Slashdot Mirror
Iran's Hacking of US Navy 'Extensive,' Repairs Took $10M and 4 Months
cold fjord sends news that Iran's breach of a computer network belonging to the U.S. Navy was more serious than originally thought. According to a Wall Street Journal report (paywalled, but summarized at The Verge), it took the Navy four months to secure its network after the breach, and the repair cost was approximately $10 million. From the article:
"The hackers targeted the Navy Marine Corps Intranet, the unclassified network used by the Department of the Navy to host websites, store nonsensitive information and handle voice, video and data communications. The network has 800,000 users at 2,500 locations, according to the Navy. ... The intrusion into the Navy's system was the most recent in a series of Iranian cyberoffensives that have taken U.S. military and intelligence officials by surprise. In early 2012, top intelligence officials held the view that Iran wanted to execute a cyberattack but had little capability. Not long after, Iranian hackers began a series of major "denial-of-service" attacks on a growing number of U.S. bank websites, and they launched a virus on a Saudi oil company that immobilized 30,000 computers. ... Defense officials were surprised at the skills of the Iranian hackers. Previously, their tactics had been far cruder, usually involving so-called denial of service attacks that disrupt network operations but usually don't involve a penetration of network security."
Missiles, ships, planes, tanks, and large groups of soldiers all cost a lot of money. As long as you have them you are on a perpetual upgrade cycle if you don't want to be outclassed. A geek with a computer is pretty cheap, can do a lot of things, and cause a lot of really inconvenient problems. If there is one thing Iran probably isn't short of it is smart people that like to play with computers. It isn't 1988 anymore, and the world has heard about the internet.
much of left-wing thought is a kind of playing with fire by people who don't even know that fire is hot - George Orwell
By studying Stuxnet.
I eat only the real part of complex carbohydrates.
...and figured they could get some much-needed F14 parts if they requisitioned planes to be outfitted special for missions...
Do not look into laser with remaining eye.
...the Navy saved taxpayers at least that much by not having tighter security.
Well, it was a nice thought.
Any sufficiently unpopular but cohesive argument is indistinguishable from trolling.
They seem to learn fast, also they have a lot of good engineers. We should expect some kind of response to Stuxnet and I guess we have established by Stuxnet that electronic warfare is OK for countries to do against each other.
It is going to be much harder to stomach the day some Air-force guy is taken out by a drone attach in Virginia with a missile to his car as he is delivering his children to Kindergarten.
The Marine Corp's budget is $29B per year. An extra $10M would be an increase of 0.03%. The Department of Defense budget, minus the money spent on individual military branches, is $190B. $10M is 0.005% of that.
It's not just the military or Iran. We choose to twittle our thumbs and write it off as a rarity. Most companies don't even realize the drastic damage its doing. When your competition in China has all your secrets and make identical clones of your products for a fraction of the price how do you expect to stay in business. Iran's impact is probably insignificant in the scheme of things. It's industrial espionage and 'theft' of proprietary information that's the major problem. Iran's just an exemplary example at the moment, but in reality most of these attacks are just swept under the carpet until the system breaks down utterly and completely. All the while you wonder why American companies are selling out there core businesses. There is nothing left the competition doesn't already have.
The only answer to this problem is defaulting to hardened systems, moving away from auto-on for stupid default setting (macros, javascript, etc), etc.
But your company uses Microsoft Windows? ohh never mind. Keep doing what your doing. I'm sure you'll survive given nobody ever went wrong with that!
this was clearly explained to me by the principal author of the HMI/SCADA program that I'd just been hired to work on. I later resigned in protest.
It's been long enough I figure they've fixed their security holes by now.
Despite their taking industrial safety very seriously, to company owner thought it was quite fucking funny that his product was totally shot through with security holes.
HMI/SCADA: Human-Machine Interface / Supervisory Control And Data Acquisition. That's the proper name for what most would call industrial control systems.
The Stuxnet and Flame worms attacked our competitor Siemens' HMI/SCADA, but only when the installations were in Iran. Particularly they spun the Uranium Hexafluoride Gas Turbine Centrifuges far faster than the could tolerate them, thereby damaging them.
It's not like the Iranians don't know how to write computer programs. Maybe right now would be a good time to move way the Hell out into the countryside, and invest in some HEPA filters and lots of solar power.
HEPA filters can get plutonium dust out of the air you see.
Please mail me URLs of software employers.
I know this because a client I once consulted for, sold 400,000 licenses for their Windows product to the Navy.
Windows isn't so bad if it's properly locked down, but it's not really possible to do that unless all of your application are Windows Logo-compliant, for example they don't store end-user documents in the Program Files folder. I expect the military has a lot of homebrew software they absolutely need to use, that prevents Program Files from being locked down.
Also everyone who actually administrates a windows box, has to actually know how to lock it down.
Please mail me URLs of software employers.
We're not at war with Iran, and no sane person in the U.S. or in Iran wants a shooting war. IMHO, what we have here is more of a cold-war style cat and mouse game where each side tries to provoke the other and see how far they can go. Examples being Iran supplying arms to Shiite militias in Iraq, Iran being involved in proxy wars in Syria and Lebanon, taking Americans hostage, and developing a nuclear weapons capability. The U.S. responded with Stuxnet and probably a few other things that we don't know about. In the end it's really about gaining some sort of political bargaining advantage and to have a stronger bargaining position when the time for deal making comes.
Iran is also the regional heavy weight, and they're not a bunch of modern-day spearchuckers as the parent somehow implies. They do have a professional conventional military with semi-modern weapons systems. They also have the ability to maintain, develop and upgrade their weapons systems. The main difference between Iran and the U.S. is that Iran lacks the global logistical capabilities that America brings to the battle field, and the depth that the U.S. has in any fight. The Iranians would lose a conventional battle with the U.S. and both sides know this. Defeating the U.S. in a conventional battle probably isn't a factor in Iran's military planning. They're more focused on regional domination, especially if and when the U.S. pulls out of the middle east. Without the U.S. backing of the Gulf states, Iran would probably be able to defeat any of their neighbors in a conventional war, at least in theory. Without the U.S., the only country in the region that might defeat Iran would be India.
If somehow forced into a conventional fight with the U.S., Iran could, with the right leadership, inflict heavy damage before being defeated. But Iran is a very old country. IMHO, they're playing for time and will poke us at any chance they get. As Sun Tzu once said, "If you wait by the river long enough, the bodies of your enemies will float by." In more modern terms that is called, "strategic patience."
The Marine Corp's budget is $29B per year. An extra $10M would be an increase of 0.03%. The Department of Defense budget, minus the money spent on individual military branches, is $190B. $10M is 0.005% of that.
Another figure to put in in perspective: 5% of the cost of a single F-35 or F-22.
Do we bother believing the DOD telling us another story about big, bad, Muslim wolves and the need for endless war footing?
And if they spent $10 million, no doubt about 75% of that was wasted, poured down the maws of corpulent military contractors (cui bono).
I am against violent extremists, aren't you? Certainly many ordinary Muslims are against the extremists and just want to live in peace.
I think the Palestinians have been saying this for ages, but Israel's armed forces don't seem to be listening.
You mean they want their stolen property back, no different than Jews demanding the return of property stolen from them. And your talking point died when Carter visited Hamas and talked them into accepting Israel as party of a peace deal, just by actually talking to them.
Other parts left out of your storyline (cuz that's what you do), Israel created Hamas to undermine Fatah. And while you guys like to whine about the Hamas charter, the Likkud charter lays claim to all of the West Bank, which is flatly illegal and always has been. And then there's the odd Israeli official that nakedly talks about a "final solution" for their "Palestinian problem".
Of course, one side has the best military hardware a sugar daddy can buy along with hundreds of nuclear weapons, but it's a good thing we have people like you to focus on the other side: rock throwers and gunpowder rockets straight out of the 12th century.