoilMan]

Dude, doncha know, if it's free it's no good!!!
Of course banks think Linux means:
Less
Intelligence
Needed
Unless
Crossed (x)

Urgent message to mods re: Satan's rectum

[Anonymous Coward]

It is Satan's rectum, poised over the third-world.

Best slashdot line in ages.

Please, please, please mod parent comment down. The last thing we need is for the phrase "It is Satan's rectum, poised over ..." to become a new Slashdot meme.

I mean can you imagine:

- an item about Linux and posts like "It is Satan's rectum, poised over capitalism";

- an item about fascism and posts like "It is Satan's rectum, poised over our freedoms";

- an item about the Cheney/Bush government and posts like "It is Satan's rectum, poised over privacy and the U.S. Constitution"

- an item about a new Windows version and posts like "It is Satan's rectum, poised over the computer world";

Yech! Please stop it before it starts!

Re:Urgent message to mods re: Satan's rectum

[darthnoodles]

I am Satan's rectum you insensitive clod!

Re:Urgent message to mods re: Satan's rectum

[Satan's Rectum]

Sir, I beg to differ....

Re:Urgent message to mods re: Satan's rectum

[Artifakt]

...gentlemen in Webland now-a-bed
Shall think themselves accurs'd they were not here,
And hold their manhoods cheap whiles any speaks
That was here when the Satan's Rectum meme was borne.

                                  (William Shakecyber)

In Korea, only old people have Satan's Rectums poised over them...

Re:Urgent message to mods re: Satan's rectum

[Anonymous Coward]

It is Satan's rectum, poised over ..."

...Natalie Portman.

*hides*

Re:Urgent message to mods re: Satan's rectum

[element-o.p.]

Nicely done! I needed that laugh today :)

Re:Urgent message to mods re: Satan's rectum

[FeepingCreature]

It is Soviet Russia, poised over Satan's rectum!

(I, for one, am strictly Don't Ask Don't Tell about this)

Re:Urgent message to mods re: Satan's rectum

[GrumblyStuff]

Good thing you got modded up, eh?

This new meme... it is Satan's rectum, poised over Slashdot.

Re:Urgent message to mods re: Satan's rectum

[MiniMike]

Yes, it is like Satan's rectum, poised over our memes... Oh wait, isn't that where most of them came from?

Printer Friendly

[machine321]

http://www.foxnews.com/printer_friendly_story/0,3566,435681,00.html

The cracker's scheme

[gizmo2199]

No doubt the spammers now have the goods on the World Bank to have their loan for that Dam they're building to be approved.

And the highway project is done deal too!

i asked for a paranoid schizophrenic

[circletimessquare]

not a raving fruitloop

come on people

Re:i asked for a paranoid schizophrenic

[ShieldW0lf]

Jack and Jill have a family. They have 3 kids. They can't work as much, because they're caring for them, and they don't have as much money to invest.

Bill and Betty have no family. They work a white collar job, make a lot of money, party hard, live life high on the hog. They've still got leftover money to invest.

Shawn and Sue are the same as Bill and Betty.

Now Jack and Jill and Bob and Betty and Shawn and Sue are old. All six of them have retirement savings, but Jack and Jill have the least, because they've been caring for their kids.

Now, Jack and Jill and Bob and Betty and Shawn and Sue are all trying to hire the young people to care for them because they are elderly.

If the economic system holds, then Jack and Jill will end up in the lurch, while their kids work like slaves trying to take care of Bill and Betty and Shawn and Sue. And Jack and Jill don't get to have grandkids, because their children are too busy. Soon, there will be no people left.

If the economic system fails, Jack and Jill will be cared for by their three children, while Bill, Betty, Shawn and Sue will die of deprivation, because they have no leverage, and no one cares what happens to them. And Jack and Jill's kids will have some time left over to care for their own kids, the next generation of mankind.

My mom and dad are like Jack and Jill. And you reading this, unless you are an elderly boomer, your mom and dad are also like Jack and Jill.

I don't know about you, but I don't want to care for Bill and Betty and Shawn and Sue. This economic collapse is in my best interests, and in the interests of those I care about. It is exactly what I want to see happen, and I'm glad it's finally here.

No matter how high they build the wall...

[freeryan]

someone will always build a ladder just a little higher.

This is a non-story

[Anonymous Coward]

So what if the World Bank gets hacked into? It's not like banks have any money left to steal these days.

Possibly.

[jd]

It is interesting, though, that it has been about a year since the current run on the stock markets and world finances began. (The current credit crunch, if you look at the graphs, is simply a continuation of a trend that began probably about April last year.)

Now, to use the oft-quoted "correlation does not prove causation", it would be totally absurd to say that the coincidence of dates proves the current problem is related to the cyber-attacks. Lots of things probably happened in April of last year. To pick one out, just for the sake of picking something, would be stupid. However, if I were in charge of IT security at the World Bank, I would be wanting to know if sensitive or classified information was continually exposed over that period that would permit someone to destabilize things.

It's almost certain that unencrypted sensitive information would be present on e-mail servers, which is stupid and naive, and members of the World Bank who don't make use of secure methods of communication for sensitive material should be made to walk the plank regardless of whether any harm was done. The IT managers who allowed unencrypted data to be present and who did not properly install suitable intrusion countermeasures should follow shortly thereafter. In the (extremely dubious and unlikely, but arguably possible) circumstance that the crisis is related to the infiltration, then the game changes from a mere fix-things-up and discipline-the-bastards scenario to a more severe lockdown-the-damn-network-now-defcon-1 type of situation.

The former simply means you need to apply suitable patches and/or servers, and maybe hire a pirate ship to escort the former employees to shark-infested waters. Since this is the most likely situation by far, that's all they need to do. But concealing it hasn't helped them apply the measures they needed, or the attacks could not have continued the moment it tripped the first intrusion detector. In this case, the secrecy has caused severe harm to the World Bank, but probably nobody else. Like I said, this is the most likely.

The worst-case is that we're seeing a positive feedback loop. Sensitive/classified information on volatile situations that could cause those situations to get considerably worse being posted, then lifted and used to do exactly that, causing people to post even more such information, and so on. Positive feedback loops are not simply a technological problem but an entire attitude problem and social engineering problem. That requires more than IT security, because IT security can't debug or firewall the brain. Yet. Such a loop might easily require a complete organizational shutdown, because no amount of patching will help. It needs a major attitude shift - not just on the part of internal employees but also on the part of all countries involved - and that takes time. If it's the mind that's the vulnerability -AND- it is causing massive devastation, the World Bank would have to shut down all operations completely. Otherwise, you can't guarantee killing the loop. The chances this would need to happen are extremely slim, but as I said, it is technically possible, and you can't afford to be piecemeal when it comes to such scenarios.

If it's so unlikely, why mention it at all? Because the timing -is- interesting (a crisis is uncommon, so two parallel financial crises should raise eyebrows), along with the fact they even see it is as a crisis is exceptionally interesting, the fact that their response has been one of paralysis (suggesting a non-trivial people problem, rather than an idiotic individual or an unpatched machine), and the fact that everyone else's management of their perceived problem isn't managing it in the least, is suggestive that (a) the wrong problems are being fixed, and (b) that there is a lot of pressure to avoid fixing - or even seeing - the right problems. Suggestive isn't proof, of course, which is why I'm more interested in whether they're even looking to see if this is a possibility.

Re:Possibly.

[Msdose]

Well the latest theory is that each time the Large Hadron Collider blows up the universe, we end up in an alternate universe where things seem the same but are subtly different. In this universe, an accident has shut down the LHC and life goes on apparently normally but with strange unexplainable occurences. The next collider 'accident' is scheduled to happen next april. Interesting times, anyway.

So, did anyone consider just not using Windows??

[toby]

Does anyone intelligent actually believe anything on FOX News anyway? There's an elect-the-Republican angle in here somewhere.

Hmm... Fear? Check. Blame China? Check. I'm sure they'll work Terrorists and Mexicans and the French into this somehow. Blah.

You must be new around here

[toby]

Secrecy is the hallmark of your government. There are good reasons for this. Bush-Cheney would be dangling by piano wire at this moment if the American public could freely see into what they've done and how they did it. (Actually there's more than enough of what we know they've done.)

It's one reason why a Democrat isn't permitted to be elected; Obama-Biden have threatened to prosecute criminal acts under Bush-Cheney. You can bet that puts the fear of god into them. Too many powerful people have too much to lose.

Re:You must be new around here

[GrumblyStuff]

Cynic in me says, nothing will come of them. No charges, maybe a stern headline on page four of a Friday newspaper. And in exchange, Obama and Biden can pretend to run the country for a while.

World at War and hidden from normal worker bees?

[teacher_dude]

I've always thought the next world war would be fought with I.T. tools, acquiring data, corrupting data, putting economies into turmoil. Is this what is happening? China and others(recall cybertraffic around the olympics when Georgia-Russia got into it), are they secretly waging war or deceptively setting up the next war? And what, if any response is the U.S. countering with? Is this something hidden from citizens or is it just not happening?

China?

[flyneye]

China? Well here at WB when we find out who did it,we just cut off the flow of money and they can go to bed without supper.Nope, not even those brussels sprouts you wanna mail to em. No Money,No food and then the Mongols next door can kick your ass.Intrude on us will ya,We'll reposess that olympic stadium,then where will you host? Bet that'll be embarrassing.
We're World Bank. We don't care. We don't have to.

 

Re:China?

[wintermute42]

I'm sure that the parent was meant as satire. But the problem is, the satire will not stick because the Chinese are far beyond needing any World Bank funding. They hold a vast amount of US debt. It seems quite possible that China, as a major creditor of the US might be on the creditor side of the satirical scenario you outline above. The US is headed toward a debt situation that is more akin to a South American country than a first world financial and military power.

RE: World Bank Under Cybersiege In "Unprecedented

[d0n0vAn]

You know, corporate accounting is sure as hell gonna notice $305,326.13....

aha!

[imyy4u3]

So now we know why all these banks across the world have been failing...let's blame it on hackers now, and not the banks! If world bank goes under, now they have an excuse!

Can anyone tell me why on Earth you would have computers with such sensitive data connected to the outside world/internet? Why were they not on their own private network, behind tons of firewalls and other security devices? Are Bankers that stupid? Apparently they can protect physical items very well, but not electronic information...

What??? Where do you get that?

[Anonymous Coward]

The world bank makes HUGE loans to entire nations and imposes draconian reform rules and regulations, requires real assets as collateral, usually the target nation's most valuable raw resources, and charges interest. If that ain't a bank of sorts, what is?

Re:What??? Where do you get that?

[GrumblyStuff]

Mafia?

Re:What??? Where do you get that?

[lysergic.acid]

it's interesting that this is called the "World Bank" as if it's some kind of intergovernmental financial organization and has been given the power to dictate the domestic policies of entire nations. however, the World Bank operates without transparency, is not subject to public oversight, and its executive directors are not elected nor government appointed. it's technically a "non-profit" organization, but the reigns of power are held by industry heads who use it to advance their own financial interests, often at the cost of developing nations who have pretty much no say in the World Bank's decisions.

it's scary how much power and influence the neo-cons have been able to acquire while completely bypassing the democratic process. it's no wonder more and more people are questioning the legitimacy of the World Bank as well as the IMF.

Re:What??? Where do you get that?

[TapeCutter]

"If that ain't a bank of sorts, what is?"

1. An agency mandated to have a US citizen leading it, it's purpose is to hide the identity of predatory lenders who blackmail impoverished governments via their tresuries. Largely financed by the industrial/military complex to keep the oil flowing to the military/industrial complex.

2. An agency that used the Bretton Woods system to rebuild western Europe, and has gone on to bring democracy, wealth and good govanance to much of S.America, S.E Asia, and Eastern Europe.

I have heard "the road to hell is paved with good intentions" and suspect both definitions are correct at one time or another.

No, but...

[jd]

...I could give you some really good disreputable ones. In the meantime, researchers have found a home owner unaffected by the crisis so far.

As an employee (aka What Happened)

[Anonymous Coward]

As an employee, let me explain something which may not be clear: we are not a "Bank" in the sense of your neighbourhood lender, holder of money and such. We are a development agency, not much different from USAID. As such, we don't deal with personal financial data like you're accusing us of doing so.

Now, with that clarification out of the way... I agree, the way this has been handled internally is disastrous. Our largely incompetent IT team has kept us in the dark about what has been stolen and from where. There is no clear understanding of what passwords were compromised, what data was stolen and an email sent to all hands basically says "we will never know". This is infuriating to staff because it's possible that our banking (personal bank accounts, like your neighbourhood bank) details were stolen, along with tax info, personal id numbers, and so on.

My understanding of what happened is this: internally, we used to use a single password system, deployed at ridiculous expense two years ago, after years of development. (Any one chapter of the development of the single password system would qualify as a story at TheDailyWTF.) Said system would change passwords by going to every system (Active Directory, SAP, internal applications, etc) one by one and changing the password. Said system was also developed in house, with no code review and inevitably, someone discovered a flaw in it, and broke in. Since all other systems were set up to trust this password broker system, you could change an administrator password by simply telling the broker to negotiate the change.

What is aggravating most of all however, is that the breach was detected initially in July 2007, nothing was done for OVER a year and when they did decide to start cleaning up the mess, it was when a huge portion of staff were on leave or away at work on the field. So naturally, they were cut off from access, without any contact information, or even understanding what had happened.

We're still waiting to have the CIO and most of the IT staff fired. A bug can happen. Not correcting said bug for over a year once means their heads should roll. Don't count on it, though.

I believe I speak for

[Unlikely_Hero]

I believe I speak for a good deal of IS specialists when I shake my head in a morose fashion and say "this is why I don't trust financial institutions to safeguard diddly squat"

Opportunistic conmen

[TheLink]

Well keep in mind in the 1997 Asian Financial Crisis the IMF recommended the Asian Governments to do about the opposite of what the USA is doing now.

http://en.wikipedia.org/wiki/Asian_financial_crisis

"The IMF's support was conditional on a series of drastic economic reforms influenced by neoliberal economic principles called a "structural adjustment package" (SAP). The SAPs called on crisis-struck nations to cut back on government spending to reduce deficits, allow insolvent banks and financial institutions to fail, and aggressively raise interest rates."

Raise interest rates, allow insolvent banks and institutions to fail (even if they are "too big to let fail"). And allow them to be bought up by foreigners. How'd the USA like it if AIG got bought up by China/Japan (they do have enough money, it's just that they know it'll annoy their number 1 customer ).

Go compare what the USA is doing now to the IMF's recommendations in 1997.

So, forgive me if I see the IMF as evil. The World Bank? Probably the other arm ;).

They're both just tools for the US to increase its power over the rest of the world.

Re:Opportunistic conmen

[jabithew]

The IMF was and still is right. The way the US and UK are dealing with the banking crisis is silly. We're propping up a failed business model. The Scandinavians did a good job with their mechanism (they basically wiped the institution empty, eliminating stockholders and management, then nationalised it to protect savers).

The only institutions too big to fail are Fannie/Freddie, the federally created duopoly. And that's a problem unique to the US. The UK has no institutions too big to fail.

Lehman Bros got bought out by foreigners (Barclays). I think we should allow the sovereign wealth funds of the Middle East and Far East to buy out our failed banks.

Ha, ha!

[TheDarkener]

When you've got global secrets, the whole globe will try to find them out.

Let's hope they publicize as many "secrets" as possible - and then, maybe, we can all wake up from this nightmare of economic control.

Riiiight

[Anonymous Coward]

It's one reason why a Democrat isn't permitted to be elected

Riiiiight . . so when Obama gets elected what happens to your conspiracy theory then? I'm guessing I won't hear about it then, so I want to get your reaction now.

Re:Double Standard by /. Readers

[Artifakt]

Sure we can. I for one, don't believe any single source uncritically. I keep my links to the BBC, the Berlin server of the World News Network, CNN and others, in a folder called "News - Trust but Verify". My link to Fox is in "News - Strong Politicization) (Along with the Moscow Times, The Nation, and other such sources). There are no links in "News - Trust Absolutely". None.
      The decision to put Fox in the second category came when they kept 'accidentally' labeling republican politicians as (D) just after they were arrested or put under investigation, but never made the reverse mistake. Since then, I've seen industry studies that showed Fox basically made certain mistakes more often than most of their competition (like miss-attributing a source, i.e. saying some 'expert' was a liscenced and practicing psychiatrist when all they had was a basic 4 year psychology degree).
      So, no, not everyone here is taking this story very seriously. I'll get more serious about it if everything Fox reported is confirmed from some of the other sources I trust a little more. If even a good portion of what Fox reports holds up, I'll give them due credit for having broken the story first.
      Oh, I speak 2 non-English languages, and so I often check relevant news on native language sites. If Chinese was one of my languages, I'd have some Chinese speaking sites bookmarked, and when Fox (or any English language source), blamed China for something, I'd check them. (Note that I didn't say those sites should or shouldn't be under control of the PRC. If you don't trust the People's Republic of China, you could check sources opposed to them, and see if they agree with Fox that the attacks originated in the PRC or have their own opinions. Even if you only speak English, you could do more than check Fox against American sites, or the BBC. Look up some sites in Australia or Canada, or English speaking sources from Eastern Europe or South America, and see what they say.

Bogus: Read the email

[palalonde]

http://www.foxnews.com/projects/pdf/WorldBankDoc1.pdf

Why would anybody authorise installing Skype in a Bank environnement? How many organisation instal Skype in a closed environment? Since when a Lotus Notes Admin account gives you access to a physical server? When did Microsoft start forensics?

And yet

[WindBourne]

there really is no difference. For the times that I have watched FOX, it is pretty obvious that they are the pub's pravda.

I don't believe it.

[Anonymous Coward]

We all know what's going down in the so-called 'finacial world' right now. Somewhere somebody wants to sink some 9-to-12-digit money-loss to the bottom of the ocean with a block of concrete tied to its feet without others noticing it - thus this shady cover-up story. I don't trust it a bit.

Believe me, people, the stuff we're hearing on the news and in every official channel, in Europe but in the USA especially, its 80% total and utter bullshit. You don't seriously believe that people who don't care squat about who's money they're burning think twice about oomphing the next inflation and deficit spree on top of the old one that just blew up sky high on the tab of current market values still in play in the real economy? I thought so. I trust these people who do even more than fake a break-in to get back to business as usual.

I think this story couldn't be farther from what it is presented as. Especially if it comes from the US Reichspropaganda Ministry 'Fox News'.

Posted anonymously from somebody with a few-digit sum of slashdot comments. Yeah, I'm starting to get that paranoid. And for good reasos too.

And we all know...

[rgviza]

...that Fox has the most reputable and accurate reporting on the planet, their sources are impeccable and they NEVER blow things out of proportion.

This article is more than a little sensationalized...

-Viz

Re:This could be a ruse for clamping down on Inter

[ScrewMaster]

The US government has a long history of conjuring up fictitious demons in order to justify bringing in more police state measures.

I bet we're about to hear of a clampdown on the Internet, "to safeguard freedom and the effective operation of world markets".

Of course, the reason our government does that is because it is a government By, Of and For The People. That means our leaders are (to a limited degree) accountable to us, and have to sell us on any such nonsense they wish to implement. That they're able to do that is speaks more to the caliber of the American citizen than anything else. We should be a harder sell than we are, that's for sure. As it is, just mention children or terrorists and we'll bend right over.

Put it this way: the reason that national governments of countries such as China, or Russia, or North Korea don't have to run a con on their citizens is because those people are nothing more than subjects, serfs in fact. They have no say in what their governments do, so their governments do whatever the hell they want.

Always shoot for the stars!

[Zero__Kelvin]

" ... while also trying to keep the news from leaking to the public."

I sure hope they succeed!

Wow, a server list.

[mmcgreal]

Is anyone else a little surprised that an actual list of server names and apps was leaked in the memo?

And oh, look, they don't even subscribe to the fundamental security tenet of not naming your hosts something obvious. An attacker wouldn't even have to scan the box to determine where to begin an attack. That saves time! From the memo...

SERVERS CONTAINING SENSITIVE DATA:
---
wb2ksql08
wbmfilecl01b
wbes126
wbdc104
wbmsrsa001

Golly, I wonder what platform and applications these servers are running.

Re:World at War and hidden from normal worker bees

[greyhueofdoubt]

>>I've always thought the next world war would be fought with I.T. tools, acquiring data, corrupting data, putting economies into turmoil.

I hope you're right. I'd rather have my flights redirected and my credit cards canceled then be gut-shot by a 17-year-old conscript.

After all, I'm a 2 hour drive from Canada as it is... I can just see the Tim Horton's signs going up as they politely herd us into 're-education' camps to watch hour after hour of the Red Green show.

Yes, I've thought about this a lot.

-b

Hi, this is the best offer to you!

[omuls are tasty]

We offer OEM mod POINTS at low prices, from Adobe, Microsoft, Mac, ETC!

We also sell high-quality SLASHDOT THREE and FOUR DIGIT ID replicas! Go to that cocktail party with this ID, and be sure to catch people's attention. You'll have ALL the class, and still have all your MONEY.

Read the update as well

[omuls are tasty]

UPDATE: After FOX News published its story, a World Bank spokesman issued the following statement: "The Fox News story is wrong and is riddled with falsehoods and errors. The story cites misinformation from unattributed sources and leaked emails that are taken out of context.

"Taken out of context" by definition means "it happened and we can't deny it, but we're not crazy to confirm it".

I don't know why would Skype be installed, but you should read the memo a bit more thoroughly before making "bogus" claims.

Nowhere does the it say that a Lotus Notes Admin account has been compromised. It says that the Notes Server sent a notification triggered by an attempt to access the mail inbox for a (compromised) sysadm account of some guy who was on vacation.

And nowhere does it say that Microsoft was doing the forensics, it says that "Microsoft forencsics is being worked on by Charles team". Since the server they mention is a Domain controller, it would make sense that they're running some M$ software on it, wouldn't it?

I'm not saying the memo is for real, but you need to work a bit harder than that to discredit it

Re:Read the update as well

[palalonde]

Maybe you are right but something smells fishy. Why would a bank server with sensitive information be linked to the internet?

This IS fox news we're talking about

[Manetheran]

The fact that this comes from fox news makes doubt the doubt the validity of the story. Does it also come with a demonstration of an exploding van?
It sounds to me like they're trying to set up a scapegoat to blame for the current financial crisis, while of course, protecting the CEOs of the big banks and those who are actually responsible for the current world situation.

Ever notice anything with the word

[JohnnyGTO]

World or United seems to end badly?

Re:The Real Difference

[Eunuchswear]

You've managed to mischaracterize the positions of both the left and right wings. What does that make you?

Anyone who thinks the US Democratic party is "left" doesn't know what left is.

hype-alert, factcheck: Ask Sans storm-center

[SpzToid]

SANS Internet Storm Center has published these words, from a World Bank spokesman, regarding this Fox story specifically.
 
  "The Fox News story is wrong and is riddled with falsehoods and errors. The story cites misinformation from unattributed sources and leaked emails that are taken out of context."
 
"Like other public and private institutions, the World Bank has repeatedly experienced hacking attacks on its computer systems and is constantly updating its security to defeat these. But at no point has a hacking attack accessed sensitive information in the World Bank's Treasury, procurement, anti-corruption or human resources departments."

http://isc.sans.org/diary.html?storyid=5161

Can such a gross and misleading news article by such a large and well-funded media organization, with such wide-reach, be attributable only to poor quality reporting and lack of editorial standards, or is Fox trying to start a run on the bank?

Oh wait. That doesn't make any sense, it isn't that kind of bank. But these aren't ordinary times, and who is this Fox after all? Sorry to be grabbing my tinfoil hat, for example, but clearly questions should be raised.

Screw them.

[Shoten]

They approached the company I work for quite some time ago, looking for help to get things under control. They have networks in ~100 different countries, mind you, and wanted absolutes: all vulnerabilities found, all problems fixed, all breaches found and cleaned up. They provided almost no details of their environment, were not open to answering questions, and gave a ridiculously short timeline to scope it all out. And the maximum allowed timeline for this insane uber-project? Six weeks. They need to grow the fuck up and treat IT security as a business function that can protect them, not as whipping boys that they grudgingly acknowledge now that they've been smacked around by bad people. In the meanwhile, they deserve the news coverage...better that they serve as an example to others of what not to do.

Re:there's no such thing as a neutral media

[Descalzo]

anyone with any real intelligence on the issue of bias in the media is over it, doesn't care anymore

meanwhile, anyone who is a child is still obsessed with the issue

Hence the longest post on media bias I've ever read.

Cyber lions, tigers and bears Oh my!

[ikeman32]

Let me guess they are using software from Microsoft right? I don't think we are in Kansas any more Toto.

Pay not attention to that man behind the curtain!