Slashdot Mirror
US Weapons Data Stolen During Raid of Australian Defense Contractor's Computers (wsj.com)
phalse phace writes: Another day, another report of a major breach of sensitive U.S. military and intelligence data. According to a report by The Wall Street Journal (Warning: source may be paywalled; alternative source), "A cyberattacker nicknamed 'Alf' gained access to an Australian defense contractor's computers and began a four-month raid that snared data on sophisticated U.S. weapons systems. Using the simple combinations of login names and passwords 'admin; admin' and 'guest; guest' and exploiting a vulnerability in the company's help-desk portal, the attacker roved the firm's network for four months. The identity and affiliation of the hackers in the Australian attack weren't disclosed, but officials with knowledge of the intrusion said the attack was thought to have originated in China."
The article goes on to state that "Alf obtained around 30 gigabytes of data on Australia's planned purchase of up to 100 F-35 fighters made by Lockheed Martin, as well as information on new warships and Boeing-built P-8 Poseidon maritime-surveillance aircraft, in the July 2016 breach." The stolen data also included details of the C-130 Hercules transport aircraft and guided bombs used by the U.S. and Australian militaries as well as design information "down to the captain's chair" on new warships for Australia's navy.
The article goes on to state that "Alf obtained around 30 gigabytes of data on Australia's planned purchase of up to 100 F-35 fighters made by Lockheed Martin, as well as information on new warships and Boeing-built P-8 Poseidon maritime-surveillance aircraft, in the July 2016 breach." The stolen data also included details of the C-130 Hercules transport aircraft and guided bombs used by the U.S. and Australian militaries as well as design information "down to the captain's chair" on new warships for Australia's navy.
"A cyberattacker nicknamed 'Alf' gained access to an Australian defense contractor's computers and began a four-month raid that snared data on sophisticated U.S. weapons systems. Using the simple combinations of login names and passwords 'admin; admin' and 'guest; guest' "
Wow, much sophistication in the Australian loginname/password scheme,
Australia's "navy" *rolls eyes*
http://www.navy.gov.au/fleet/ships-boats-craft/current-ships
This reminds me of the US patent debate. It is the same type of spying that has been happening since forever, except with "over the Internet" attached. Yes, the Internet makes the remote access attacks easier, but really it is just a different form of the same type has has always existed. Countries have been stealing the weapon plans of other nations, and will continue to do so using whatever mechanisms are available, and no one should be surprised.
Must be an Aeron.
Back in the good old days, spies couldn't sit on their couches in their PJs watching soap operas while their scripts downloaded stuff in the background. They actually had to go out to do their jobs.
Computers make everyone stupid.
Doesn't the DoD audit and require proof of security protocols when handing over Secret information to both domestic and foreign contractors? How could having passwords of admin/admin and guest/guest miss even the simplest of tests?
Pathetic and ridiculous to even classify stuff if this is how they run the show.
I'm just amazed that we have policies that allow the removal of important data and devices from secure facilities outside of specific needs to do so. No one should ever be taking data home with them. It shouldn't even be possible to remove such data in the first place. These environments should be secured and locked down much more so than my high school was back in the 1990s. Yet it doesn't seem as though the government takes security seriously in spite of that being what its sole focus aught to be. There is no other purpose for a military other than that. The military is suppose to protect a country from foreign actors of significant violence (ie other militaries of significance).
Australia is buying 100 F-35 aircraft? That must have been a huge bribe.
Or fast becoming so. Sure, they still appeal to cave-men that like to kill wholesale and make things go "boom". In the actual conflicts to come, they will just be extremely expensive historic artifacts, nothing else. The age of "big weapons" (with small brains behind them) is coming to an end.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
So....he was using Windows? Shocking. You'd think a country within boating distance of communists and extremists would know better. Then again, our paranoid lady of the UK wouldn't have a backdoor.
John Podesta?
'facepalm; facepalm'
I believe that these things occur because of an old mentality amongst the military that is still true on a physical battlefield: "the best defence is a strong offence".
The thing is that, in "the cyber", offence and defence are mostly unrelated. Hacking another country does not stop that country from hacking back.
This leads to the ridiculous situation where the NSA leaves the US government vulnerable so that it can hack Russia.
The real "Libtards" are the Libertarians!
Having protocols and policies in place is one thing, actually adhering to and enforcing them is quite another...
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
I have to wonder, did Alf also eat their winning lottery ticket and try to eat their cat?
The lax security is there because that's better for the people in charge of security. Think. What happens as a result of this? They go to Congress and say, "defense contractors need more funding to develop newer and even better and more powerful and deadly weapons systems to counter the ones we just lost, (which you are still paying for, by the way,) so pour even more money that could be going to SCHOOLS, HOUSING, HEALTH CARE, etc., which of course means more payments for the people at the top, and less for any and everyone else, because otherwise the funding might dry up.
Basically, we're paying for them to come up with ideas that they then let others steal, so they can get paid even more to come up with OTHER ideas, which they will inevitably let someone steal, so that they can get paid even MORE... or maybe not. Maybe I'm wrong but if I were right, ask yourself this: What would it LOOK LIKE?
It would look exactly like this.
One day America will just be a military, and the rest of the nation will be a life-support system for the military, like Sparta, which did fantastically well and lasted forever and that's why the city-state of Sparta is still around today just as it was during its heyday...
Oh, wait... no, Sparta isn't still around, not in THAT sense. Turns out, if you squander your nation's resources on spears and shields and swords, or helicopters, tanks, bombs, and guns... you can't spend it on shit you ACTUALLY NEED.
In the old days, penetration exploits like this would be noticed, as large file transfers flooded routers going to unusual IPs, and someone literally would pull the plug on the router or swap in a honeypot.
Nowadays, there is no such oversight, and the weakest point in any system is any weak point, be it someone not following basic security protocols or the NSA and other groups (there are more than you think) leaving exploit holes everywhere, including in your mouse, keyboard, monitors, and so on.
It's like voting, use paper ballots. In this case, don't outsource weapons research. Don't trust, verify. And keep verifying, use social engineering tests on your "secure" facilities. I used to wait for people to "just go to the bathroom" (easy method: pop up a button cam under a windowsill, motion activate, fixed on door, after a while you pattern match with one on bathroom door, easy to extrapolate.
And never ever trust third party.
-- Tigger warning: This post may contain tiggers! --
"So the combination is... one, two, three, four, five? That's the stupidest combination I've ever heard in my life! That's the kind of thing an idiot would have on his luggage!"
When it said the insanely easy password/login info was that it had to be a temp login. The summary said it had been scanning the network for weeks. Its possible the IT admin was reconfiguring/setting up new equipment or logins and used those combos as a temp. I think a lesson here for us sys admins is even if its a temp login that will be changed in a day or less, you still need to use a decent password because the malware could already be on your network.
yep.
My guess is this was a "false flag" organised by the DSD to force the government into policy changes to make things more secure. Australian government is full of dinosaurs with little or no knowledge of IT and they really make idiotic descions (see the recent fuck up of the NBN).
No sensitive data was lost, and they have released ALOT of info about this breach which is unusual.
Therefore.. I call bullshit.
the folks in charge would be smart enough to put fake docs in places that could be hacked.
But I'm a realist. I look at the hope hand and and see a pile of smelly stuff. I look in the "smart folks" hand and see nothing.
Re "No sensitive data was lost, and they have released ALOT of info about this breach which is unusual"
Every document and file would have had a checksum. The new NSA buddy system and more contractor security than ever would now be in place in 5 eye nations.
Every access down a pipe or tube to any contractor has always been watched. Staff have all their home/work networks watched.
The entry of any intruder would have been detected in real time. The files copied and what was of interest examined.
The code litter of the intruder would have been studied and shared only with the USA and UK.
Nothing would have been said to any politician, the media, any other staff if this had been real.
The ASD would have only shared the results within the NSA and GCHQ. Nobody else has to know about real time intrusion detection or how intrusions are detected and what was found.
A fictional cyber news story for cyber budget growth. New cyber powers is in the media in near real time.
An actual cyber event would take a few more decades to get officially declassified and released.
Domestic spying is now "Benign Information Gathering"
Just how much hacking / stealing / pilfering needs to happen before someone decides the current way of doing business probably isn't the most secure way of doing it ?
Here's a thought:
Quit allowing sensitive / classified data outside of secure networks.
You want access to that data ? Drive your ass into the facility designed to house and secure it. Yes, it's inconvenient. Security usually is.
But it's either that or we may as well just de-classify all of it and mail it to everyone on the planet. Save a lot of trouble.
The most important detail is AWOL in this discussion - none of the data stolen was classified information.
And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.
I hate to dampen anyone's outrage but it wasn't a secret, none of the data stolen was classified.
And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.
Would you stop with these stories? I'm sorry, but if the US systems are run by morons that use admin:admin combo to manage critical systems (just like Equifax), they deserve to die and get replaced. Just fire them already.
Then there's the fact that the more protocols and policies you have, the fewer of them are actually going to be implemented. Good security is just the right amount. Not so little that your passwords are left on default, no so much that no one gets around to changing the default passwords because they're busy checking all the other boxes and figuring out ways to get their work done despite them.
despite the articles insinuation none of that information is considered secret.
Well what do we have
* the stolen information was commercially sensitive rather than “classified” military information.
* the firm was subcontracted four levels down from defence contracts.
In other words a nonevent not worth discussing, but he catchy title and summary are made up to sell it anyway.
My company just got thru installing a new accounting system and there is a separate document handling piece that has its own login. The trainer that trained us on the main accounting piece showed us how to setup security on that software, but never showed us the setup on the Document Handling system. Someone called my extension inside my company asking for access to that system (I knew the person and his job, so I knew he needed access), and I happened to guess the default admin password was 'admin'. SMH & (facepalm). Obviously I made myself admin on the system with my own credentials and disabled the built-in admin acct.
You're messin' with my Zen Thing, man.....
Have they ever considered not storing their U.S. military and intelligence weapons data on a computer connected to the Internet?