Slashdot Mirror
How the FBI and Secret Service Know Your Network Has Been Breached Before You Do
coondoggie writes "By all accounts, many of the massive data breaches in the news these days are first revealed to the victims by law enforcement: the Secret Service and Federal Bureau of Investigation. But how do the agencies figure it out before the companies know they have been breached, especially given the millions companies spend on security and their intense focus on compliance? The agencies do the one thing companies don't do. They attack the problem from the other end by looking for evidence that a crime has been committed. Agents go undercover in criminal forums where stolen payment cards, customer data and propriety information are sold. They monitor suspects and sometimes get court permission to break into password-protected enclaves where cyber-criminals lurk."
And here I thought the answer was the NSA tells them and they know because they have root access to these systems.
The fact that it's actually through real police efforts actually makes me feel a tiny bit better.
Creationist Textbook Stickers Declared Unconstitutional by CowboyNeal
Just waiting for someone else to login ..
Step 2 - they go and post in the credit card forums .. excuse me, my tinfoil hat is slipping a bit..
They set it all up...
"Flyin' in just a sweet place,
Never been known to fail..."
"...and sometimes get court permission to break into..."
Hehe... lawl
Law enforcement is very actively trolling the Internet to discover things, he says.
Funny, I'd be happier if they were trawling the internet for info instead of trolling.
I'll bet they got a lot of good leads from their imbedded World of Warcraft agents! ( http://games.slashdot.org/stor... )
Verizon 2013 DBIR: http://www.verizonenterprise.com/DBIR/2013/
for several years now.
Is that what is going on?
They have real time access to credit card processors and to all major credit cards, they had this long before so they can effectively track an individual under warrant by their spending, they can tell by time and usage if a number has been compromised. There was never a reason to penetrate the store front credit card processing environment so Dell, apology accepted for the "inconvenience" -jerks. These numbers they come across in their hacking endeavors should be flagged by the major credit cards and credit source charges rerouted if they wanted to pursue individual targets, aside from that they should be immediately cancelled. I've seen bad investigative calls made by the Secret Service by determining malware that monitored keystrokes detected on the fileserver, but it would have been required to be present on the terminals as that is where the keyboard wedge MSR's were installed. I'm pretty sure these guys are quite busy on their forensics but they need to better substantiate root cause to rule out inside jobs.
Companies do not focus on security.
They spend money. They are compliant. But they are FAR from secure.
wtf yo send me to that gay website for this user should get kick in teeth
Really? Millions spent on 'compliance' ... are you new to the business world in general?
I can't think of a single business other than credit card processors and banks that ACTUALLY put EFFORT into security.
For pretty much everyone else, the standard is 'fix the breech after the fact that it happened'
The police know your car is stolen before you do if you're out of town and someone steals it to rob a bank.
When investigating crime, you generally follow the leads back to the source to find the perpetrator. That means unless the perp was a moron, (S)he probably bounced through some networks that would make it harder to track them ... and thats why the FBI goes to them.
Second, if they knew they were breeched and what it was, they'd just fix it.
99 times out of 100, someone else informs you that you've been breeched.
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
Shouldn't Congress be doing some watching of its own?
Ohh look at all the smart, creative people here making the same comments about the FBI/NSA being in on or part of the crimes.
I would think that it would be much easier to use an ip list for a botnet attack to find out who is infected.
"get court permission"
Please... Like they ask for permission before doing stuff like that.
I've got better things to do tonight than die.
Back in 2005, I had a personal blog site defaced. I didn't even know it had happened.
The way I spotted the issue was through an open terminal window that was tailing the apache access log. I'd glance at it every once in a while as traffic trickled over the blog. I saw a request come in from the PENTAGON domain. I thought it was odd because my blog was about skateboarding and didn't think it would be of interest to anyone working at the Pentagon. I looked at the referrer and it was a site I was unfamiliar with: http://www.zone-h.org/.
So I browsed over to that server and saw that the page linking to my site was a list of defaced sites. Then I checked my own homepage and sure enough, Wordpress had been compromised by an exploit and someone had posted an article on the front page.
So, it seems like someone at the pentagon had a script scraping the defacement indexing sites and was then visiting each affected server and scraping that. Never got an email or phone call or anything.
$5 / month hosted VPS on linux = awesome!
Simple. If you are hacking into someone's network, you know you are breaching it.
FBI: Your network has been breached.
Network Admin: By who?
FBI: Us, how do you think we know it was breached?
Some random guy who is 'a windows admin' (meaning he clicked next until Server was installed) ... yes, the FBI knows first because that douche doesn't have a clue.
99.9% of the admins on the planet are absolutely clueless. Being an 'admin' no longer means you know what you're doing, it now its just means anyone who can click next calls themselves an admin ... and as such, their networks are generally piles of crap.
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
I'd much rather have the FBI/CIA/NSA hang around with all the miscreants than spying on individuals at large. Sure, there's an issue of what probable cause they have to participate in such forums. But its the same thing that they do when undercover cops hang around a bar and wait for some moron to come in and look for a hit man.
It would be nice if they'd give the owners of compromised networks a call once in a while to get them started making repairs.
Have gnu, will travel.
"especially given the millions companies spend on security and their intense focus on compliance" You wish! For 99% of company, network/computer security is on last tier priority list, even farther when you talk about investment... From a Network Security Specialist.
With a serious identity problem
plus they have automated surveillance systems that:
1. track all IP connections for them, so they know who connects and to where.
2. all IP, SMTP, and HTTP, FTP and other protocols that aren't encrypted are being watched, so they know what is accessed and what information is sent to the server (GET/PUT/PUSH) requests.
3. All this is monitored because they have splits in the fiber and telecommunication system to passively monitor and record all traffic, 24/7.
On top of this, satellites and radar systems automate tracking of individuals and their behavior. Including heart rate, breathe, brain activity, and more. All ground activity is automatically tracked for them.
The Artificial Intelligence that runs the system is more effective than human brains at scanning and tracking things. Kind of like Facebook's image recognition software that uses virtual neurons, which beats human visual scanning capability.
The stats of the 32+ satellites pointed at earth indicate that all modernly launched models are 53,000 times more powerful than Hubble, pointed right into your homes and backyards and businesses, remotely tapping the emissions and radio frequencies of electronics and human beings.
Dr. Robert Duncan for reference is the guy who whistleblew about most of this; he has been to secret Naval bases and designed several of their surveillance and weapons systems for the DOD/NSA/FBI/USDOJ/CIA. Details about all this on this page (scroll down for some of the interviews with Dr. Robert Duncan, PhD from MIT/Harvard/Darthmouth): http://www.oregonstatehospital...
Of course it's true that the internet forums and shit are monitored; without encryption and/or heavy shielding to block signals emissions, like a foreign nation uses, you cannot hide any of your activity. The NSA/FBI basically uses all the same techniques that they use on foreign nations to spy on Americans. IN fact, they monitor Americans with this technology MORE than other nations. And it's easier because they have direct-access to all the land, laws, and agents who will willingly corporate with these abuses, and won't fight back or start a war like another nation might.
The answer is Brian Krebs from his relatively unsophisticated home office.
The feds are way behind..
Humbug I say, Humbug!