Slashdot Mirror


DoD Networks Completely Compromised, Experts Say

AZA43 writes "A group of U.S. federal cybersecurity experts recently said the Defense Department's network is totally compromised by foreign spies. The experts suggest the agency simply accept that its networks are compromised and will probably remain that way, then come up with a way to protect data on infected machines and networks."

164 comments

  1. or it is used as a tool by FudRucker · · Score: 5, Interesting

    to spread misinformation to those foreign spys that only think they compromised DoD computers (naw too good to be true) the US Gov is too stupid to do anything like that

    --
    Politics is Treachery, Religion is Brainwashing
    1. Re:or it is used as a tool by cparker15 · · Score: 5, Funny

      The entire DoD network is one massive honeypot. All the real data is sent by carrier pigeon.

      --
      Have you driven a fnord... lately?

      You must wait a little bit before using this resource; please try again later.

    2. Re:or it is used as a tool by Anonymous Coward · · Score: 0

      Yeah, I was just thinking the "compromised" network would be a killer honeypot.

    3. Re:or it is used as a tool by erroneus · · Score: 4, Insightful

      There is no shortage of "stupid" at the DoD. As every security expert knows, the weakest link is the user. And it doesn't matter how high or low ranking that user may be... if fact it kind of helps if they are "full of themselves" because they tend to demand that restrictions are relaxed so they can have access more easily. There is LOTS and lots of stupid out there.

      And nothing helps more than the fact that running Windows as the standard has. Why? Isn't it obvious? We know from the headlines that every government has been demanding the source code and decryption keys for just about everything. Microsoft, I expect, has been no different when faced with such requirements... we certainly know that's true in the case of RIM. And the source code is now always enough or even completely helpful, but it definitely helps that governments are willing to hire black-hats to find the billions of holes available in the platform EVERYONE USES.

      Sure, Microsoft profits lots... they are what everyone uses... including and especially the weakest links.

    4. Re:or it is used as a tool by AioKits · · Score: 5, Funny

      The entire DoD network is one massive honeypot. All the real data is sent by carrier pigeon.

      Damnit man! Why did you let them know?! Now I gotta figure out how to armor the pigeons so they're not shot out of the skies... How tiny do they make bullet proof vests? Maybe I could use a swallow instead. Does anyone here know the air speed velocity of... Never mind, I'll figure something out.

      --
      "Quote me as saying I was mis-quoted." -Groucho Marx
    5. Re:or it is used as a tool by Bigby · · Score: 1

      With an RSA public encryption key around his neck

    6. Re:or it is used as a tool by g0bshiTe · · Score: 4, Interesting

      I'd hate to think the DOD would be dumb enough to keep sensitive data on a network that was internet accessible.

      --
      I am Bennett Haselton! I am Bennett Haselton!
    7. Re:or it is used as a tool by Anonymous Coward · · Score: 2, Interesting

      I just hope that they're RFC 2549 compliant, with (hopefully) an encryption layer along with that.

    8. Re:or it is used as a tool by FudRucker · · Score: 3, Insightful

      and dont forget the windows users that insist on logging in and running as admin/root for a regular user account because they dont want to be inconvenienced with having to type in a password for anything

      my own brother runs his PC like that and i explain to him the concept of a multi-user system that has root and user accounts and he just stares off in to space with that deer in the headlights look on his face

      --
      Politics is Treachery, Religion is Brainwashing
    9. Re:or it is used as a tool by elgeeko.com · · Score: 3, Interesting

      Honeypot was my first thought too. You could keep the enemy scrambling to build the mind control ray gun we developed back in the 80s using technology we stole from the cities on the far side of the moon. Knowing someone is hacking your system can be a lot of fun.

    10. Re:or it is used as a tool by Anonymous Coward · · Score: 4, Funny

      You ever tried encrypting a bird? They don't like that.

    11. Re:or it is used as a tool by Bigby · · Score: 3, Funny

      Is that like putting a bird in a crypt?

    12. Re:or it is used as a tool by Anonymous Coward · · Score: 1

      Might not be far from the truth...

      The question is, is this the unclassified worker-drone finance-weenie network, or are they claiming SIPRNET compromise?

      SIPRNET is audited out the wazoo, and many facilities only have 1-2 machines even connected to SIPRNET.

      Airgapped networks + sneakernetting CDs/DVDs is the norm. Inter-facility transfer is often done by double-wrapped overnight postal service mailings. (If something goes missing, it'll get reported.)

    13. Re:or it is used as a tool by v1 · · Score: 1

      You ever tried encrypting a bird? They don't like that.

      they also don't like being hashed...

      --
      I work for the Department of Redundancy Department.
    14. Re:or it is used as a tool by Anonymous Coward · · Score: 0

      Dunno, but you could start by looking here.

    15. Re:or it is used as a tool by Beardo+the+Bearded · · Score: 5, Informative

      They don't.

      I work with a lot of military documents. I've got some in the other windows right now. 99.9% of military documents are not important, security-wise. Sure, you can find out what kind of cable is used to plug in that receptacle. It's not important. It's not Classified. Nobody gives a shit.

      The Classified stuff, should I ever even look at any of it, is really quite a different type of animal. Here's how I'd handle it:
      1. Make sure it had to be me since they're a PITA.
      2. Our document control folks would burn a copy and FedEx to me.
      3. It would be sent to the Secure Room once it arrives.
      4. When I went to work on it, I'd get a supervisor, sign in to the secure room, and pull out the removable HDD from the vault.
      5. Check the Secure Machine for oddities, like anything in the USB ports or the sudden appearance of an Ethernet port. Seriously, there isn't even a phone jack in the room.
      6. Boot the Secure Machine. Yes, it is Win XP. While it's booting, draw the blinds and close the door.
      7. Work on the Classified document.
      8. Once I'm done, I can burn a disk to send back and have it printed by the document control group. Then I power down, put the HDD in the vault, and then sign out.

      Seriously, the important stuff is airgapped. The really important stuff is airgapped and guarded by people with weapons.

      --

      ---
      ECHELON is a government program to find words like bomb, jihad, plutonium, assassinate, and anarchy.
    16. Re:or it is used as a tool by Anonymous Coward · · Score: 0

      You've never worked anywhere in the DoD have you?

    17. Re:or it is used as a tool by Peristaltic · · Score: 5, Funny

      What the DoD will do is hire a contractor to armor the pigeons, who will then design armor that puts the pigeons over max gross weight, so they'll add wing extensions, but since pigeon wing muscles can't flap the modified wings as fast, they'll replace their little pigeon wings with fixed composite wings and pigeon-scale turbine engines.

      Unfortunately the turbine engine exhaust burns pigeon tail feathers, so they'll replace these with composites also. The Air Force will see an opportunity at this point to add hard-points to the composite wings, so the wing area and turbines will be made larger, increasing cruising speed and altitude, requiring life-support for the pigeons.

      Cost: about $500,000 / pigeon for the Block 20 model, assuming the contractor will be allowed to sell Block 10 Pigeon Communication and Reconnaissance (PCR) units to our allies in Saudi Arabia. Test flights slated for 2020.

    18. Re:or it is used as a tool by erroneus · · Score: 2

      ...my own boss insists that his staff be made administrators on servers... I have always disagreed with that. He says it's for accountability and I can kind of see it, but make it a separate unique account, not my normal user account.

    19. Re:or it is used as a tool by jamstar7 · · Score: 0

      99.9% of military documents are not important, security-wise.

      Doesn't stop them from classifying said documents, even something as no-brainer as the menu down at the mess hall for the 'Lower 4's' and who's tending bar at the O-Club. Especially if it's the bartender schedule at the O-Club.

      Granted, it won't be classified much, but once you get in the habit...

      --
      Understanding the scope of the problem is the first step on the path to true panic.
    20. Re:or it is used as a tool by An+ominous+Cow+art · · Score: 2

      This little guy might have benefited from some body armor.

    21. Re:or it is used as a tool by NIN1385 · · Score: 3, Funny

      You left out the part where another contractor designs another version of said pigeons and undercuts this contractor with an inferior product because they had the lowest bid and then the people that awarded the bid to the cheaper contractor are left wondering why the cheaper pigeons are falling from the skies and killing innocent citizens.

      --

      If carrots got you drunk, rabbits would be fucked up. - Comedian Mitch Hedberg R.I.P. 03/30/68-2/24/05
    22. Re:or it is used as a tool by Peristaltic · · Score: 1, Funny

      ...then the people that awarded the bid to the cheaper contractor are left wondering why the cheaper pigeons are falling from the skies and killing innocent citizens.

      Maybe quietly to themselves, while DoD media relations at Fox informs their viewers: "...if they were innocent, they wouldn't be dead now, would they."

    23. Re:or it is used as a tool by Anonymous Coward · · Score: 1

      There was this Pfc in Iraq who had access to all kinds of document, some even from State Dept. I do not see how that is well compartmentalized or airgapped. He was able to burn tons of this shit to a disk. He then turned around and gave it to a website to post for all the world to see. Yeah, this shit was classified and stuff.

    24. Re:or it is used as a tool by Anonymous Coward · · Score: 1

      FedEx to me

      I think I have discovered a very weak link in this chain.

    25. Re:or it is used as a tool by Anonymous Coward · · Score: 0

      May be true. Have you ever seen a baby pigeon or a dead one? They are genetically engineered and grown in vats until ready for their duty.

    26. Re:or it is used as a tool by Anonymous Coward · · Score: 0

      All that security then you just drop it in the mail? LOL.

    27. Re:or it is used as a tool by Peristaltic · · Score: 1

      You left out the part where...

      What I left out was that before accepting their order, the Saudis, adhering to Wahhabi doctrine, demand assurances that none of the PRC weapon system pigeons are female, even demanding the program be renamed before they make the purchase.

      Boeing doubles the price and hopes to sell at least 1000 units of the Pigeon Reconnaissance Intelligence and Communication System each year to the Kingdom.

    28. Re:or it is used as a tool by mikael · · Score: 2

      As long there is plenty of seed, and not too much salt. You might try adding some skipjack. But if you see little knapsacks, you know they are going off on Feistel rounds.

      --
      Vintage computer adverts: http://www.vintageadbrowser.com/computers-and-software-ads
    29. Re:or it is used as a tool by Anonymous Coward · · Score: 0

      Does anyone here know the air speed velocity of...

      Yes.

    30. Re:or it is used as a tool by Woogiemonger · · Score: 1

      I've worked with secure documents before too, and can verify this, especially the PITA part. However, I haven't had to send docs before.. are the fedex guys that handle the copy cleared as well? Also, I know transporting the docs yourself can be quite an ordeal, because you're not supposed to let them out of your sight, even through security.

    31. Re:or it is used as a tool by Anonymous Coward · · Score: 1

      There's a process right there which inevitable leads to reconstruction of the F-22. The only remaining part of the pigeon is an image of the courageous bird who donated its body for higher purposes, piece-by-piece. And a feather. Bird suicide attacks against airplanes of all types have increased as a result.

    32. Re:or it is used as a tool by frisket · · Score: 1

      All your pigeon are belong to us

    33. Re:or it is used as a tool by Anonymous Coward · · Score: 0

      Having been in DoD and worked on classified systems: This isn't how it is handled on DoD's side. There are classified networks. The data on them is even sent using the same satellites that carry the unclass stuff. Of course, it's encrypted, but it is most certainly not airgapped.

    34. Re:or it is used as a tool by SCPRedMage · · Score: 3, Informative

      Speaking as someone who used to administrate an Air Force base's SIPRNet systems, I don't believe for a second that they're talking about anything other than NIPRNet (which is the military's way of referring to their unclassified, Internet-connected base networks).

      I find it HIGHLY suspect that classified networks are compromised, simply because of what would be required to do so. The SIPRNet has NO Internet connectivity at all; you simply cannot send packets between the two, at all, in either direction.

      --
      My sig can beat up your sig.
    35. Re:or it is used as a tool by Anonymous Coward · · Score: 0

      You ever tried encrypting a bird? They don't like that.

      they also don't like being hashed...

      If you think that's bad, you should try taking the Fourier transformation of a cat...

    36. Re:or it is used as a tool by BorelHendrake · · Score: 1

      Surprisingly (at least to me), you can send classified documents up to a certain level via certified or registered mail, I can't remember which one it was... I thought that there would be more drama surrounding it but apparently not...

    37. Re:or it is used as a tool by Anonymous Coward · · Score: 2, Interesting

      Actually it isn't just to make access easier. We do it to make working feasible. Im sure you've heard of problems like mine and gloss over it at work and online, Mr Important Security Expert.
      Because of stigs, on our dod network I couldn't run the installer for the software we were developing. I also didn't have the development tools I needed. It took over 6 months to get a approval for new tools. Some tools, like virtual pc, would not be allowed. I usually just gave up on my wishes for tools just like the people before me.
      I could go on. Security broke features of the tools that I did have. Hotdeploy didn't work in tomcat. Eclipse autocomplete didnt work. Random memory errors and terminated processes. Eventually, cut and paste would hang the computer for several seconds.
      Additionally, much time was spent on forms. Finding them, completing them, finding the right person to give it to, and following up when that idiot doesn't pass it on to the next idiot.
      And thats when I got a job working for a japanese company. See ya!!

    38. Re:or it is used as a tool by Anonymous Coward · · Score: 0

      ummm, room spec is for slab-to-slab construction with *no windows*, which means no blinds to draw...

    39. Re:or it is used as a tool by AdamWill · · Score: 2

      This post is all the proof anyone should need that Slashdot comment scores should go up to 6.

    40. Re:or it is used as a tool by AdamWill · · Score: 3, Informative

      They're not talking about either of those things. Those are military networks. They're talking about the Department of Defense network - the network of the civilian agency which oversees the military. Different organizations, different networks.

    41. Re:or it is used as a tool by philip.paradis · · Score: 1

      I'm not sure what the previous poster meant; perhaps he was referring to things classified "Confidential," although even that doesn't typically go in the mail. Perhaps he meant data coming in as a result of the execution of warrants, but that stuff is not typically classified; the key thing with proper handling for such materials is demonstrating chain of custody.

      Stuff That Matters doesn't go in the mail at all. It goes by courier, where the courier is typically someone employed with the Defense Courier Service, or an active duty military member with a courier card, or a federal agent with appropriate transport authority. Stuff That Really Matters which has to be physically moved from one location to another goes interesting routes, accompanied by many serious guys, who carry serious weapons and are perfectly willing to do what they have to.

      I know these things because I used to carry various sorts of classified stuff around on occasion, back when I wore a uniform for a living.

      --
      Write failed: Broken pipe
    42. Re:or it is used as a tool by jeff4747 · · Score: 1
      From this article:

      There are restrictions on how classified documents can be shipped. Top Secret material must go by special courier. Secret material can be sent within the U.S. via registered mail, and Confidential material by certified mail.

    43. Re:or it is used as a tool by philip.paradis · · Score: 1

      It really doesn't usually work that way in practice, at least not for certain types of materials that, while they may "only" be classified Secret, tend to be treated somewhat differently by default. A fair amount of stuff could be described in that manner. While it's true that Secret material isn't the sort of stuff that represents the end of the world if a security incident happens with said material, the level of safeguarding that is insisted upon at most facilities is significantly higher than many people might expect.

      This is the sort of thing that falls into the category of "nobody ever got fired for being more careful than he had to be," and thus again, things work differently in practice. As an interesting side effect, you might think people couldn't get fired for incidents whereby materials were technically handled according to regulations, but when things go wrong, it happens anyhow.

      --
      Write failed: Broken pipe
    44. Re:or it is used as a tool by genner · · Score: 1

      The entire DoD network is one massive honeypot. All the real data is sent by carrier pigeon.

      Damnit man! Why did you let them know?! Now I gotta figure out how to armor the pigeons so they're not shot out of the skies... How tiny do they make bullet proof vests? Maybe I could use a swallow instead. Does anyone here know the air speed velocity of... Never mind, I'll figure something out.

      Will you figure something out in Africa or Europe?

    45. Re:or it is used as a tool by bryan1945 · · Score: 1

      RFC 1149 to the rescue! Though they really should be using RFC 2549.

      --
      Vote monkeys into Congress. They are cheaper and more trustworthy.
    46. Re:or it is used as a tool by erroneus · · Score: 3, Interesting

      Consider working with something other than Windows. (I know, not always an option depending on who you are working for.) And as for Japanese companies... you don't, by chance, mean the Japanese defense contractor which was breached just like Lockheed and the others do you?

      I completely believe and understand your point of view. It's completely valid. It's one of the many reasons why the MS Windows platform is simply bad for security. It's not only Microsoft's fault, but also the fault of crappy developers who do not respect security models... even the bad ones Microsoft has put forward.

      To be frank, there's really no way to get out of the hole that is MS Windows without doing some drastic, ugly and unpopular things. 1. Microsoft needs to significantly change their next OS breaking compatibility with the previous versions. 2. Microsoft needs to review and somehow disallow software which does not meet security principles. The result of this type of move could be disasterous for Microsoft for many reasons, though. It could mean a huge backlash from developers. It could mean a huge rejection by users since they wouldn't be able to get access to applications.

      Security is a PITA. No question about it. But when security is built into the OS, it helps a lot. Windows as we know it today, evolved from DOS. I know, I know, there's little if any DOS in Windows today, but its evolutionary genetics still show today.

      And in some ways, it can't be helped that administrator/root is needed to install applications. I wouldn't have it any other way, actually. But requiring administrator/root to USE tools which do not affect the OS is quite a problem. And that problem comes from a wide range of bad practices by both Microsoft and developers for Microsoft's Windows platform. With the exception of OS manipulating/managing tools, I have yet to see this problem in Linux. In fact, I see the OPPOSITE occur when programs actively discourage and even DENY the ability to run as the 'root' user. That's a huge diference in programming/development culture.

      And before anyone calls me a fanboy or a troll or whatever, I use Linux primarily... it's true. I also use and support Windows and I have to admit I have been warming up to Windows 7 quite nicely. I don't *HATE* Windows as much as you might think. In the end, I hold that I don't actually CARE what I run so long as it works. And your point, once again, is quite valid in that in "MS Windows reality" usability and security are, in practice, diametrically opposing needs. I'm here to say it doesn't HAVE to be, but to make a change is painful if not impossible.

    47. Re:or it is used as a tool by jm.one · · Score: 1

      Just because he cant and wont tell how it really is sent to him. After all, the transport IS the weakest link if the computers involved lack of any network acess. Makes sense to hide the real details of transportation.

    48. Re:or it is used as a tool by smeaggie · · Score: 1

      Or, to spin this thread the other way round (and being completely off-topic), the only thing left of the actual pigeon is the brain: http://dsc.discovery.com/news/briefs/20041018/brain.html

    49. Re:or it is used as a tool by MtViewGuy · · Score: 1

      You mean a "honeypot" operation? No wonder why intelligence agencies still think the best form of intelligence are still "feet on the ground," airplanes/RPV's that can do electronic intelligence/signals intelligence (ELINT/SIGINT), or spy satellites.

    50. Re:or it is used as a tool by Anonymous Coward · · Score: 0

      A friend of mine works for the Dept. of State and is currently going around the country installing DSL and WiFi at field offices (she's not in an IT position BTW). Apparently there was some issue with them connecting from internal networks so their solution was to get a normal DSL line and (presumably) VPN in from outside...

    51. Re:or it is used as a tool by Anonymous Coward · · Score: 0

      They don't use FedEx. They us USPS certified mail. Which is STILL lock and key. yes, it's stupid, but that's what they trust. Of course, they ALSO have hand couriered for the really sensitive stuff.

    52. Re:or it is used as a tool by Curseyoukhan · · Score: 1

      I am soooo telling the DHS about you letting our secret out.

    53. Re:or it is used as a tool by Anonymous Coward · · Score: 0

      switch to anonymous...

      I used to work for a company that make missile, big AGM missile. All the computers (mainly only unix stations like SGI, IBM, SUN, etc) were on an intranet, there was no conection with the internet at all. There was separates computers that were used for emails/web browsing.

    54. Re:or it is used as a tool by shoehornjob · · Score: 1

      I can't stand the deer staring at headlights look. Are we really that stupid or do we just not give a sh#$?

      --
      "We are just a war away from Amerikastan. When god vs god the undoing of man." Dave Mustaine
    55. Re:or it is used as a tool by Whorhay · · Score: 1

      According to http://www.dhra.mil/perserec/csg/s1class/mailing.htm the only stuff you can't send through the mail or fedex is Top Secret stuff. It does talk about making sure the package is wrapped multiple times and sealed to detect tampering.

    56. Re:or it is used as a tool by jamiesan · · Score: 3, Funny

      They will also create Pigeon Reconnaissace Intelligence Construction Kit Systems for our allies, but they will be smaller versions than the ones the US uses.

    57. Re:or it is used as a tool by Anonymous Coward · · Score: 0

      And we all know that carrier pigeon is TCP/IP complient: http://www.ietf.org/rfc/rfc1149.txt

    58. Re:or it is used as a tool by AragornSonOfArathorn · · Score: 1

      This little guy might have benefited from some body armor.

      Looks like he didn't need it. He lived another 17 years after completing his mission. Incredible story; I hadn't heard it before. Thanks for the link.

      --
      sudo eat my shorts
    59. Re:or it is used as a tool by Anonymous Coward · · Score: 0

      What makes you think Windows is the problem? Linux is no better or worse. MAC is no better. Implimentation is everything.

    60. Re:or it is used as a tool by jafac · · Score: 1

      See - there's a difference between State Dept. classified, and DoD classified. And then there's NRO, and NSA, and CIA - who do not even fall under those auspices. State Dept are complete buffoons, basically. Stuff is "classified" to avoid embarrassment. YMMV - but how do you define what's REALLY important? Something that could trigger enough people to get upset and start a revolution to topple a regime, where a bunch of people who've already been miserable for 6 decades will just end up being miserable for another 6? I guess so.

      Dates and times and places that nuclear weapons are being transferred? No - that stuff isn't really going to be available. And if it is, it's expired.

      --

      These are my friends, See how they glisten. See this one shine, how he smiles in the light.
    61. Re:or it is used as a tool by Anonymous Coward · · Score: 0

      This doesn't bode well for the effectiveness of the Windows STIGs.

    62. Re:or it is used as a tool by Sarten-X · · Score: 1

      something as no-brainer as the menu down at the mess hall for the 'Lower 4's' and who's tending bar at the O-Club. Especially if it's the bartender schedule at the O-Club.

      Of all the examples to pick, these make perfect examples of good things to keep secret (at least for a short while)

      The meal being served at a particular time can be strategically important, if your goal is to disable a certain group of "Lower 4's" at a later particular time. The timed poisons from spy movies aren't entirely fiction, and could be used to affect a crucial mission, just by contaminating a particular food shipment. Rather like using a shotgun to drill a pilot hole, but it's a risk the military doesn't want to (or really need to) take.

      Knowledge of who's tending bar is a more blatantly risky item. Threaten a bartender's family, and you could extort all kinds of information about officers' meetings, discussions, and thoughts.

      --
      You do not have a moral or legal right to do absolutely anything you want.
  2. Oh sweet by Anonymous Coward · · Score: 0

    That's great.

  3. wth by Anonymous Coward · · Score: 1

    Seriously?

    I mean....

    This is hardly surprising. I worked for a formerly existing mortgage servicing company that outsourced its servicing, and as part of the Soldiers and Sailors Relief Act during the Gulf War II, they wanted us to send military deployment orders offshore so they could be serviced for the benefits. Maybe they found it easier just to hack in and get it from the source and bypass the middle man.

  4. Best use of the word cyber ever! by synapse7 · · Score: 4, Funny

    “DoD is capability-limited in cyber, both defensively and offensively,”

    Anyways, are we talking a bunch of old NT boxes plugged right into the internets, I mean the cyber.

    1. Re:Best use of the word cyber ever! by HBI · · Score: 2

      The best part is that what they are really saying there is that they lack the skilled personnel to compete with other nations. The reason they lack said personnel is that no one who is any good would like to work for the government. It's an unpleasant work environment in a lot of ways, especially in light of current budget expectations for DoD and certain mandated cuts.

      --
      HBI's Law: Frequency of calling others Nazis is directly correlated with the likelihood of the accuser being Communist.
    2. Re:Best use of the word cyber ever! by rrohbeck · · Score: 1

      I have a feeling that China nourishes its hackers and pays them well.

    3. Re:Best use of the word cyber ever! by jmactacular · · Score: 1

      Too bad we don't have a Commander in Chief who thought, hmmm... let's strategically shift all that money we're spending on imprisoning Americans over plants, or feeling up old ladies and kids in wheel chairs, or waging useless wars, and put it towards things like I don't know, protecting our national infrastructure and coming up with an alternative to fossil fuels.

    4. Re:Best use of the word cyber ever! by Lucractius · · Score: 3, Interesting

      I dont know how well the "original" hacker mentality of 'everything is worth poking at' mentality would be tolerated in a state run hack team.
      I cant give much in the way of proof for this but this argument is based on organisational psychology vs personal psychology... but anyway

      China, the USA, Russia... I would imagine that the dog tag & rank 'military' hackers are selected via a process much like test pilots (different criteria obviously)

      If you show aptitude in mathematics, logic, and attention to detail, you get funneled into a program, they hone your skills and teach you computer security theory & practice much like the basics I learned in university courses.
      The goal of a state organisation would be a 'state hacker' who's priorities rank something like 1) the defense of the state, 2) their own life, 3) hacking
      I would not call these "Hackers". They are soldiers with computer security training who follow orders.

      Most true to the name and tradition/ethos hackers will not have this ordering, so 'recruiting' or 'nurturing' "free range"/"wild" hackers doesnt fit well with the goals of any nation.
      The idea that "no your not allowed to try that" doesnt sit well with a dedicated old school type hacker. Because the first place the mind turns is 'Why?'
      They may decide not to do something (eg: hack a SCADA system & shut down a hospital, killing people) but this decision usually comes after they worked out how to do it anyway, just because it was there to be worked out.

      --
      XML - A clever joke would be here if /. didn't mangle tag brackets.
  5. Would that include .. by Anonymous Coward · · Score: 0

    the island networks that I assume exist somewhere within the DOD's physical buildings? I'm gonna make the assumption here that people have been infiltrated as well, not just networked machines.

    1. Re:Would that include .. by tripleevenfall · · Score: 3, Informative

      Stuxnet was still able to reach such methods, though direct control wasn't possible, it was more of a phone home/carrier pigeon type of compromise.

    2. Re:Would that include .. by tripleevenfall · · Score: 1

      "networks", not methods

  6. Best Practice by jcaldwel · · Score: 4, Insightful
    From TFA:

    “We’ve got the wrong model here. I think we’ve got this model for cyber that says, ‘We’re going to develop a system where we’re not attacked.’ I think we have to go to a model where we assume that the adversary is in our networks. It’s on our machines, and we’ve got to operate anyway. We have to protect the data anyway."

    Its nice to see the DoD finally catching up with basic best software practices.

    1. Re:Best Practice by SecurityGuy · · Score: 1

      It's also been best security practice for as long as I can remember. This is not really news.

    2. Re:Best Practice by FormOfActionBanana · · Score: 3, Informative

      More specifically, the principles I would ascribe to this is "Defense in Depth" and "Fail Securely".

      --
      Take off every 'sig' !!
    3. Re:Best Practice by smellotron · · Score: 1

      It's also been best security practice for as long as I can remember.

      Even longer, if you look at castle wall construction.

  7. cut the wire by the_Bionic_lemming · · Score: 5, Insightful

    Why does the network have to be accessible remotely? It should be isolated and need a meat sack to get the information from the system and relay it to the party that needs the information. Same thing with public utilities and such - why is it wired so that someone remote can tap a few buttons and remotely access controls for water plants?

    --
    _ _ _ Go for the eyes Boo! GO FOR THE EYES!
    1. Re:cut the wire by tomhath · · Score: 4, Informative

      That's called an "air gap". And yes, DoD has many systems behind them.

    2. Re:cut the wire by HBI · · Score: 5, Informative

      There are physically isolated networks.

      They are referring to the NIPRnet which is directly connected to the rest of the internet. NIPR is all about web apps - time trackers and such, and e-mail. The actual secure stuff has an air gap.

      This is mostly hyperbole. These people who are testifying don't know jack shit about technology, and neither do the people who are listening to them.

      --
      HBI's Law: Frequency of calling others Nazis is directly correlated with the likelihood of the accuser being Communist.
    3. Re:cut the wire by Anonymous Coward · · Score: 0

      meat sack

      Always nice to see a healthy respect for human dignity.

    4. Re:cut the wire by cpu6502 · · Score: 2

      My thoughts exactly. Or setup a separate ARPA-owned network that no one can access except DOD employees.

      BTW the recent news about an electric utility plant being "hacked" by foreign spies was a false flag. In reality it was one of the workers while he was on vacation, logging-in remotely, but of course we never hear that followup story on the Pro-war FOX, CNN, NBC networks. They'd rather scare everyone into thinking we need to bomb Iran and Russia (and then the defensecorps profit).

      --
      My AC stalker: " I personally agree with your posts most of the time, but that won't keep me from modding you troll"
    5. Re:cut the wire by Verdatum · · Score: 1

      It feels like hyperbole to the point of pure nonsense. If any network can be shown to be compromised, the hole would be closed. If we don't know about the compromise, then we can't make the claim the networks are "completely compromised". The only decent suggestion at least from the article (too lazy to read original, sue me) is to operate on a network with the assumption that it's already compromised; that's just the concept of Defense in Depth, and it is nothing new.

    6. Re:cut the wire by Anonymous Coward · · Score: 0

      telework, duh.

    7. Re:cut the wire by HBI · · Score: 1

      There is plenty of CND in the DoD's networks. The statement that they are completely compromised is one of those statements you can make without fear of it being falsified, but it's a bunch of bullshit nonetheless.

      --
      HBI's Law: Frequency of calling others Nazis is directly correlated with the likelihood of the accuser being Communist.
    8. Re:cut the wire by Kadin2048 · · Score: 5, Informative

      Or setup a separate ARPA-owned network that no one can access except DOD employees.

      This exists, it's called the SIPRnet. You can only access it from secure workstations in secure facilities, and in theory all the network hardware is also secure, etc., etc.

      AFAIK, the only recent SIPRnet compromise was Bradley Manning, and that was more of a social exploit than a technical one.

      --
      "Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
    9. Re:cut the wire by Lunix+Nutcase · · Score: 1

      What "recent news"? I've tried Googling this supposed "electric utility hacked" and the only links I get are a 3 year old story and links talking about hypothetical situations. Care to post an actual link to the story you're talking about?

    10. Re:cut the wire by cdrguru · · Score: 1

      The utilities answer is an easy one. You take a city like Chandler with lots and lots of wells feeding the water supply and each and every single site is connected to some kind of network. Maybe public, maybe not - it is just not disclosed. But with a lot of different sites not being connected it would lead to a lot more staff cost and probably a lot more travel costs - fuel, vehicles, etc.

      So everything is networked and remotely controllable. Means instead of a staff of ten people they can have just one. I would suspect the same reasoning applies to plenty of small-to-medium size cities with any sort of dispersed facilities.

    11. Re:cut the wire by elgeeko.com · · Score: 1

      You're right, the politically correct term is "Meat Puppet".

    12. Re:cut the wire by heypete · · Score: 2

      It was actually a water pump, not an electric utility.

    13. Re:cut the wire by Whorhay · · Score: 5, Insightful

      From what I've heard that's mostly true. There are a number of 3 letter agencies that have been known to be so egotistical as to believe they are above the air gap requirements and actually run machines that cross that gap.

      Besides which an air gap is not as full proof as one might think. Just look at what stuxnet managed to do to the Iranians nuclear program. And it would only take a single compromised person on whatever air gapped network to gather the datadumps and send them back to whatever party they work for. Off the top of my head I can think of at least one publisized account of malware being found on an airgapped system that seemingly couldn't be removed.

      Whatever your technical measures and implementations, your security is always limited by the personnel using it. What percentage of people with clearances and access are turnable? It's impossible that it'd be zero, and even at a tenth of a percent it'd mean hundreds or thousands of compromised people and consequentially the networks they have access to.

      All this ignores that classified information is often derivable from other non-classified sources.

    14. Re:cut the wire by Anonymous Coward · · Score: 0

      That's his example of a false flag? An incident that DHS denied was a foreign hack pretty much right after the incident surfaced in the news? Is cpu6502 an idiot?

    15. Re:cut the wire by HBI · · Score: 1, Interesting

      This post above deserves an upmod. Unfortunately, I can not comment further.

      --
      HBI's Law: Frequency of calling others Nazis is directly correlated with the likelihood of the accuser being Communist.
    16. Re:cut the wire by Penguinisto · · Score: 2

      No, it is "Meat Popsicle".

      Geez - am I the only one who knows the correct terminology around here?

      --
      Quo usque tandem abutere, Nimbus, patientia nostra?
    17. Re:cut the wire by Anonymous Coward · · Score: 5, Informative

      Little anecdotal story from my time in the military (can't speak to the policies of all the 3-letter-agencies) USMC had (has) a very VERY strict policy about crossing the streams.

      There are "normal" computers that access the internet and what not, and other computers which exist on a completely separate self-contained network. And never the two shall meet. At all.

      For the most part, the secure computers were in a completely different building, or at very least in a different room behind lock and key. If someone was important enough to warrant access to the secure networks in their office (usually restricted to O-5 at bare minimum) the ports for the secure side were emblazoned in bright red and stuffed behind lock-boxes, so there was no possible way to confuse the two. Oh, and the office itself had to be secured. Certain quality of lock on the door, no windows, etc.

      Any computers that became part of the secure networks, were part of that network for LIFE. When replacement time came, the secure computers had their HDDs wiped via electromagnets and then holes drilled through the platters.

      Even non-computers had to live by a one-way pathing. If you plugged a monitor into a secure computer, that is now a secure monitor and CANNOT leave the secure area. Fax machines, copy machines, etc etc etc. Anything that interfaced with ANY secure data was locked down.

      Suffice to say, there was no crossing the streams, and no matter how infected or compromised the "normal" networks were... there was practically zero chance of any info getting out of the "air gapped" secure networks.

    18. Re:cut the wire by mikael · · Score: 1

      A lot of projects are cross collaborations between academic researchers , DoD, and corporations. Researchers need access to download/upload data, results, source code and documentation as well as use facilities like wind tunnels, supercomputers and wave machine water tanks.

      Its cheaper to give someone FTP access than to have them fly across the continen every time they want to do a simulation run.

      --
      Vintage computer adverts: http://www.vintageadbrowser.com/computers-and-software-ads
    19. Re:cut the wire by Anonymous Coward · · Score: 0

      That sounds VERY SIMILAR to what I deal with everyday. I am a Navy contractor who deals with some classified data. Most of it tends to be torque settings, cable lengths, pin-outs, etc. so nothing exciting. Now every once in a while we have to see the SECRET stuff. That stuff if kept in a LOCKED SAFE, where we have to have two people open it and we go to a secure room to look at it. The computers that have access to the CLASSIFIED network are VERY CLEARLY marked, and you have a special log in/password. As was stated above the streams are never to be crossed. My building is one where you can not have a camera, cell phone, radio, or several other items. If you are caught with those items you will be detained, interrogated, the item will be confiscated/destroyed and you will probably loose your clearance for a while/permanently. They are not joking around with that kind of data.

    20. Re:cut the wire by __aaltlg1547 · · Score: 1

      The meat sacks are the least secure part of the system.

    21. Re:cut the wire by Anonymous Coward · · Score: 0

      That's called an "air gap".

      Saturation use of 802.11 suggests that you need a new term...

    22. Re:cut the wire by Anonymous Coward · · Score: 0

      If sneakernet is available, then it's not a sufficient air gap.

    23. Re:cut the wire by HBI · · Score: 1

      The AC is correct.

      --
      HBI's Law: Frequency of calling others Nazis is directly correlated with the likelihood of the accuser being Communist.
    24. Re:cut the wire by Whorhay · · Score: 1

      What you describe is the policy everywhere I've ever worked. Perhaps I overstated when I said "known". That bit came from my conversation with an inspection team once upon a time when I asked about the point of a security check regarding crossing the streams. I pointed out with the seperate networks for each classification levels it should never happen. And in the case of a spillage no one should be wasting time and effort marking up the finding instead of actually rectifying the situation, at which point it would cease to be a open problem. Their reply, and I guess it counts as hearsay, was that some 3 letter agencies felt above the law in that regard and the finding remained in the checklist to track that issue.

    25. Re:cut the wire by elgeeko.com · · Score: 1

      I stand corrected. It's true, I am a "Meat Popsicle". I was just ashamed to admit it.

    26. Re:cut the wire by themusicgod1 · · Score: 1

      You are delusional if you think one private was the only one who compromised that network. At least 100,000 people have access -- the chinese, russians and others know who to bribe to get access. He just made the data available to the general public.

      --
      GENERATION 26: The first time you see this, copy it into your sig on any forum and add 1 to the generation.
  8. Scary by gmuslera · · Score: 4, Insightful

    Surely will convince public opinion that the new measures of surveillance on all internet connections have a good reason and they should give up on privacy forever.

  9. I couldn't imagine why by Anonymous Coward · · Score: 0

    Perhaps they should re-evaluate their staff qualifications during hiring.

  10. this is all retarded anyway by HBI · · Score: 2

    The military would like a bunch of script kiddie canned attacks as their 'offensive' capability. They don't want to rely on anyone with a brain in real time. That doesn't work very well in practice.

    They're never going to get what they want.

    --
    HBI's Law: Frequency of calling others Nazis is directly correlated with the likelihood of the accuser being Communist.
  11. Funny by DaMattster · · Score: 1, Funny

    I guess the DoD should finally retire Windows 3.11 for Workgroups, huh? LOL!

    1. Re:Funny by elgeeko.com · · Score: 1

      They'll never do it. Do you have any idea how hard it is to get Windows 7 to work on a token ring?

    2. Re:Funny by Greyfox · · Score: 2

      Oh har har har. Do you know how much paperwork that's going to require? To re-write all the specs that specify Windows 3.11 for Workgroups will cost TEN BILLION DOLLARS! So do we re-write all those specs or do we buy the FRONT TIRE of a Joint Strike Fighter! It won't be so funny when a Joint Strike Fighter can't land because it doesn't have a front tire!

      --

      I'm trying to teach myself to set people on fire with my mind... Is it hot in here?

  12. Well it's defense so... by Anonymous Coward · · Score: 2, Insightful

    Well it's defense so ultimately what this boils down to is: "here's a file that says they're going to kick our ass". Can they do that? "Yes". Well, at least we infiltrated their network so we know our asses are going to get kicked and we can prepare for that. "No we can't, we'd have to move the entire country and kick somebody elses's ass to do it. What's more is our network is infiltrated too so they'd know we were going to do it and what's worse is we don't have much ass kicking capability". So. We're dead meat; but we know it in advance. That showed them!

  13. It's not surprising... by SCHecklerX · · Score: 4, Interesting

    ... given the general below-mediocre quality of the contractors and government employees that work for the DoD, and the amount of senseless policies for policy's sake claiming to be for 'security' but, uh, no, not really. The people in charge are the worst.

    I just started working for DoD again, and want to punch people in the face all day long.

    1. Re:It's not surprising... by HBI · · Score: 1

      I SO agree with you. I am getting out after 10 years - at least I keep promising myself that.

      The federal government is home to the most idiotic employees ever.

      --
      HBI's Law: Frequency of calling others Nazis is directly correlated with the likelihood of the accuser being Communist.
    2. Re:It's not surprising... by Anonymous Coward · · Score: 1

      Exactly. A Theo De Raddt quote is relevant here, "Do you trust the guys who can't make a secure OS to make a secure sandbox?"

      Only in this case, you're not trusting guys who make the OS, you're trusting DoD contractors.

    3. Re:It's not surprising... by Anonymous Coward · · Score: 3, Interesting

      Hilarious. I'm a fed here in IT (not DOD) and feel the same exact way. There are idiots that are high up and make decisions without knowing the technical consequences. I keep telling myself they will retire and leave soon, but it never happens.

      It's going to be interesting in the next 5 to 10 years as all of the old folks are going to retire, and there's no new blood to take over for them. I don't know how it is at other places, but that's how it is here. And unfortunately, the new blood (me) is getting too frustrated to hang around much longer because of idiotic decisions that are made.

      I'm only hoping that things will change and people will step down... Surely, it can't be like this at every government facility!

    4. Re:It's not surprising... by Anonymous Coward · · Score: 0

      been there, done that... in DC, Club Fed is a Welfare State for both inner-city and suburbia...

    5. Re:It's not surprising... by Anonymous Coward · · Score: 0

      I work in a public school and your description sounds exactly like it is here.

    6. Re:It's not surprising... by Anonymous Coward · · Score: 0

      Seeing other replies to your observations I'd like to say that I worked for a big bank and it is the same. Two points:

      1) We may be confusing "below-mediocre quality" with "below-acceptable quality".

      2) The problem is inherently related to big organisations and their complexity rather than to their public or private nature.

    7. Re:It's not surprising... by Anonymous Coward · · Score: 0

      Ohhh....sorry. It can be. And it is.

  14. Shut it down by Anonymous Coward · · Score: 0

    If its compromised shut it down and wipe.

  15. DOD security, not so good. by Anonymous Coward · · Score: 3, Interesting

    Reminds me of when I was sent to a DOD site to try to figure out why everyone was scoring 97% on a certain test.

    30 seconds of looking around and I had a pretty good guess:

    (1) The unused tests were printed out in print runs of 10,000 and kept in an alcove in a dusty unused office. Said alcove had a plywood door with 18 inch gaps at top and bottom. Padlocked, but with the hasp mounted backwards, with all the screws exposed.

    (2) There was a 50 page per minute xerox copier in the same room, no access card needed.

    That was a rude introduction to DOD security measures, and the cluelessness of the security folks.

    1. Re:DOD security, not so good. by Datamonstar · · Score: 1

      Who was doing the metrics monitoring? With a lapse in security that gaping, I'm very surprised that the linear test scores was discovered in the first place.

      --
      The eternal struggle of good vs. evil begins within one's self.
  16. In Other Words: +5, Profitable by Anonymous Coward · · Score: 0

    buy OUR consulting services.

    I hope this helps DuD, errr..... , DoD security.

    Yours In Minsk,
    K. Trout

  17. I think that was part of spy test / truth test by Joe_Dragon · · Score: 1

    I hear a story like that before.

  18. They are not spies by Anonymous Coward · · Score: 0

    They are our trusted allies

  19. The problem with the DOD by WindBourne · · Score: 3, Interesting

    is that they will do political things. As such, they have LOADS of windows. And yes, they are LOADED with spies (and the DOD knew it). However, I differ with the expert. NSA should step in and help DOD upgrade everything to a decent set-up. Secure Unix or Linux (with SEL). NO MORE WINDOWS. In addition, restore the security that we used to have back in the 80's. We have slacked so much that many of the contractors are spies. Hell, I have dealt with a probable Chinese spy that was married to a USAF officer.

    The USS reagan should be refitted with secured systems, or we should simply send it in the middle east and allow Iran to blow it up (better iran than china).

    What amazes me is that EU, Russia, and China are all brighter than so many of the idiots in the DOD and at American companies.

    --
    I prefer the "u" in honour as it seems to be missing these days.
  20. Re:The problem with the DOD by bobaferret · · Score: 1

    > What amazes me...

    Being stupid pays better in the short term.

  21. dump the contractors and sub contractors move it by Joe_Dragon · · Score: 1, Offtopic

    dump the contractors and sub contractors move it in house so not only do you cut out a lot middle man you also get more control.

    More control is nice so you don't have people who get moved site to site or have to go thought a reapply for the same job you have now paper work.

    Also it lets you say have trading and other stuff with out the staffing agencies say we don't want to pay for that or we don't or cut to go down paying for time off / travel time / costs come out of own margin. This one guy on a contract said that the staffing firm did not like having to pay for the paid time (part of the over all deal) as it came out of there margin.

  22. Re:The problem with the DOD by WindBourne · · Score: 1

    Stupid or Greedy? I am not sure which.

    --
    I prefer the "u" in honour as it seems to be missing these days.
  23. TL;DR by Anonymous Coward · · Score: 0

    DoD finally watched the TV show "NCIS" and realized that either special agent Timothy "Probie" McGee or forensics specialist Abigail "Abby" Sciuto can hack through any DoD firewall in a few seconds when ordered to do so by special agent in charge Leroy Jethro Gibbs.

  24. Smart Move by drkstr1 · · Score: 2

    The experts suggest the agency simply accept that its networks are compromised and will probably remain that way, then come up with a way to protect data on infected machines and networks.

    This is actually one of the smartest things I've heard come out of the DoD relating to information security, in a long while.

    One of the first rules of thumb when developing secure client-server applications is, never trust the client. One must assume that given a high enough incentive, any public facing interface can and will be exploited in one way or another, and there is no way to reliably anticipate all attack vectors.

    It is smart to develop policies and procedures around this assumption.

    --
    Fanboy Status: Apache Flex, C#, Eclipse, KDE, Pirate Party, Ron Paul, Slackware, Windows 7
  25. Re:The problem with the DOD by Whorhay · · Score: 5, Insightful

    While I agree that I'd like to see the DoD move to more secure technical solutions, I don't think it'd solve the security problem. Like you pointed out the system is only as good as the people that are using it. And even with a very small percentage of people willing to spy it'd be almost trivial for a foreign government to buy their way into almost any system.

    Prior to 2001 everything was more compartmentalized, which was good for Information Security's sake. But it proved to be bad for our national safety as the CIA wouldn't pass on information about a potential threat to the FBI for what amounts to dick measuring reasons. In the aftermath of 9/11 the policies swung the other way and we end up with Bradley Manning having access to way more information than he needed for his job.

    A proper solution is a multi faceted problem. We need technical systems that are secure and yet still useable by a barely trained 18 to 50 year old volunteer. We need systems designed to be as secure as possible but still interface with each other and work in a timely manner. We need people that are as immune to corruption and insanity as possible. And the hardest part is probably sticking to fights and engagements that don't force those people to question the morality of the job they are tasked with doing.

  26. It's possible to run as a "limited administrator" by Anonymous Coward · · Score: 0

    In Windows... such as HAVING to answer to UAC and even more than say, Linux? Having to literally LOG IN to do things, just like normal users do!

    How? Ok (& my systems are setup thus in fact, bit of a pain, but stops bogus installers from malware 'automagically & invisibly' using your current logon privelege level to bypass UAC & other high-security restrictions):

    These are most of, if not ALL, of the registry areas to set this up in to make that happen with the settings to examine & change are as follows in gpedit.msc &/or regedit.exe:

    ---

    Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Admin Approval Mode for the Built-in Administrator account

    OR

    HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v FilterAdministratorToken

    (Set as ENABLED)

    ---

    Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode

    OR

    HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin

    (Set as PROMPT FOR CREDENTIALS)

    ---

    Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Behavior of the elevation prompt for standard users

    OR

    HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorUser

    (Set as Automatically deny elevation requests)

    ---

    Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Detect application installations and prompt for elevation

    OR

    HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableInstallerDetection

    (Set as ENABLED)

    ---

    Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Only elevate UIAccess applications that are installed in secure locations

    OR

    HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableSecureUIAPaths

    (Set as ENABLED)

    ---

    Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Run all administrators in Admin Approval Mode

    OR

    HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA

    (Set as ENABLED)

    ---

    Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Switch to the secure desktop when prompting for elevation

    OR

    HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop

    (Set as ENABLED)

    ---

    Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Virtualize file and registry write failures to per-user locations

    OR

    HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableVirtualization

    (Set as ENABLED)

    ---

    Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop

    OR

    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableUIADesktopToggle

    (Set DISABLED)

    ---

    * There you go... you can do all of what you state, & more, easily enough, but instead by using NATIVE TOOLS already present in Windows itself in, gpedit.msc or regedit.exe!

    APK

    P.S.=> To even FURTHER enhance that, albeit @ the application level? You can use taskmgr.exe, & set UAC Virtualization ENABLED on ANY RUNNING APP too: Further sealing it off from infecting/infesting other running apps or the entire OS b

  27. In Your Base by Anonymous Coward · · Score: 0

    Im in ur base killin ur d00dz

  28. It's the same everywhere. by Anonymous Coward · · Score: 0

    What you're missing is that when the idiots in charge finally leave (and it will take longer than you will believe possible), they will either be replaced externally, or by internal people who play the game rather than caring about actual results. They will still probably be idiots (from the perspective of caring about doing good quality work). You won't have a look in - excellence in doing your job is not rewarded.

    I lasted 8 years in various government jobs before finally smelling the coffee and leaving for a much, much better job in a smaller private sector organisation with higher pay, motivated and intelligent colleagues and opportunities for advancement. And genuinely, no idiots.

    Don't wait, unless you really enjoy playing politics or working around mediocrity. Or you believe in some kind of public-service ethic, of course.

  29. Re:It's possible to run as a "limited administrato by Anonymous Coward · · Score: 0

    Oh sweet jesus, that's hilarious - APK's gonna tell us how to fix the DoD's computers?

  30. Cyano-Acrylate by Anonymous Coward · · Score: 5, Interesting

    We use CA epoxy as a very effective security measure. For any commodity hardware we buy, we fill all of the USB ports with a CA epoxy that prevents access. We also use it to permanently attach mouse and keyboard. Motherboard USB headers are also filled with CA to prevent the casual attachment of devices (although users cannot physically get to their machines, since they are in locked cabinets, with IDS tied to building security. Same goes for unused SATA, PCIe, and other ports. Any plug that isn't used is made unusable.

    PCs are on a network, but users have no physical access to cables, and similarly we use a secure cable type with a current loop and TDR to detect physical tampering. If the current loop is cut, building security knows precisely where the cut is within seconds.

    There is no wireless, and no bluetooth. Employees are not allowed to bring in cell phones, MP3 players, or anything else with any capability of capturing data, and yes, we 100% search at the door with metal detectors and millimeter wave detection like you see at the airport (except we actually know how to use it). We're also in a steel building with no windows and and EMI shielding, just in case.

    We're not on the Internet. We have absolutely no need to connect to it. Even if we did have a spy as an employee, they would have to reproduce anything they did on another machine outside the office in order to transmit it anywhere else. And obviously, there is no means to allow employees to "work from home" in their pajamas in sandals.

    Any new software has to go through a thorough vetting process, and any vendor wanting to sell us software is required to allow us to load the source code and build environment onto our build farm, review and inspect the code for possible attacks, and then compile it ourselves. This is a lot easier to achieve than you might think.

    Finally, we're old school. Everything is compartmentalized. The guy working on the math routines has no idea why he's working on them, or what they will be used for. All he knows is that he's a software engineer in charge of high-level math function development. He doesn't know what the product is or what it does.

    1. Re:Cyano-Acrylate by Anonymous Coward · · Score: 0

      Compartmentalization is Fail -

      "Finally, we're old school. Everything is compartmentalized. The guy working on the math routines has no idea why he's working on them, or what they will be used for. All he knows is that he's a software engineer in charge of high-level math function development. He doesn't know what the product is or what it does."

      This is how you weed out ethical employees...

    2. Re:Cyano-Acrylate by Anonymous Coward · · Score: 0

      Seems overkill, what's the point in wasting time gluing your computer together if it's going in a cabinet anyway? Just setup something that will detect if the cabinet is opened, it should be relatively simple given the rest of your setup.

    3. Re:Cyano-Acrylate by OneMadMuppet · · Score: 4, Funny

      OMG - you work for Apple?

    4. Re:Cyano-Acrylate by Whorhay · · Score: 1

      Those efforts sound like a very good setup. But it's still not as secure as you might think. I didn't see anything about rectal exams. They can make very small devices these days containing small enough amounts of metal that smuggling something in still sounds plausible, if uncomfortable. Although given the systematic way in which the hardware is locked down they would likely be limited to recording what a person could see or hear, which is a very good thing.

      All in all it sounds like quite enough to stop casual leaks like Manning. But a concerted effort from a nation state would probably still find a way.

    5. Re:Cyano-Acrylate by Anonymous Coward · · Score: 0

      There is no such thing as cyano-Acrylate Epoxy. That is like saying coca cola (tm) car oil.

      They are two different classes of adhesive.

    6. Re:Cyano-Acrylate by Rich0 · · Score: 1

      Sure, but why deploy security patches if you're behind a firewall, and why put the computer in a cabinet if employees aren't allowed to bring in usb drives?

      This is called defense in depth. It means that even if an attacker gets past a layer of security their ability to exploit is greatly reduced. If you put all your energy into a single layer of protection then if somebody subverts it they have the run of the place.

      The extra layers of security, coupled with guards/etc, mean that an attacker is going to take a long time to do anything. Even if they are armed with zero-days against every layer of your software security they still have to break into cabinets and solder around glued up USB ports/etc, and that makes them easy to catch with roaming patrols.

      Sure, nothing is perfect, but layers of security are the best way to contain problems.

  31. don't worry, ex l0pht hacker is on the job by decora · · Score: 3, Informative

    millions-of-dollars research projects, are underway right now. in fact, a guy from the l0pht, named Midge.

    see

    http://en.wikipedia.org/wiki/Cyber_Insider_Threat

    im sure theres no coincidence between 'experts' pushing this and the industry about to 'provide the solution'.

    nevermind that they are basically, built around theories like "maybe a guy changes the time he eats lunch".

    and that 'insider threats' also = whistleblowers.

    1. Re:don't worry, ex l0pht hacker is on the job by Shoten · · Score: 2

      I think you mean Mudge. Mudge is the L0pht Heavy Industries alumnus who is at DARPA.

      Also, the reason why 'insider threat' = whistleblowers in this scenario is because technical controls cannot interpret or extrapolate intent. They can't tell the reason why information is being extracted from a secure environment, only that it is. The lack of differentiation is not some nefarious scheme to catch well-meaning whistleblowers along with spies, just a shortcoming of technology. A hammer doesn't know whether or not it's being used for good or bad either.

      --

      For your security, this post has been encrypted with ROT-13, twice.
  32. That's only a TINY bit of what's needed by Anonymous Coward · · Score: 0

    Specifically tailored to what erroneus said's all... want to do it right? Ok:

    http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&qs=ns&form=QBLH

    * It's been EXTREMELY highly rated by others online since 2008, & I've been doing the same, since 1997 onwards... &, yes, it works... & has been seen by millions, with testimonials galore, it actually works, when "FOLLOWED TO THE LETTER", exactly, point by point.

    However, believe-it-or not?

    Suggesting it & PROVING it was needed??

    Event got me fired from a job once!

    Why?? Simply, because I caught the fact my then "Head of Operations", a paper MCSE, nothing more, setup TREND MICRO antivirus wrong, & our network was RIDDLED w/ keyloggers & more... that fool!

    However - Politics did me in though, because when I pointed out it's only minutes of work to migrate its settings via .reg merges & gpedit/secpol usage @ an AD network-wide level???

    He tried to say "it's too much work", but I even later proved he didn't even KNOW how to do it!.

    My role then was as a programmer/analyst coding for security...

    By securing applications @ a DB + app level using .NET & SQLServer (migrating badly done work that was NOT using stored procs OR bind variables, & yes - you have to do THAT too, but it's useless to 'batten down the hatches' @ that level, if your entire network & OS setup is wide the "F" open!) + far more...

    He got fired though!

    How??

    LMAO, because, some "little bird" let it out to AVG he then turned to the freebie model of that antivirus vs. his erroneously setup TREND setup, & that? IS a "NO-NO"...

    "Someone", lol, took that jackass for the same ride he sent me on, but on more valid grounds... + his superior (a nearly completely computer illiterate stooge who was oddly titled "CIO") got 'taken out' too!).

    What goes around, COMES around... lol. This? This is the price negligent DOLTS pay, in addition to opening the door for negligence lawsuits from clients who were compromised.

    APK

    P.S.=> The problem, from these mgt. DOLTS who have never really done years of ALL-AROUND work in computing (from techie, to network admin, to security AND coding) are a problem... they complained about costs or tried to?

    I proved it was minutes of work, & users logons would handle the rest, domainwide, & I had a system setup thus that was NOT infested as my proof, where everyone else was diseased to hell by NOT doing it... @ both OS security & database + application levels, & for a WORLDWIDE very famous client company that had very famous folks, law enforcement, & more's data (health data no less)... apk

  33. What all the experts have in common... by Shoten · · Score: 2

    "A group of guys whose budgets revolve around coming up with new cybersecurity defenses testified today that they should be given a LOT more money to play with."

    --

    For your security, this post has been encrypted with ROT-13, twice.
  34. Re:The problem with the DOD by Anonymous Coward · · Score: 0

    It doesn't actually pay better in the short term, it just seems to ...if you are a completely ignorant idiot, you aren't aware that you're phukd, until you've bled out, and even then, often live in denial.

  35. The key sentence in the story by jeff4747 · · Score: 1

    "It is difficult to know how many of these warnings are hyperbole, since some, but not all of them, were accompanied by pleas for more funding."

  36. Oblig. by Anonymous Coward · · Score: 2, Funny

    But when did the Soviets begin this type of research?

    Well, sir, It looks like they found out about our attempt to telepathically communicate with
    one of our nuclear subs. The Nautilus, while it was under the Polar cap.

    What attempt?

    There was no attempt. It seems the story was a French hoax. But the Russians think the story about the story being a French hoax is just a story, sir.
    So, they've started psi research because they thought we were doing psi research,

    When in fact we weren't doing psi research?

    Yes, sir. But now that they're doing psi research, we're gonna have to do psi research, sir.
    We can't afford to have the Russians leading the field in the paranormal.

  37. Re:dump the contractors and sub contractors move i by Anonymous Coward · · Score: 0

    English much?

  38. Re:The problem with the DOD by c0lo · · Score: 1

    Stupid or Greedy? I am not sure which.

    Being independent, why not both?

    --
    Questions raise, answers kill. Raise questions to stay alive.
  39. Re:It's possible to run as a "limited administrato by GmExtremacy · · Score: 1

    Nonsense.

    Instead of using the hosts file, use Gamemaker. Return to Gamemakerdom! Return to righteousness!

  40. Where were hosts files noted here? by Anonymous Coward · · Score: 0

    Plus a brand new 7 digit registered luser acc't from u too? Go away troll. You & "your kind" online (pond scum), make me laugh...

    APK

    P.S.=> Illogical off-topic ad hominem attack attempts directed my way & failing like usual on your part's NOT 'cutting it' here... apk

    1. Re:Where were hosts files noted here? by GmExtremacy · · Score: 1

      Why you little wusaaaaaaaaaaaaay! Now ya gonna get it!

      Word about you has spread all over the grapevine. There are countless rumors circulating everywhere. Every single elite has read them. The rumor? You're missing a few gigabits on your puter. The person who started it? Komen Bryce himself!

      Should've used Gamemaker. Fuckin' fucker cheeks patty.

  41. U.R. FAILING (lol, see video inside)... apk by Anonymous Coward · · Score: 0

    LMAO - how predictable from the newly created 7 digit registered 'luser' account utilizing /. troll that's appeared suddenly! Oh boy: Here comes name tossing now too from you (predictable as off-topic trolls always are, no creativity or imagination exists in their "dull brains").

    Plus, this says it ALL about "your kind", regarding puny attempts @ off-topic trolling me on hosts files usage & from a respected others in the field of computer sciences & the security community itself:

    "I don't actually get time for many sites such as slashdot anymore, but certainly see my fair share of trolls on the MyWot (Web of Trust (I'm a moderator there, and MyWot includes hpHosts in their "ratings")) and Malwarebytes forums, and you're correct - it's always either users of malicious software/sites, or the owners of such, that are doing it." Mr. Steven Burn of malwarebytes/hpHosts

    * I've discussed with he this week in fact as I submitted a 64-bit GUI program for hosts file processing to he in & fact (which he said was 'excellent work') no less & they are hosting it for me, gratis, too (see what work does, instead of off-topic failing ad hominem attack attempts directed MY way from you?)...

    I even proved BOTH COMODO antivirus + ArcaBit/ArcaVir WRONG on false positives they had because their detection engine algorithms were a bit 'weak' in handling a custom executable compression engine I utilize also in the same stroke, for roughly 1 month's work on/off in my spare time creating it.

    APK

    P.S.=> However, back-on-track, busting you up some more weasel, lol: Your Off-topic illogical attempts @ ad hominem attacks directed my way & failing as usual? Please... this also says it ALL for you, lol:

    http://www.youtube.com/watch?v=zVmBAd76kak

    "U.R. FAILING"... lol, bigtime: To think you had the stupidity to try 'matching wits' with me! apk

  42. Advice to Guys in 5-Sided Building by Anonymous Coward · · Score: 0

    Suggestion:
    Let it be known that, every time an attack is traced to a certain country, another American missile will automatically be targeted at a major city in that country.
    It's a lot easier to build missiles than it is to secure a vast network.

    BTW, Pentagon, every hear of disinformation via honey pots?
    Store information that would cause an adversary to react in a unique, predictable, detectable way, then see which government does so.
    Voila! The attacking government identifies itself.
    Sometimes problems are easier to solve than one imagines.

  43. Hmm... whats there IP by Anonymous Coward · · Score: 0

    Hmm... whats the DoD's IP block? Would be worth a TOR routed nMap scan maybe...

  44. Re:It's possible to run as a "limited administrato by Sardaukar86 · · Score: 1

    Have you noticed that you never get above 0 with your posts?

    Most people posting stuff online would fairly promptly realise nobody gives a fuck about their opinion - but not you. Any idea why that might be?

    --
    ..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
  45. Ur /. peers show otherwise 160++:1 ratio vs. you by Anonymous Coward · · Score: 0

    "Have you noticed that you never get above 0 with your posts?" - by Sardaukar86 (850333) on Thursday March 29, @07:16PM (#39516851) Homepage

    See the 160++:1 ratio of posts where I've been modded up then vs. your b.s. quoted above!

    I've even dusted you on this very point before, dolt, see my p.s. below for proof of that no less, on where you tried this same tactic on "mod downs"!

    (Poor, because you're repeating the EXACT same mistake expecting different results but NOT getting them vs. what's next below (Some folks call what you're doing, insanity, in fact, constantly failing on the very point you're trying now)):

    ---

    Roughly 160++ of them & I post as AC (hard to get even +1, as /. hides our posts & we "AC"'s start @ ZERO/0 points, unlike registered "lusers", lol!):

    +5 'modded up' posts by "yours truly" (5):

    HOSTS & BGP:2010 -> http://tech.slashdot.org/comments.pl?sid=1901826&cid=34490450
    FIREFOX IN DANGER: 2011 -> http://news.slashdot.org/comments.pl?sid=2559120&cid=38268580
    TESLA:2010 -> http://science.slashdot.org/comments.pl?sid=1872982&cid=34264190
    TESLA:2010 -> http://tech.slashdot.org/comments.pl?sid=1806946&cid=33777976
    NVIDIA 2d:2006 -> http://hardware.slashdot.org/comments.pl?sid=175774&cid=14610147

    ----

    +4 'modded up' posts by "yours truly" (4):

    APK SECURITY GUIDE:2005 -> http://developers.slashdot.org/comments.pl?sid=167071&cid=13931198
    INFO. SYSTEMS WORK:2005 -> http://slashdot.org/comments.pl?sid=161862&cid=13531817
    WINDOWS @ NASDAQ 7++ YRS. NOW:2009 -> http://tech.slashdot.org/comments.pl?sid=1290967&cid=28571315
    CARMACK'S ARMADILLO AEROSPACE:2005 -> http://science.slashdot.org/comments.pl?sid=158310&cid=13263898

    ----

    +3 'modded up' posts by "yours truly" (6):

    APK MICROSOFT INTERVIEW:2005 -> http://developers.slashdot.org/comments.pl?sid=155172&cid=13007974
    APK MS SYMBOLIC DIRECTORY LINKS:2005 -> http://it.slashdot.org/comments.pl?sid=166850&cid=13914137
    APK FOOLS IE7 INSTALL IN BETA HOW TO:2006 -> http://slashdot.org/comments.pl?sid=175857&cid=14615222
    PROOFS ON OPERA SPEED & SECURITY:2007 -> http://slashdot.org/comments.pl?sid=273931&threshold=1&commentsort=0&mode=thread&cid=20291847
    HBGary POST in Fake Names On Social Networks, a Fake Problem:2011 -> http://tech.slashdot.org/comments.pl?sid=2375110&cid=37056304
    APK RC STOP ROOKIT TECHNIQUES:2008 -> http://it.slashdot.org/comments.pl?sid=1021873&cid=25681261

    ----

    +2 'modded up' posts by "yours truly" (12):

    HOW DLL API CALL LOADS WORK:2008 ->

  46. Repeating the SAME mistakes, Sardaukar86? by Anonymous Coward · · Score: 0

    "Have you noticed that you never get above 0 with your posts?" - by Sardaukar86 (850333) on Thursday March 29, @07:16PM (#39516851) Homepage

    U tried this before w/ the SAME "FAIL" results http://news.slashdot.org/comments.pl?sid=2579684&cid=38413180

    * The "infamous they" often say that repeating the same mistakes over & over again expecting different results is the very definition of INSANITY, Sardaukar86... & you definitely repeated that mistake again today!

    E.G.-> Where I blew you away the EXACT SAME WAY here now:

    http://yro.slashdot.org/comments.pl?sid=2741535&cid=39525081

    With rougly a 150++:1 ratio vs. that b.s. of yours I requote from you above now... lol!

    As per my usual, you have been DUSTED!

    Easily too - With literal accompanying proofs to the contrary vs. your b.s. quoted above, lol, except there are 14++ more this time than last time where I have been upward modded!

    (Which to get them is even harder for us AC's since we start @ 0, and /. hides our posts from many viewers by default... but as you can see? It happens, and it also happens to BLOW YOU AWAY, with ease too, & with actual proofs vs. your DAYS LATER appearing & trolling to no avail!).

    APK

    P.S.=> When are you going to realize that even coming into my posts a week later as you have this time, is doomed to fail vs. myself since I use proofs that literally can be shown to be correct and which blow you away, everytime? Especially on THIS account??

    Please... grow an intellect!

    Simply because you're only showing us that your "intellect" such as you have shown us, is FAR inferior to my own... apk

  47. HBGary style multiple reg'd accounts 4 downmod? by Anonymous Coward · · Score: 0

    Let Mr. Bruce Perens tell you about my subject-line above everyone:

    "It just takes one Ubuntu sympathizer or PR flack to minus-moderate any comment. Unfortunately, once PR agencies and so on started paying people to moderate online communities, and to have hundreds of accounts each, things changed." - by Bruce Perens (3872) on Friday July 30, @03:55PM (#33089192) Homepage Journal

    SOURCE -> http://linux.slashdot.org/comments.pl?sid=1738364&cid=33089192

    (So given that - Do you think that "fake accounts" and "spam" or "technically unjustified mod downs" & the like in trolling posts of others that may "threaten the 'powers-that-be'" etc./et al doesn't happen on /. as it does every place else? Guess again, per the above...)

    APK

    P.S.=> It's not just "malware makers" or "spam mailers" folks - Mr. Bruce Perens is also showing you that it's also done in the name of big companies as well, via "paid for trolls" in the big name companies' hire - now, as anyone can plainly see per my other replies here where I have LITERALLY dusted Sardaukar86 on the same mistake he's made here now today (7 days AFTER I 1st posted here no less... did you actually *think* I wouldn't see it? LMAO, guess again):

    http://yro.slashdot.org/comments.pl?sid=2741535&cid=39525081

    AND, in the past on the same erroneously failing note:

    http://news.slashdot.org/comments.pl?sid=2579684&cid=38413180

    Does anyone TRUST the "moderation" system here completely, especially regarding unjustified mod-downs? Hell no... trolls like yourself are only "biting off" what HBGary got caught doing (just like the Chinese "water army" has been as well):

    HBGary POST in Fake Names On Social Networks, a Fake Problem:2011 -> http://tech.slashdot.org/comments.pl?sid=2375110&cid=37056304

    Using multiple registered 'luser' accounts to pull off unjustified moddowns of others' posts is a WELL-KNOWN trolls' trick, fool... get over it - plus, my showing TONS of upward mods to my credit/name in my favor utterly DUSTS you as per usual, yet again, easily!

    ... apk

  48. Re:It's possible to run as a "limited administrato by Anonymous Coward · · Score: 0