Slashdot Mirror
Compromised Government and Military Sites For Sale
Khopesh writes "Imperva blogged today about the sale of compromised .gov, .mil, and .edu sites, illustrating that cyber-criminals are getting bolder. Krebs on Security has an unredacted view of the site list. Perhaps the biggest threat is yet to come; if an industrious criminal can break into top government and military sites, so too can government-backed teams, proving that GhostNet and Stuxnet are just the beginning."
Wikileaks.mil!
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
1. Buy commerce.gov
2. ?????
3. Profit!!!
More then half of those listed are from other countries are not not all US .gov and .mil sites.
Your hair look like poop, Bob! - Wanker.
The sites aren't the only thing for sale.
Government and military sites sell YOU !
Yours In Washington, D.C.,
Kilgore Trout, C.I.O.
like your mother?
Selling off control of government and military websites is all part of the new Republican program to shrink the government and balance the budget.
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
Is it sad that my first thought was "good, now they can just buy the control back!"
Not only do they get to find out what sites have vulnerabilities, but they can use the exchange to try to track down the perps at the same time.
Capability based security (Cabsec) can provide OS with no exposed vulnerabilities. It's based on an L4 proven microkernel. The only problem is that it's vaporware.
It doesn't have to be. The parts are starting to fall into place, but the open source community has to be made aware of the fact that it is possible to solve computer security, instead of patching it with layers of band-aids.
So either they actually have compromised all of those sites, OR they're phishing... hmm I wonder which it could be....
I tried to look up information on the Ouachita National Forest last year, and was warned by Google Chrome that the site was a potential malware host, with parts of the site coming from a .cn domain. I didn't push forward to the site to find out exactly what part of a .gov site would require .cn content.
It looks like they've fixed it now, though I'm really not sure... this sensible URL expands to a hundred character monstrosity that's just begging for a reverse-engineering attack.
Stressed? Me? Of course not. Stress is what a rubber band feels before it breaks, silly.
I don't know which is more worrying - that some of these sites are for sale, or how cheaply they're going for...
Chaos maximizes locally around me.
http://www.srblche.com/
this
Capability based security (Cabsec) can provide OS with no exposed vulnerabilities. It's based on an L4 proven microkernel. The only problem is that it's vaporware.
It doesn't have to be. The parts are starting to fall into place, but the open source community has to be made aware of the fact that it is possible to solve computer security, instead of patching it with layers of band-aids.
There's a research project that managed to add it to FreeBSD fairly easily:
http://www.cl.cam.ac.uk/research/security/capsicum/
It's not a full blown system, but a userland library (with some kernel code) that allows applications to drop privileges/capabilities it does not need (e.g., gzip does not need to talk to the network or do I/O if it detects it's in the middle of CLI pipe stream; tcpdump generally doesn't need to fork(2); etc.).
The hacker's site is http://www.sbrlche.com/.
Quite easily googleable from the phrases in the screenshots!
Hold on a sec, here. DoD pharmacoeconomic server? That sounds like it could be nasty.
TLDs like .gov and .edu get a massive multiplier in Google's PageRank. Spamvertising effectiveness is therefore amplified in kind.
On a more alarming note, the system may have been blessed in some manner that might make it useful as a launching point for attacking a more important site which might implicitly trust the hacked server due to its ownership or similar relationships. The most sensitive systems are completely firewalled and therefore inaccessible from the outside, and these systems might extend a level of trust to servers like those for sale on this list. Of course, that might be one of the reasons those servers were hacked and are being turned around for sale at so low a price (i.e. they don't grant such access, so the crackers are flipping them).
Use my userscript to add story images to Slashdot. There's no going back.
It says so, right here:
http://www.informationweek.com/news/global-cio/security/showArticle.jhtml?articleID=229000789
-AI
For me, it is far better to grasp the Universe as it really is than to persist in delusion
I can access Univ of South Carolina at Beaufort!
I'm gonna spend $88 and change my degree to say A+
and make my IQ test say pass and I'm gonna have
a 100 on my SATs!
{oblig from a Sandlapper}
-@|
Here's a thought, drop misinformation 'honeypots' on bogus secret data sites hardly hidden behind public sites and start forensic backtrack
to blacklist or emp the fucking root servers in some of these countries via satellite.
Then other nations will get the hint that we're aware of their thieving asses!! Or how bout bogus fund a top secret
airplane, missile, sub, etc that is a dud!!! Then china and russia will spend themselves into oblivion
on junk that won't work..
WTF!!! where are the misinformation people on this crap, you guys can do alot of damage
to the thieves stealing IP and research data from America.. I'm sick of seeing these sneaky bastards
ripping us off and making their own knock offs using our stolen research and IP..
We need to get smart like Kelly Johnson was running skunkworks, we did'nt need any foreign science brain trusts, not even
any fucking nazis to produce the engines for the SR-71, it was all us doing it back then!
No country to this day is able to keep up with the SR-71 so fuck them and their 'brain drain' bullshit..
...but just because you can paint graffiti on it doesn't mean you can break in!
Yeah, but he claims that a lot of the sites on the list have "high-value information", and I assume that the mil/gov database information he claims to sell on the side are some sort of amalgamation of stuff like that he found. Like the US DoD "pharmacoeconomic center"? That could be sensitive stuff, I guess. Fortunately it looks like they took it down.
Emotions! In your brain!