Slashdot Mirror
FBI, US Marshals Hit By Virus
Norsefire writes "The FBI and US Marshals were forced to shut down part of their computer network after being hit by a 'mystery virus.' FBI spokesman Mike Kortan said, 'We are evaluating a network issue on our external, unclassified network that's affecting several government agencies.' Nikki Credic, spokeswoman for the US Marshals, said that no data has been compromised but the type of virus and its origin is unknown."
More and more, sensitive corporate and government networks will need to be isolated or at least mostly isolated from non-sensitive networks and the Internet.
They may not need an air gap but they will need to be isolated enough to prevent general problems like viruses.
They also need to be run with the philosophy of "every other machine or user on my network could become compromised (infected or bribed) at any time."
A couple of possible solutions:
*Give employees 2 computers with a KVM, one for surfing the web and access to non-secure data, one to access secure data.
*Give employees a multi-homed, ROM+read-only-USB-stick-for-configuration-data-boot "thin client" that's stripped down and hardened, with no copy-and-paste, no network bridging, and other designed way for one remote server to influence the other. Then have them connect to different servers on different networks for different needs.
If your security requirements are extreme, use an air gap.
In either case, don't forget to take countermeasures against human idiocy, ignorance, and bribery/blackmail.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
"said that no data has been compromised but the type of virus and its origin is unknown."
How do they know that there was no data compromised if they don't even know the type of the virus?
Knowledge is power. Knowledge shared is power lost.
How many people have gotten a virus from surfing a site using Linux? Very, very, very, few, to non existent. Sure, Linux is vulnerable but it isn't targeted, the diversity in distros, kernel versions, browsers, etc. help keep the target moving. About the only way to get a virus, in the wild is to download and explicitly install a virus or a trojan.
Taxation is legalized theft, no more, no less.
They DO use Macs. And Dell. They were shown VERY CLEARLY inside FBI headquarters during season 7 of 24.
The spokeswoman said :
"no data has been compromised but the type of virus and its origin is unknown"
That is an extraordinary statement. How would they know ?
If I was head of IT there I would assume that that was not true. Even if there was a completely different computer system for any sensitive information, data has a way of leaking to where it shouldn't be. Of thousands of people, not one put notes or passwords or whatever on the insecure side of the line ?
Regardless of what they tell the press, I hope that internally they are assuming that this is a breach, and acting accordingly.
Please copy this file to your hard drive, decompress it, untar it, chmod it, and place an entry in the root crontab... so I can have your advice.
If you mod me down, I shall become more powerful than you could possibly imagine.
Mac is in no way less vulnareble than Windows, specially in targeted attacks. It seems most people have been brainwashed quite good. Yes, the amount of malware for mac's is lower than Windows, but so is mac userbase. However there are many OSX malware circumventing already and it seems to be just going up.
And no, not all malware require root to run. They can easily run under your user account aswell and still steal lots of data, passwords and keylog etc. If they require root, then social engineering attack will get past most users as they happily enter their root password.
This claim is made by nearly every spokesperson for any major organization which is forced to disclose a malware attack to the public. In nearly every case the claim cannot be substantiated. Run of the mill malware often scans hard drives and uploads data to remote servers over encrypted connections. Most organizations have no way of knowing if these even happened. They don't know how long they have been infected. They don't know if the attack is directed at them, specifically (and thus might be smarter about hiding its activity). These folk really don't know yet what the extent of the damage is. The stock line should be, "we don't know", not, "nothing bad happened". Something bad happened -- malware got on your network and spread. That much is clear.
If you mod me down, I shall become more powerful than you could possibly imagine.
True, US-government-classified material does have to be regulated.
But what about the human resource database of the United States Postal Service, with its employee birth dates and social security numbers? What about the customer database at American Airlines, with its juicy collection of credit card numbers? What about your medical insurer, which may have lots of information about your or your children's health you don't want entering the public domain? What about the bank teller whose terminal let's her do almost anything with people's money?
It's probably a bad idea to let computers which have access to that kind of data, particularly write-access, to access the Internet or an unsecured network unless absolutely necessary to do the job. Sometimes, you have to allow such access if you are going to allow certain services, like allowing people to order products or services with credit cards from home, or do home banking. However, at least in these cases you can limit the potential damage to what that customer is allowed to access. If you allow people with wholesale access to sensitive databases to "work from home," give them a separate, secure computer that runs on an isolated LAN at the person's house, tunnel everything over a VPN, and block all non-VPN traffic except that needed to establish the VPN. Better yet, give them a separate real connection straight back to the corporate glass tower, bypassing the Internet entirely. Even better yet, don't let them work from home.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
It's known as the "fastlead" virus, and it's frequently game over if you get infected.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Correct, zero is a tad less than ~ninety-three thousand.
Considering that UNIX-like systems are ubiquitous in the server world (and OS X is a UNIX-variant), that is a really lame argument.
[citation needed]
Caveat Utilitor
US Air Force General Kevin Chilton, head of US Strategic Command, has said that attacks on the United States via the Internet could merit a conventional military response.
"I don't think you take anything off the table. We're particularly looking toward one group in Seattle."
The Seattle-based insurgent group is thought to have seeded American government and military computers with millions of copies of malware that allows attackers easy access to any data stored on the computer, or indeed to take complete control of the computer and use it for their own ends as part of a massive "botnet" to mount further attacks. The malware, "Windows," makes securing a computer running it almost impossible.
"Turning Seattle into a glass crater would only be undertaken strictly as the minimum required surgical military action," emphasised Chilton, "and not in any way out of twenty-five years' bitter resentment and frustration at computing machinery."
Chilton stressed that members of the US military must begin to think of their computers as the front lines. "Do you realize that in addition to adding Windows to computers, why, there are studies underway to Windowsize salt, flour, fruit juices, soup, sugar, milk ... ice cream. Ice cream, Mandrake, children's ice cream! I can no longer sit back and allow Windows infiltration, Windows indoctrination, Windows subversion and the international enterprise licensing conspiracy to sap and impurify all of our precious bodily fluids!"
The Obama administration is currently reviewing the United States' cyberspace defense policy. "We're considering all options thoroughly," said the President, closing his MacBook and looking lingeringly at the red button on his desk.
http://rocknerd.co.uk
93,000?
That's a mighty low estimate.
Step 1: Ditch a closed-source product notorious for exploits and viruses
Step 2: Choose a better open-source alternative notorious for its security and stability
Step 3: close the source
http://news.cnet.com/8301-13579_3-9808489-37.html
http://www.tuaw.com/2008/11/21/new-mac-os-x-malware-osx_lamzev-a/
http://www.f-secure.com/v-descs/trojan_osx_dnschanger.shtml
http://www.f-secure.com/v-descs/inqtana_a.shtml
http://blogs.zdnet.com/security/?p=2418
to begin with a few.
Also, most mac users think and they're told that theres no malware and they're secure, so they have the mentality of "nothing can hit me" and even tho theres a few mac av's, almost noone runs them.
Hell, there's botnets running inside _routers_. What makes it think that mac is somehow some bulletproof solution. You dont need root to send spam or ddos either.
Mac is also a standardized os, so its a lot easier to make malware for it than the tons of different linux os's. And its already true, but because of this mentality Apple and Mac users have given to everyone, they think they're safe. It's really stupid from Apple's part, because the problem keeps just rising and one day it gets hit badly and no one has prepared because of their assumptions.
Trojans can run on any OS, once the user is tricked into installing them. IOW,they're extremely easy to avoid. However, viruses are only found in the wild on Windows systems. And only Windows can be infected by simply visiting a web site.
Caveat Utilitor
Step 4: watch a lower ranking employee click on the HappyFunTime executable in their mail
Step 5: Priceless.
The reason windows systems are more vulnerable than Unix-like OS's is because in Windows, the default status of the computer is that the end user is running an administrator-type account, with full privileges to install new system software and replace drivers. In a properly administrated Unix system, only a few root-level processes are running, and the logged-in user does _not_ constantly have access to such privileges except when they are specifically requested by the user, and only then within the process that the end user specifically escalated privileges on. This leaves social engineering as the only real means by which a unix-type of machine is liable to be compromised, and avoiding that is also a matter of maintaining established sound system-administration practices.
Of course, maintaining such practices on windows systems would cause a significant (HUGE, even) drop in viruses on that platform as well (possibly even to the point that a resident virus scanner could be considered wasteful, and regular on-demand checks for compromises alone would likely be adequate). However, most windows users simply are not interested in learning how to be sysadmins, so the problem remains.
File under 'M' for 'Manic ranting'
700,000 desktops in the US Army are going to be upgraded to Vista.
you had me at #!
Especially 2. I work for a government contractor. The amount of stupid pointless shit we have to do in the name of "security" while leaving HUGE GAPING HOLES untouched just hurts my head. It's like our security policy is designed by ADD addled five year olds. They read about something in a magazine and think "Oh, shiny!" They quickly write some insane, over the top, policy to "solve" the "problem" and keep reading the magazine. It's great assuming that the article covers all possible security problems ever, or that it contained actual solutions instead of stuff that kinda sounds like it ought to fix a problem.
The latest brainstorm is that we are switching to 12 character passwords which change every 60 days. This is almost certain to result in:
a) People forgetting their passwords, requiring continuous password resets
b) People writing down their impossible to remember, constantly changing, password
c) Both (a) and (b)
Meanwhile, we still have a number of systems that use rsh (No, not Kerberized rsh, the plain 30 year old version with .rlogin files.). Granted this is an isolated network, with no Internet access at all. We're not likely to be attacked by outside entities. But if you trust the users of the isolated network enough to assume that they are not going to take advantage of the multiple and well published rsh vulnerabilities, why don't you trust them enough to assume that they are not running password crackers?
I don't need a million points of light, just two points of multi-mode fiber and a 10 Gig-E router.