Slashdot Mirror
Pentagon Confirms 2008 Computer Breach — 'Worst Ever'
jowifi writes "The New York Times reports that the Pentagon has confirmed that, in 2008, a foreign agent instigated 'the most significant breach of US military computers ever' using a USB flash drive. While the breach was previously reported on Wired and the LA Times, this is the first official confirmation of the attack that led to the banning of USB drives on government computers."
This is likely why Windows 7 has explicit GPOs to either set USB flash drives read-only, or deny them the ability to mount whatsoever. Other programs that have this functionality are PGP Universal, and Symantec Endpoint Protection.
Now, if MS can put autoplay/autorun to rest six feet under with Clippy and Bob, that would be a good security advance.
Damn. Parsing got rid of my comic book guy html tags.
Do not argue with an idiot. He will drag you down to his level and beat you with experience.
This reminds me of the joke of the man that, having learned that his wife was fucking other men in the couch in the living room, moved the couch to the garage.
USB drives have a purpose for legal uses. Wouldn't it be better to improve their systems so that USB drives couldn't be used in harmful ways?
That's OK. Maybe some day Slashcode will actually render and tags. About the time they decide to implement more than 2% of the HTML entity set.
Welcome to the Panopticon. Used to be a prison, now it's your home.
A US Army dental surgeon told me that their computers were "fixed", so they could not copy pictures of their operations to any external media. The surgeons needed anonymous pictures of operations that they had performed, for preparing for their careers after their service. Like, applying for a job somewhere.
One of them figured a way to use the USB port in the Canon printer that they had. They could toss pictures at the printer, and land them on the USB stick. Circumventing any blocks on the PCs from accessing the PCs' USB ports.
So any unprotected port is, well, a potential source of a leak.
Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
Rob Rosenberger at VMyths notes:
So why this story? Well (from the same source):
Same guy that stole the plans to defend South Korea from attack by the North with a thumb drive? There are solutions guys and they're not very difficult. How about this one, which I stole from "Cryptanomicon": Anything electronic going in or out goes through security. Personnel drop such things off at the entrance and then walk through a very large, strong magmetic field. Same thing leaving. Just like the airport only if you forget to drop off your watch, it gets fried.
In 1983, a high school kid named David Lightman hacked his way into DOD computer @ Norad called the W.O.P.R. which almost resulted in an all out nuclear war between the U.S.A. and Russia. I believe they made a movie about it.
So until I hear a story that tops that, keep your "worst ever" superlatives to yourself. Oh, wait...
Authority questions you. Return the favor.
So, what system the computer were running? Why is that information never in this news reports? Are they assuming that computers just runs, without any software on it? Don't they know that computers usually have an operation system on it to be useful?
I really had it now. I clicked through the pages and agent.btz is mentioned. Nobody had mentioned that's a Windows worm Worm:W32/Agent.BTZ http://www.f-secure.com/v-descs/worm_w32_agent_btz.shtml Platform is Windows 32, of course. Why is nobody is mentioning the operation system? Why is nobody blaming Microsoft? Oh George W. Bush was briefed on it, was he briefed on it that the worm is only useful on Windows systems and that his military is vulnerable?
His article appeared intended partly to raise awareness of the threat to United States cybersecurity — “the frequency and sophistication of intrusions into U.S. military networks have increased exponentially,” he wrote — and partly to make the case for a larger Pentagon role in cyberdefense.
How about they mentioning that's it's increased on Windows and that Linux and other systems are save and sound? How about they ditched this system which proved times after times after times to be the only system that is vulnerable?
http://www.mueller-public.de - My site http://www.anr-institute.com/ - Advanced Natural Research Institute
It's always someone's first day. It took you years to get to the point you could even post on /.
---
ECHELON is a government program to find words like bomb, jihad, plutonium, assassinate, and anarchy.
Hilarious
That was my thought, why are they allowing physical access to the USB ports without properly monitoring the devices being allowed to be used in the machines. Physical access to the keyboard and mouse is enough of a security risk as it is, but allowing people to plug in strange USB devices without first inspecting them strikes me as irresponsible. Admittedly, people do have to do their work, but I'm not sure why they weren't being required to scan the information on the drive before connecting it up to a secured computer.
There's no reason why the check point computer even needs to be connected to the net at all if you're willing to do manual updates to the security software via disk.
Let me guess, it's Alice and Bob again.
Nah, it's Mallory.
In 2008 any standard issue Army computer would've...
But were they able to track down and deal with the individual(s) that deployed Microsoft products?
The military procurement procedures produce a solid paper trail even if on some occasions they produce nothing else. Had they deployed properly engineered products rather than brands infamous for bad design the problem would not have arisen. The US Navy will focus on open systems only, if it can stay clear of the old M$ contractors and M$ resellers.
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.