Slashdot Mirror
US State Department Can't Get Rid of Email Hackers
An anonymous reader sends this quote from a Wall Street Journal report:
Three months after the State Department confirmed hackers breached its unclassified email system, the government still hasn't been able to evict them from the network, say three people familiar with the investigation. Government officials, assisted by outside contractors and the National Security Agency, have repeatedly scanned the network and taken some systems offline. But investigators still see signs of the hackers on State Department computers, the people familiar with the matter said. Each time investigators find a hacker tool and block it, these people said, the intruders tweak it slightly to attempt to sneak past defenses. It isn't clear how much data the hackers have taken, the people said. They reaffirmed what the State Department said in November: that the hackers appear to have access only to unclassified email. Still, unclassified material can contain sensitive intelligence.
Isn't asking the NSA to secure your system like asking the fox to check the barbed wire fence around the henhouse?
...how to get them off of your network, then I don't think I'd trust you to accurately determine what the hackers have and haven't accessed.
Assuming its not actually one of their own employees/consultants helping re-infect the systems maybe one or more of these fairly common situations applies:
* Using Cisco routers with default configurations and firmware that hasn't been updated in years...
* Using unencrypted, plain text authentication for systems instead of public key auth...
* No password strength standards (some employees predictably using "911" or "123456" for their passwords)
* Employees allowed to re-use the same passwords after the supposed "clean sweep"
* Windows filesharing services
* Wireless networking at all, or possibly using WEP or even completely open
* Microsoft office documents from outside sources
* HP printers, or really any network/wifi enabled printers
* That one old Windows XP box nobody is allowed to reformat clean because its "mission critical"
* Employees are allowed to bring in their own laptops/cellphones and other usb/bluetooth/wifi enabled devices
Did I miss anything? Anyone else seen this crap enough times to know the intrusion vector is probably nothing highly advanced or original?
Mr. Laden didn't carry out the attacks himself: he got grunts to it.
Yeah, he conned a bunch of uneducated, down-on-their-luck grunts into abandoning their personal sense of decency and agreeing to kill thousands of people - not because their religious convictions told them it was the right thing to do, but because ... they just couldn't find work?
... that the guys doing that are doing so because they're not happy with the local employment prospects ... that would be really funny if it weren't so dark and just plain evil. Not enough schools? Of course not! These are the people who are dragging the teachers out into the street and shooting them in the head before they burn down the schools. The problem isn't lack of foreign investment, it's cultural rot in the form of their local religion crashing headlong into the rest of the world's more contemporary ways of life. These guys don't want modern jobs, they want medieval jobs.
That must have been the case with "grunts" like Mohamed Atta, right? Totally uneducated. Well, except for going to college to study architecture, and spending time at the Technical University of Hamburg. You know where he met with other poor grunts who could only afford to do things like fly back and forth between Germany and various middle eastern destinations, spend time training in Afghanistan, and so on. He traveled to Spain for some meetings, then - the poor, uneducated, desperate guy! - flew to Maryland, where he met up with fellow grunt Hani Hanjour, then off to other destinations where the fellow grunts were living in various states of perfectly comfortable. They didn't just round up some scruffy guys from some poverty-stricken village in the desert and talk them into this because they had no options. These were people who were dedicated to the world view preached by Bin Laden and their intellectual fellows in the Taliban. Focusing on the leaders IS important, because it's what they say and stand for that thousands and thousands of their compatriots - including those living comfortably in western nations, where they've been educated and employed - find agreeable enough to follow.
This whole notion that the guys running, say, the media production facilities, newsletter operations, and logistics for groups like ISIS as they line up insufficiently hardline Muslims and of course western hostages out of whom they can't squeeze enough cash, and lop off their heads or burn them alive
Don't disappoint your bird dog. Go to the range.
The security hole is likely end users. The software being "tweaked" is probably Word documents pushing Dyreza malware. The issue they face is that if they want to allow Office documents with embedded VBA macros (this is probably heavily embedded in their office workflows), it doesn't matter that they've identified the security hole, they can't close it without making massive changes to how they do business (or significantly change their IT security policies for desktop endpoint use).
Based on the mincemeat the Office macro payloads have been making of everyone's security lately, this is probably all it is. There's probably no targeted hacking going on at all; just a failure to keep up with the latest generic malware attacks, like with almost everyone else. Of course, since the attackers probably realize by this point where they've gotten into, they're going to ensure they stay there by using the same methods.
That said, it could be just about anyone else employing APT methods too -- wouldn't be all that difficult; just more difficult than deploying the already common crimeware packages you can get on the darknet at a discount.