Slashdot Mirror
Officials Warn: Cyber War On the US Has Begun
snydeq writes "Security pros and government officials warn of a possible cyber 9/11 involving banks, utilities, other companies, or the Internet, InfoWorld reports. 'A cyber war has been brewing for at least the past year, and although you might view this battle as governments going head to head in a shadow fight, security experts say the battleground is shifting from government entities to the private sector, to civilian targets that provide many essential services to U.S. citizens. The cyber war has seen various attacks around the world, with incidents such as Stuxnet, Flame, and Red October garnering attention. Some attacks have been against government systems, but increasingly likely to attack civilian entities. U.S. banks and utilities have already been hit.'"
Really? So we're going to see buildings destroyed, thousands murdered? The hyperbole is way out of hand on this one.
Thanks to the War on Drugs, it's easier to buy meth than it is to buy cold medicine!
So, they put a bug in Russian oil pipeline controlling kit that blows up. They put a virus on Iranian nuclear power testing plants (could have blown up).
And everything was just "The Next Cyber War Could Be Deadly".
But now that the USA's banks are being attacked, "ITS THE NEXT 11/9!!!!!!!!!!"
Fucking drama queens.
FUD to steal more of our rights away. "FOR YOUR PROTECTION, we need to monitor everything, sign on the dotted line and everything will be ok. You Can Trust US" MEH.
After all, what with fiscal responsibility looming, we need all the excuses we can get to keep the war funds flowing.
If even somewhat true, this is the kind of thing that will usher in a new era of network surveillance and the kind of restrictions that will kill a formerly free Internet. Governments will have much more incentive to get involved in the standards drafting process in order to ensure "proper adherence" to national security "requests" etc.
I hope I'm wrong, but having seen how people go apeshit with simple "point and click" technologies like guns.......let's see what happens when you get a bunch of old white guys with power trying to lock down things they *truly* don't understand.
Begun, the Cyber Wars have.
What the heck is he smoking? China et al. have been attacking the US through computer systems for decades.
Love sees no species.
This cyberwarfare has been going on for more than five years now. Do you know how many banks, medical facilities, etc. as well as research institutions have been hit by the Chinese? I won't say whom, but a major US aerospace research corporation has been undergoing an almost constant stream of attacks since 2005...
So has my ssh server. Except that has been going on for much longer.
And when I turn on logging in iptables I see a constant patter of attempts on common windows networking ports as well.
Is this is what constitutes an "attack" in these reports?
My guess is that with public news articles coming out daily and homeland security trying to convince every
little public utility of grave danger and stampede them to harden their system, that these script kiddie attempts, which are
almost universally unsuccessful, are exactly what is being touted as a cyber warfare attack.
Sig Battery depleted. Reverting to safe mode.
They are mentioning StuxNet and the like as a threat example? So, the US is in danger of malware created by the US ... perhaps loosing viral code on the world wasn't a good idea.
Now, to "protect" ourselves from our government we need to do what ... turn over more information and control to the people that created the problem? Why would I want to give more power to people that have already proven they can't be trusted with it?
This sounds like nothing more than multi-faceted spin control and manipulation.
What I hear being said:
Look, we need a larger budget to monitor this situation.
And more power to get the information we need without the red tape of actually getting warrants.
For your protection against what we've done, you should just give us all your info, all the time.
"Flame away, I wear asbestos underwear"
I'm a security professional. I work for one of the largest banks in the world, in a role directly involving online security.
Putting it succinctly, Infoworld is full of shit.
Yes, there have been attacks. There were also attacks last year. And the year before. And pretty much every year going back to the day somebody first connected a modem to the serial port of a computer with access to the bank's internal network. I have no doubt whatsoever there will be attacks this year, next year, and every year to come.
This is NOT "Cyber 9-11". Not even fucking CLOSE to it. People fucking DIED on 9-11, including two guys I was friends with in college and used to drink, play videogames, and trade warez with all the time. I think one of them might have even jumped, and had to spend ~40 terrifying seconds deciding whether he'd prefer to be killed instantly, or live an extra millisecond or two in searing pain after getting shredded by the steel and glass atrium feet first.
It sucks having to tell your boss that there's a distributed denial of service attack in progress, or someone might have compromised an application and harvested usernames or email addresses (but as of yet, no passwords). It doesn't even come CLOSE to sucking as badly as falling a thousand feet to your death, or getting liquefied and burned alive by 400 million tons of flaming concrete.
Picture sitting at your desk, sipping a latte, checking out the morning's posts on Slashdot, and having a 767 crash into your office at 500mph. A chunk of wing hurls across the floor, tears off your legs, and sends you flying into a column or something solid. You have about a quarter of a second to think, "WTF" before getting engulfed in a fireball and dying more slowly than you'd have otherwise rationally preferred. Now, in that context, try to think of ANY conceivable computer hacking attempt or attack that either keeps people from accessing their accounts or creates fraudulent line items for the forensic bookkeeping team to try and sort out that you'd EVER classify as being worthy of being used in the same sentence as "9-11". Go ahead, I *dare* you.
this is why the banks are a perfect hacker target. they are full of arrogant, ignorant people whose main judgment on whether something is important or not, is what their buddies think. since their buddies are all bankers, they kind of have a myopic view of the world.
I assure you, the people who do IT here know exactly what they're doing. You're talking to one of them right now. Besides a corporate culture and management that supports and leverages their IT resources, the lawyers and reams of federal laws governing the business simply won't allow what you're proposing to happen here or at any other major financial institution in this country. Again, I cannot comment directly on specific business practices, nor can I act as a spokesperson for the business I work for, but as an IT professional, I would stake my reputation on the security here being sufficient to prevent the kind of damage discussed in the article. Is it perfect security? Of course not. It is sufficient security.
i used to work at a 'financial institution', and let me tell you, its running everything from DOS to WinNT to WinXP ---- everyone brings their cellphones and USB sticks and plugs them into their computers to charge, everyone visits any website that pops into their mind without thinking about security. machines are running all kinds of versions of IE, sometimes back to 6.0, often unpatched.
You should call the government then and step forward to collect your million dollar whistleblower bonus then. Cell phones aren't connected to the network, and as to anything being plugged in via USB... I happen to know for a fact that any unrecognized devices that are connected to any workstation generates a security alert in realtime. The offender usually has a visit by security accompanied by his/her manager in a matter of minutes. And speaking as someone who works in software packaging and deployment, There is no "all kinds" of anything on the network. As soon as a new version is approved for use (the approval process is extensive, I admit) , it is deployed to all workstations as quickly as labor resources can handle it. There is no "IE6" running anywhere in production here.
everyone visits any website that pops into their mind without thinking about security.
Which is why there are numerous proxies and realtime scanners. I'm sorry if you've been living under a rock these past eight years or so, but google "Intrusion Detection System" sometime. Internet access is something any office worker demands, and worker morale is very negatively affected if it's unavailable. This is a happy medium for most corporations. You're right that an airgapped network would be "more secure" but then so would unplugging the computer and locking it in the closet. I work with security reality, not the security fantasy you're laboring under.
nobody understands even the basic principles of computer security - and despite the banks strong profits,
"Nobody" is standing right in front of you telling you that we not only understand them, we exceed them by leaps and bounds. And in a recent article, those "strong profits" only came about in the last few months. In Fantasy Security, a large business with over 130,000 workstations spread across over 5,000 retail locations can simply push a button and revamp their security because the money is now available, but in Realworld Security, the budget is approved in January, and the plans are made the year before. Everything we're doing now is based on last year's "profits". And by profits, I mean... in the red. Something about a subprime mortgage crisis we're just getting over, I suppose.
the bank branches are full of minimum wage employees who have something like 90% turnover for a year,
Dude, lay off the cheap $3 crack. It's
#fuckbeta #iamslashdot #dicemustdie