Slashdot Mirror
Personal Data For More Than 130,000 Sailors Hacked: U.S. Navy (reuters.com)
Hackers gained access to sensitive information, including Social Security numbers, for 134,386 current and former U.S. sailors, the U.S. Navy has said. According to Reuters: It said a laptop used by a Hewlett Packard Enterprise Services employee working on a U.S. Navy contract was hacked. Hewlett Packard informed the Navy of the breach on Oct. 27 and the affected sailors will be notified in the coming weeks, the Navy said. "The Navy takes this incident extremely seriously - this is a matter of trust for our sailors," Chief of Naval Personnel Vice Admiral Robert Burke said in a statement.
Everything these days going wrong in information security is a 'hack'. Most likely this dude clicked on an advert on CNN and got some spyware installed.
It's not a 'hack' if it involves the user on a Windows machine installing something unsavory.
Custom electronics and digital signage for your business: www.evcircuits.com
Add this to all the murder and drunk driving death stories in the news today. What a time to be alive.
and managed to get spyware/malware on it, but of course it's convenient to say they were "hacked", and as is usually the case, blame it on "Russian hackers". They say they take the incident very seriously, now if they had only taken security as serious as well...
Open Source Network Inventory for the masses! Kuwaiba
saw this on /. earlier
I have confidence that I can keep MY computers secure from anything short of a dedicated state sponsored attack, but I am still vulnerable.
Anyone who I give my personal data to is a huge risk. Medical care. Employment. Shopping online. Almost any activity collects such data and these systems are compromised on a regular basis, sometimes with the disclosure of highly sensitive data.
Shit, I don't even trust my doctor's office to secure their infrastructure, but there's nothing you can do., because they will not give you medical care without entering your information into their computer systems.
Well then, at least it could not possibly be data of any significance. Nope, not remotely.
Brought to you by Carl's Junior.
Social Security Numbers need to be defanged. There is no reason they should be considered 'secret numbers' that can be used against a person. It should be totally safe to print your SSN on a t-shirt and wear it in public.
There is no excuse for it being 'dangerous' to reveal your SSN to others. It's not designed to be a 'protected' piece of information and when established, a Social Security Number was intended simply as an index.
Unfortunately, the credit industry seems to think they can use the posession of a person's SSN to extend credit to anybody who has access to it. Because of this, our SSNs have become weapons against us.
It would be easy for us all collectively to take that power of the SSN away from the credit industry. If 10% of all Americans agreed to disclose their SSNs publicly, it would make it impossible and impractical for the credit industry to use the revealing of a SSN to issue credit cards at cash registers in stores, which is, among other conveniences for them, what the 'secrecy of SSNs' is all about.
My dream is that someday enough of us will agree to publish our SSNs that it would become impractical for the credit industry to use it as a 'secret code.' The coolest way for this to happen would be for people to just start writing their SSN on a sign in front of their house, or on the mailbox or something of that nature.
Practically, though, the best way it could happen would be in an all-at-once event, so that the Credit Industry can't use SSNs tricking out as an attack vector on a few people at a time. But with a mix of some sort of 'big release' of SSNs and a trickling out, i.e. people not on the 'big release' revealing their SSNs on a place like their mailbox where it can't be verified en-masse, the use of SSNs as a 'secret number' for credit applications could be nullified.
No doubt Russia was behind the hack, again, seize Russian assets to pay for the cleanup and re-securing of the servers. Putin had $2 billion in Panama bank accounts, we know this from the Panama leaks. That money is easy to grab. So go grab it.
Same with the recount for the hacked swing states, that will cost a few million $$$. We know Florida and many others had their election rolls hacked, and an unnamed election machine maker had their servers hacked.... and likely quite a few other hacks yet to be discovered.
Those voting paper trails need to be checked, it costs money to do that, Russian state hacker did that, NSA and CIA already confirmed that, so go seize Putin's cashpile in Panama to pay for it.
And do it before Trump tries to stop it, because he also had Panama accounts, and he benefitted from those hacks, and he provided political cover for Putin's hackers. So he has big reasons to cover for those foreign hijack of the election.
hooray for M$ Windoze...
The last 5 or 6 major breaches/spillages of sensitive/PII/FOUO information in the DoD were either directly caused by IT contractors or from IT contractor maintained systems. Be it HP, DT, BA, SAIC, or CSC. Most of my IA department's arguments are not about security of government systems, they are about the security of the contractor systems and why WE the government employees should be controlling those networks.
Enough said. Business as usual for the most insecure OS ever.
My bad on the spelling.
found three common factors: rum bum and baccy
The problem is, that horse is out of the barn and has left the coral and far down the road. No amount of recrimination will fix it. The system needs to be overhauled completely, with complete reissue of a new style SSN and the banking industry coming up with a separate and new system of positive ID.
I agree with your post, but I'm just wondering what we could use to prove identity without using SSN. Birthdate is easy to find. Driver's licenses can be faked. Mother's maiden name is easily known by any family members.
Meh. just give 'em free lifetime identify theft protection. They'll be PROTECTED FOR LIFE GODDAMIT! So what exactly is the problem?
It's about a combination of things you know. Ultimately one of those things has to be secret, like a password that you supply and only you know. Your SSN is entirely unsuitable for this.
The idea is you should supply 3-4 items from this list:
Full Name
DOB
Address
Telephone Number
SSN
Driver's License Number
And in addition to that, a secret password that you selected, otherwise, someone finding your wallet on the street has access to everything.
The whole concept of SSNs being secret and used in the US in all kinds of crazy ways always makes me laugh. Sucks to be in the US. On the contrary, the UK goes way too far the other way, asking for all kinds of ridiculous information just to change the billing plan on your cellphone.
Or like a Windows Defender: strong and bold letters hide luke-warm amateur walled-protection with juicy soft and tender innards.
Sailors are used to getting backdoored.
Huh? Drivers licenses can be faked by an SSN can't? What kind of absolutely absurd knowledge is that? Your SSN ceases to be secret and personal every time you share it for identification purposes, at least someone needs to put effort into faking a drivers license (and if that is such a big problem then maybe you should change your drivers licenses).
Some countries use a point ranking system which requires multiple documents to establish who you are with multiple characteristics. e.g. in Australia for banking changes (loans, credit, etc) you need 100 points. Documents which are difficult to issue and fake are more valid than others. E.g. A valid passport is something like 50 points. Add a drivers license you get another 35. Also have a credit card, birth certificate, or other government, local council or otherwise issued documentation well that gets you over the line.
That is a surprising number of Navy LGBTQs using the same escort and prostitution service.
Must have been an accounting and billing audit.
Years ago there was talk of a national id. I don't know how practical that was or what kind of security could be built in. What sunk it was the Libretards and Republicans. Naturally, the Christian fundamentalists were against it too, claiming it was akin to tattooing 666-xxx-xxx-xxx-xxx onto everyone. They then went back to pretending security was a warm blanket.
To avoid all identity theft problems we need to do away with all on line, give me this or that bit of your public life to verify it's you.
All these require some form of physical presents.
One solution would be local 'kiosks' to issue a digitally signed certificates, for specific reason, after physical verification of identity. Technology exists, (chain of trust or whatever they use for digital currency). Services paid by whoever requested this verification. In a way it would be a kin Public Notary service in 21 century.
Yes it would be less convenient, but so much safer. Probably a problem for all living out in da boonies...
There are activities that do not accept on-line verification, some I can think of:
1) DMV/ID
2) INS
3) DOS/Passports
4) Hospitals/Doctors
5) Home appraisal (requires physical inspection by certified agent)
6) Public Notary
If we made all CC etc. be by statue responsible for all damages caused be identity fraud, they would have come with solution. Now, they just do not care.
4wdloop
Did grindr get hacked?
Is making a website of DMV information that is push-only (recieves one way batch processed new information daily) with cryptographically signed records for each resident with a rewritable verification code on the card (either digital or some sort of rewritable/replacable label so it can be updated periodically at the DMV to keep unauthorized/previously authorized individuals from snooping on your personal information.
It would take some work to set up, but it would provide 'reissued credit card' level of security without the costs associated with replacing the physical card, only the authorization token and a freshly signed copy of the data.
Not Russian hackers? what absolute nonsense everyone knows that the only people in the world who know how to hack are Russian.
Awwwww man looks like I'm getting another letter from the DOD
And the world will see you right back.
There's no time like the present. Well, the past used to be.
Why was this information on a laptop in the first place??? Sensitive data is required to be stored on a secure server NOT! on a friggin laptop. PLEASE! go read and put in place your NIST regs.