Slashdot Mirror
Personal Data For More Than 130,000 Sailors Hacked: U.S. Navy (reuters.com)
Hackers gained access to sensitive information, including Social Security numbers, for 134,386 current and former U.S. sailors, the U.S. Navy has said. According to Reuters: It said a laptop used by a Hewlett Packard Enterprise Services employee working on a U.S. Navy contract was hacked. Hewlett Packard informed the Navy of the breach on Oct. 27 and the affected sailors will be notified in the coming weeks, the Navy said. "The Navy takes this incident extremely seriously - this is a matter of trust for our sailors," Chief of Naval Personnel Vice Admiral Robert Burke said in a statement.
Everything these days going wrong in information security is a 'hack'. Most likely this dude clicked on an advert on CNN and got some spyware installed.
It's not a 'hack' if it involves the user on a Windows machine installing something unsavory.
Custom electronics and digital signage for your business: www.evcircuits.com
Open Source Network Inventory for the masses! Kuwaiba
saw this on /. earlier
I have confidence that I can keep MY computers secure from anything short of a dedicated state sponsored attack, but I am still vulnerable.
Anyone who I give my personal data to is a huge risk. Medical care. Employment. Shopping online. Almost any activity collects such data and these systems are compromised on a regular basis, sometimes with the disclosure of highly sensitive data.
Shit, I don't even trust my doctor's office to secure their infrastructure, but there's nothing you can do., because they will not give you medical care without entering your information into their computer systems.
Well then, at least it could not possibly be data of any significance. Nope, not remotely.
Brought to you by Carl's Junior.
Social Security Numbers need to be defanged. There is no reason they should be considered 'secret numbers' that can be used against a person. It should be totally safe to print your SSN on a t-shirt and wear it in public.
There is no excuse for it being 'dangerous' to reveal your SSN to others. It's not designed to be a 'protected' piece of information and when established, a Social Security Number was intended simply as an index.
Unfortunately, the credit industry seems to think they can use the posession of a person's SSN to extend credit to anybody who has access to it. Because of this, our SSNs have become weapons against us.
It would be easy for us all collectively to take that power of the SSN away from the credit industry. If 10% of all Americans agreed to disclose their SSNs publicly, it would make it impossible and impractical for the credit industry to use the revealing of a SSN to issue credit cards at cash registers in stores, which is, among other conveniences for them, what the 'secrecy of SSNs' is all about.
My dream is that someday enough of us will agree to publish our SSNs that it would become impractical for the credit industry to use it as a 'secret code.' The coolest way for this to happen would be for people to just start writing their SSN on a sign in front of their house, or on the mailbox or something of that nature.
Practically, though, the best way it could happen would be in an all-at-once event, so that the Credit Industry can't use SSNs tricking out as an attack vector on a few people at a time. But with a mix of some sort of 'big release' of SSNs and a trickling out, i.e. people not on the 'big release' revealing their SSNs on a place like their mailbox where it can't be verified en-masse, the use of SSNs as a 'secret number' for credit applications could be nullified.
HP requires its employees to encrypt the HDDs on their PCs.
Wouder what wrong here.
I agree with your post, but I'm just wondering what we could use to prove identity without using SSN. Birthdate is easy to find. Driver's licenses can be faked. Mother's maiden name is easily known by any family members.
It's about a combination of things you know. Ultimately one of those things has to be secret, like a password that you supply and only you know. Your SSN is entirely unsuitable for this.
The idea is you should supply 3-4 items from this list:
Full Name
DOB
Address
Telephone Number
SSN
Driver's License Number
And in addition to that, a secret password that you selected, otherwise, someone finding your wallet on the street has access to everything.
The whole concept of SSNs being secret and used in the US in all kinds of crazy ways always makes me laugh. Sucks to be in the US. On the contrary, the UK goes way too far the other way, asking for all kinds of ridiculous information just to change the billing plan on your cellphone.
Sailors are used to getting backdoored.
Huh? Drivers licenses can be faked by an SSN can't? What kind of absolutely absurd knowledge is that? Your SSN ceases to be secret and personal every time you share it for identification purposes, at least someone needs to put effort into faking a drivers license (and if that is such a big problem then maybe you should change your drivers licenses).
Some countries use a point ranking system which requires multiple documents to establish who you are with multiple characteristics. e.g. in Australia for banking changes (loans, credit, etc) you need 100 points. Documents which are difficult to issue and fake are more valid than others. E.g. A valid passport is something like 50 points. Add a drivers license you get another 35. Also have a credit card, birth certificate, or other government, local council or otherwise issued documentation well that gets you over the line.
Years ago there was talk of a national id. I don't know how practical that was or what kind of security could be built in. What sunk it was the Libretards and Republicans. Naturally, the Christian fundamentalists were against it too, claiming it was akin to tattooing 666-xxx-xxx-xxx-xxx onto everyone. They then went back to pretending security was a warm blanket.
To avoid all identity theft problems we need to do away with all on line, give me this or that bit of your public life to verify it's you.
All these require some form of physical presents.
One solution would be local 'kiosks' to issue a digitally signed certificates, for specific reason, after physical verification of identity. Technology exists, (chain of trust or whatever they use for digital currency). Services paid by whoever requested this verification. In a way it would be a kin Public Notary service in 21 century.
Yes it would be less convenient, but so much safer. Probably a problem for all living out in da boonies...
There are activities that do not accept on-line verification, some I can think of:
1) DMV/ID
2) INS
3) DOS/Passports
4) Hospitals/Doctors
5) Home appraisal (requires physical inspection by certified agent)
6) Public Notary
If we made all CC etc. be by statue responsible for all damages caused be identity fraud, they would have come with solution. Now, they just do not care.
4wdloop
Did grindr get hacked?
If the Navy keep data secure this with its own teams its seen as a big gov going and not supporting the very dynamic and smarter private sector.
When data fails in the hands of the private sector its just part of the American way.
Domestic spying is now "Benign Information Gathering"
AC what did the "NSA and CIA already confirmed that"?
The US gov said it saw that someone in the private sector found old BEAR code that anyone could be using and that a few very different groups accessed very different US networks. Groups using old code that was well understood to be in public hands and that contractors told the media about.
As for this topic AC, the US navy issues?
"compromised" is about the best world to use. No mention of nations or methods AC.."early stages of investigating "...
Not the usual rapid contractor rush out to tell the waiting media about code litter AC.
The question is then was the data unencrypted and why was it facing the internet? Why does the US gov and mil have data facing the intent thats often easy to find and then read?
Domestic spying is now "Benign Information Gathering"
And the world will see you right back.
There's no time like the present. Well, the past used to be.