Slashdot Mirror
US State Department Can't Get Rid of Email Hackers
An anonymous reader sends this quote from a Wall Street Journal report:
Three months after the State Department confirmed hackers breached its unclassified email system, the government still hasn't been able to evict them from the network, say three people familiar with the investigation. Government officials, assisted by outside contractors and the National Security Agency, have repeatedly scanned the network and taken some systems offline. But investigators still see signs of the hackers on State Department computers, the people familiar with the matter said. Each time investigators find a hacker tool and block it, these people said, the intruders tweak it slightly to attempt to sneak past defenses. It isn't clear how much data the hackers have taken, the people said. They reaffirmed what the State Department said in November: that the hackers appear to have access only to unclassified email. Still, unclassified material can contain sensitive intelligence.
Isn't asking the NSA to secure your system like asking the fox to check the barbed wire fence around the henhouse?
... or is that 'too nuanced’ of an explanation?
Maybe we just can't clean our way out of these attacks?
Help Brendan pay off his student loans
Does 'Unclassified' is this context mean not yet given a class, or is it the same as 'declassified'?
...how to get them off of your network, then I don't think I'd trust you to accurately determine what the hackers have and haven't accessed.
The US may have to allow more immigrants in order to be competitive with China and perhaps other populous countries in a potential cyber-war. It's more or less a game of man-power. Either that, you siphon techies off of other fields. Maybe the "secret plan" is to send all non-military IT work to India, freeing the rest to be cyber warriors? Our trade deficit will be Jupiter-sized, though.
Table-ized A.I.
Hellooooooooo NSA! Do you like having a taste of your own medicine?
This is the future, people. Hack and counter-hack. Ad infinitum. In other words, bleak and without hope.
The right to offend is far more important than the right not to be offended. (Rowan Atkinson)
Assuming its not actually one of their own employees/consultants helping re-infect the systems maybe one or more of these fairly common situations applies:
* Using Cisco routers with default configurations and firmware that hasn't been updated in years...
* Using unencrypted, plain text authentication for systems instead of public key auth...
* No password strength standards (some employees predictably using "911" or "123456" for their passwords)
* Employees allowed to re-use the same passwords after the supposed "clean sweep"
* Windows filesharing services
* Wireless networking at all, or possibly using WEP or even completely open
* Microsoft office documents from outside sources
* HP printers, or really any network/wifi enabled printers
* That one old Windows XP box nobody is allowed to reformat clean because its "mission critical"
* Employees are allowed to bring in their own laptops/cellphones and other usb/bluetooth/wifi enabled devices
Did I miss anything? Anyone else seen this crap enough times to know the intrusion vector is probably nothing highly advanced or original?
So rather than isolating and repairing the hole they should bulldoze everything and build another one and just hope it doesn't have the same hole? - sound like a government plan to me.
And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.
This article and the PR folks for the government presume or falsely claim there is a different system for unclassified email as classified email. If so, why doesn't the government use the classified methodology for unclassified messages starting tomorrow?
The fact is even the classified system uses about the same hardware and services. It might have some additional encryption, that as we all know have already been breached by "five eyes". Based on what we have seen there are at least six.
[trolling]No, they should bulldoze everything and then install Linux.[/trolling]
replace all your servers with new ones and decommission the old ones.
Nope. Keep the old ones running as honeypots.
Problem is: it's not just the servers. Some of the employees' PCs have probably been pwned. And when they connect to the new servers it starts all over.
Have gnu, will travel.
I had a ROFLCOPTERBBQ and it wasn't just words. The burns are real, bro, the burns are real.
Did I miss anything?
The massive slashdot paradox in this thread? - In other stories the NSA are seen as omnipotent hackers who know more about me than my closest friends, but in this thread they suddenly don't know their arse from their elbow?
And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.
I think its more accurate to say "The left hand does not know what the right hand is doing."
You can justifiably blame the state for lack of opportunity, but there's nobody to blame for a lack of morals other than yourself. And before you ask - I have walked many miles in a poor man's shoes.
And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.
The security hole is likely end users. The software being "tweaked" is probably Word documents pushing Dyreza malware. The issue they face is that if they want to allow Office documents with embedded VBA macros (this is probably heavily embedded in their office workflows), it doesn't matter that they've identified the security hole, they can't close it without making massive changes to how they do business (or significantly change their IT security policies for desktop endpoint use).
Based on the mincemeat the Office macro payloads have been making of everyone's security lately, this is probably all it is. There's probably no targeted hacking going on at all; just a failure to keep up with the latest generic malware attacks, like with almost everyone else. Of course, since the attackers probably realize by this point where they've gotten into, they're going to ensure they stay there by using the same methods.
That said, it could be just about anyone else employing APT methods too -- wouldn't be all that difficult; just more difficult than deploying the already common crimeware packages you can get on the darknet at a discount.
There's no paradox.
When you have a budget of millions of dollars AND practically unrestricted access to everyone's Internet transmissions then it is a lot easier to appear to be "omnipotent" in your ATTACKS.
But DEFENSE is a lot more difficult.
Who are the hackers? The United States Federal Government (NSA, CIA, etc). No mystery. You're biting youself and getting sick; bruch your own teeth. Seriously, the climate of paranoia and total espianage that is Uncle Sam today promotes hacking everyone, including "youself". If the Pentagon is encouraged to hack the German State Department, why shouldn't it hack the U.S. State department while it's at it? Sure, Germany is supposed to be an ally, and the US is supposed to be an ally, but Uncle Sam hacks allies already. If eveywhere, why not here?
Pay the price.
... Manning and Snowden.
It little behooves the best of us to comment on the rest of us.
OR ...
We could make user's desktop computers much, much smarter than the user.
"We're sorry, but our predictive algorithms, which run a shitload of scenarios well into the future, indicate that the action you just chose, like clicking on a link or attachment, is contraindicated and your computer is locked, air-gapped, and nonfunctional in an operative sense and will remain so until IT, who has already been contacted, so there's no need to call, arrives at your location to reinforce your prior security training with a bop on the nose with a rolled up newspaper."
It little behooves the best of us to comment on the rest of us.
The NSA is not charged with defending the government from hackers.
The NSA is fucked up already ... let's not give them more stuff to fuck up.
It little behooves the best of us to comment on the rest of us.
This is the same government we trust with our healthcare data which on the black market is worth much more than verified usable credit card data?
I'm no conspiricay theorist, but as many in government have said "Let no crisis go to waste". I suspect they will use this and other examples to advocate more government control over the internet in the name of "national security". Because regulation will do so much more than hiring people who know how to properly secure a network...
"they're taking a black-list approach, rather than identifying the security hole that the hacker tool exploited in the first place?"
I think everyone is mind numbingly in a thoughtless black-list approach. I used to work security at a college where I would perform application risk assesments, penetration testing, network analysis, and so on. The help desk, for which I was tier 3 (contacted me when they couldnt figure something out essentially), was constantly removing "viruses." I would have to get involved with removal sometimes because I understood the nature of the various malwares and how they would get a foothold in the system. Anyway, after doing this a few times I would talk with the users trying to get an idea of WHERE they got the virus by tracing their browser history and interviewing them. A majority of the time (mostly academic types) thee people were just on popular news sites like MSNBC or whatever. Their browser history often backed up their stories 100% and these people where not in a place to be browsing privately if you know what I mean and they were not savvy enough to clear their tracks anyway. I always felt the root cause was the most important aspect of removing malware but my boss and "colleagues" never gave it a second thought..."oh...you got a virus...lets try to remove it" was the extent of their thought process.
I object to power without constructive purpose. --Spock
US State department cannot get rid of the ultimate hackers and never will -- their rivals for taxpayer dollars at the NSA.
I was not just talking 911, but also Bin Laden's followers in Afghanistan and elsewhere. I feel my position has been twisted to be mostly about 911, when in fact 911 is a drop in the bucket. The education visa issue probably tilts "immigrant" terrorist statistics, as mentioned in a nearby message.
Information on the education and goals of TYPICAL terrorists and extremists is still fuzzy, at least as given here. The above is merely speculation based on an insufficient sample size (including lack of samples from other countries).
Table-ized A.I.
No, unclassified information is NOT necessarily public. There is a lot of stuff US government agencies don't reveal that isn't "classified" as Secret, Top Secret, Confidential or other. Like for example, Privacy Act information (government employees SSNs are one) is NOT public and is NOT classified.