Slashdot Mirror
FBI, US Marshals Hit By Virus
Norsefire writes "The FBI and US Marshals were forced to shut down part of their computer network after being hit by a 'mystery virus.' FBI spokesman Mike Kortan said, 'We are evaluating a network issue on our external, unclassified network that's affecting several government agencies.' Nikki Credic, spokeswoman for the US Marshals, said that no data has been compromised but the type of virus and its origin is unknown."
You wanna know how you do it? Here's how, they hit you with a virus, you pull a gun. He sends one of your servers to the IT department, you send one of his to the morgue. That's the Chicago way, and that's how you get Capone! Now do you want to do that? Are you ready to do that?
Why doesn't the government switch to Linux already? Sure, you can get a Linux virus, but to get one it takes work. On the other hand merely browsing a site in IE can give you viruses in Windows.
Taxation is legalized theft, no more, no less.
More and more, sensitive corporate and government networks will need to be isolated or at least mostly isolated from non-sensitive networks and the Internet.
They may not need an air gap but they will need to be isolated enough to prevent general problems like viruses.
They also need to be run with the philosophy of "every other machine or user on my network could become compromised (infected or bribed) at any time."
A couple of possible solutions:
*Give employees 2 computers with a KVM, one for surfing the web and access to non-secure data, one to access secure data.
*Give employees a multi-homed, ROM+read-only-USB-stick-for-configuration-data-boot "thin client" that's stripped down and hardened, with no copy-and-paste, no network bridging, and other designed way for one remote server to influence the other. Then have them connect to different servers on different networks for different needs.
If your security requirements are extreme, use an air gap.
In either case, don't forget to take countermeasures against human idiocy, ignorance, and bribery/blackmail.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
What I want from each and every one of you is a hard-target search of every JPEG, MPEG, EXE, PXE, hard drive, flash drive and floppy drive in that area. Firewalls go up on every computer. Your fugitive's name is Neeris. Go get him.
"said that no data has been compromised but the type of virus and its origin is unknown."
How do they know that there was no data compromised if they don't even know the type of the virus?
Knowledge is power. Knowledge shared is power lost.
We need to start looking for destroyed helicopters in order to find John McLane!!
http://www.itbusiness.ca/it/client/en/home/news.asp?id=53225
They DO use Macs. And Dell. They were shown VERY CLEARLY inside FBI headquarters during season 7 of 24.
The spokeswoman said :
"no data has been compromised but the type of virus and its origin is unknown"
That is an extraordinary statement. How would they know ?
If I was head of IT there I would assume that that was not true. Even if there was a completely different computer system for any sensitive information, data has a way of leaking to where it shouldn't be. Of thousands of people, not one put notes or passwords or whatever on the insecure side of the line ?
Regardless of what they tell the press, I hope that internally they are assuming that this is a breach, and acting accordingly.
Please copy this file to your hard drive, decompress it, untar it, chmod it, and place an entry in the root crontab... so I can have your advice.
If you mod me down, I shall become more powerful than you could possibly imagine.
Mac is in no way less vulnareble than Windows, specially in targeted attacks. It seems most people have been brainwashed quite good. Yes, the amount of malware for mac's is lower than Windows, but so is mac userbase. However there are many OSX malware circumventing already and it seems to be just going up.
And no, not all malware require root to run. They can easily run under your user account aswell and still steal lots of data, passwords and keylog etc. If they require root, then social engineering attack will get past most users as they happily enter their root password.
This claim is made by nearly every spokesperson for any major organization which is forced to disclose a malware attack to the public. In nearly every case the claim cannot be substantiated. Run of the mill malware often scans hard drives and uploads data to remote servers over encrypted connections. Most organizations have no way of knowing if these even happened. They don't know how long they have been infected. They don't know if the attack is directed at them, specifically (and thus might be smarter about hiding its activity). These folk really don't know yet what the extent of the damage is. The stock line should be, "we don't know", not, "nothing bad happened". Something bad happened -- malware got on your network and spread. That much is clear.
If you mod me down, I shall become more powerful than you could possibly imagine.
True, US-government-classified material does have to be regulated.
But what about the human resource database of the United States Postal Service, with its employee birth dates and social security numbers? What about the customer database at American Airlines, with its juicy collection of credit card numbers? What about your medical insurer, which may have lots of information about your or your children's health you don't want entering the public domain? What about the bank teller whose terminal let's her do almost anything with people's money?
It's probably a bad idea to let computers which have access to that kind of data, particularly write-access, to access the Internet or an unsecured network unless absolutely necessary to do the job. Sometimes, you have to allow such access if you are going to allow certain services, like allowing people to order products or services with credit cards from home, or do home banking. However, at least in these cases you can limit the potential damage to what that customer is allowed to access. If you allow people with wholesale access to sensitive databases to "work from home," give them a separate, secure computer that runs on an isolated LAN at the person's house, tunnel everything over a VPN, and block all non-VPN traffic except that needed to establish the VPN. Better yet, give them a separate real connection straight back to the corporate glass tower, bypassing the Internet entirely. Even better yet, don't let them work from home.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
It's known as the "fastlead" virus, and it's frequently game over if you get infected.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Correct, zero is a tad less than ~ninety-three thousand.
Considering that UNIX-like systems are ubiquitous in the server world (and OS X is a UNIX-variant), that is a really lame argument.
[citation needed]
Caveat Utilitor
US Air Force General Kevin Chilton, head of US Strategic Command, has said that attacks on the United States via the Internet could merit a conventional military response.
"I don't think you take anything off the table. We're particularly looking toward one group in Seattle."
The Seattle-based insurgent group is thought to have seeded American government and military computers with millions of copies of malware that allows attackers easy access to any data stored on the computer, or indeed to take complete control of the computer and use it for their own ends as part of a massive "botnet" to mount further attacks. The malware, "Windows," makes securing a computer running it almost impossible.
"Turning Seattle into a glass crater would only be undertaken strictly as the minimum required surgical military action," emphasised Chilton, "and not in any way out of twenty-five years' bitter resentment and frustration at computing machinery."
Chilton stressed that members of the US military must begin to think of their computers as the front lines. "Do you realize that in addition to adding Windows to computers, why, there are studies underway to Windowsize salt, flour, fruit juices, soup, sugar, milk ... ice cream. Ice cream, Mandrake, children's ice cream! I can no longer sit back and allow Windows infiltration, Windows indoctrination, Windows subversion and the international enterprise licensing conspiracy to sap and impurify all of our precious bodily fluids!"
The Obama administration is currently reviewing the United States' cyberspace defense policy. "We're considering all options thoroughly," said the President, closing his MacBook and looking lingeringly at the red button on his desk.
http://rocknerd.co.uk
This should be modded up.
Generally, I also recommend Mac for brain-dead users whose computers I don't want to fix every 3 days. There is simply less chance of such problems... randomly. Most exploits target Windows and MSIE, simple as that. But that is only GENERALLY...randomly...blindly.
More and more, we are seeing targeted attacks. The targetted attack is most successful when the contents of the network are known. So get one machine compromised (advanced scout), survey the network to see what's out there, then plan the real attack. There are abundant attacks for Mac and even Linux. In the event of targeted attacks, all bets are off. "Reputation" for security only serves the attacker because the defences of the machines will likely be lower on those machines considered "more secure."
Well, maybe some hardened versions but not the run of the mill version.
If you want hardened computing, you want:
*A hardened network, with hardened human access
*A hardened computer, with hardened human access
*A hardened OS or one that comes pre-hardened by design. SELinux, OpenBSD, some specialty flavors of MS-Windows, some small/embeded-systems OSes, some Unix-style OSes, and some mainframe-type OSes qualify
*Hardened sofware all the way around
*People who are trained in security in general and trained how to use the computer properly and how to spot people who are trying to compromise it or the network
Do you really want hardened computing?
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
93,000?
That's a mighty low estimate.
http://news.cnet.com/8301-13579_3-9808489-37.html
http://www.tuaw.com/2008/11/21/new-mac-os-x-malware-osx_lamzev-a/
http://www.f-secure.com/v-descs/trojan_osx_dnschanger.shtml
http://www.f-secure.com/v-descs/inqtana_a.shtml
http://blogs.zdnet.com/security/?p=2418
to begin with a few.
Or does this sound like a cheap stunt to cook up funding for "cyber warface" and somesuch. Virus my butt... Some idiot probably tripped over a server power cord, sent half the FBI down, and now the bozos in charge are trying to use it as an excuse to get more taxpayer cash.
Also, most mac users think and they're told that theres no malware and they're secure, so they have the mentality of "nothing can hit me" and even tho theres a few mac av's, almost noone runs them.
Hell, there's botnets running inside _routers_. What makes it think that mac is somehow some bulletproof solution. You dont need root to send spam or ddos either.
Mac is also a standardized os, so its a lot easier to make malware for it than the tons of different linux os's. And its already true, but because of this mentality Apple and Mac users have given to everyone, they think they're safe. It's really stupid from Apple's part, because the problem keeps just rising and one day it gets hit badly and no one has prepared because of their assumptions.
Trojans can run on any OS, once the user is tricked into installing them. IOW,they're extremely easy to avoid. However, viruses are only found in the wild on Windows systems. And only Windows can be infected by simply visiting a web site.
Caveat Utilitor
Last I heard, the FBI was embarrassingly under-tech'd. They probably use paper and pencil a lot of the time.
Which, of course, is because Dell and Apple are sponsoring the show. This has been happening for years; Amiga used to sponsor the Neighbors soap, and so people had Amigas on the show. They went with Macs later, probably because they got better/alternate sponsorship from Apple then.
Sure some mysterious unknown virus. Or Someone broke/deleted something and didn't know how to fix it. I mean would you want to tell the FBI you broke their computers?
The reason windows systems are more vulnerable than Unix-like OS's is because in Windows, the default status of the computer is that the end user is running an administrator-type account, with full privileges to install new system software and replace drivers. In a properly administrated Unix system, only a few root-level processes are running, and the logged-in user does _not_ constantly have access to such privileges except when they are specifically requested by the user, and only then within the process that the end user specifically escalated privileges on. This leaves social engineering as the only real means by which a unix-type of machine is liable to be compromised, and avoiding that is also a matter of maintaining established sound system-administration practices.
Of course, maintaining such practices on windows systems would cause a significant (HUGE, even) drop in viruses on that platform as well (possibly even to the point that a resident virus scanner could be considered wasteful, and regular on-demand checks for compromises alone would likely be adequate). However, most windows users simply are not interested in learning how to be sysadmins, so the problem remains.
File under 'M' for 'Manic ranting'
This is sounding more and more like Plan Nine from User Space.
700,000 desktops in the US Army are going to be upgraded to Vista.
you had me at #!
Any known vaccines ? And what is the fatality rate ?
Every example in your list is a social engineering trojan. They all require the user to literally INSTALL the malware and enter their admin password to do it. No system can defend against that. There are proof of concept viruses and worms on the Mac, but pretty much everything in wild is a trojan and requires significant user intervention to work. That's hardly fair. Of course stupid Mac users are still stupid users. That doesn't make the system itself less secure. I'm not one of the "OMG, it's completely secure!" fanbois. There are definitely holes in OS X, and Apple has not always been quick to fix them. The fact remains, however, that their are virtually no Mac viruses or worms in the wild (for the proper, security profession, definitions of "virus" or "worm").
I don't need a million points of light, just two points of multi-mode fiber and a 10 Gig-E router.
*Give employees 2 computers with a KVM, one for surfing the web and access to non-secure data, one to access secure data.
Or use one operating system that allows different levels of security on one system, with different applications each running at different levels, and with access to variously segmented networks spanning from unclassified to top secret:
http://en.wikipedia.org/wiki/Trusted_Solaris
It's called multi-level security, and the DoD already uses it.
Actually, Apple has pretty much led the way in how to make becoming your own sysadmin dead easy. The problem has been that MS makes backwards compatability a priority -- and also, possibly they have decided that insecure systems are ultimately more profitable. I've never heard of a Mac user buying a new machine because the old one was a year old and too slow to be useable. But that's a common scenario for non-geek windows users, which means a lot more profit for MS and the OEMs.
Caveat Utilitor
This is a military organization under attack. Why not just have explanations about social engineering, and have punishments for those who fall for the regular fake social engineering tests?
"Lower" in this context is like saying that the ocean is wet.
Mac (and linux, bsd, and probably the rest) are not invulnerable to malware, specially if you count what is run by the user. But the ladder you must climb (both in social and software engineering) is far higher for those cases than for the average windows installation, where the culture teaches you to install/run things from open internet without even worrying if there is a source that could be checked and is pretty documented how easy is to get into, and already there are plenty of "bad boys" doing nasty and complex stuff for it (conficker et al)
Check with the lads at the CIA.
I will not be pushed, filed, stamped, indexed, briefed, debriefed or numbered. My life is my own.
No, that's the FBI Computer Crime Center, and only because they got upgraded from chalkboards.
somehow this seems related to the urine candid camera post earlier today
They're the government, they're not supposed to lie.
Maybe the virus writer is a disgruntled Pisser that didn't like DHS invading his personal pee space during a lay over in Houston?
Politics is the art of looking for trouble, finding it everywhere, diagnosing it incorrectly and applying the wrong fix.
__STOP__ USING WINDOWS, and don't allow users to get root.
Oh, my, yes.
Linux and UNIX are not immune: the Morris Worm proved that in 1988, and many of the flaws it revealed about people using bad passwords and not doing security updates remain true today in most personal and corporate environments. I just had a lot of fun explaining to a corporate partner that they _will not_ run VMware ESX in the exposed network network because it is RHEL 3 based, and VMWare basically refuses to provide access to RedHat registration to get updates or install necessary tools to manage the system as a member of a managed environment. So kiss realistic security on any ESX server goodbye. Tripwire? nmap? What do you need those for? You paid VMware good money for this, yo udon't need to manage these systems!
But the ridiculous joke that is providing security for the HR and purchasing departments of any serious bureaucracy (and believe me, the FBI has a _massive_ bureaucracy) is itself a nightmare. Couple that with slapping civil servants in the head to stop having their secretaries with the boss's personal passwords, and the bosses having to have everyone's passwords as a matter of policy, and you have a nightmare waiting to happen. The FBI may have the "FBI Computer Security Center", but have you ever tried to deal with those bozos to actually report a computer crime? They're like a Delhi call center but with American caccents. They have neither the competence nor the authority to actually do anything about day to day crimes: they are a giant, expensive department to soak up federal money and absorb complaints and do _nothing_ about crime.
Has anyone, ever, actually had the FBI provide anything resembling help with a computer crime? Hands up, please, anyone who's actually gotten help from those red-nosed Bozo the clowns with badges in actually securing a system or convicting anyone of a theft of data or a breakin?
All the others require the user to either accept a transfer or installation and in several cases even type in his root password. And for the one that came in the pirated iWork 09 installer, you're downloading pirated software - not the most trusted sources, imho.
To quote one of the articles (the second one you listed):
Sure, there is malware for Macs, but there are a lot fewer things that automatically install when you open an email or visit a website.
This space up for sale.
A hardened network, with hardened human access
Show me a hardened network connected to the Internet and I'll show you a self-contradiction.
I get your point though: If you are connected to the Internet, there's an upper limit on how secure you can be.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Random stats for the win.
I guess Symantec and McAfee should shut down their Mac operations since Macs are so safe. I wonder why they even try to sell antivirus software for Macs in the first place seeing how they are immune from attack!
While I agree with the general principle that *nix OSes (including Macs) are more secure than Windows, viruses are just as possible on other operating systems.
That said, the government could save shit-tons in licensing fees by switching to a free OS like Ubuntu, and they wouldn't have to worry about something like this happening nearly so often.
It's better to vote for what you want and not get it than to vote for what you don't want and get it.
- E. Debs
I wonder if Microsoft and some of the organizations it has hired to produce Total Cost of Ownership (TCO) reports take things like this into account.
If we're betting, I'll take "no."
"It is nice to know that the computer understands the problem. But I would like to understand it too." --Eugene Wigner
The claim that Mac/Linux/*nix are all as vulnerable as Windows is specious. Every one of the exploits previously mentioned depends on the stupidity, gullibility or laziness of the user, not on the insecurity of the system.
Microsoft shills and astroturfers can bleat all they want, but Windows systems are simply rotten to the core when it comes to security. I'm not claiming that *nix (including OS X) systems will always be 100% immune to malware, but at least they do a good job of keeping casual exploits out of the works.
Whereas in Windows, attempting to continually patch holes in something that was initially designed as a single-user system to make it safer in a networked world is always going to be problematic.
Whatever else we may think about Apple, they made a sound, pragmatic decision when they threw out the old OS 9 architecture and replaced it with what is essentially a BSD-like system with their own work on top to make it pretty. Unix, by its very nature, is actually quite hard to crack if sensible operating defaults are followed.
Dood, these people are the FBI -- they know EVERYTHING (DCS 1000, plus gruvy software by number one intel contractor, S.A.I.C.). Also, I have the same false positives whenever I download porn, too......
The smaller number of exploits targeting Mac does make it a more secure platform, even if a big reason for that is a smaller user base. As far as I am aware, there are only three Macs in existence: a laptop owned by my boss, my idiot cousin's G5, and the one I've seen on House. I am sure there a few I am missing.
But I agree with your point regarding targeted attacks. If you ask the so-called Unix geeks on Slashdot if Unix platforms are susceptible to, say, Internet worms or other malware, I am certain a high percentage will be quite literally foaming at the mouth trying to convince you that Unix is invulnerable to such attacks.
You seem to forget here that most of the exploits now a days are from third party programs. These exploits are just aswell possible on mac/linux once the userbase is just there. Some windows services have been exploitable, but thats because like 90-95% of desktop computers use Windows, so its better idea to try to find exploits on them. However aswell as Windows, both Mac's and Linuxes have had their share of exploits to third party programs.
Whatever else we may think about Apple, they made a sound, pragmatic decision when they threw out the old OS 9 architecture and replaced it with what is essentially a BSD-like system with their own work on top to make it pretty. Unix, by its very nature, is actually quite hard to crack if sensible operating defaults are followed.
Most malware work just enough good when run under user account aswell. You do not need root access to most of the functions they do.
For example the recently hugely exploited Adobe PDF reader exploits would work quite aswell on Mac's. You seem to be blaiming OS's instead of the third party programs. Mac and Linux will have just as much malware as soon as its profitable enough for the malware authors.
http://www.tuaw.com/2008/11/21/new-mac-os-x-malware-osx_lamzev-a/
Not true. Install "Little Snitch" and you'll have full knowledge of what program is trying to call home. Anyway root access (or even user's password) is asked for only when installing something new, so even the dumbest Mac user will know when not to enter a password for an known program.
As I said, I don't repeat myself.
So comes along one of those many fake websites that say 'you need to update your codec to watch this video'. User thinks its a new codec installed = your new program. Lots of malware seem to have changed to social engineering tactics instead of just trying to exploit some hole, and lots of users seem to fall to those.
Maybe coincidence, maybe not. I happened to be crossing the border back into the U.S. from Niagara Falls on Thursday afternoon when the Customs and Border Patrol computers at the entry port started to randomly shut down. It took over two hours of waiting for them to finally call the ATF to run our passports. Lo and behold, the FBI system was their backup! This is the side-effect of inter-agency connectivity: if you CAN successfully launch an attack, you can take down EVERYBODY.
And then they'd have to pay shit tons to VMWare or Citrix so that they'd have some way of running all the Win32-only stuff they depend on and still end up paying for Windows licences. Ubuntu is not a drop in replacement for Windows just because Open Office can read and write .DOC and .XLS files.
And only Windows can be infected by simply visiting a web site.
Apparently not. Unless Apple have fixed it in the last 48 hours, there's an open serious issue on Macs in relation to Java. OTOH, it's unclear how prevalent the exploits for this are in the wild; things that stay in the lab aren't stuff to panic over.
Alas, it seems that Win-targeted exploits are fairly common. But let's not pile on unwarranted FUD...
"Little does he know, but there is no 'I' in 'Idiot'!"
Idiot. You don't have to miss the point of something to take the topic further anyway. It's called conversation. You should try learning it sometime.
What Win32-only stuff? My guess is you mean internal apps that are coded to only be read through IE, in which case, they can run IE on Ubuntu through various means. If you legitimately mean apps coded strictly for Win32, I doubt there are that many, and likely they can run through Wine without any trouble.
It's better to vote for what you want and not get it than to vote for what you don't want and get it.
- E. Debs
You doubt there are that many? What planet do you live on? And they can run through WINE without any trouble? Again what planet do you live on?
Perhaps you missed the pwn-to-own competition, where exploits that allowed remote attacker to execute arbitrary code on Linux and OS X were demonstrated? The user only needed to visit a URL with their browser to be exploited. Or maybe you missed the Linux SCTP vulnerability, which gives remote attackers the ability to execute arbitrary code as root if the machine is running anything that uses SCTP.
I am TheRaven on Soylent News
That vulnerability also affected Linux and was unpatched for about three months after being first discovered there (six months after it was fixed on Linux, it's still open on OS X). Linux has also had a very nasty vulnerability in the SCTP part of the network stack recently. If you're running anything that uses SCTP, a maliciously-crafted packet can cause arbitrary code execution in the kernel, which is almost as compromised as it's possible to be.
I am TheRaven on Soylent News
Ah, so you don't have any actual evidence.
It's better to vote for what you want and not get it than to vote for what you don't want and get it.
- E. Debs
*whoosh*
See? I can do it too. Are we done yet, or would you like to play at 2-year-olds some more?
If you hardware doesn't give you the tools to implement layered security, you don't have layered security.
Even the lowly 80286 chip offered memory protection and privileged APIs.
In the mainframe world, "escaping" from a virtual machine and taking over the supervisor process was hard and absent bugs, should be impossible. Ditto breaking out of a Windows/VMWare/etc, Java, or other virtual machine.
It's worth repeating: In a system with layers like the grandparent post mentioned, either you have good security, or you don't have layered security or any security at all.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Malware? Yes. Viruses or worms? No.
These are all trojans. The problem is not the OS, it's the user giving EXPLICIT PERMISSION to install the malware. No OS can protect against that. Talk about making mountains out of molehills. Nice list of FUD you compiled there.
Good point. The obvious reason is money. Macs are a rising market, and an untapped one by the scare peddlers. So, they routinely send our some prognostication in the form of a press release saying that any day now a deadly Mac virus will be released that will kill all your loved ones. How else are they going to scare up business on a platform that has no need of their snake oil?