Slashdot Mirror
JP Morgan Chase Breach: Shades of a Cyber Cold War?
TheRealHocusLocus writes: The New York Times is quoting "people briefed on the matter" who allege that the JP Morgan data thieves "are thought to be operating from Russia and appear to have at least loose connections with officials of the Russian government." The article suggests it could be retaliation for sanctions. Personally, I'm skeptical — I've seen the former Soviet Union evolve into an amazingly diverse culture that is well represented on the Internet. This culture has grown alongside our own and runs the gamut of characters: tirelessly brilliant open source software developers, lots of regular folk, and yes — even groups affiliated with organized crime syndicates. This is no surprise, and these exist in the U.S. too. Are we ready to go full-political on this computer security issue, worrying more about who did it than how to protect against it in the future? How do you Slashdotters feel about these growing "tensions," and what can we do to help bring some reason to the table?
The article also notes that the same group responsible for the breach at JP Morgan Chase was responsible for attacks on 9 other financial institutions.
How long before we see corporations forming hacking groups off shore dedicated to destroying competition by breaching security and causing chaos? Causing chaos to a competitor is one way to steer profits towards a companies cash registers. Can't you see Burger King trying to wipe out McDonalds?
http://www.bloomberg.com/news/...
tl;dr: People think it'll happen at other banks anyway, plus it costs money to change banks, thus they don't care enough and stick with Chase (JP Morgan).
And, naturally, how does the stock market react to that? "The bankâ(TM)s shares climbed 2.5 percent to $60.30"
Start making people care that a company they do business with has been hacked, maybe then people will actually bother to worry about motives.
From the article:
"But much remains unanswered about the intrusion, including just who the hackers are, which other financial institutions were hit and why the hackers went down a path inside JPMorganâ(TM)s computer system that contained troves of customer information, but not financial data."
They have no motive, no indication of who, or why they did what they did. I agree with posters saying that it's officials throwing out a red herring to get everyone worked up over Russia instead of poor security.
Secure your fucking networks or get off the internet.
I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
"People briefed on the matter" generally equals "deliberate leak, to move public opinion or at least test the waters."
Help save the critically endangered Blue Iguana
And system administrators have to stop acting like implementing security is a bad idea, shouldn't happen, and won't work. You can argue that 'the business' always comes first no matter what. However that doesn't work if 'the business' puts security at risk. If your business is cloned by a foreign competitor your screwed, if your bank accounts drained your screwed, if you really think 'the business' always comes first your wrong. It highly depends on what the risks from being comprised are.
I'm the CEO of a small technology company and I get that security is hard. Hell- I'm not even living up to my own high standards. However its hard to do that when *nobody* else is. Despite that I'm trying to put security first during our web site revamp (the most critical aspect of this company, if our security is hosed in a slow planned manor we'll never recover).
One good example is the 'security' systems (two factor authentication) aren't even well thought out and are done such to be 'cheap' rather than effective. This will only stop the bottom feeders temporarily. It won't stop Russian organized crime from doing live intercepts via botnets to gain access to bank accounts and once the tools are sold to typical criminals the entire system is back in the hands of the criminals. I have nothing against the criminals, and considering that I'm the *primary victim* (100% of the shares, business owner here) when fraud happens I'm in a position where I should be more pissed than anyone (and it happens too often).
But I'm not because the problem isn't the criminals. It's the lack of security and enablement by critical institutions (government and corporate). What I have a problem with is visa, master card, american express, the banks, and the government. They are not implementing the systems we actually need.
1. True security, not halfway crap 'wireless WEP/WPA/WPA2', if your bank's site gets 'hacked' and a known vulnerability w patch exists at the time, then the bank should be shut down, assets seized, etc, none of this proprietary bull shit either. All defaults should be set to off or specifically added to a white list after approval only (on the client side, things like macros, etc).
2. The systems should be built on hardware that there is source code for and audited. BIOS, firmware components, etc. Right now this doesn't even really exist unless we're talking about *a consumer router* or two. Some individual components may qualify as being pretty close to 100% free software friendly and source code available though.
3. Calling a cell phone for authentication is NOT a security measure. It's merely a nuisance for the customer (particularly when the cookies make it such you can steal them and never actually have to authenticate via phone anyway). We need something closer to secure ID /w password (on the secure ID token itself). This would prevent the ability of a middle-man (or make it much more difficult) because the identification number revealed by the token to authenticate can only be used once and you can be confident that the person involved in accessing it did authorize it. Now it won't prevent some attacks where the system is compromised, but you can thwart unauthorized wire transfers by adding a screen that shows information to a wire transfer such that the user has to approve it on the device itself. This way the attacker could not simply show the user a different set of data than the one he authorized by entering the token number during authentication.