Slashdot Log In
Unisys Investigated For Covering Up Cyber-Attacks
Posted by
kdawson
on Tue Sep 25, 2007 01:49 AM
from the whadda-ya-know-a-trojan dept.
from the whadda-ya-know-a-trojan dept.
Stony Stevenson writes "Unisys, a major government IT contractor, is reportedly being investigated for failing to detect cyber-attacks, and then covering up its failings. Two US congressmen have called for an investigation into cyber-attacks aimed at the Department of Homeland Security, along with a contractor (that would be Unisys) charged with securing those networks. 'The House Committee on Homeland Security's investigations led them to believe the department is under attack by foreign powers, and could be at risk because of "incompetent and possibly illegal activity" by a US contractor. The congressmen didn't name the contractor in the letter. However, the Washington Post on Monday reported that the FBI is investigating Unisys, a major information technology firm with a $1.7 billion Department of Homeland Security contract, for allegedly failing to detect cyber break-ins traced to a Chinese-language Web site and then trying to cover up its deficiencies.'" Unisys denies it all.
Related Stories
[+]
Technology: China Taking on U.S. in Cyber Arms Race 262 comments
Pabugs writes with a CNN story about an uncomfortable development in world politics and information technology. According to General Robert Elder, an Air Force military man setting up a 'cyber command' in Louisiana's Barksdale Air Force Base, the nation of China is already in the process of developing their own 'cyber warfare' techniques. While Elder described the bulk of China's operations as focusing on espionage, they and others around the world have more serious goals in mind. "The Defense Department said in its annual report on China's military power last month that China regarded computer network operations -- attacks, defense and exploitation -- as critical to achieving "electromagnetic dominance" early in a conflict. China's People's Liberation Army has established information warfare units to develop viruses to attack enemy computer systems and networks, the Pentagon said. China also was investing in electronic countermeasures and defenses against electronic attack, including infrared decoys, angle reflectors and false-target generators, it said."
[+]
800 Break-ins at Dept. of Homeland Security 276 comments
WrongSizeGlass writes "Yahoo is reporting about the computer security nightmare going on at the Department of Homeland Security. Senior DHS officials admitted to Congress that over a two year period there were 800 hacker break-ins, virus outbreaks and in one instance, hacker tools for stealing passwords and other files were found on two internal Homeland Security computer systems. I guess it's true what they say ... a mechanic's car is always the last to get fixed."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
One Million Dollars. (Score:3, Funny)
No.2: Ahem...well, don't you think we should maybe ask for *more* than a million dollars? I mean, a million dollars isn't exactly a lot of money these days. Unisys alone makes over one million dollars a year!
Dr. Evil: Really?
No.2: Mm-hmm.
Dr. Evil: That's a number. Okay then. We hold the Department of Homeland Security ransom for.....One Point Seven BILLION DOLLARS!!
Re: (Score:2)
Have you seen Unisys' quarterly reports recently? I'm not quite sure that's the case.
(joking. They still make a ton of money. Just not as much as they need to support themselves.)
Incompetence on both ends (Score:3, Interesting)
Yes, Unisys may have screwed up, but then again, its all about the better mousetrap and all...
Re: (Score:3, Informative)
Re: (Score:3, Insightful)
Security is actually the quest for the better mousetrap. The problem is, as soon as you have it, you get to
Re: (Score:2)
Re: (Score:2)
What I blame is the way contracts are. A contract specifies what is to be done, and a company will do that, to the point, and not an inch more. There is some regulation, written more than a year ago (in security terms, somewhere in antediluvian times), and that regulation is upheld. Why or for what, nobody cares.
And unless that attitude towards security, or any procedure,
Re: (Score:2)
Some security rules or procedures are drafted and never reviewed.
E
Re:Incompetence on both ends - Gov't BS (Score:3, Insightful)
"Sir, there appears to be atta
Re: (Score:2)
Page 2? (Score:2, Informative)
Here is page 1 anyway: http://www.washingtonpost.com/wp-dyn/content/article/2007/09/23/AR2007092301471.html?nav=rss_business [washingtonpost.com]
Re: (Score:3, Interesting)
Cyber (Score:3)
Well... (Score:4, Insightful)
Damn (Score:2)
Re: (Score:3, Insightful)
Re: (Score:2)
Re: (Score:2)
Typical govt C&A hokum (Score:5, Interesting)
Re:Typical govt C&A hokum (Score:4, Informative)
Far more money gets spent on documenting that the system works correctly than actually making the system work correctly. Often you end up with a system that looks great on paper that has lots of bugs in actual operation. Lots of tests get written that look like they test something but which rarely uncover bugs. The whole exercise costs a fortune, and largely exists to satisfy auditors (whether internal or external to the company performing the exercise).
Techniques like agile programming, automated testing, code reviews, etc are shunned because they're non-traditional and don't generate lots of paper. There is a fear that in an audit a government representative who hasn't signed on to the methodology might hammer you to death over not having a 2000 page design specification and a load of tests written and executed by everybody from the programmers, to IT QA, to end users (often the same exact test gets reformatted and run by all parties just so that it can be said that everybody had a hand in testing).
I once had to evaluate whether it was safe to directly modify a particular database field in an application, and was relieved to see that this application had one of those aforementioned thick design specifications. Then I was dismayed to find out that the only documentation there was on the field was the fact that it existed, what table it was in, what it was called, what kind of field it was, and what it contained (WidgetCorrectionFactor = Factor used to Correct the Widget value - really helpful as if I couldn't have guessed that much from the field name!). Absent was any kind of documentation as to what code might reference that field or what tables might join to it. I could search the source for the field name, but then there wasn't any kind of documentation or flow charts indicating the typical system workflow or in what order the various routines might get called. It was like documenting all the cell types in an animal without bothering to indicate what the actual animal looked like and how everything went together. But the auditors loved the document.
The issue is that most often QA and management and external auditors have no way of knowing whether a piece of code actually works or not. So, instead they look for stuff they can understand - paperwork. The paperwork does tend to lead to some basic form of quality, but rarely does it lead to code that doesn't break down on all the various one-off-cases that don't make their way into human-executed tests. I'll take a simple automated test that can be executed against a matrix of input values against a complex human-executed test that only ever gets run once (and is likely not repeated every time a piece of seemingly-unrelated code is touched) any day!
Parent
Re: (Score:3, Funny)
"Configuration Management is a serious engineering discipline!"
Unysis (Score:2, Interesting)
Re: (Score:2)
Well, (Score:2)
Re: (Score:2)
Appearantly they mean whoever wants to hack their customers and not their customers with that statement, but you can't say that they're lying.
Unisys? (Score:3, Funny)
They Have the Way Out!(TM)
Dan Quayle's DEA record? (it's the coverup) (Score:2)
As
1.7 billion (Score:3, Funny)
What I want to know is what the hell could cost 1.7 billion dollars? Are they putting HA systems with redundant fiber channel SANs on every desktop? How big is the DHS? If were talking even 100,000 people that's over $17,000 per person in IT costs. For that kind of money they should have had big time segmentation with all kinds of traffic monitoring and IDSes along with honeypots and tarpits. Hell, for that kinda money I would even include fart detectors.
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
For reference, see SOX.
And in any case... (Score:3, Informative)
FWIW, Unisys didn't exist in the seventies. I was there. I worked on both types of kit (in those days you either went with the herd and learned to use IBM, or you learned to be versatile).
IIRC it came about via the merging of Burroughs and Sperry/UNIVAC in about 1986 (in fact, to be specific, I think Burroughs swallowed Sperry).
Re:Typical unisys (Score:5, Interesting)
This is a big part of the problem. The vast majority of Government Contractors are only marginally qualified and got their jobs by having the clearance, not by being technically proficient. This is known as "warm bodies" syndrome since many contracts pay per position filled. Getting a clearance can take years, depending on the level, and usually takes months, so this is a high barrier to entry and keeps a lot of smart people out.
There are many very capable and well-qualified people in Government Contracting, but they are a minority. Of course, Management, being what it is, doesn't want to give bad news to a customer, so sometimes they "muddy the waters".
Parent
Re: (Score:2)
Re:Typical unisys (Score:4, Informative)
Parent
Re: (Score:2)
Re: (Score:3, Interesting)
I know this, because I worked for IBM in a government data center at the time. We handled the big iron (oddly enough, including some machines from Sun and some ancient AS/400s) and the Unisys flunkies did operations and tape library stuff (cartridge and reel to reel). DOT, IRS, etc stuff. Believe it or not, they had PCs in there running Win95 and NT4 with no egress filtering to the internet... There were qui
Re: (Score:2)
Re: (Score:2)
Sometimes yes, sometimes no. I'm a former full-time employee of Unisys, and used to do pre-sales architecture and systems engineering for them. On one particular contract we worked on, there were a couple of us full-timers to do architecture, another to handle the PM angle, several short-timers to do write code and DBA work, and a couple of outsourced coders.
Also, a PM outsourced from our Indian contractor.
Re: (Score:2, Funny)
I fart in your general direction !
Re: (Score:3, Informative)
circle of competitors and those competitors rehire most of the people who were on the contract.
In fact that is so common you usually take your tenure / seniority with you to the
next company. When a contract changes hands, it really means the management layer
and the interface between management and the government is being changed. Workers
by and large keep their jobs.
Re: (Score:2)
How did "never made it out of the seventies" and "probably outsourced... to india" make it into the same post? Might I recommend you read and/or watch The Commanding Heights by Daniel Yergin?
http://en.wikipedia.org/wiki/Commanding_Heights:_The_Battle_for_the_World_Economy [wikipedia.org]
Re: (Score:2)
Out-of-country non-nationals are not about to be supporting contracts to DoD or DHS that require security clearances.
Re: (Score:3, Informative)
Re: (Score:2)
Re: (Score:2)
If I could get her to lie about her age I swear I'd rent her out as a consultant. She can evrn make the VCR stop flashing 12.
Come to think of it I'll paypal anybody $5 who can show me a picture of a vcr flashing 12 inside Unisys.
Re: (Score:3, Insightful)
On the other hand, classified data can include material that people CAN find out from their own observation if they happen to be in the right place at the right time. Like whether a particular vessel is in a particular location... individual o
Re: (Score:2)
I don't know. You don't know, either.
Not all data on government systems belongs to the government. Some of it is proprietary information owned by private individuals and institutions and licensed or otherwise made available to the DHS (for a rather obvious example to prove my point, Windows is licensed from Microsoft, you can't get a copy of Windows for the price of a FOIA request).
Re: (Score:2)
By itself or in normal amounts or normal handling, Unclassified has no impact on nat'l security. Nat'l security has nothing to do with what *the*company* considers important. Examples: almost all contractor's business info that doesn't overlap class. stuff, source code to company tools, blue
Re: (Score:2)
Federal law-enforcement officials said the FBI was taking a look at the incidents -- and Unisys's response -- but said the allegations were so far not viewed as a major breach of national security. "The FBI is making sure that this was not something out of the ordinary," one official said, noting that attempts by hackers to infiltrate U.S. government computers are "everyday occurrences.
Good point (Score:2)