Anonymous Releases 400 MB of FBI Contractor Data
An anonymous reader writes "Anonymous, as they have claimed they would, finally released 400 megabytes of files (NSFW language) allegedly stolen from ManTech, a cyber security firm contracted by the FBI. Anonymous stated, 'The FBI is outsourcing cybersecurity to the tune of nearly $100 million to a Washington-area managed services company. The deal shows a willingness in the federal government to place IT services more and more in the hands of third parties as agencies don't have enough staff on hand to do the job.'"
Well that's embarrassing. Not entirely surprising, and not a big deal to be honest, but yet again we have it demonstrated that short of being physically disconnected from the internet and placed in a lead lined box there's no such thing as 100% security. If you want secure, don't put it on a computer and certainly don't plug the computer into the interwebs.
(Disclaimer: No, that's still not 100% secure.)
Please consider this account deleted, I just can't be bothered with the spam anymore.
"a cyber security firm contracted by the FBI. . . . more and more in the hands of third parties as agencies don't have enough staff on hand to do the job."
No crap, you idiots. They're called contractors!
I'm pretty sure that the government shutting down on Tuesday isn't going to help this at all. :P
looks like there is nothing, but :)
I am not going to touch it just to see.
Mission and Cyber Support
We tackle some of the most challenging cyber security problems facing our nation, including identifying and neutralizing external cyber attacks, managing security operations centers (SOCs), developing robust insider threat detection programs, and creating enterprise vulnerability management programs.
If you closely inspect this package you'll also come across several items which make me conclude that anonymous has basically overrun (several?) Windows servers (default.rdp anyone?).
So I think its safe to conclude that this is the result of your average (and very poor) Windows administrators. Window servers can be secured and I'm also leaning to say that while they probably won't be able to match Solaris, BSD and even Linux, they sure can go a long way. IF you know wtf you're doing. Sure; general popular opinions are of course against me, but that's your problem and not mine ;-)
I wonder if we get to see some admins being layed off, they sure would deserve it IMO.
Oh well; look on the bright side you ManTech guys; now there are also a lot of resume's out in the open. Who knows; maybe some people can get a new job at a firm which takes security more seriously.
i wont want a knock on my door, or have it kicked in by a government goon squad, i will wait until someone else downloads sorts through it for all the best parts and read about it on some conspiracy nut's website :)
Politics is Treachery, Religion is Brainwashing
This whole thing reeks of these types of charades.
So you don't hire enough people to do the job. This to save money. Then you realize, you need some help. You hire a contractor to do the job for 4 times the money. I don't get it. If you don't work with consultants the smart people who like a challenge realize. Hay if I want to do the cool stuff, I need to be in government.
its already in the wild....and unless you go run up to a fbi agent and start throwing printouts i doubt they care
Neil Caffery, the White Collar crimes consultant that works with the FBI?
Ken
and then you can find out the real FBI is like.
I know a person very well who works for ManTech. He is paid a well above-avarage salary right out of college to answer perhaps two help desk phone calls a day. He is not allowed a cell phone or any means to surf, so he tells me how he counts ceiling tiles all day. He is literally paid to sit on his ass.
They pay these people for doing literally nothing. A very well known college of mine is paid a well above-average salary by ManTech to answer perhaps one help desk call a day. He does literally nothing, all day long, most of the year. He is not allowed a cell phone or a laptop or browsing access for security reasons, so he tells me he just counts ceiling tiles.
Apparently ManTech and HBGary work together ( http://publicintelligence.net/hbgary-mantech-internet-and-social-media-reconnaissance-presentation/ ), so this could be more fallout from the HBGary/Aaron Barr/Anonymous story.
WHICH, as a matter of fact, I just wrote a small journal article about (sorry to shill, but I really think it's relevant!) http://slashdot.org/journal/269108/Aaron-Barr-amp-The-Jester
One day the complete Anonymous story is going to make a great book and several bad movies.
Since when we measure significance of a breach by the raw amount of data?
Faceless corporations with nothing in the way of accountability and very little oversight with the keys to the FBI and other government data systems. I don't see how anything could go wrong with that arrangement.
Why pay attention to that when you have those darn teacher's unions trying to live high off the taxpayer hog?
That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
They're outsourcing the IT department ... which leaves them with no one in-house capable of verifying that the outsourcing service is competent or even following data-security processes.
is that the fbi has to contract out for this. all government agencies should be completely self-sufficient. none of these third party money grabs. this is where most of the government waste lies. all those industries jockeying for a piece of the pie while demonizing the poor and disheveled. this is the real problem. no one should profit of the government.
...
Was wondering about that. Thanks for clarifying, hehe ;)
Start with the "Re-Inventing Government" initiative under Gore during the Clinton administration, where some idiot decided that government should be run "more like a business." (Protip - Anytime someone says "Government should be run more like a business" you've just received perfect proof they're an idiot. Govt and business aren't the same and cannot/should not be run the same way.)
Add 8 years of "We hate government. We hate government workers. Government is incompetent at everything it does and, by the way, too-often prevents us from funneling contracts to the big-money corps that help us get elected." under the Bush administration.
Stir in the fact that IT is in the middle of everything nowadays.
Bake a while and what do you get? Everything being outsourced, even to people who have no idea what they're doing and don't give two shits about the concept of "public service."
A couple of months ago, I retired from a once-wonderful IT position with a major U.S. three-letter-agency. I just couldn't stand the whole "Do more with less. Don't worry about all the new, critical changes; they'll be admin'd by contractors, anyway. Bump the efficiency metrics; forget about actually keeping the field guys functioning."
For the first 20 years I was there, we were allowed to do good work, help officers and agents do their jobs, and serve the public. Over the last 10 years, that whole notion of public service got lost in an orgy of fiefdom creation and repayment of favors.
U.S. govt IT is going to hell. It's happening slowly but, I fear, inexorably.
While it is certainly true that the US Government has used contractors for a long time, this pernicious reliance on contractors (to the point where many US government agencies have basically no in-house expertise on mission-critical elements of their functioning) started with Ronald Reagan. Remember that he started out with a massive RIF (Reduction in Force), which was followed with (civil service) hiring freezes. If you can't hire permanent employees, and you are tasked with doing more, you have to engage contractors. It's just that simple. I was working for the Government at the time, and the increase in contractors (and the decrease in in-house expertise) was striking.
Of course, the ironic thing is that
- contractors are almost always much more expensive than doing the same thing in civil service and
- contractors can lobby the Congress to get more money what they are doing
At the time, I thought this was a bug; now I am sure it was a feature.
If his/hers native language is greek and gives you the exact spelling then that gives you an opportunity to look it up yourself
It is kinda funny how people claim the government is too stupid to get things right (i.e., post office, DMV, roads), but then bitch at them when they try to contract out. Granted, they could do a much better job vetting the contracts, but government is always in a lose-lose.
https://www.accountkiller.com/removal-requested
For these asswipes to install norton and upgrade to IE8 on some dell contract pc that will be thrown away next year
If I had mod points, I would give +1 insightful. From a slightly different perspective, I work in IT for a State Government. The Feds and the States are very similar, except that they are reducing compensation at the State level. So recent graduates are not even looking for employment with the State. It is so bad now that we have permanent job postings for IT positions. But the benefits and pay are no where near private sector. They have to have contractors now that so many have retired. The contractors cost far more than State Employees. But you still read articles in the local papers about how over paid State Government workers are. Plus the same mantra over and over that government workers just sit around and do nothing all day. I guess if they keep this crud in the press, then the populace will accept it as fact. I know of many contractors who have failed in the day to day duties, yet they are still employed. Many of the government contracts are poorly written. Add to that management not holding the contractors to the signed contract and properly monitoring progress of the projects. Over all it is very sad to be in government IT unless you are a contractor. And if you are a contractor, your only benefit is in knowing that you are better compensated than the government employees around you. Either way you are still told: "Do more with less" which has never made sense to me. Following those instructions means that you have to loose quality or quantity. There really is no other choice. Throw in the furlough days, bank leave time, and all of the other compensation reducing schemes, and our compensation has been reduced by thousands of dollars per year. All of those savings are going to pay for contracts. In my state the contracts total over 15 billion. That is more than what it costs to pay for the state employees. They privatize different functions more and more. Costing the tax payers more and more. Sorry for the long rant. I will get off the soap box now and let someone else have it.
... you're some basement dwelling teenage virgin whose "friends" are other similar losers that he's never met IRL. Which , lets face it, is the demographic that makes up the self righteous bunch of script kiddies that call themselves anonymous, lulzsec or whatever self agrandising name they've thought up this week.
For your average tax paying adult the fact that government contracts out services is neither news nor shocking. Next...
Getting an error on that torrent when using Bittorrent.
If your client supports the selection of files, there you go. Just deselect the files that are borking the download. Or you can try using a different client? I decided to give Vuze a try, and before I could even finish configuring my ports, it has slurped the file down lickety-split.
So Vuze apparently ignores the error.
Still, I don't have a login for PirateBay-for obvious reasons-and I'll be posting this AC? But if someone could put a note up there for the mods or Anon to correct the problem, it'd be appreciated. Or Anon might just read about it here. HI GUYZ!!
Failure in security is due to closed commercial software in combination with a lack of acceptable security coding standards and design problems. We are constantly told that it would be too expensive to code everything securely and yet we send robots to mars which have to be perfect in every regard and tons of money is spent adding unnecessary new features and making changes without good cause.
No. I don't see how we sit by and accept new features at the expense of security where the security of the system matters. There should be a core set of standardised, peer reviewed, open hardware components with publicly vetted source code. The citizens should demand the government be held to account for hiring and for vetting the source code of all critical components. This isn't just a software issue though. Security critical hardware should be produced in the USA and in other countries where governments can validate all code and designs. Yes- a computer might run into the $10k plus range or more especially given the nature of what we're trying to secure.
From TCIP protocols to encryption algorithms and randomisation components.Drivers that interact with the hardware for these standardised components need to reviewed and set in stone for 10 to 15 year spans (except for potential security fixes). Debian and similar based GNU/Linux distributions have security down right in this regard even if there is way more code than is needed.
Databases need to be coded securely too and made more challenging to interact with in insecure ways. Encryption AND redundancy all need to be part of these standards. GUI's and other non-essentials should not be part of a standard installation. On the desktop a minimal secure, simple, and minimalist GUI needs to be written which fits into the security policies (can only do a minimal set of things without further approval from a security department). Those security policies should be easily set through a simple GUI and command line (for the servers) and well documented tutorials explaining how, what, and why to set things up for particular tasks (web servers, databases, and similar, and depending on the type of platform management system in use). Virtual private networks too need to be reviewed.
Secure destruction devices should be common place for media. The media should be specific (non-USB), hardened, redundant, and wear resistant. Our current standard is weak and unreliable. We use MLC where SLC should be used in flash based media and USB and similar connectors that fail frequently. Ideally a new secure media designed today for tomorrow would be designed with GPS tracking built-in, encryption (with two authentication mechanisms where you enter it before connecting it to a computer and again on the computer itself), have satellite or at least radio communications of some sort, and be resistant to tampering. If the media loses satellite communications for any length of time it should send a warning sound to the user to alert them they need to enter a password to avert self-destruction.
The government has put themselves into this position, as anyone who works government IT/IA knows. The processes involved are so laborious and tedious that there is no way that government IT workers can handle the load themselves. IT procurement is a good example. It takes about $3 in effort for every $1 spent on procurements.
Simplify the processes and security will get better when people stop pencil whipping the reports because they can't currently keep up.
They're talking about cyborgs obviously...
To the contrary. Nothing in this data is really interesting, except for the fact that the FBI is paying mountains of taxpayers' money to their friends for basically nothing. What AnonSec proved here (yet again) is that these "security contractors" have nothing to do with security. Really! :)
- Admin Forum Perniagaan Internet Malaysia
http://PerniagaanInternet.my/forum
I find it very interesting that a group of people can post data on the internet and tell folks where they got it from and that it was some big deal, horrible security, stupid contractor's etc. and folks just believe everything they say. I mean, why would an "Anonymous" group of people have any motivation to stretch the truth or outright lie about their point of view?
First, the "small government" acolytes, starve regulatory agencies -- and the funding for this, comes from companies that Don't want regulation.
Then the "big government agency" downsizes, because it cannot afford to keep people on staff.
For some reason, the Contracting Agency, gets paid about 10 times per employee that we paid for each "big government" worker. You know, like the Mercenaries in Iraq who got $100,000 PLUS to do KP duty and make food for the soldiers.
Eventually, the lack of oversight, means that the FDA has an inspector visit a company once every few decades -- or the Oil company oversight fails to make BP put adequate devices on their drilling platforms. We certainly "saved" a lot of money, deregulating banks and having them lose $70 Trillion!
>> Bush and Republicans have increased the SPENDING on government -- the ONLY reductions have come from reducing SERVICES provided from Government, and oversight of Billionaires.
>> We now have a "feedback" loop with many "profitable" business that contract for Government services. The Prison corporations, make money from more prisoners and by cutting costs -- meaning, a more demeaning life for prisoners -- but also, that they LOBBY for longer sentencing and to make more things illegal.
It seems to me, that we DON'T want profits to be made in some parts of our economy -- we DO NOT WANT a business approach. If a Corporation makes money on war -- they want MORE war. It's that simple. Anything we want to redistribute, or make LESS likely should be a government function -- period.
>> And it's CRAZY to have private weapons manufacturers -- what do we do when they set up shop and take their technology to China because the USA is NOT the great source of "War Profits?" We are much less safe, and much less well off because corporations made a bundle on our needless invasion of Iraq -- and the Oil Companies benefitted while lobbying for Tax Breaks. The people BENEFITTING from Government are making it bigger -- that's just doesn't happen to be the working poor.
>>"ad space available -- low rates!!!"
to collect information on each and every contractor who deals with the FBI. They'll own the FBI within a year. What an utter clusterf***.
The only sounds I hear are their death gurgles. Too bad - they could have been so much more. Not the first cadre to burn brightly and carbonize themselves. Not the last, either.
No. I'm a very old-timer, one of the few remaining covered under the old Civil Service Retirement System. 100% of my pension is funded by participant contributions.
Additionally, I will never receive Social Security retirement benefits nor will I get govt-subsidized medical care, though my private group insurance payouts will be limited to Medicare rates, thus making me a far less attractive customer to healthcare providers once I get old.
People who think U.S. govt retirees are a budget problem or parasites or being paid for by the poor, put-upon taxpayers of today simply don't understand how the system works.
If you want to find screwed up govt employee retirement setups, you need to look to state, county, and city governments. The fed got its act together and solved all those problems for its own people over 25 years ago.
No. You obviously don't know how these things work. You're not distinguishing "govvies" by what level of government at which they worked, meaning any comment you make will be demonstrably wrong for a large percentage of the "govvies" at question.
Specifically, I'm a fed retiree. The screwed-up retirement setups are found at the state, county, and city level. The fed fixed their problems during the transition from the Civil Service Retirement System to the Federal Employees Retirement System, a transition that occurred over 25 years ago.
- NO. State Employees get a 401K. There is no pension or healthcare. It has been proven over and over, that contracting in this state costs more.