Slashdot Mirror
US Army Website Hacked By Syrian Electronic Army
swinferno writes: On Monday afternoon, the Syrian Electronic Army claimed on Twitter to have successfully hacked the website of the United States Army, army.mil. Various screenshots that appeared on Twitter reportedly showed pro-Assad propaganda on the site before it crashed. "Today an element of the Army.mil service provider's content was compromised. After this came to our attention, the Army took appropriate preventive measures to ensure there was no breach of Army data by taking down the website temporarily," spokesman Brig. Gen. Malcom B. Frost said in a statement.
https://xkcd.com/932/
I guess you can tell the ambition of an attack based on how obvious it is.
When the Syrian Electronic Army hacks a website, they simply vandalize it and make a lot of noise. When someone else, say the Chinese government, hacks a web address, they ignore the front pages altogether and go straight for the data centers. Way more discrete, way more dangerous.
I could make a fart analogy out of this. So I will.
The silent ones are the ones you need to fear.
seems to be similar policy. Manning should have never been able to use a USB stick on an Army system. Snowden should have never been given so much access to various systems. These "failures" are the fault of the organization, not the individuals. The concept of "compartmentalization" exists for a reason. Personally I am glad both people were able to do what they did...but with proper security in place this would have never happened.
Really? Is hacking the US gov. still a thing?
Don't be apathetic. Procrastinate!
I think that the damage to USA is very much over-exaggerated. So, the article says, that the informational gate to one of the websites has been messed up for some time.
So here is the prospective: if 50 years ago some some villages boys would have desecrated the entry of the US military base by peeing on the gates, or dropping a dead animal, nobody would care.
Same with the desecration of US website. The readiness and combat abilities did not decreased at all.
Oh good job, Captain Hindsight! You are absolutely right! Manning should have never been able to use a USB stick [takes notes]. Also Snowden should have never been given so much access [takes notes].
"...this would have never happened."
Oh excelsior! Your powers of observation and hindsight deduction are without compare. Between that and your three split infinitives all I can say is BRAVO, SIR, BRAVO! You truly have your finger on the pulse of ... everything that's that wrong.
Forbidding portable media didn't work well in the days of the floppy disk, and doesn't work now. Much better to talk to people, make sure no one has a justifiable grievance against an immediate supervisor. If someone sees something to blow a whistle about, give them a way to do so that isn't so damaging and doesn't have a bunch of organization men conflating treason to the nation with refusal to look the other way when they lie and cheat. We should be grateful to whistleblowers, not treat them with suspicion.
The first line of defense is not to make enemies in the first place. That goes for other nations as well as insiders.
Intellectual Property is a monopolistic, selfish, and defective concept. It is "tyranny over the mind of man"
In the early days of the rebellion, there was hope that moderates would rise up, and turn Syria into a moderate Republic. However, the CIA could not find enough militant moderates. Branches of al qaeda in Syria and Iraq have since taken over the rebellion. al qaeda in Iraq broke off, and became ISIS. al qaeda in Syria is still on good terms with al qaeda HQ, and is now called Nusra Front. The moderates don't care if al qaeda conquers Syria. They want Assad dead. So does the European media.
I bet ten hard drives that the Army hacked it's own site and blamed it on Syria for propaganda reasons. Any takers?
- A Frog in a pond utters an azure cry. -
You think with all the nonsense that happens here, someone would have taken offense and hacked into the /. servers.
I've taught computer security and web application security at an undergraduate level, and I can tell you that this is just not true. Now, its possible you can have foreclosed all the most obvious direct methods of breaking into your system. You've closed every possible content injection hole, you've configured the network such that even if someone started a rogue process on your machine it couldn't talk to anything outside your network, you've locked down every file using SELinux rules so no process exposed to any outside influence can write to any file whatsoever. Great, that's all wonderful!
Now, are all the other systems on your network, even the appliances and your connectivity providers routers all 100% secure? No? Gosh, now I've defeated the network origin based aspects of your setup. Now, is the IPMI properly secured on the physical server your instance is running on? Is the VMWare hypervisor unhackable? Could I get into the management infrastructure (maybe through an insecure operator workstation, etc) and say create an instance of my own that I can use to leverage an attack on that hypervisor? Or maybe I can just poison the image you use and force VMWare to restart your instance. Once I'm on your network, eventually I own you. I don't care what you do, I WILL own you. If its worth my time and energy to own you then I will. And all of the suggestions above? Those are the HARD way to do it. As the Chinese have amply shown you can ALWAYS count on human weakness. You can spearfish someone, etc, own their machines, get their ssh keys, run APTs on their system that can spread through a network by means you don't even know exist.
There are basically 2 things you do. First you do what you're doing, its not valueless, its just that all it does is keep out the riffraff. It makes you uninviting to the casual, inept, and poorly resourced threats. That allows you to concentrate on the REAL threats. Next you analyze your assets and determine which things are most valuable to protect. You can now determine what might be viable pathways for an attacker to get to those things. You can now use active defenses, monitoring and threat response systems to make attacks on those things so difficult and expensive that they're just not economically worth it. There still might be some insane guy that won't quite and he'll beat you perhaps, but that's life. No Russian mobster or Chinese corporate hack will bother, its not cost-effective to them.
And that is the key point, static defenses, as good as you may make them, are worthless. You wouldn't defend a ton of gold by just locking it in a safe. A safe is great, but if I can stand in front of that safe for a week its GOING to fail. You must have active defenses, guard dogs around the safe, watchmen that can catch intruders, etc. Likewise, you need active defenses. Not only do they (hopefully) detect intrusions, but they at least allow you after the fact to narrow down what happened, find out which files the bad guys got, which machines they accessed, etc. They are both security AND mitigation methods, and they're the most important things. Even the simple ones, running some sort of file system integrity checker on each server and keeping track of the results, etc.
There's a LOT more to security than write protecting all your files and such. You can NEVER lock down everything and the attack surface of your machine always extends beyond the reach of any single sysadmin.
"Malo periculosam, libertatem quam quietam servitutem." -- Jefferson