Slashdot Mirror
Utah Cyberattacks, Up To 300 Million Per Day, May Be Aimed At NSA Facility
schwit1 writes Five years ago, Utah government computer systems faced 25,000 to 30,000 attempted cyberattacks every day. At the time, Utah Public Safety Commissioner Keith Squires thought that was massive. "But this last year we have had spikes of over 300 million attacks against the state databases" each day: a 10,000-fold increase. Why? Squires says it is probably because Utah is home to the new, secretive National Security Agency computer center, and hackers believe they can somehow get to it through state computer systems. "I really do believe it was all the attention drawn to the NSA facility. In the cyberworld, that's a big deal," Squires told a legislative budget committee Tuesday. "I watched as those increases jumped so much over the last few years. And talking to counterparts in other states, they weren't seeing that amount of increase like we were."
This url apparently shows up frequently in their logs.
http://publicsafety.utah.gov/Hey-man-got-any-gud-NSA-stufz-fix-me-upyo
The article doesn't say. A ping flood? Attempted DOS? Attempt to connect to telnet port?
Sorry, but this guy is clearly exaggerating the number in order to try and get more money. Kind of like when Darryl on The Office wrote on his resume that he had overseen the "shipping of 2.5 billion units of paper material." I.e., pieces of paper.
"Anyone who [rips a CD] is probably engaging in copyright infringement." - David O. Carson
TFA is quite ludacrisly sensational. Lemme fix that for you.
Cyberattacks == script kiddie spam
Hackers == no talent ass clown skiddies
How do they define "Cyber Attack"? My home firewall fends off thousands of "cyberattacks" every day if you include port scans, and my webserver gets hundreds more vulnerability probes.
I think this summary was longer than the article itself. I was hoping to find what they consider as a 'cyber attack'. Do they count failed attempts at logins, port scans, pings...? Knowing how ignorant even some IT workers are, I could imagine many of those numbers are not actual 'attacks'. But hey, it sure sounds scary to mom and pop.
The US govt illegally spying on its own citizens is a big deal in the real world too.
Sounds like a mid level IT manager needs an increase in his budget. Because, Hey, NSA!
What exactly constitues a cyberattack? Does it count if I ping one of their IP addresses and get dropped on the firewall?
Microsft spel chekar vor sail, worgs grate !!!
Did anyone realize that the buildings in Utah were built to be seen as the public facade of the NSA? Did anyone look inside?
The real facility is underneath the Bellagio in Las Vegas.
...with criminals (the NSA).
--CF
The proximity means the NSA is constantly hacking the node loops scouring the local name servers for people positioning themselves to fuzz or intercept NSA out and in loops. Their manifesto is "it is better to be the hacker than the hackee" so are being proactive in tying up all extra server cpu cycles.
if i dumped a gallon of water on your head, you wouldn't say i dumped water on your head 768 times.
Good.
The world got a glimpse of what information the NSA has in its databases with the Snowden revelations. Think that was it? Hardly. We can't even imagine what they might have and how valuable the data could be to rival nations. But if you think those rival nations are going to wait for Snowden Part 2...think again.
So, NSA, this is what happens when you decide to collect anything and everything without regard to the consequences of storing such information.
It's just the metadata for a DDoS attack, not an actual attack. Nothing criminal about it.
Inheritance is the sincerest form of nepotism.
"hackers believe they can somehow get to it through state computer systems. "
The article makes it sound like the folks doing this are idiots. However, if you really wanted to be a significant thorn in the side of the NSA, would you really attack them directly knowing those systems would be some of the hardest targets on the planet ?
Or perhaps go after some of the potentially easier targets such as the power grid or water control systems that feed a particular site ?
That mammoth data center and all the super-computers within it won't be doing a damn thing if you shut off the water supply required to cool it. Ditto for the electricity, though they likely have back-up power, I doubt it's sufficient to run the entire site non-stop for extended periods of time.
Sort of the whole " Why try to kick down the armored door if a glass window is available to you ? " sort of thing.
If the data center has to store all of our private information, why is it available on the internet to be attacked? Storage units should be for storage, I don't care if you have to truck in station-wagons full of tapes. One misstep followed by another, apparently.
At least it serves as a honeypot, absorbing attacks, keeping the internet safe for people who respect the U.S. Constitution.
https://www.youtube.com/c/BrendaEM
These kinds of attack numbers are routinely paraded around in hearings attended by lawmakers on security issues. From expressed concerns and lack of follow-up tactic seems to effective although I would imagine there must be a shelf-life.
Interesting remaining argument for why they deserve money from NSA rests on invocation of specific incidents involving identity theft and local incidents of crime having nothing to do with NSA activities.
Tell the NSA to GTFO of Utah, and see if the number of attacks decreases.
If you have a million public IPs, you catch about 3 million attacks every time somebody messes around with Z-Map or MasScan. They always try it at least 3 times. That is 1% of that scary 300 million per day total. And there are a lot of people in the world playing with Z-Map.
I do IT Security for Utah State University. We are at the North end of the state. We see about 3k PPS of attack all the time. We have 128K of public IP address space. Most days, we are at about 300K PPS at the border. 3K PPS of attack is about 1% of the total. Having 1% attack be incoming packets is normal for the last few years for us. This works out to about 1 attack packet per IP address every 30 seconds. Of course, almost all of them are rejected at the border. Most of my peers are seeing the same attack levels. But, all my peers are at universities.
However, In the last couple years the attack has shifted. Now, about 1/2 of our detected attack is sponsored or condoned by the Chinese government. The rest is evenly divided between other governments and organized crime. We assume that this shift is the inevitable consequence of the current cyberwar. The shift has also made it easier to do most attribution. Almost all attack by civil servants is easier to identify. It is predictable. It follows patterns. It has preferential quality of service. When you report abuse from a non-government attacker, it shifts methods, or stops, or moves to another target. When you report abuse to a government attacker, it increases. Sometimes it improves.
The shift in attack may be local to Utah and due to the NSA facility, but I think it is more likely that we are all screwed.
It could also be in relation to the number of Marvel movies made or ice cream consumed per capita. Do they have any evidence to back up their correlation?