Slashdot Mirror
DoD Takes Criticism From Security Experts On Cyberwar Incident
wiredmikey writes "Undersecretary of Defense William J. Lynn is being challenged by IT security experts who find it hard to believe that the incident which led to the Pentagon's recognizing cyberspace as a new 'domain of warfare' could have really happened as described. In his essay, 'Defending a New Domain,' Lynn recounts a widely-reported 2008 hack that was initiated when, according to Lynn, an infected flash drive was inserted into a military laptop by 'a foreign intelligence agency.' Critics such as IT security firm Sophos' Chief Security Adviser Chester Wisniewski argue that this James Bond-like scenario doesn't stand up to scrutiny. The primary issue is that the malware involved, known as agent.btz, is neither sophisticated nor particularly dangerous. A variant of the SillyFDC worm, agent.btz can be easily defeated by disabling the Windows 'autorun' feature (which automatically starts a program on a drive upon insertion) or by simply banning thumb drives. In 2007, Silly FDC was rated as Risk Level 1: Very Low, by security firm Symantec."
Millitary runs windows without disabling autorun. Now that's egg on your face...
on military systems.
And so they can either pretend it didn't happen or pretend that they were only defeated by a dedicated and skilful foe rather than by their own ineptitude and laziness.
they went with the latter.
A variant of the SillyFDC worm, agent.btz can be easily defeated by disabling the Windows 'autorun' feature (which automatically starts a program on a drive upon insertion) or by simply banning thumb drives.
But in 2007, that wasn't the case. Autorun usually on, and thumb drives not banned. The Air Force SDC (Standard Desktop Configuration) and the follow-on FDCC (Federal Desktop Core Configuration) ended that.
The only thing the article really provides to dispute the Pentagon's account is that the worm is simple and common.
But then it goes on to mention that while common, its payload is configurable. And the soldier quoted at the end of the article point blank says that it was the outsized effect (14 months of cleanup and lost data) compared to the simplicity of the vector that freaked them out so badly.
Shit, all the military really needs is some logs showing where the thing was sending data and it gets a pretty solid idea of what's going on. And they hinted that there was something to the circumstances where the worm initially entered the system...
Really, what's the story here? Pentagon says it conducted 'forensics' on the worm and decided on foreign origin, security analysts say, "But it's such a simple worm, it can't be that!" The analysts are talking out of their asses, and the Pentagon's explanations make a great deal of sense. Maybe the Pentagon is lying, maybe not, but nothing the doubters say in the article means anything.
As the Security Week article suggests this sounds like the lying the military told about the Gulf of Tonkin Incident.
Falcon
Should there be a Law?
Since when was efficacy or even logic a metric for whether or not a new department/task-group/domain/[insert group du jour] is deemed "necessary" for any govenrmental body? This is just another not-so-subtle attempt at widening the jurisdiction of the military. After all, if the boogyman is unmasked, why, another must be conjured lest we all wake up to the cold truth that these people are simply pissing large reams of money down the tubes.
In the end, all of this will be justified after the fact despite any protestations. War on terror, anyone?
ps. Although if you think about it, it's somewhat ironic that antivirus firms (Sophos, Symantec, etc), which have been frequent fear mongerers themselves, are calling the military on fear mongering.
Wait, are you saying a government agency might have lied, appealing to the general public's lack of knowledge in the area of computers and using a buzzword-filled report to justify an application of force? I find that hard to believe.
Funny may not give karma, but +5 Informative never made anyone snort coffee out their nose.
Where I am, is a lot less on the "secret agent" / James Bond side of things, and a lot more on social engineering.
Two vectors were talked about.
Vector 1: Middle East. Some guys decided they wanted to be insurgents, but didn't have explosives experience and really didn't want to be shot at. So instead, they loaded up viruses on a bunch of hardware (external drives, thumb drives, etc) and sold it to soldiers. Said soldiers then turned around and used these drives on not only their personal computers, but also on Unclass and Classified systems, where it quickly spread because of bad IS/IA policies.
Vector 2: Pentagon area. Similar situation, but instead of selling pre-infected items, some foreign power just left a lot of pre-infected thumb drives around various coffee shops, etc. While some were turned in to lost and found, others were picked up by people who said, "Hey! Free thumb drive!" and proceeded to use them at work and at home. And when work was in a government office that, again had poor IS/IA policies, suddenly you've got computers opening holes in firewalls and transmitting data out.
Hence the big change in policy, to ban thumb drives, turn off auto-run, etc.
I like you, Stuart. You're not like everyone else, here, at Slashdot.
Now that many nations have nuclear weapons, it's obvious that development of the internet or IT doomsday device will be next.
I think the US military are hinting along these lines.
seeing as they're, you know, the pentagon, I highly doubt there are any real 'killer apps' they must have that they don't have the source code to. That said: why use windows? Its not designed to be a secure operating system in the same way that... say.. openBSD is, and while they may have the windows source code (I believe that large and gov't organizations are allowed to see it) they're not allowed to modify it. I'm just saying that in an environment like that, a very secure operating system, closed source or open is the way to go. You can't have it to where any old person can plug in a flash drive and compromise your system. Disabling autorun helps, it helps quite a lot, but it doesn't solve the underlying problem. If they refuse to change, methinks cyber warfare against the US just got a few orders of magnitude easier.
"People don't want to learn linux" hasn't been a valid excuse since '03.
I would be surprised if the secret forensics information is anything more than the malware has Russian roots.
Just because malware is written by Russia crackers doesn't make it a Russian government attack.
rd
I work for a TLA that shall remain nameless. Our contract IT support people, who are supposed to know what they are doing, still haven't figured out how to use group policy editor (in an active directory environment) to disable USB storage devices or how to disable autorun.
Instead, we get this implausible thumb drive scenario. And guess what, instead dof applying $0.02 of common sense, we will see a proposal to spend $2B on intelligence system upgrades and military contracts. Of course, senator, we have earmarked 20% of that for your state...
-- Loaurnkoz
Firstly, I have direct exposure and knowledge of the state of IA affairs in the DoD/IC world. Very direct. At an extremely senior level. This is a world of dysfunction that you cannot, I promise you, imagine. A world where the Gov hires contractors for insurance (so that they have someone to blame) and is unable to even so much as make a decision without pushing it all the way to the top of the agency/directorate/branch. A world where every vendor that peddles any product with "Cyber" or "Cloud" in the name can rest assured that they'll sell an enterprise license. A world where best practices are forever short-circuited in the name of 'emergent mission need'. There is an almost underworld movement amongst those technologists that understand this whereby Open Source solutions are being sneaked in the back door in the name of "research lab product". The USB problem is already solved (see HBSS Device Control) and the real issue was already solvable (via both a registry hack to disable USB storage devices and the auto-play disabling) but the retards at the top couldn't make a decision to move forward with it because, "What if it disables a keyboard, mouse or CAC reader". Idiots. The Government breeds them internally. No one worth their salt wants to be a Govvie. The pay sucks, the politics is unbearable and the future is bleak. Because of this it attracts dimwits who hire others like them, only dumber so that they don't threaten their 'stature'. The net result is Agencies full of semi-retarded morons who never leave, never get fired and keep getting promoted because the system's wired that way. We're doomed, I assure you.
Virus writers update their viruses 100 times faster than the military its rules. I would not wonder if the rules effective at that moment were 10 years old (or just minor revisions - like fixing security holes already being exploited). I work in a very large company, and each time i try to report a security problem i observe, i am being told the IT department is responsible and its not my job - and nothing changes. I assume in the military its the same problem but worse; maybe you even go in jail because you figured sth out.
In Soviet Russia, KGB thumb worm auto-run you!
I was there in 2008 during the midst of this. At that time, there were significant problems with security on the network terminals that we all used to access the internet. In most places, we were limited to two or three ways to access the internet (not NIPERNET.) Either computer labs operated by Spawar (government contractors) ,computers operated by Cyberzone (A commercial entity) or, if your FOB was large enough, in-room/tent access provided by the MWR (Morale Welfare and Recreation.)
Now all the computers that were in use there used satellite up-links to access the internet. Too many users would max the link, and access to the web would slow to a crawl, or worse. Think 5 - 10 minutes to load a web page. Now after a long day (or two, or three, or more!) out on mission, people would roll back in the gate, tromp off to the internet and eat, often in just that order and go to bed. Most of the time people were sending and receiving email and pictures from friends and family, baby pictures, movie clips and the like. Most of the time, these would be put on flash drives so people could see them later in their tents and so on.
The computers that were operated by the Cyberzone and Spawar rarely if ever had their anti-virus up to date. Worse, the anti-virus updates would take so long to download (hours!) that people would give up on doing them. The MWR and Post Exchange were often great about getting laptops out to troops in remote locations. However there was often no way to get software updates to these PC's. The situation was ripe for trouble.
Many people did both their office work and home use on the same computers, as the situation demanded.
While I was there in 2008, we began seeing signs of the SillyFDC worm and agent.btz in increasing numbers. We were able to track it back to the Spawar and Cyberzone computers, but we had no way to convince the people there to update their anti-virus. The PC's that were on NIPERNET at the time had restrictions on the use of flash drives, but those were not fully enforced. No-one is sure who “Crossed the Streams” but both worms started showing up in more and more NIPERNET computers. The largest problem in stopping it was that we were not in charge of policy of our own computers. We knew that the worms spread through the use of autorun, but we could not get people to bring in their flash drives to have them scanned. Worse, we could not disable autorun on the NIPERNET PC's. We had no access to the local policy on the machines (or anti-virus updates!) We were able to finally contain things by disabling autorun on personal computers, sacrificing one of our personal laptops to doing nothing but scanning possible infected drives, and quarantining known infected PC's from use.
We were never able to get updates for the anti-virus for the NIPERNET PC's, but we eventually discovered and distributed ClamWin for personal computers, though.
We received word about the no-flash-drives rule about 3 months later. That generally made things more difficult, as there were quite a few places that had no network access; a flash drive was the only way to move documents about. More people ended up doing work on their personal computers and ignoring the government ones after that.
Things that would help defend against this in the future:
Spawar, Cyberzone, and MWR should be required to keep on their networks a basic SAN that has updated anti-virus, security patches and run a script to update that when network traffic is low. That way, individuals can get their updates from local storage rather than trying to pull hundreds of megabytes over a slow network link.
If you have a computer while downrange, you should be required to make sure that it's security is up to date, and download patches (from the SAN) at least monthly. Anti-virus should be done as frequently as possible.
NIPERNET needs to have some method of having local administrators modify their systems. Many times, the local S-6 (Communication and Networking Support)
...Iraq didn't really have WMD.
I think all of these stories of military oopsies sound a lot like the story of the woman who "accidentally" dropped her bag and waits for some guy to pick it up. Except, in this case the guy gets tagged like an animal and watched like a hawk for the next 30 years.
Wanna fight ? Bend over, stick your head up your ass, and fight for air.
was that a trap system? old systems that where not updated but still where siting on part of the network?
Or did he point how bad there systmes are and they just tried to cover it up and though the book at him?
It is interesting how any government solution to their own screw-up always involves giving them more power. The obvious solution to an "asymmetrical" cyber-security threat to our national infrastructure, from their point-of-view, is more centralization of authority and a big "cybersecurity command" that gets more budget dollars.
%0
you see the same stuff with outsourced IT out side of a army setting.
Some times with little to no on site IT guy and outsourced ones are not tied ed to your site and some times there is lot of paper work and other BS to get stuff down as well.
That's the result of having a tool that allows computer-illiterate people to process data.
When the printing press was invented people started learning to read and write. They learned spelling and grammar.
When the GUI was invented people started forgetting how to read and write. They want to click on icons because they don't want to learn the spelling and grammar of the commands that control the computer.
In the computer world, Johannes Gutenberg invented the comic book.
...and was actually discussing the switch from Windows to Linux with couple friends of mine from the IA shop. I'm in charge of desktop PC support for this 3,300-user agency.
I'd like to preface things by saying that I use Linux exclusively at home and have for several years. No dual boot, no wine and no running Windows in a VM. I could do my whole job from within Linux if Firefox supported reading encrypted mail in Outlook Web Access and if there was something available for Linux that'd allow me to read Visio drawings in their native format.
Software costs are inconsequential so we'll ignore that argument for the time being. The biggest expense in an IT budget isn't software or hardware, it's people - and although things would settle down after a year or two the cost of migration is the showstopper here, not the cost of sustainment.
I've heard different stories about what caused the USB ban but for me the short version is that somewhere in DoD some sysadmin should have been fired. I can't say for sure what happened but at least two Defense Information Systems Agency (DISA) policies were violated - autorun wasn't disabled on the workstations and apparently workstation virus scanners weren't configured properly, so to minimize the threat DoD bans USB storage devices rather than fire the nitwit who wasn't doing his job.
Windows as a vector? Out of 3,300 users we had eight (yes, eight) security incidents in the last twelve months where a PC was infected by a hostile application - the reason I know this is I had to put that damn metric in a Powerpoint slide recently. Eight out of better than three thousand is a pretty good average, but the PCs still run like crap ;-)
They've authorized turning USB storage back on, but only for approved devices that will be encrypted and centrally managed - and USB storage will be enabled by device rather than by user. Unauthorized devices still won't work. We've decided that since folks have been working without thumb drives for two years we're gonna continue to let them work that way - we've got the infrastructure in place to authorize thumb drives by hardware signature but we don't plan to issue any to end users at this point.
DoD information security policies aren't written by Microsoft - Microsoft wouldn't hire anybody that stupid. Case in point - DISA mandates that LAN and WLAN interfaces on a machine can't be active at the same time but outside of creating separate hardware profiles for wired and wireless Windows doesn't support this configuration - and simply disabling network bridging doesn't satisfy the requirement. If you ask DISA how to implement this requirement they can't tell you. I can tell you there's a neat little application called Wireless AutoSwitch that'll do the job and it's dirt cheap, though.
But I digress.
we see things not as as they are, but as we are.
-- anais nin
...chatting with Lamo. No one has been able to speak to Manning and that chat log seems to be the only thing pointing to him.
'... PUNCH!' at the end of your posts, and imagine you striking down those who disagree with you.
Nope, I'm non-violent like Henry David Thoreau, who wrote Civil Disobedience, and Mohandas Karamchand Gandhi. Where I differ is that if it came to it, such as with the NAZIs, I would not hesitate to bare and use firearms.
There are four boxes of liberty: soapbox, ballot box, jury box, and ammo box. Use in that order.
Falcon
Should there be a Law?
.
If almost anything and everything Microsoft wasn't such a fragmented fuck up of a shitbag operating system, with 500 security settings in 900 locations, and with no interaction between any of them....
.
Jeezers FUCK I hate Microsoft.
.
I unless you learn the ways of the Jedi, and get power toys, have you ever tied to disable Autorun - so your fucking DVD drive doesn't just sit there spinning it's fucking guts out for hours and hours every day, for no particular reason than you chose to leave a fucking DVD in it.....
.
Fucking dickheads at microsoft.......
.
Fucking MICOSOFT security settings......
.
Farrrrkkkk I hate MICROSOFT.
.
.
Voting up, Voting down - If I really gave a fuck about your approval or not, I'd come and ask you.