Slashdot Log In
FBI, US Marshals Hit By Virus
Posted by
Soulskill
on Sat May 23, 2009 09:15 AM
from the nothing-tommy-lee-jones-can't-handle dept.
from the nothing-tommy-lee-jones-can't-handle dept.
Norsefire writes "The FBI and US Marshals were forced to shut down part of their computer network after being hit by a 'mystery virus.' FBI spokesman Mike Kortan said, 'We are evaluating a network issue on our external, unclassified network that's affecting several government agencies.' Nikki Credic, spokeswoman for the US Marshals, said that no data has been compromised but the type of virus and its origin is unknown."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
We have to hit back and hit back HARD (Score:2, Funny)
You wanna know how you do it? Here's how, they hit you with a virus, you pull a gun. He sends one of your servers to the IT department, you send one of his to the morgue. That's the Chicago way, and that's how you get Capone! Now do you want to do that? Are you ready to do that?
There's a name for that virus (Score:3, Funny)
It's known as the "fastlead" virus, and it's frequently game over if you get infected.
Sensitive networks should be treated as such (Score:5, Interesting)
More and more, sensitive corporate and government networks will need to be isolated or at least mostly isolated from non-sensitive networks and the Internet.
They may not need an air gap [wikipedia.org] but they will need to be isolated enough to prevent general problems like viruses.
They also need to be run with the philosophy of "every other machine or user on my network could become compromised (infected or bribed) at any time."
A couple of possible solutions:
*Give employees 2 computers with a KVM, one for surfing the web and access to non-secure data, one to access secure data.
*Give employees a multi-homed, ROM+read-only-USB-stick-for-configuration-data-boot "thin client" that's stripped down and hardened, with no copy-and-paste, no network bridging, and other designed way for one remote server to influence the other. Then have them connect to different servers on different networks for different needs.
If your security requirements are extreme, use an air gap.
In either case, don't forget to take countermeasures against human idiocy, ignorance, and bribery/blackmail.
Re: (Score:2)
Security regs in the USG mandate this sort of stuff for Classified information.
classified vs sensitive (Score:3, Interesting)
True, US-government-classified material does have to be regulated.
But what about the human resource database of the United States Postal Service, with its employee birth dates and social security numbers? What about the customer database at American Airlines, with its juicy collection of credit card numbers? What about your medical insurer, which may have lots of information about your or your children's health you don't want entering the public domain? What about the bank teller whose terminal let's her
US Marshals! (Score:2)
What I want from each and every one of you is a hard-target search of every JPEG, MPEG, EXE, PXE, hard drive, flash drive and floppy drive in that area. Firewalls go up on every computer. Your fugitive's name is Neeris. Go get him.
Bold claim (Score:5, Insightful)
"said that no data has been compromised but the type of virus and its origin is unknown."
How do they know that there was no data compromised if they don't even know the type of the virus?
Re: (Score:2, Insightful)
Perhaps the network is reasonably self contained?
The article says they shut down internet access, but it doesn't really make it clear if the computers in question have any connection to the internet or not.
Typical Bold Claim, Scenario A14 (Score:5, Insightful)
Parent
Re: (Score:3, Insightful)
Re: (Score:3, Interesting)
How do they know that there was no data compromised if they don't even know the type of the virus?
For the same reason that if I got a virus, none of your data would be comporomised. Seperate network, like it said in the summary. :P
Re: (Score:3, Informative)
The FBI isn't a spy agency...
Actually, they are. The FBI is largely responsible for intelligence gathering and counter-intelligence within the US.
http://en.wikipedia.org/wiki/Federal_Bureau_of_Investigation [wikipedia.org]
quick! (Score:2)
Maybe they recently bought some new computers? (Score:3, Informative)
http://www.itbusiness.ca/it/client/en/home/news.asp?id=53225 [itbusiness.ca]
How do they know ? (Score:4, Interesting)
The spokeswoman said :
"no data has been compromised but the type of virus and its origin is unknown"
That is an extraordinary statement. How would they know ?
If I was head of IT there I would assume that that was not true. Even if there was a completely different computer system for any sensitive information, data has a way of leaking to where it shouldn't be. Of thousands of people, not one put notes or passwords or whatever on the insecure side of the line ?
Regardless of what they tell the press, I hope that internally they are assuming that this is a breach, and acting accordingly.
Re: (Score:3, Insightful)
Well exactly. What their spokeperson says doesn't necessarily have any correlation to what their head of IT thinks.
The spokesperson's job is to put the best spin on things. Saying "We lost loads of public data" would not be doing their job well.
The government should retaliate in force (Score:4, Funny)
US Air Force General Kevin Chilton, head of US Strategic Command, has said that attacks on the United States via the Internet could merit a conventional military response [today.com].
"I don't think you take anything off the table. We're particularly looking toward one group in Seattle."
The Seattle-based insurgent group is thought to have seeded American government and military computers with millions of copies of malware that allows attackers easy access to any data stored on the computer, or indeed to take complete control of the computer and use it for their own ends as part of a massive "botnet" to mount further attacks. The malware, "Windows," makes securing a computer running it almost impossible.
"Turning Seattle into a glass crater would only be undertaken strictly as the minimum required surgical military action," emphasised Chilton, "and not in any way out of twenty-five years' bitter resentment and frustration at computing machinery."
Chilton stressed that members of the US military must begin to think of their computers as the front lines. "Do you realize that in addition to adding Windows to computers, why, there are studies underway to Windowsize salt, flour, fruit juices, soup, sugar, milk ... ice cream. Ice cream, Mandrake, children's ice cream! I can no longer sit back and allow Windows infiltration, Windows indoctrination, Windows subversion and the international enterprise licensing conspiracy to sap and impurify all of our precious bodily fluids!"
The Obama administration is currently reviewing the United States' cyberspace defense policy. "We're considering all options thoroughly," said the President, closing his MacBook and looking lingeringly at the red button on his desk.
Am I completely paranoid (Score:2)
Sure some mysterious virus. (Score:2, Insightful)
In other news... (Score:4, Interesting)
700,000 desktops in the US Army are going to be upgraded to Vista. [slashdot.org]
UNIX email virus (Score:5, Funny)
Parent
Re: (Score:2)
While most users will jump through hoops to see dancing pigs/bunnies, if you make it easier, more of them will do it.
Re:UNIX email virus (Score:4, Funny)
Parent
Re: (Score:2, Interesting)
Re: (Score:3, Interesting)
Everyday I have to run apt-get update && apt-get upgrade to keep my system secure. Not everyday it is a possible remote exploit, but there is always some security related bug to fix. Linux may have a better implementation to keep those risks from escalating quickly compared to windows, but I would not run nation-critical apps on it. Not at this point in time.
I think you're making the classic mistake of equating the number of patches seen with the actual number, and severity, of vulnerabilities. Of course Debian gets more patches more often than Windows: the Debian security team sends out fixes for security vulnerabilities as soon as they're discovered, rather than leaving users exposed by waiting up to a month and fixing (some, but often not all) of the most critical known vulnerabilities in monthly roll-ups. And of course Debian sees more patches, when nearl
Re: (Score:3, Insightful)
They rather get infected every now and then. After all it's your money they are spending.
Re: (Score:2)
Re:Linux... (Score:5, Interesting)
Parent
Re: (Score:3, Insightful)
Sure, Linux is vulnerable but it isn't targeted, the diversity in distros, kernel versions, browsers, etc. help keep the target moving.
1. If the Government switches to Linux, there will not be a diversity in distros, kernel versions, browsers, etc.
2. Assume that, like the current windows installation, there will be gaping security holes due to mismanagement and misconfiguration.
3. The US government is an awfully big target and if they switch, you will see significant, concentrated effort on exploiting whatever distro and apps the Feds chooses.
Re: (Score:2)
Then contract the NSA to train a bunch of people to properly configure SE Linux with targeted policies.
Develop targeted policies for the various government departments and offices. Create proper images so machines are correctly locked down from the install.
It isn't *hard* to configure systems to be secure, it is unpopular and time consuming. Apply the same logic used with firewalls -- default deny -- and you're much further along the path of secure computing. That is, explicitly allow only needed binarie
Re:Linux... (Score:4, Interesting)
Especially 2. I work for a government contractor. The amount of stupid pointless shit we have to do in the name of "security" while leaving HUGE GAPING HOLES untouched just hurts my head. It's like our security policy is designed by ADD addled five year olds. They read about something in a magazine and think "Oh, shiny!" They quickly write some insane, over the top, policy to "solve" the "problem" and keep reading the magazine. It's great assuming that the article covers all possible security problems ever, or that it contained actual solutions instead of stuff that kinda sounds like it ought to fix a problem.
The latest brainstorm is that we are switching to 12 character passwords which change every 60 days. This is almost certain to result in:
a) People forgetting their passwords, requiring continuous password resets
b) People writing down their impossible to remember, constantly changing, password
c) Both (a) and (b)
Meanwhile, we still have a number of systems that use rsh (No, not Kerberized rsh, the plain 30 year old version with .rlogin files.). Granted this is an isolated network, with no Internet access at all. We're not likely to be attacked by outside entities. But if you trust the users of the isolated network enough to assume that they are not going to take advantage of the multiple and well published rsh vulnerabilities, why don't you trust them enough to assume that they are not running password crackers?
Parent
Re: (Score:2)
Re:Linux... (Score:4, Insightful)
Step 2: Choose a better open-source alternative notorious for its security and stability
Step 3: close the source
Parent
Re:Linux... (Score:5, Insightful)
Step 4: watch a lower ranking employee click on the HappyFunTime executable in their mail
Step 5: Priceless.
Parent
Re: (Score:3, Informative)
SELinux Background
Researchers in the National Information Assurance Research Laboratory of the National Security Agency (NSA) worked with Secure Computing Corporation (SCC) to develop a strong, flexible mandatory access control architecture based on Type Enforcement, a mechanism first developed for the LOCK system. The NSA and SCC developed two Mach-based prototypes of the architecture: DTMach and DTOS. The NSA and SCC then worked with the University of Utah's Flux research group to transfer the architecture to the Fluke research operating system. During this transfer, the architecture was enhanced to provide better support for dynamic security policies. This enhanced architecture was named Flask. The NSA integrated the Flask architecture into the Linux® operating system to transfer the technology to a larger developer and user community. The architecture has been subsequently mainstreamed into Linux and ported to several other systems, including the Solarisâ operating system, the FreeBSD® operating system, and the Darwin kernel, spawning a wide range of related work.
Re: (Score:2)
Yes, but as far as I can tell the only thing SELinux accomplishes is to make the Operating system virtually useless as anything other than a desktop. The first thing most admins I know do upon installing a new server is disable SELinux. It's possible (possible) to use SELinux on a server, but it usually requires days of tweaking settings, and winds up eliminating a good part of the benefit of the hardening.
Re:They should use macs (Score:5, Funny)
Parent
Re: (Score:2, Redundant)
Which, of course, is because Dell and Apple are sponsoring the show. This has been happening for years; Amiga used to sponsor the Neighbors soap, and so people had Amigas on the show. They went with Macs later, probably because they got better/alternate sponsorship from Apple then.
Re: (Score:3, Informative)
Mac is in no way less vulnareble than Windows, specially in targeted attacks. It seems most people have been brainwashed quite good. Yes, the amount of malware for mac's is lower than Windows, but so is mac userbase. However there are many OSX malware circumventing already and it seems to be just going up.
And no, not all malware require root to run. They can easily run under your user account aswell and still steal lots of data, passwords and keylog etc. If they require root, then social engineering attack
Re: (Score:3, Insightful)
Correct, zero is a tad less than ~ninety-three thousand.
Considering that UNIX-like systems are ubiquitous in the server world (and OS X is a UNIX-variant), that is a really lame argument.
[citation needed]
Re:They should use macs (Score:4, Informative)
That's a mighty low [bbc.co.uk] estimate.
Parent
Re:They should use macs (Score:4, Informative)
http://news.cnet.com/8301-13579_3-9808489-37.html [cnet.com]
http://www.tuaw.com/2008/11/21/new-mac-os-x-malware-osx_lamzev-a/ [tuaw.com]
http://www.f-secure.com/v-descs/trojan_osx_dnschanger.shtml [f-secure.com]
http://www.f-secure.com/v-descs/inqtana_a.shtml [f-secure.com]
http://blogs.zdnet.com/security/?p=2418 [zdnet.com]
to begin with a few.
Parent
Re:They should use macs (Score:5, Insightful)
Also, most mac users think and they're told that theres no malware and they're secure, so they have the mentality of "nothing can hit me" and even tho theres a few mac av's, almost noone runs them.
Hell, there's botnets running inside _routers_. What makes it think that mac is somehow some bulletproof solution. You dont need root to send spam or ddos either.
Mac is also a standardized os, so its a lot easier to make malware for it than the tons of different linux os's. And its already true, but because of this mentality Apple and Mac users have given to everyone, they think they're safe. It's really stupid from Apple's part, because the problem keeps just rising and one day it gets hit badly and no one has prepared because of their assumptions.
Parent
Re:They should use macs (Score:5, Insightful)
Parent
Re: (Score:3, Insightful)
While I agree with the general principle that *nix OSes (including Macs) are more secure than Windows, viruses are just as possible on other operating systems.
That said, the government could save shit-tons in licensing fees by switching to a free OS like Ubuntu, and they wouldn't have to worry about something like this happening nearly so often.
Re: (Score:3, Insightful)
Every example in your list is a social engineering trojan. They all require the user to literally INSTALL the malware and enter their admin password to do it. No system can defend against that. There are proof of concept viruses and worms on the Mac, but pretty much everything in wild is a trojan and requires significant user intervention to work. That's hardly fair. Of course stupid Mac users are still stupid users. That doesn't make the system itself less secure. I'm not one of the "OMG, it's compl
Re: (Score:3, Insightful)
This should be modded up.
Generally, I also recommend Mac for brain-dead users whose computers I don't want to fix every 3 days. There is simply less chance of such problems... randomly. Most exploits target Windows and MSIE, simple as that. But that is only GENERALLY...randomly...blindly.
More and more, we are seeing targeted attacks. The targetted attack is most successful when the contents of the network are known. So get one machine compromised (advanced scout), survey the network to see what's out t
Re:They should use macs (Score:4, Informative)
The reason windows systems are more vulnerable than Unix-like OS's is because in Windows, the default status of the computer is that the end user is running an administrator-type account, with full privileges to install new system software and replace drivers. In a properly administrated Unix system, only a few root-level processes are running, and the logged-in user does _not_ constantly have access to such privileges except when they are specifically requested by the user, and only then within the process that the end user specifically escalated privileges on. This leaves social engineering as the only real means by which a unix-type of machine is liable to be compromised, and avoiding that is also a matter of maintaining established sound system-administration practices.
Of course, maintaining such practices on windows systems would cause a significant (HUGE, even) drop in viruses on that platform as well (possibly even to the point that a resident virus scanner could be considered wasteful, and regular on-demand checks for compromises alone would likely be adequate). However, most windows users simply are not interested in learning how to be sysadmins, so the problem remains.
Parent
Re: (Score:2)
Last I heard, the FBI was embarrassingly under-tech'd. They probably use paper and pencil a lot of the time.
Houston's Hobby Airport (Score:3, Funny)