Slashdot Mirror
Pentagon Confirms 2008 Computer Breach — 'Worst Ever'
jowifi writes "The New York Times reports that the Pentagon has confirmed that, in 2008, a foreign agent instigated 'the most significant breach of US military computers ever' using a USB flash drive. While the breach was previously reported on Wired and the LA Times, this is the first official confirmation of the attack that led to the banning of USB drives on government computers."
This is likely why Windows 7 has explicit GPOs to either set USB flash drives read-only, or deny them the ability to mount whatsoever. Other programs that have this functionality are PGP Universal, and Symantec Endpoint Protection.
Now, if MS can put autoplay/autorun to rest six feet under with Clippy and Bob, that would be a good security advance.
Worst...Computer breach...Ever.
Do not argue with an idiot. He will drag you down to his level and beat you with experience.
This reminds me of the joke of the man that, having learned that his wife was fucking other men in the couch in the living room, moved the couch to the garage.
USB drives have a purpose for legal uses. Wouldn't it be better to improve their systems so that USB drives couldn't be used in harmful ways?
... watched the movie "The Recruit" when it came out.
TOP DSLR Cameras Reviews of the top DSLRs
That seems to be a more reasonable security risk.
I swear to God...I swear to God! That is NOT how you treat your human!
"He also put a name — Operation Buckshot Yankee — to the Pentagon operation to counter the attack"
Who are we counter attacking? With what?
Since the US Armed Forces, DoD, et al. still use Windows it would be prudent for all of them to employ BitLocker or whole drive encryption even on the unclassified computers. The reason being is that I just made a flash drive today that can still blank out the local system admin password on any windows computer in existance (unless they have BitLocker or TruCrypt).
A US Army dental surgeon told me that their computers were "fixed", so they could not copy pictures of their operations to any external media. The surgeons needed anonymous pictures of operations that they had performed, for preparing for their careers after their service. Like, applying for a job somewhere.
One of them figured a way to use the USB port in the Canon printer that they had. They could toss pictures at the printer, and land them on the USB stick. Circumventing any blocks on the PCs from accessing the PCs' USB ports.
So any unprotected port is, well, a potential source of a leak.
Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
Rob Rosenberger at VMyths notes:
So why this story? Well (from the same source):
I know for sure that USB drives (flash and otherwise) have been banned on DoD systems for quite a while before 2008. Perhaps other government sectors didn't have this rule in place, but more likely it was simply not being enforced.
Same guy that stole the plans to defend South Korea from attack by the North with a thumb drive? There are solutions guys and they're not very difficult. How about this one, which I stole from "Cryptanomicon": Anything electronic going in or out goes through security. Personnel drop such things off at the entrance and then walk through a very large, strong magmetic field. Same thing leaving. Just like the airport only if you forget to drop off your watch, it gets fried.
In 1983, a high school kid named David Lightman hacked his way into DOD computer @ Norad called the W.O.P.R. which almost resulted in an all out nuclear war between the U.S.A. and Russia. I believe they made a movie about it.
So until I hear a story that tops that, keep your "worst ever" superlatives to yourself. Oh, wait...
Authority questions you. Return the favor.
So, what system the computer were running? Why is that information never in this news reports? Are they assuming that computers just runs, without any software on it? Don't they know that computers usually have an operation system on it to be useful?
I really had it now. I clicked through the pages and agent.btz is mentioned. Nobody had mentioned that's a Windows worm Worm:W32/Agent.BTZ http://www.f-secure.com/v-descs/worm_w32_agent_btz.shtml Platform is Windows 32, of course. Why is nobody is mentioning the operation system? Why is nobody blaming Microsoft? Oh George W. Bush was briefed on it, was he briefed on it that the worm is only useful on Windows systems and that his military is vulnerable?
His article appeared intended partly to raise awareness of the threat to United States cybersecurity — “the frequency and sophistication of intrusions into U.S. military networks have increased exponentially,” he wrote — and partly to make the case for a larger Pentagon role in cyberdefense.
How about they mentioning that's it's increased on Windows and that Linux and other systems are save and sound? How about they ditched this system which proved times after times after times to be the only system that is vulnerable?
http://www.mueller-public.de - My site http://www.anr-institute.com/ - Advanced Natural Research Institute
I didn't follow the original story back then, but I find somewhat surprising what I read here. USB drives allowed on a sensitive system containing sensitive informations seems like a bad idea how ever you present it. But having one universal port for everything is a problem for sensituve application. You can only block its use for data link on the software level, which will eventually be bypassed.
It will always be possible to retrieve information from the system, sometimes with considerable amount of work. But allowing USB drives just make it too easy and too likely to happen...
AFAIK, Everybody that uses a Pentagon computer uses a Common Access Card (CAC) that usually inserts in the keyboard. When you remove your CAC, you are logged out. In theory, nobody should ever be able to use a computer while logged into another user's account without their knowledge.
Although I believe all USB storage devices are banned from military computers, How difficult would it be to create a script to capture the user's ID info from the CAC and write it to a log file so offenders can be caught and prosecuted? It may not necessarily prevent a crime, but it would certainly help prosecutions after a crime is committed.
nuf said
Hey AT&T ima let you finish but the Pentagon had the worst data breach EVER! Worst data breach ever!
insert funny sig here
Hilarious
The Gummermint in their infinite wisdom has decided that they will no longer hire Tech people as permanent employees (there are exceptions) so their has been an explosion of revolving door "new people" who have to be allowed to sit at a desk, in the building, at a console for up to six months until their security clearances come through. Can you say "social networking"?, I know you can!
Hi, Foobar, can I sit at your terminal, you know, just to check my Foobar account, is that OK? (check & mate).
I killed da wabbit -Elmer Fudd
Against the array of threats, Mr. Lynn said, the National Security Agency had pioneered systems — “part sensor, part sentry, part sharpshooter” — that are meant to automatically counter intrusions in real time.
Sounds almost next gen A.I. ish. If it weren't for the "pioneered" part, I'd just think he was talking about plain jane intruder detection systems.
Do we think these systems are really as advanced as insinuated? Or is it just puffing up for P.R. & intimidation? If these systems really are that awesome, how long before this tech trickles into the civilian world? Government software engineering can't be outpacing "civilian" efforts by that much, can it? --- Hey, what they hell do I know? I'm just a guy on a couch.
Now instead of an autorun that says 'do nothing' to launch my evil .exe, I have to plant a standard file format and an evil .dll on the pen.
That's like a whole extra step. It could take almost as long as typing this comment did.
Help stamp out iliturcy.
I can't speak for the pentagon, but none of the computers I have used that require a CAC for log on log you out or lock the computer when the CAC is removed.
Well there's multiple problems with that, as applied to the government:
1) If the idea is to go to the less used system because it is more secure, that means changing any time your system isn't so minor. In fact they'd be much better to write their own OS, with no relation to any existing one, than to use Linux. Linux does have a fair bit of use and does get owned (our research labs get their poorly secured Linux boxes owned from time to time) and of course the government is a big user so them switching would make it a much larger target.
2) You are advocating a monoculture. The government does use UNIX, just not exclusively. So if the argument is "Switch all to one system," then you've created an environment easier to break in to. With multiple kinds of OSes, there is hope that a fault in one is not a fault in all. Switch everything to Linux and that all goes away.
3) While the government doesn't like getting a worm, that isn't their real concern. Their real concern is espionage. That means facing a well motivated, financed, and focused adversary. They'll break in to Linux if that's what it takes. The SVR isn't going to say "Oh shit, they aren't running Windows, oh well just leave off it then." They'll look for Linux weaknesses, and write attacks targeting that if that's what it takes.
4) There are real needs in terms of apps and so on, not all of which Linux can meet well (if at all). Even Office would be an example of this. OpenOffice is NOT the equivalent of MS Office. If you think it is that only demonstrates you've never used an office suite for anything more than simple activities. No shame in that, many don't need to, but many do, the government being one of them.
Also if you think that sites that hold CCs don't get owned you've got your head in the sand. Online sites get owned all the time and yes, many of them run Linux. Hell a payment processor got hit last year. My bank couldn't tell me who (privacy laws) but informed me my card was being replaced because it had been processed by that company.
Sorry, but systems get hacked. Trying for obscurity isn't a good solution. I'm not saying "All Windows all the time," but "All Linux all the time," is just as stupid.
I remember reading a book about the Mitrokhin archive, which was archival info about the activities of the KGB during the Cold War. One memorable thing was that the Soviets got a LOT of technical secrets from the West and they congratulated themselves on how it was cheaper to steal than develop on their own. The problem is, they couldn't get ahead that way. The porosity of the west allowed information to be traded, cross-fertilization, open competition that stimulated and sped up the development of new things, so that whatever was stolen was soon obsolete anyway.
As for diplomatic secrets, there was the famous incident of a bug in the US embassy in Russia from which the Soviets got a lot of diplomatic secrets. I've read comments that this actually was a good thing because that way the Russians knew the US wasn't planning to attack them any time soon, just as we could relax a bit thanks to our spy satellites and U-2s showing us the Russians weren't planning to attack us any time soon.
I admit I'm only offering speculation and hearsay, and I don't want to come across as too starry eyed and idealistic. Particularly in war loose lips and sink ships and Bletchley Park was very bad news for the Nazis in WW2 so there is a place for espionage and counter-espionage, but I do think that before people get utterly hung up on security and paranoia, they should perhaps do a little thinking outside the box.
In theory, theory and practice are the same; in practice they're different. (Yogi Berra & A. Einstein)
They don't log you out. A few minutes after you walk away the screen saver will kick in and lock the screen, but pulling a CAC doesn't log you out.
That would make it a real pain to register a new CAC card on a system, or do one of many common tasks we do where someone will sit at another's machine and log into AKO or another site with their own CAC.
I'm too lazy to compose a creative sig.
In 2008 any standard issue Army computer would've...
But were they able to track down and deal with the individual(s) that deployed Microsoft products?
The military procurement procedures produce a solid paper trail even if on some occasions they produce nothing else. Had they deployed properly engineered products rather than brands infamous for bad design the problem would not have arisen. The US Navy will focus on open systems only, if it can stay clear of the old M$ contractors and M$ resellers.
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
Code executed automatically off external media could be allowed if the O/S had a security model that allowed it. For example, if code in external media did not have write capabilities to the hard disk, or if said code had lower privileges over installed applications etc.
The breach was from a USB drive used overseas and occured on a classified system not a typical user PC. Hence the lack of information on its operating system. The military just don't want you to know it was thier super secure network that was compromised. People seem to think that these systems are always used carefully. People will do whatever they think they can get away with. If people see no potential harm in the action they are less likely to follow the rules. Most people don't think about external media as dangerous unless its being used to steal data. In reality they are one of the more dangerous devices due to thier portability. They are an IT security nightmare. Not only USB drives were blocked from use but all external media. This includes the use or installation of printers with USB slots and SD readers. Users were required to turn in all external storage devices including media cards for cameras, to be "evaluated". They were not returned.
Trust me, I have implemented just about any security method in a variety of settings (medical, financial, ...).
What about military? I've worked in medical, financial, manufacturing and retail too. Military is very different.
The fact remains that people can't be bothered to lock their screens when they step out because it's "too difficult" and "too complicated" let alone click the button to encrypt their e-mail or their USB sticks.
Very true but the difference is that the military can send you to prison for the rest of your life if you get caught being sufficiently lazy/sloppy/incompetent with secure data. The same laws we live by in civilian life don't apply much of the time. The worst a financial firm can do is fire you. I'm not saying that people don't behave exactly as you describe (I'm sure they do) but there are people in the military who actually pay attention to this stuff.
You would think be military and all, they would have thought to disable all usb ports to begin with, no? Military seems to me to be the most important place to have the most security, with all those classified documents and all.
So no hope that the person who did this gave the info to Wikileaks? That would definitely be the best of all possible worlds here.
That would be the only silver lining that I could hope for here. You can't really blame other countries for spying, I am sure just as many (if not many more) USB drives were filled up with secrets by people on american payrolls, so its hard to feel bad for the US Military on this one. When you choose to play the game, sometimes you get played. I only really care about innocent bystanders.
So, really unless this was going to wikileaks, I don't care. If it was, then I applaud it.
There is one ray of hope though:
Thats practically music to my ears. Talk about validating my statements that the military is utterly useless and kept around only because people are convinced that they actually do something for us.
-Steve
"I opened my eyes, and everything went dark again"
This goes from being shot with your own gun to being beat to death with your own laptop.