JP Morgan Chase Breach: Shades of a Cyber Cold War?

TheRealHocusLocus writes: The New York Times is quoting "people briefed on the matter" who allege that the JP Morgan data thieves "are thought to be operating from Russia and appear to have at least loose connections with officials of the Russian government." The article suggests it could be retaliation for sanctions. Personally, I'm skeptical — I've seen the former Soviet Union evolve into an amazingly diverse culture that is well represented on the Internet. This culture has grown alongside our own and runs the gamut of characters: tirelessly brilliant open source software developers, lots of regular folk, and yes — even groups affiliated with organized crime syndicates. This is no surprise, and these exist in the U.S. too. Are we ready to go full-political on this computer security issue, worrying more about who did it than how to protect against it in the future? How do you Slashdotters feel about these growing "tensions," and what can we do to help bring some reason to the table? The article also notes that the same group responsible for the breach at JP Morgan Chase was responsible for attacks on 9 other financial institutions.

Comments

All is fair...

[BringsApples]

...in love and war.

Re:All is fair...

[koan]

All is vanity.

Re:All is fair...

[BringsApples]

"All is fair in love and war" can mean anything you want, but here, it would be wise to look at it to mean, "Inspire love rather than war".

So many groups of people aren't satisfied with the current configuration of the financial institution that the US harbors, because it's a debt-based system whereby many many more are in debt than are not.

Re:All is fair...

[TheRealHocusLocus]

Remember wise old Solomon
Recall his history
He was the wisest man on Earth
And so he cursed the day of his birth
He knew that all is vanity

So not much fun was poor Solomon
Now most of us would agree
We are not much better off than he
His brains it was that put him on the spot
I thought that brains were good--- Guess not!

~Threepenny Opera

Betteridge's law of headlines

[Anonymous Coward]

no

Re: Betteridge's law of headlines

[tysonedwards]

Don't be daft. Everyone has at least a loose association with a government official, and that's what's being asserted here. A friend of a friend was a Russian Government official, thereby the whole thing must be their fault! Couldn't possibly be that it was "because we could", or "because it looked like easy money", or "because they were acting in a criminal syndicate"... Nope, we need a new enemy and ISIS isn't scary enough and China owns too much of our debt, so Russia it is!

Re: Betteridge's law of headlines

[TheRealHocusLocus]

The submitter is even "skeptical" about the whole issue.

Hello. I'm more than skeptical, I find it alarming. It's Orwellian. Because I remember a time when the US and USSR were one provocation away from open conflict. And as we all knew at the time it would have been ugly and global. I remember when newspapers went out of their way not to even appear to be inviting or inciting conflict. The New York Times now considers itself to be an ankle-biting attack dog for the Obama Administration. They're proud of it. It would merely be pathetic if one could find humor in there somewhere.

What if the attack had appeared to originate from IP address ranges in the UK? Would the Queen's photograph be on Drudge, and would the NY Times accuse Her Majesty's government of hooliganism, or would the reporting take on a whole other angle? Would Drudge dip into his stock photo bin and retrieve some generic 'hacker' illustration instead? They need to consider that, and ask themselves why the response would be different.

People need to ask these questions. It is not enough to shrug off Yellow Journalism when it touches on things that really matter. There must be an appropriate response, even if it is some sort of dialogue taking place elsewhere, such as on the net. Otherwise we run the risk of being carried along (towards war, for example) with people who do NOT question these things.

TL;DR: I'm not clicking this bait.

Too bad no one showed up when you held that March For Apathy. Oh darn--- I was just one click short of earning a free bicycle from the New York Times affiliate program! Curses, foiled again.

Re: Betteridge's law of headlines

[cavreader]

About the idea of China owning much of the US debt. Over 80% of the national debt is owned by the US Federal Reserve. The remaining debt is parceled out in bonds and investment certificates to countries and regular people. China and a lot of other countries stash large sums of cash in US financial instruments. The US is recognized as one of the safest and stable places to invest their money. And in the unlikely event that the US and China were to start a war or do anything else that pisses off the US government their assets can be frozen with a signature.

Re: Betteridge's law of headlines

[cavreader]

Other than the US embassy what property or bank accounts could China freeze to seriously harm the US? And for a million soldiers to get any where close to the US they would have to execute the "million man" swim to get there. One word: logistics. Geography has always given the US an advantage. There is not a single country on the planet who can project military power any where in the world on a moments notice except for the US. No other country has as many foreign military bases around the world as the US. Bases that are there because the foreign governments have welcomed them for various reasons. Bases that were built after WW2 to place trip wires to deter potential aggression against US allies. SK is the best example.However, the US has always vacated any base were the host asked them to. The Philippines are sort of regretting their decision as well as Iraq. And in the event that things get really out of hand a nuclear war would devastate all sides so there is really nothing to talk about in that dismal case. If missile defense technology continues to advance to the point of rendering ICBM's and cruise missiles useless we could see another non-nuclear WW3 in the future.

Classic case of not owning the problem

[Anonymous Coward]

Just as most other organizations that have been hacked and made public, I'm sure they (JP Morgan Chase and associated entities) would love to blame this on some "advanced", "state sponsored", or other threat they claim was unrealistic to defend against. They will claim they spend a lot of time and money, and they still got hacked. In reality, they simply use the "time and money" as as plausible deniability. They are making so much money off their "customers", they could care less about security. It's all about dodging responsibility when something happens.

um

[Charliemopps]

I think someone doesn't know the definition of "Cold war"
Given that this story is about an actual attack, that would lead me to believe this is a "hot" war.

Re:um

[TheRealHocusLocus]

The difference between a hot war and a cold war is that during a hot war people do very little prevarication about who's responsible. For example, note that Ukrainian separatists openly boasted about blowing a plane out of the sky when they thought that it was a Ukrainian plane. They didn't start lying about it until they found out that it was a Dutch passenger plane. Cold war attacks are like that from the beginning. They didn't happen. If you can prove they did happen, we didn't do it. We don't know anything about it. If you can prove we did it, then it was a mistake. Also, this is not what I would describe as an actual attack. There were no boots on the ground. No weapons fire. No one died. Economic sabotage is exactly the kind of thing that happens during a cold war precisely because it is easily deniable.

Well said. Spoken like an old school CIA analyst. To clarify for the three-letter gubmint haters out there, that is high praise.

I see a Cold War as a sort of heavy mechanical 'flywheel' that begins to move because it is fed with an assortment of motive and sentiment. It may be started by some actual conflict such as competition for resource or political influence in contested regions, or difference of ideology and the merest suspicious of intent of conquest... it feeds also on distrust... but once it gets going it becomes an object used by both sides to acquire 'ways and means'. It is a funding machine, a hate machine. It supplies momentum and drop-in motives for anything one would wish to allege or ascribe to the 'enemy', even false flag operations. It can win or upset elections. But this is key: once all parties involved gain their footing, all parties involved find ways to make it useful to them. A Cold War is as lucrative as a successful corporation, as threatening as an invading army. It is a shadow-construct that spins off fear and loathing. The Cold War itself is easy to create and cheap to maintain. The true cost of weaponry is not what it costs to make--- it's the cost and effort put behind keeping people convinced that it is necessary. Cold Wars deliver this justification cheaply, for years. They can do this because they thrive on acquired personal prejudice and pride in one's own opinion, which can last a lifetime with little external input. It thrives on and depletes the same cultural energy people would otherwise spend reaching out in curiousity, seeking opportunities that promote cooperation and generally improve life.

I could call it a vampire squid, but the term is taken. Suffice it to say, fuck Cold Wars.

Cold Wars also promote false flag operations because they subvert healthy skepticism. Back in the "good old days ha ha", no terrorist organization would act without ensuring that they claim responsibility in a way that was incontrovertible. This took the form of a telephone or fax delivered to news media just before or at the moment the event occurred. You'd think anyone with a cause would want to ensure that the world knows who is responsible, and why, right?

Something awful happened to the human race between 1970-1980, a real IQ drop. Terrorists stopped calling and claiming responsibility in ways that were verifiable. There was a time--- believe me--- when no self-respecting news organization would even publish a claim of responsibility that had been received after the event. Now not only do they publish any rumor they hear (especially if it pins the act on an evil empire)... what's worse, they are slobbering at the feet of "confidential government sources" and printing it word for word without analysis or even speculation.

The Internet is the best antidote human kind has created to oppose their formation. Oh yeah, it can be used to spread and replicate crap with blinding speed and easily manipulated (I prefer to call them un-vested persons) can create a storm... but it also keeps tyhe lines of communication open for more productive or truthful messages once they arise. The New York Times does not even seem to know what it is doing, that's the saddest part. Perhaps all the adults have left the building.

Loose connections?

[rduke15]

appear to have at least loose connections with officials of the Russian government.

I thought any important criminal gang in Russia had much more than "loose connections with the gorvernment.

Corporate Wars

[JimSadler]

How long before we see corporations forming hacking groups off shore dedicated to destroying competition by breaching security and causing chaos? Causing chaos to a competitor is one way to steer profits towards a companies cash registers. Can't you see Burger King trying to wipe out McDonalds?

Re:Corporate Wars

[CaptainDork]

I agree with you, but a question I'm more concerned about is, "How long before we see corporations tighten up their stuff?"

Personally, I don't see that happening until some major lawsuits are filed.

Re:Corporate Wars

[koan]

This has been going on as long as the Internet has existed, you are a bit slow on the uptake.

Re:Corporate Wars

[sgt_doom]

You're not particularly current, dood, it has been going on for quite some time now.

Re:Corporate Wars

[BringsApples]

I like the way you think, because it's insightful. But in this case, who would be the competition to The Federal Reserve?

Re:Corporate Wars

[mlts]

Here is the problem rearing up with two nasty heads:

The first is that security has no ROI, and has a relatively trivial financial cost. A major breach happens, a company feeds a PR firm some cash, says they boosted security [1], they toss all affected a year's subscription to some monitoring service, and that is that. Come a lawsuit, there isn't much to sue because they can easily throw their hands up and say that the hackers would get through anything.

Which brings up the second point. In the 1990s, a rogue Internet site could be pulled from the net. Now, doing that is tantamount to an act of war, similar to blockading a port with a naval force. So, no matter what, there is no shutting down blackhats. IP blocks can be worthless since it just takes a compromised computer to bypass them. So, eventually the bad guys will find a way in.

Want an actual solution to the hacking problem? Banks need to create a separate network that uses dedicated physical links that is not connected to the Internet, and if it is, it is connected via application firewalls. Machines are keyed to only be able to connect with other boxes in a pre-arranged manner. If box "A" wants to connect to box "B", it needs to be registered beforehand, or the central switch fabric will deny it. Built into the fabric would be the ability for the central switching fabric to completely lock a box out at the L1 level, so a DoS is stopped.

Yes, this sounds Draconian, and puts power into a central place... but this isn't the Internet we are looking at, but a private network between banks, banks and credit card processors, and other entities. With this in mind, the actual machine NICs could be made with tamper-resistant chipsets, public keys, and authorization can be done via a PKI system.

Higher layers could be controlled by the individual institutions, so that even though L1/L2 traffic is handled by a central authority, application permissions can be controlled on a per machine basis with whitelists. That way, if the central authority is compromised, machines are still secured. Spoofing is protected, since public key fingerprints would be used as a part of a box's IP and stored on a HSM on the interface.

This is nowhere near 100%, but what it means is that there is not just an open network for someone to go after a site. To access a bank, it would require a compromise of an extremely hardened CA and a L1 ISP (both the keys authorizing machines to communicate and the actual WAN switching fabric, which could be kept completely separate from each other.) If a breach happens, it can be fixed fairly rapidly, and a site failing to address it would be disconnected from the WAN.

In general, not a 100% secure solution, but this gives three benefits. The network is separate, so for any mischief to occour, it require compromise of the core fabric. Then, individual hosts will have to be attacked, and with contract stipulations mandating a high level of security, this would be difficult. Finally, sites that are too lazy to keep current with security advisories would have their access pulled as part of being on this network.

This is pretty much done with NIPRNet and SIPRNet, so why not a similar WAN mechanism for businesses and finance.

[1]: The security "boost" could be another checkbox ticked off in a GPO object applied to the ass end of the company, so that passwords are needed to be changed every 60 days instead of every 90. Yep, a security boost.

Re:Corporate Wars

[Deadstick]

And this would be a bad thing how?

Re:Corporate Wars

[CaptainDork]

I'd mod you +1 if I could. Well said.

Re:Corporate Wars

[eric_harris_76]

That was sarcasm, I assume. (But thanks to Poe's Law, I don't put much confidence in that assumption.)

We do all know that the movie "Demolition Man" was fiction, right?

Worry less about motive - worry about apathy

[QuasiSteve]

http://www.bloomberg.com/news/...

tl;dr: People think it'll happen at other banks anyway, plus it costs money to change banks, thus they don't care enough and stick with Chase (JP Morgan).
And, naturally, how does the stock market react to that? "The bankâ(TM)s shares climbed 2.5 percent to $60.30"

Start making people care that a company they do business with has been hacked, maybe then people will actually bother to worry about motives.

Re:Worry less about motive - worry about apathy

[matthekc83]

I would like to be able to care less. We need to get the ssn to have a changable security pin attached to it. It looks like your information has been compromised sorry you will have to change your pin... darn.

Can We All Just Get Along?

[MellowBob]

No.

FUD. They don't even know.

[Vokkyt]

From the article:

"But much remains unanswered about the intrusion, including just who the hackers are, which other financial institutions were hit and why the hackers went down a path inside JPMorganâ(TM)s computer system that contained troves of customer information, but not financial data."

They have no motive, no indication of who, or why they did what they did. I agree with posters saying that it's officials throwing out a red herring to get everyone worked up over Russia instead of poor security.

Boot them from the Swift system for a few weeks

[EmperorOfCanada]

If this turns out to be provably true then an easy solution would be to boot Russia from the swift system for a few weeks. That would basically mean that no international transactions could take place large or small. Or if they wanted to make it interesting they could restrict swift transactions to minor amounts so that the very richest would be impacted while the average Russian would feel a lesser impact.

But large food importers and whatnot would be massively impacted.

But before this can be done Europe needs to find an alternative to Russian Gas. But when Europe does then they won't tolerate Russian shenanigans for 1 second.

The key is that any retaliation needs to hit those around Putin who can change their mind about his being in power. The average Russian on the street will choose Putin over the West nearly 100% of the time.

Re:Boot them from the Swift system for a few weeks

[koan]

Or maybe we can goose step Dimon to jail, and burn JPMorgan to the ground financially.

Re:Boot them from the Swift system for a few weeks

[hjf]

Argentina has VAST reserves of gas and oil. They just don't have the money to exploit them.

Re:Boot them from the Swift system for a few weeks

[Bob_Who]

Or maybe we can goose step Dimon to jail, and burn JPMorgan to the ground financially.

Now that's the first pertinent response I've yet heard.

Why should we trust anything JP Morgan says when they are proven liars and frauds and they are protected by policy. The fact is that bank robbery has been conveniently been redefined as identity theft, therefore JP Morgan has less at stake when they say this happened. One minute they're secure, the next, they're not but they can point to the perpetrators with certainty. Yeah right, I trust them, its the commie gangster's fault. Not one US Banker has taken the fall yet, but we're supposed to blame Russia for our fucked up security and banking laws. Eric Holder will no doubt be well paid for his epic failure. Its unbelievable how distracted and hypnotized Americans have become lately. Common sense has eluded us. If we won't toss Dimon in jail then lets just make him President or drop him from B-2. Its really getting absurd. Russia is not our enemy, our policy is the problem we need fix first and foremost. WAKE UP AMERICA!!

Re:Boot them from the Swift system for a few weeks

[hjf]

Argentina paid to repsol MORE than its market value estimation.
And what they did was not "illegal". If it was, they couldn't have done it.

Re:FUD. They don't even know.

[crunchy_one]

Spot on comment. TFA also fails to name the 10 financial firms that were allegedly attacked. The New York Times seems to be rapidly morphing into a US version of Russia Today. If there's any new cold war, it's clearly a propaganda war. And guess what? I don't give a flying fuck.

FUD

[mike.mondy]

Posting to undo moderation mistake.

shades of incompetence actually...

[Karmashock]

Secure your fucking networks or get off the internet.

Re:FUD. They don't even know.

[Archtech]

Very much like the utterly unsubstantiated claims that Russia had something to do with the shooting down of MH17. John Kerry said that there was a mountain of evidence, but so far not a single shred of evidence has been published by the US government. The Russians released a good deal of hard evidence, including radar traces and the locations of known BUK units. Basically, MH17 was shot down either by cannon fire from one or more fighters, or by a BUK SAM. The only fighters in the air that day were Ukrainian government planes, and while the rebels may have captured a BUK unit, it had no radar. However the Ukrainian military units near Donetsk had at least three BUK units, complete with radar and trained crews - one of which was in exactly the right place to have shot down MH17, given where it came down.

So the Western media were flooded with "stenographic" reports and opinion echoing US government statements (almost word for word) and without any skepticism or investigative journalism. Although there has still been no evidence produced to incriminate Russia or the Ukrainian rebels, virtually all Westerners have been so heavily and repeatedly brainwashed with the certainty that Russia was responsible that they think they "know" it.

Perhaps the recently revealed large and widespread payments made by the CIA to American media (and others) in return for the printing of CIA-written propaganda helps to explain many of these odd situations. And media corporations are all the more disposed to go along with the scam because their circulations are shrinking and they laying off journalists and editors left, right and centre. It's a double win: money for nothing, and masses of copy that has been written elsewhere. The only losers are any remaining readers who are foolish enough to believe what they read in the newspapers and what they hear on radio and TV.

Hackers: "This is our world now."

[matthekc83]

Hackers movie quote "This is our world now. The world of the electron and the switch" I think at some point nearly everthing will get "hacked"... we can cry about it or we can make things less fun. Hackers movie quote "There is no right and wrong. There's only fun and boring." We need treaties to ensure those commiting crimes can be prosecuted across borders with long boring sentences. Hackers movie quote "Kid, don't threaten me. There are worse things than death, and uh, I can do all of them." For the love of god why is our ssn a national identifier and the unchangable password to our finances!

Wagging the dog?

[ErikTheRed]

"People briefed on the matter" generally equals "deliberate leak, to move public opinion or at least test the waters."

Propaganda

[koan]

Sounds like one of many smears to come up prior to some sort of "intervention" in Russia or just the usual "he said she said" crap our (and other) government/s are famous for.

Re:Can't be serious..

[koan]

Then you're an idiot, that's reason for war.

Technology should be designed to be *secure*

[Anonymous Coward]

And system administrators have to stop acting like implementing security is a bad idea, shouldn't happen, and won't work. You can argue that 'the business' always comes first no matter what. However that doesn't work if 'the business' puts security at risk. If your business is cloned by a foreign competitor your screwed, if your bank accounts drained your screwed, if you really think 'the business' always comes first your wrong. It highly depends on what the risks from being comprised are.

I'm the CEO of a small technology company and I get that security is hard. Hell- I'm not even living up to my own high standards. However its hard to do that when *nobody* else is. Despite that I'm trying to put security first during our web site revamp (the most critical aspect of this company, if our security is hosed in a slow planned manor we'll never recover).

One good example is the 'security' systems (two factor authentication) aren't even well thought out and are done such to be 'cheap' rather than effective. This will only stop the bottom feeders temporarily. It won't stop Russian organized crime from doing live intercepts via botnets to gain access to bank accounts and once the tools are sold to typical criminals the entire system is back in the hands of the criminals. I have nothing against the criminals, and considering that I'm the *primary victim* (100% of the shares, business owner here) when fraud happens I'm in a position where I should be more pissed than anyone (and it happens too often).

But I'm not because the problem isn't the criminals. It's the lack of security and enablement by critical institutions (government and corporate). What I have a problem with is visa, master card, american express, the banks, and the government. They are not implementing the systems we actually need.

1. True security, not halfway crap 'wireless WEP/WPA/WPA2', if your bank's site gets 'hacked' and a known vulnerability w patch exists at the time, then the bank should be shut down, assets seized, etc, none of this proprietary bull shit either. All defaults should be set to off or specifically added to a white list after approval only (on the client side, things like macros, etc).

2. The systems should be built on hardware that there is source code for and audited. BIOS, firmware components, etc. Right now this doesn't even really exist unless we're talking about *a consumer router* or two. Some individual components may qualify as being pretty close to 100% free software friendly and source code available though.

3. Calling a cell phone for authentication is NOT a security measure. It's merely a nuisance for the customer (particularly when the cookies make it such you can steal them and never actually have to authenticate via phone anyway). We need something closer to secure ID /w password (on the secure ID token itself). This would prevent the ability of a middle-man (or make it much more difficult) because the identification number revealed by the token to authenticate can only be used once and you can be confident that the person involved in accessing it did authorize it. Now it won't prevent some attacks where the system is compromised, but you can thwart unauthorized wire transfers by adding a screen that shows information to a wire transfer such that the user has to approve it on the device itself. This way the attacker could not simply show the user a different set of data than the one he authorized by entering the token number during authentication.

Re:Russia not equal to USA

[Anonymous Coward]

When the leader of your country is connected to the mafia, declares himself leader and starts taking over other countries this is very much different from a country that has democratic elections and holds freedom as an ideal. I'm sure there are great people in Russia, but it is no united states.

Are you describing President Obama and the United States of Amerika (now KKK) or President Putin and Russia (formerly part of the CCCP)? Any pretence of freedom in USA has long been exposed an a fallacy. Dear Leader Barack Hussein Obama is merely jealous that Putin wrestles with Siberian tigers, swims in icy waters, and does not bow and scrap to the Master of the Plantation.

Re:FUD. They don't even know.

[Archtech]

"Citation please".

That's an easy game to play, isn't it? Tell you what: first, since it was mentioned first, YOU give ME a citation for some hard evidence substantiating the claim of Russian involvement in the J.P. Morgan affair.

And if you want a citation for the CIA allegations, Google is your friend.

Re:FUD. They don't even know.

[Archtech]

Although I did go to the CIA Web site and searched for "propaganda media". This is what I saw next:

Search is Temporarily Unavailable

Search is temporarily unavailable. We apologize for the inconvenience. Please try again later.

Posted: Aug 27, 2012 04:31 PM
Last Updated: Aug 27, 2012 04:31 PM

Russian diversity

[wonkey_monkey]

I've seen the former Soviet Union evolve into an amazingly diverse culture that is well represented on the Internet. This culture has grown alongside our own and runs the gamut of characters: tirelessly brilliant open source software developers, lots of regular folk

But no pooftahs.

Re:Russian diversity

[mjwalshe]

In Russia we have many types of criminals "simples yes" - as Lord Leveson sort of said perception is a bitch

Blame Russia to distract the plebs

[Anonymous Coward]

Hurr durr, someone hacked us and exposed our incompetence. Let's blame Russia so the masses don't take it out on us.

Attribution?

[Lawrence_Bird]

Fail, fail and more fail. The press, three letter agencies and especially the congress critters love to a) inflate the threat and b) give attribution when none is possible. This book is extensively researched and has footnotes out the ying-yang. Bottom line is attribution at a level where one can say "these guys did it" is rare and even saying "probably did it" is difficult. And beware that many of the players involved have multiple objectives and even relationships with each other (when convenient).

Curious reframing within a reframing . . .

[sgt_doom]

. . . after all, JPMorgan Chase (Chase) is the largest criminal organization in America today, and together with Goldman Sachs, they effectively run and control the US Department of the Treasury, while existing as the major forces of the Federal Reserve Bank. If the Russian mob was attacking the American mob, it is really about the mobs, now isn't it?

Ah yes, The Times

[fustakrakich]

The war mongering Randolph Hearst of the new century, and the old one.

I'm rooting for the Russians

[Mister Liberty]

I hate banks. So should you.

Re:Russia not equal to USA

[wiredlogic]

You shouldn't delude yourself into thinking that the US has free elections or in any resembles a true democracy or republic. Just look at how almost all states ban non-party affiliated voters from participating in primaries even though they use public resources to collect those votes.

Re:FUD. They don't even know.

[znrt]

which "rebel side"? you mean the fascist western backed coup d'état that overthrew a legitimate elected government and threw the country into civil war?

and you guys still speak of "cold" wars? lol.

Cooperation

[Sciath]

Going after criminals (in foreign countries) requires the cooperation of that government. Russian government (like the U.S.) is corrupt enough to impede any legitimate investigations. Especially when government officials are benefitting from the criminal activities. In the case of Russia, there is little incentive for Putin to cooperate.

Diversity of russians

[bombman]

I find it an odd chain of logic, that because the Russian netizens are a diverse bunch, then it excludes that
a crime syndicate with ties to persons in the Russian government are involved in some specific incident of hacking.
Both can easily be true at once.