Slashdot Log In
Pentagon Hid Magnitude of Data Loss From Recent Breach
Posted by
Soulskill
on Fri Mar 07, 2008 11:18 PM
from the it's-just-a-flash-wound dept.
from the it's-just-a-flash-wound dept.
blueton tips us to a brief story about recent revelations from the Pentagon which indicate that the attack on their computer network in June 2007 was more serious than they originally claimed. A DoD official recently remarked that the hackers were able to obtain an "amazing amount" of data. We previously discussed rumors that the Chinese People's Liberation Army was behind the attack. CNN has an article about Chinese hackers who claim to have successfully stolen information from the Pentagon. Quoting Ars Technica:
"The intrusion was first detected during an IT restructuring that was underway at the time. By the time it was detected, malicious code had been in the system for at least two months, and was propagating via a known Windows exploit. The bug spread itself by e-mailing malicious payloads from one system on the network to another."
Related Stories
[+]
Chinese Military Hacked Into Pentagon 405 comments
iFrated informs us of a successful penetration of US Defense Department computers by the Chinese military last June. From the article: "The Pentagon acknowledged shutting down part of a computer system serving the office of Robert Gates, defense secretary, but declined to say who it believed was behind the attack. Current and former officials have told the Financial Times an internal investigation has revealed that the incursion came from the [Chinese] People's Liberation Army. One senior US official said the Pentagon had pinpointed the exact origins of the attack. Another person familiar with the event said there was a 'very high level of confidence... trending towards total certainty' that the PLA was responsible." The PLA is also accused of breaking into German government computers, including a network in the office of the Chancellor.
Submission: Pentagon hides actual data loss in recent breach. by Anonymous Coward
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Windows strikes again. (Score:5, Informative)
The DoD doesn't need Windows, we need bunkers.
Re:Windows strikes again. (Score:4, Insightful)
It's also apparently to the point that the US government ought to consider dropping Windows entirely.
That, or maybe we should all just set our login names to Bejing and the password to China. Just let them have the run of anything we have of value.
Running Windows just slows them down a little. A very little.
Parent
Re:Windows strikes again. (Score:5, Insightful)
Parent
Re:Windows strikes again. (Score:5, Interesting)
2) Decent firewall alerting you to connections to chinese IP space,
Duhh.. these guys weren't amateurs. They wouldn't have been communicating directly with the compromised hosts. There'd be like three or more hops of compromised boxes between them and the Pentagon. Not to mention that the intrusion might have originally been thanks to a viral botnet where the controllers recognized some interesting IPs within their herd. Then used the command-control structure to issue specific commands to those boxes to further infiltrate the Pentagon. Probably was always outbound connections uploading data and grabbing new marching orders (encrypted in both cases).
Seth
Parent
Re: (Score:3, Insightful)
Why would you? I doubt they'd be out selling access to their network to spammers. We're talking about military espionage here after all.
Broken management (Score:4, Insightful)
Their network admins should be fired on the spot, that's ridiculous.
Yes it is ridiculous and someone should be fired.
But why does everyone go after the grunts and not the department heads? After all it is the department heads to allocate the money and resources to do such things as watch the network.
The local admin might be over worked, under trained, understaffed and no hardware to accomplish this task. Don't be so quick to pounce on the network person. This is a management issue pure an simple.
Parent
DoD Security knows all, does all, is all BullShit (Score:3, Insightful)
DoD has bought into Alpha-security (A-Sec). A-Sec is when all things are controlled by being identical or bunker-consolidated.
It is like a single point of failure looking for a place to happen. Someone once told me (or I read) about the blackberry network with one or two critical nodes (points of failure/attack/access). MS-products on most all DoD desktops is another single node. Server/Network help-desk-script Admin is another node. Things done the same way
Re:DoD Security knows all, does all, is all BullSh (Score:3, Informative)
It really does make what the NSA were doing look very suspicious and s
Re: (Score:3, Insightful)
Re:Windows strikes again. (Score:4, Funny)
Parent
Re: (Score:3, Interesting)
With the firewall exception Windows does some with the IDS you are referring to. Network monitoring is deeply ingrained and has no trouble reporting to a syslog server. The problem is the effort it takes to setup a proper IDS so that it doesn't overwhelm you with false-positives which is really the same with any IDS package. Microsoft likes the basic approach that comes with Windows and then the advanced approach they get through their Operations Manager software. Of course now it's being rolled and merged
Re: (Score:3, Insightful)
Re: (Score:3, Interesting)
Re:Windows strikes again. (Score:5, Interesting)
Parent
Hmm... (Score:4, Funny)
Re:Hmm... (Score:4, Funny)
Parent
Is this supposed to be some sort of scandal? (Score:5, Insightful)
What is it with you people? Is there no such thing as a state secret anymore? Should the Pentagon just list all its secrets on its Web site and get it over with? Let's just post all the targeting information, launch codes, encryption keys, advanced weapons and defense systems. etc. Let's just post it all on .mil in the interest of openness.
Not everything is a scandal folks! Nothing to see here, move along.
Re:Is this supposed to be some sort of scandal? (Score:4, Funny)
Parent
Re:Is this supposed to be some sort of scandal? (Score:5, Informative)
Parent
Not entirely accurate either (Score:3, Interesting)
Not stolen! (Score:5, Funny)
When will everyone learn the difference?
The solution is obvious: sic the Mafiaa on the attackers.
Re: (Score:3, Funny)
Not keeping up to date on fixes? (Score:3, Insightful)
army net security is indeed ridiculous. (Score:5, Interesting)
Sounds decent so far, hmmm?
The army has some committee that regularly decides which patches to approve.
Still not too bad, hmmm?
The committee approves patches for things that are being actively exploited.
Ponder that one for a moment. It means that every security hole will be exploitable on the army networks. Every security hole gets a chance, since "not exploited yet" means "not a problem".
Parent
Here Is A Fun April Fools Joke for the Chinese (Score:5, Funny)
Compose a few Microsoft Word documents about a planned nuclear attack on Beijing on the opening day of their olympics. Make it sound nice and juicy, say a few things about ICBMs, nuclear submarines just off their coastline. Mention the proposed megatons and expected damage. Talk about a free Taiwan
Let them chew on that.
Re:Here Is A Fun April Fools Joke for the Chinese (Score:4, Insightful)
Parent
$TRILLIONS for Insecurity (Score:2, Insightful)
Feel safer?
Re:$TRILLIONS for Insecurity (Score:5, Informative)
The vietnam war cost 600B$USD considering 1968 USD.
If you consider inflation based on the first inflation calculator google link that I clicked [westegg.com], plugging in 600B$ from 1968 yields:
What cost $600000000000 in 1968 would cost $3688102617038.20 in 2007.
thats 3.68 trillion in north american terms no?
Parent
Re:$TRILLIONS for Insecurity (Score:5, Informative)
The Vietnam cost of $600B is in 2005 dollars [fpif.org]. Using your calculator, that's already over $653B.
Iraq alone has already cost more than that, well over $700B.
And if you're interested in using a calculator, look into the fact that at least 80% of Iraq's cost is borrowed money, which (at typical 30 year Treasury bond rates) costs 155%. So that's already going to cost well over $1 TRILLION. And that's just Iraq, which has made us a lot more threatened.
Feel safer?
Parent
Re:$TRILLIONS for Insecurity (Score:5, Funny)
Parent
Re: (Score:3, Interesting)
In fact, the actual numbers of each wars are certainly higher. The reports on which they're based are purposely smaller, and there is lots of covert budget not reported.
For kicks, imagine what the US could have done with either of those budgets if we'd invested them constructively. For example, there were about 25M Iraqis when we invaded (we've killed hundreds
All joking aside (Score:3, Insightful)
it is (Score:4, Interesting)
There is of course also a serious network of computers at the Pentagon which handles serious military secrets. It doesn't run Windows. It isn't physically connected to the Internet. The Chinese can't touch it.
This is a silly FUD nonstory. There's no reason for the Pentagon to treat random secretarial computers with the same attention to security as they give classified computers. It would be very expensive, and my taxes are high enough already, thank you.
Parent
Re: (Score:3, Interesting)
Poem (Score:5, Funny)
Exploit SOCKS
Me Put Malware
On Your Box
Me Chinese,
Go To Town,
Me Pull Fast,
Your Data Down
Me Chinese,
Make Cheap Shoe
Take You Secrets
Laugh At You
Me Chinese
Let You Think
Here You Go
Bring You Drink
Me Chinese,
Me Play Joke
Me Put Pee-Pee
In Your Coke
Re: (Score:3, Insightful)
Gary McKinnon showed the way with .mil (Score:4, Informative)
He talked of blank MS passwords and using a tiny Perl script.
So maybe you do not crack or hack MS Pentagon computers but just surf on in.
http://news.bbc.co.uk/2/hi/programmes/click_online/4977134.stm [bbc.co.uk]
You know, one time we had a box DoS, for 12 hours. When it was all over, I walked up. We didn't find one of 'em, not one stinkin' Asian ip.
The smell, you know that Microsoft smell, the whole box. Smelled like... owned.
What known exploit was used? (Score:3, Insightful)
This sounds more like an inept IT department than anything, and considering government pay grades if you aren't in _the_ top tier it wouldn't surprise me if that was the case really.
And to all you anti-Windows pro-Linux guys: How many groups of hackers does your OS have dedicated to breaking it? Microsoft damn sure has its flaws and issues, but most Windows exploits are found simply because Windows is _everywhere_ in the real world.
There is a reason NTFS was number two on the Slashdot FS poll, and it isn't because Windows and everything associated with it is total garbage. The 'open source attitude' is supposed to be about choice and sharing, not about elitism.
Sure, the default settings on Linux are more secure than on Windows. Linux is also not designed with the common man in mind. You shouldn't be surprised, especially IT guys, with how much of the problems with Windows are because of the marketing department rather than the actual coders. If the recent internal e-mails can't show that to you (what with the majority of the company bitching about how bad Vista was and how it shouldn't be released) then you are going through life blind.
Oh and yes, I use both Linux and Windows. Both have their uses. You don't throw out a screw driver when you get a power drill, and you don't throw out a ruler when you get a tape measure.
Re:What known exploit was used? (Score:5, Insightful)
Choice alone isn't very useful unless you make an effort to make good choices.
To the attacker trying to break into your systems, it really doesn't matter whether the security weaknesses were caused by marketing, the coders, or whatever, so I am not sure what your point is. What I can say is that what it looks like is a weak apology for Microsoft's poor security history. At any rate, as you indicated, marketing departments do not security make. You just gave a good reason why Windows would be a poor choice in a context where, presumably, security really matters. Therefore, the two are not on equal ground in this case. It is certainly not "elitist" to say that Linux would have been a superior choice (though probably OpenBSD would have been better still). Especially not when professional IT staff are not the "common man".
Even if the client machines must use Windows, the servers hosting the sensitive data certainly do not need to use it. The wrong tool was used for the job; there is nothing "elitist" about it.
Parent
Additional information (Score:5, Funny)
simple question... (Score:4, Insightful)
Re: (Score:3, Funny)
M$CROSOFT SUCKS (Score:5, Insightful)
I am in my 30's and I have been using Microsoft all my life, since I was about 9 years old (I started using computers when I was 7). I build their machines, I repair them, I even program them too. I also attempt to provide security on them as well. So I have been involved with Microsoft about as long as some people have been married. So I believe that I am entitled to get drunk occasionally and rant about the "Ex" for awhile. I earned it, so to speak.
Have people noticed that Microsoft is like a little sickly Boy in the Bubble? You have to protect him at all times.
You have to put up a router and a firewall at a minimum to protect your little herd of MS machines. Keep them safe from the big bad wolves and all that. Of course, these days you also need to have some really good routers with IDS, gateway anti-virus, etc. to do it even better. But that is not enough. Those little guys can get into trouble just "looking" out on the Internet. So you need anti-virus, anti-phishing, anti-spam, anti-spyware, anti-malware, etc.
When the Internet first started coming out, I remember telling people it would be cold day in hell before I hook my computer up to an unknown network in which anybody could send packets to my machines. Obviously, I had to get over that "shyness" and learn to adapt or die. However, since then, I have had to invest enormous amounts of time and energy and cold hard cash into preventative measures to keep my own Microsoft OS's from being hijacked by any asshat on the Internet.
There is billions being made, that's with a B folks, in 3rd party solution providers that specialize in providing the security solutions just to cover the fact that Microsoft can't code security if their "life depended on it".
Now that the Pentagon is using them, it would seem that in a roundabout way, Microsoft's life IS depending on it.
We can bash Microsoft all we want, and talk and talk and talk about it. What it really comes down to though, is that Microsoft just may not be a secure enough environment for our National Security apparatuses to be using. If we have to work that hard at it, with that many vendors, and have that many points in which someone can screw up and leave machines vulnerable, then we need another solution
On another side note, where the HELL are those super secured networks I keep hearing about that my tax dollars paid for huh? Apparently, the Pentagon's networks must be in really bad shape too. You would think that trillions of dollars could provide some pretty secure networks, communication infrastructures, and operating systems.
All that "bashing" on my part aside, Microsoft may make a decent OS for the little guy. The mom and pops at home with their families. Let's face it, it is easier to use then Linux, otherwise Linux would have a greater market share. Let's just not use it inside the Pentagon OK?
Re: (Score:3, Interesting)
The people who have been contracted by companies to design, implement, and maintenance solutions based on M$ products?
The people who have spent money to become certified?
The people who just don't speak out of their ass about Microsoft security flaws, and their failures to address them?
Yeah, those people cannot possibly have an educated, non-biased opinion about Microsoft as a whole.
I spell Microsoft with the $ since they care more about money t
Hitting us where we're centralized (Score:5, Insightful)
It reminds me of the Doonesbury comic years ago about Reagan's SDI shield, that was going to protect us from Soviet missiles by a single, always-perfect shield of protective devices. The comic was drawn in crayon, as I recall, with the voice of a little girl explaining that the world was beautiful because SDI was protecting us. Then in the last frame it said something abrupt to the effect of "Oops, one got through. Bye."
What makes this story so scary isn't just that something got broken into, it's the thing in the back of all our minds that says "my goodness, is that the place where All Knowledge of Everything is centrally stored?" Bad enough when someone breaks into your computer and gets all your bank accounts or passwords, but when someone breaks into The Government and gets all knowledge of launch codes, defensive systems, registries of guns in the US, files on who sympathizes with who, files on who calls who, etc. ... well, that info collected with the intent of defending us might suddenly be a liability.
That's why things like the telecom phone tapping, national IDs, etc. are so troublesome. The mere centralization of information at all for any reason is a risk that the Bush administration has been ignoring, working instead (for all we know, none of this being auditable) to pile all of everything in one fragile place. The founding fathers kept trying to decentralize things and minimize what in modern computer terms we'd call "single point of failure". They distributed power in a way that made it hard to just break in and take control, right down to making sure there was not a single head of government. It's too bad that in all the puffery we hear spouted about Constitutional original intent, the modern Republican leaders don't show more care about that kind of original intent.
Honey pot. (Score:4, Interesting)
Re: (Score:2)
Who knew?
Re:Safe? (Score:4, Insightful)
Parent
Re:Safe? (Score:5, Insightful)
Parent
Re:I guess... (Score:4, Funny)
Parent