Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
Security

Hack the Army, Brag About it, Get Raided 402

Posted by michael from the stupid-is-as-stupid-does dept.
SunCrushr was one of many who submitted this. A security company called ForensicTec decided to explore the U.S. government's computer systems, with particular emphasis on the Army. They talked to the press and had their fifteen minutes of fame. And surprise surprise, they immediately got raided by the FBI. What did they expect?
This discussion has been archived. No new comments can be posted.

Hack the Army, Brag About it, Get Raided More

Hack the Army, Brag About it, Get Raided

Comments Filter:

  • Publicly breakly the law is dumb (Score:4, Insightful)

    by mesocyclone ( 80188 ) on Friday August 23, 2002 @10:52PM (#4131594) Homepage Journal
    even when what you are doing is reasonable!
    • "Publicly breakly the law is dumb"
      It is if you think you wont be caught. There are valid reasons to break the law publicly like mounting a case against an unfair law in order to strike it down.
    • so what about using MacroVision - disabling VCRs?
      how about speeding on highways?

      IMHO the army and the FBI is taking this *way* too seriously. I mean, fine if they were doing this for criminal intent, then alright. but proceeding with criminal prosecutions? that's 158% bullshit.

      the sad fact is unless you generate some publicity, a whole lot of times shit in the govn't does not get done. (same with M$, btw). Illinois had ppl warning them for YEARS that they need to seriously wipe the old PC's hard disks they put on auctions; and what did they do? promptly ignored it until someday ABC channel 7 news (i actually don't remember the channel #, so am making this part up) found out.

      i mean, fucking a, i'd appreciate some kind of apology from the army instead of this. instead of "i am tracking down the 'law breakers' and taking a firm stand on unauthorized computer access", i think The Right Thing (tm) to do is actually apologize to ME, Joe Citizen, that they fucked up and should have kept this shit more secure in the first place, and things are being done about it; and they are switching to open source and capable sys admins.

      glad my tax dollars are going toward such useful endeavors.

      • Re:Publicly breakly the law is dumb (Score:4, Insightful)

        by RandomCoil ( 88441 ) on Saturday August 24, 2002 @12:37AM (#4131983)
        so what about using MacroVision - disabling VCRs?

        how about speeding on highways?


        I think the obvious difference here is that when one uses Macrovision-disabling VCRs, one doesn't usually:
        a) Send the RIAA/MPAA an email letting them know
        b) Tell the press what an easy time you had doing it

        Likewise, when speeding on the highways, one doesn't usually give the local police a call to let them know.

        Furthermore, I don't know about you, but I expect the law to enforced consistently. You certainly don't want Al Qaeda claiming that knocking down the WTC and was just some proof-of-concept work they were doing to point out inadequacies of airport security in the US.
        • The thing is these people help secure your networks and and do not carry out any real destructive actions. After you put them in jail:

          1) Less of this "benign tumors" develop (SecureTech, etc)
          2) More of the "malign tumors" develop (Al Qaeda)
          3) Security is improved a bit but not revisited thereafter, making the mil computer even more vulnerable.

          If some guys tryed to divert a plane and flyby some densely populated scycrapers, then sept 11 would have never happened. Of course, nobody will try that because if the actually survive (ie: they dont get killed while trying) they will be killed after succeding (even though they would have preventing a tragedy).

          So as nobody has an incentive to try, because the penalty is so high, nobody does try. But then a real terrorist takes advantage because they don't care about FBI raids. They get in, an gather the information or many launch an Nuke (or something nasty) and that's it.

          I'd rather see these guys sentenced to work as free advisors to the mil for 10000 hours than be prosecuted. Actually, It'd be a good policy to offer rewards for hacing ANY mil computer (provided you do report inmediately and in proper way [ie: tell the mil, NOT the press]).

        • Likewise, when speeding on the highways, one doesn't usually give the local police a call to let them know.

          Damn, then why did I even get this cell phone?

  • now taking bets.... (Score:3, Funny)

    by jeffy124 ( 453342 ) on Friday August 23, 2002 @10:55PM (#4131604) Homepage Journal
    ... as to how long until they show up here [dumbcriminalacts.com]


    • For those objecting to the theory of evolution in the other thread, I submit that this is exactly how the human race got smarter. Those guys are going to miss out on a lot of breeding opportunities - at least, breeding of the kind that produces babies.

  • Shooting the messenger? (Score:2, Interesting)

    by ergo98 ( 9391 )
    While I think these guys should be held accountable, at the same time I wonder in the heavy hand of the law is a case of shooting the messenger? Are these people who are so willing to call in the feds equally as willing to actually fix the source of the problem, or are they hoping that by pretending there's no problem it achieves the same effect? Color me a cynic, but I suspect the latter.

    • Re: (Score:3, Insightful)

      by account_deleted ( 4530225 )
      Comment removed based on user account deletion
      • I think that there needs to be a distinction in the law concerning the intent of the action. In a case such as this, the intent was obviously not to steal personal information, or to do harm, but it was for publicity and also to be a wake-up call to government IT departments to start taking their security more seriously.

        Since the amount of personal information that the government is capable of gathering seems to be increasing, I don't believe it's an unreasonable expectation that security be increased as well. In cases where the security is so obviously lax, I would rather somebody inform them like this (maybe under some sort of digital security good samaritan law) than to let it go unnoticed.

        -Sou|cuttr
        • I people could break into systems with non criminal intent and haveshort or no sentances then they would do it. Now we have all sorts of people being good samaritans breaking into networks left and right, and not doing anything wrong.
          Now I come along. I say, I want to do something wrong when I am in there, and people are generating so much intrusion noise that I can slip in and out unnoticed within the sea of attacks.
      • So, you wouldn't mind if I did a little security research on your home while you're away at work -- or, better yet, in the middle of the night when you *are* at home?

        I mean, I wouldn't actually steal anything. Just rifle the place a bit, see what you've got, that sort of thing. Then, I might call the press and see if they're interested in doing a story about the level of security at [insert your address here].

        I'm sure you'd appreciate the free research, right?

        Cheers
        -b
        • Why even use the real world analogy? How many of us wouldn't be pissed if we got an e-mail saying, "Hi, I cracked your security and got into your computer via --some exploit--. You might want to patch that. Also, some of your financial records are inaccurate, and the girl in 'sylvia_saint_fucking_and_sucking.avi' in the 'C:\Private\GodIHopeMyWifeDoesn'tSeeThis' directory isn't Sylvia Saint, but actually a lesser known porn star. Nice collection, BTW."

          I'd want the guy prosecuted for breaking into my personal property and I believe that a lot of you would, too. Why do we expect a lenient, "please, invade our property some more, sir" attitude from anyone else?
          • How many of us wouldn't be pissed if we got an e-mail saying, "Hi, I cracked your security and got into your computer via --some exploit--

            You'd rather not know?

            Back when you were in college you didn't e-mail people that left themselves logged in after they left the terminal?

            You never got one?

            I never like having my machine cracked, but I do like the fact that it's much easier to find out these days than when my first BBS was cracked. My workplace even hires people to come in and break into as many computers as they can. I wish the military took security as seriously. We have holes we know about, but we do keep at least one machine running a password cracker and port scans at all times. I get at least two attemped breakins into my computer a week, I'm sure their machines were owned many times over. At least these people had the good morals to tell the world.
    • I disagree. There are proper ways of doing things, and ones that dont publicly embarass the probably very hardworking and overworked people keeping the whole US Army network working. The fact that they dont have time to become completely geeked out security freaks is because they need to do other things that little script kiddies dont have to do, like work, spend time with their families, and complete projects. If they wanted to really help the army, they could have taken their info and given it, without shameless self promotion, to their people and offered suggestions on how to tighten up the whole thing. So I say screw em. If they want their 15 minutes on the back of other people, they get what they get.

      • Re:Shooting the messenger? (Score:4, Insightful)

        by ergo98 ( 9391 ) on Friday August 23, 2002 @11:26PM (#4131762) Homepage Journal
        Do you really think that these rather amateur (or so it seems) security consultants were the first to find these lapses in security? I highly doubt it. Perhaps it was beneficial that they were so public about it simply because it makes it a lot harder to ignore.

        And regarding the IT being busy doing other things: If they can't secure the network then they should _GET_OFF_THE_BLOODY_INTERNET_. I'm 100% serious. There are countless government computers and networks that are theoretically publicly accessible with absolutely no justifiable reason but that it was easier for the IT department.
        • and if your locks on your house can be picked, YOU_SHOULD_GET_OFF_THE_BLOODY_STREET_.
        • Do you really think that these rather amateur (or so it seems) security consultants were the first to find these lapses in security? I highly doubt it. Perhaps it was beneficial that they were so public about it simply because it makes it a lot harder to ignore.


          I'd disagree. The 'consultants' certainly did get the publicity, which it seems they wanted. (How beneficial it's going to be at this point though is probably questionable.) They didn't have to go 'public'. This was a case of someone intentionally mucking around inside their systems. I don't care if it's the military, a company, or an individual. Once the breach is made , if intentional, and they continue, it's illegal. Once can accidently end up at a site because of a screw up in routing tables, etc, and that's not intentional. In that case, if they are notified, they'll fix the problem... and I mean fast.. in the case of the military. (On that one I speak from experience.) But the bottom line... this wasn't accidental .. they had 'intent', it seems, from the beginning. I don't have a lot of sympathy from their resulting 'visit' from the FBI.

  • Don't hack the military unless you are a hostile foreign power, and even then it's not recommended.
    • The point here is that the company made the army security specialists look like idiots to their superiors.

      In all probability, they would've prefered to stay vulnerable if it meant saving face.

      Typical tactic. When you expose their piss-poor security, they scramble for cover and instead of acknowledging that they don't know security from a hole in the ground, immediately accuse the people who exposed their incompetence.

  • Where's ForensicTec security now? (Score:4, Funny)

    by WildBeast ( 189336 ) on Friday August 23, 2002 @10:57PM (#4131622) Journal
    Federal law enforcement authorities searched the computers of a San Diego security firm that used the Internet to access government and military computers without authorization this summer, officials said yesterday.

    So it looks like those ForensicTec computers aren't secure enough :)
  • If they were serious about what they were doing, they should have contacted the people who have influence over the systems they compromised. Making their findings public may achieve the same effect in the way of getting the systems fixed, but the end result is a lot of unpleasantness all around. In short, it was a wholly unprofessional way to act.

  • "Stumbled Upon"...heh (Score:5, Funny)

    by $carab ( 464226 ) on Friday August 23, 2002 @11:00PM (#4131637) Journal
    ForensicTec officials said they stumbled upon the military networks about two months ago, while checking on network security for a private-sector client.

    Someone new to a Dvorak probably tried to type in "lynx http://www.google.com" but instead got "nmap -v -p 1-1024 -sS -P0 army.mil -T paranoid".
  • Look, it's one thing to find a vulnerability, and another thing to say "oh look, let's see how far this goes and play with it before we tell anyone."

    It's like discovering that there's a loose brick in the wall between the boys' locker room and the girls' shower room at school: getting an eyeful before reporting is still wrong.

    They probably got searched to see if they did the equivalent of "taking pictures."

    • Re:interesting point gets made (Score:5, Funny)

      by Anonymous Coward on Friday August 23, 2002 @11:08PM (#4131682)

      It's like discovering that there's a loose brick in the wall between the boys' locker room and the girls' shower room at school: getting an eyeful before reporting is still wrong.

      No kidding... What kind of fucknut would report the loose brick?

  • Honestly, I'd have to say they were pretty dumb... (Score:4, Insightful)

    by Qwerpafw ( 315600 ) on Friday August 23, 2002 @11:05PM (#4131663) Homepage
    See, first they point out that the Governement has flaws. Ooooh, criticising those in power... can be risky...

    Then they point out specific, make-people-lose-their-jobs flaws. The kind of thing congressmen would love to jump on in order to criticise incompetency. Do it on a widely-read medium. This pisses more people off.

    Then make very clear how you did specific illegal acts, giving those you just pissed off a great and simple way to get back at you.

    Why not just walk right into jail...? I mean, its like spitting in the face of a police officer who is holding a gun, insulting them, and then making a threatening move while simultaneously pulling out a joint and smoking it. You might as well hand them the rubber hose...

    Why taunt someone and then give them an excuse to hurt you? To gain acclaim? Fame? Real hackers are not out to get publicity, but rather to expose vulnerabilities and try to fix them.

    Whats this you say? You sympathise with the "security firm?" well, take this quote into account:
    The consultants, inexperienced but armed with free, widely available software, identified unprotected PCs and then roamed at will
    I dunno about you, but that would be my definition of script kiddie. Especially someone who then brags about it for publicity.
    • Well they gotta make a point. If the government can monitor our phone calls, internet emails, conversations, etc. then why can't we spy on the government to? Or does the governemnt thinks that its better than us and that it got more rights than us?

      I say enough is enough and its time for a change.
      • its true that people need to make points sometimes, but the point they seem to be making is that people who brag about hacking get busted.

        Which is nothing particularly new.

        Oh, and the governement is better and has more rights than us. See vigiante justice. Lets say you know someone is a criminal. for example, they are pirating mp3s. You cannot do anything about it, other than maybe tell the governement. The governement can bust them, which almost never happens, because its a minor thing. Record companies want to have the "same rights as the governement," as you put it--they want to be able to search your computer, hack it, and basically fuck you up.

        There is a reason why joe billy bob next door is not allowed to do the same things the police is allowed to do. Wouldn't it suck if any old bitchy mom could pull you over for speeding and make you pay $150?

      • If the government can monitor our phone calls, internet emails, conversations, etc. then why can't we spy on the government to?

        Because there are things that the general public should not know. An obvious example would be the list of people in witness relocation program. Obviously there are a lot of military information that is not in our best interest for our enemies to know as well.

      • Well they gotta make a point. If the government can monitor our phone calls, internet emails, conversations, etc. then why can't we spy on the government to? Or does the governemnt thinks that its better than us and that it got more rights than us?

        The government is us. When you or I deal with the will of the people, we are not forced to do so by the whim of the crowd, but by the powers elected and appointed to speak for and act in the interests of the people.

        The government, as a nebulous nonpersonal entity, is a slave to every one of its citizens, and exists for no other purpose than for the well being of those it serves.

        The problem, of course, arises in that "the government" may be an inpersonal slave, but the people who run the government are very personal, flawed, human beings. It is these people who are put in power that are watched--and they're watched by other people in power who got put there different ways and across different levels, until we get back to the elected representatives and the voters en masse.

        If you take away the government's unique right to spy & investigate with legal warrant, documentation, and accountability, (see: the FBI getting smacked for lying to judges), then you're left with either an illicit society of secrets ("If no one can see me do it, then I can get away with it") or a distopian society of eternal spying.

        I would rather have some suit who's salary is paid for by my taxes spying on me than some random looney off the street.

        Oh--and you (assuming that you're an American citizen) CAN spy on the government. You just need to do it with a time delay. Ever hear of FOIL? The fourth branch of government? The @#$ing drudge report? (slashdot?)
      • "I say enough is enough and its time for a change."
        then stop saying it, and do something.sheesh.


      • Well they gotta make a point.

        The bitch to bureaucracies and incompetence is that that a successful bureaucrat covers it up. And often anybody who would make the appropriate whistle-blower is ass-deep in alligators already with all the other crap that's on their plate because their IT budget can't handle proper staffing.

        So... sure. Maybe someone does need to make something happen. They need to point a finger. They need to embarrass the bureaucrats in to fixing what is broke. Maybe this kind of act is the Right Thing.

        So how does one pull this off? Make the run, collect evidence, find a reputable journalist (No... really) you can trust, and then anonymously dump the evidence in to their laps. Maybe drop it in to a couple journalists' laps just to make sure the story doesn't turtle at that point. When the story hits the papers, nod quietly at your civic duty done and hope that nobody can ever trace it back to you.

        You do NOT use this as a vehicle for self-promotion.

    • They did the right thing (Score:4, Interesting)

      by zenyu ( 248067 ) on Saturday August 24, 2002 @01:48AM (#4132121)
      If they had reported this to the army it would have never been made public, and they might have been arrested anyway. The only thing I think they should have done differently is get a Senator involved before going to the media, it would have given them some cover. Seriously though they should be given a congressional metal of honor for bravery for informing us of the lax security.

      I used to live near a couple military bases so I know it's not exactly geniouses running the place. But they are a very organized bunch and I would have expected a policy on passwords, and that in that culture it should be easy to enforce. Password crackers shouldn't work on the military. Someone who leaves a password of "password" or "administrator" on a computer should be dishonorably discharged at the very least. If any of those machines exposed sensitive data they should get at least a few years on a slab of concrete in Cuba.

      The dirty little secret of the military is that sensitive information is a lot more important than classified stuff. Engineering data that was classified in 1950, that made it into every textbook by 1960, is still locked in a safe at night because it's too much work to declassify anything. The day to day functioning of the military tells any enemy everything they might care about and that never gets classified.

      Hey even the top secret nuclear stuff doesn' really matter since the information to build a nuke was long ago published, and the high tech stuff the US and Russia have isn't of interest to anyone. It's already expensive to build a nuke that takes out Manhattan, building one that takes out the Jersey City in the same hit is just a waste of money. But what kind of gas masks are being packed for the attack on Iraq, well that could be useful.

      • Re:They did the right thing (Score:3, Interesting)

        by mpe ( 36238 )
        The dirty little secret of the military is that sensitive information is a lot more important than classified stuff. Engineering data that was classified in 1950, that made it into every textbook by 1960, is still locked in a safe at night because it's too much work to declassify anything. The day to day functioning of the military tells any enemy everything they might care about and that never gets classified.

        The basic problem is that effective security is hard, it can be easier to give the illusion of security. Hence ending up with locking technical data which is in the public domain up in a safe. Sometimes serious things get overlooked, e.g. the Japanese gathering data on where ships were at Pearl Harbour.

        Hey even the top secret nuclear stuff doesn' really matter since the information to build a nuke was long ago published, and the high tech stuff the US and Russia have isn't of interest to anyone. It's already expensive to build a nuke that takes out Manhattan, building one that takes out the Jersey City in the same hit is just a waste of money.

        I recall it being said that in the 70's there were something like a million people who knew or could work out the triggering details of a hydrogen bomb. Information which was at that time, and may still be, classified.

        But what kind of gas masks are being packed for the attack on Iraq, well that could be useful.

        As could the amounts of any type of supply to a war zone. How many gas masks gives an indication of how many soldiers might be involved.
  • ... Princeton?
  • They way they should have gone was
    1: Hack whatever.army.mil
    2: Post anonomously to slashdot regarding army's computer problems.
    3: Request "large_num" security agreement, else will release to usenet, BugTrac, Slashdot, many newspapers, magazines....
    4: Release anyways.
  • This story should be posted on Fark [fark.com] with the "Dumbass" tag.

    One thing you DON'T do is screw around with military computer systems and then publicize it.

    These guys oughta get the death penalty for criminal stupidity accompanied by a posthumous (is there any other kind?) Darwin award ...

  • I did a security test this week (Score:4, Interesting)

    by WildBeast ( 189336 ) on Friday August 23, 2002 @11:18PM (#4131729) Journal
    I placed an unpatched Windows machine on the internet with no firewall protection whatsoever and shared the Inetpub directory. I wanted to know, how long it'll take before someone decides to crack into my machine. Sure enough, it took only two days.

    This test really made me realise that there are plenty of crackers and criminals out there that are waiting for a chance to get into your PC.

    The point I want to make is that, I'm sure those army computers have been accessed by crackers plenty of times before.

  • I don't see what the problem is... (Score:5, Funny)

    by brooks_talley ( 86840 ) <brooks AT frnk DOT com> on Friday August 23, 2002 @11:37PM (#4131805) Journal

    Rent-a-cop company raided after beating up govenment officials
    San Diego, CA

    Officials at SecureTech expressed surprise over an early morning FBI raid. For the past few months, SecureTech had been waylaying public officials and beating them to a pulp. The raid came just hours after a Washington Post article mentioning the beatings.

    Brent Clueless, SecureTech spokesperson, decried the search. "A few months ago, while installing video cameras in a local mini-mall, we realized that some government officials had woefully inadequate security. Some of them drove the same route home every day, and a few of them even left their front doors unlocked at night. By sneaking in and severely beating in their own houses, we hoped to draw attention to this problem and maybe gain some positive publicity for our security firm."

    "We only continued the break-ins and beatings because we were surprised that it was so easy, and we were curious about just how much truly malicious people would be able to get away with, " Clueless continued.

    Cheers
    -b

  • What a bunch of fools (Score:2, Insightful)

    by jpegNY ( 584447 )
    If you find your neighbor's car parked outside, unlocked with the key inside you don't go shouting this to the public, you go tell your neighbor!

  • One down (Score:2, Funny)

    by archen ( 447353 )
    Next on the stupid things to do list:

    Run around saying "I have a bomb" at the airport while pointing around a squirt gun under your coat.

    After that, urinate on an electric fence for a while.

  • Why is this even news? (Score:4, Interesting)

    by Brian_Ellenberger ( 308720 ) on Friday August 23, 2002 @11:48PM (#4131840)
    If they broke into the base, photocopied some records, and bragged about it noone would have even thought twice about their arrest. But now that it is electronic it is of some sort of interest to Slashdot? Very sad.

    Look if you want the virtual world to be treated like the real world (privacy, source code = speech, etc) then you have to accept it works both ways. Breaking in electronically is the same as physically. It doesn't matter how "weak" the security is. Just because I can throw a brick through a window and rob a store, doesn't mean it is somehow the store's fault for having windows.

    And sure I am concerned about military security. And it is disturbing someone could hack into it. But that doesn't give ForensicTec the right to go hacking it. I'm worried about airline security but I can't take it upon myself to see if I can get a gun through security.

    Brian Ellenberger

    • If they broke into the base, photocopied some records, and bragged about it noone would have even thought twice about their arrest. But now that it is electronic it is of some sort of interest to Slashdot? Very sad.

      I think this is news because of ForensicTec's attitude. As the poster said: "What did they expect?" The problem is that there are quite of few people out there that see this activity as somehow different than breaking into the base and photocopying records, even though it's not.

      And sure I am concerned about military security. And it is disturbing someone could hack into it.

      Yes. However, not to lessen the severity of the issue, but I think you would find that the stuff that really needs to be protected, is really protected. From my reading of the article, they mostly got personnel records.

      Security is a process, and it looks like the Army has quite a bit of "processing" to do.

      Milalwi
    • "If they broke into the base, photocopied some records, and bragged about it noone would have even thought twice about their arrest."

      Putting a file on a computer directly on the Internet is a far cry from putting a file in a locked file cabinet in a locked office in a secured building on a military base whose gates are protected by armed military personnel.

      It much more like putting a file in a locked file cabinet in a public park.

      -- Terry
      • It much more like putting a file in a locked file cabinet in a public park.
        The article made it seem like the computers themselves were set up with file sharing turned on, many without passwords at all.

        This is more analogous to writing all the information in a big black marker on a white board in a locked room that has windows :-)

        My 2 cents.

  • I kind of feel sorry for ForensicTec. True, they did technically break the law, but I don't believe they had any crinimal intent, otherwise I doubt they would have went public about it.

    On the other hand, if the Army didn't go after them, then that would send the wrong message to the public too.

    ForensicTec made it painfully clear that our government should get off their asses and really impliment stronger security on their systems.

    I mean damn, anyone with free software tools and a basic understanding of how to hack could have done this. The Army and other affected government facilities should be so lucky that ForensicTec was just curious, if it were another country doing this for profiling/spying/mounting an attack/sabotage, they'd be up shit creek without a paddle.

    It's proof enough for me that the U.S. is more at risk then I previously thought. The amount of taxes taken each year from every citizen is alot, at least they could do is take the time to make sure their password isnt...um.."password" among other things.

    I love my country, but it's embarassing to watch it do some of the things it does.

  • Thus spake the article: They made their findings public, said ForensicTec President Brett O'Keeffe, because they hoped to help the government identify the problem -- and to "get some positive exposure" for their company.
    Well they gots lots of exposure, not too sure about the positive part.
    And from the mission statement on their website [forensictec.com]:
    ForensicTec Solutions, Inc. intends to be the first name in computer forensics and network security. I think perhaps they left out listed as the defendant in a case brought by NASA and various military branches at the end of their mission statement?

  • Honeypots? (Score:2, Interesting)

    by tigga ( 559880 )
    I wonder if any of military boxes was honeypots with fake passwords , IDs etc.

    Any chance?

    Well, Army will not answer, of course ;)

  • Hacking the government's computers is stupid.

    Hacking the govermnent's computers during time of war is monumentally stupid.

    It's conceivable that because we are in a state of War, it might even be considered a treasonous (sp?) act.

    It's pretty funny tho, the article quotes the gov't as saying if someone finds a vulnerability, they should report it.

    Isn't that exactly what happened?


  • It is not right that government/military computers were audited for security without express permission from the government.
    ForensicTec was able to and *did* read sensitive information which they had no business in doing -- indeed they were not contracted by, and had no agreements with the government to do such a thing.

    And it was an "audit" instead of an "attack" because obviously the company had no ill intent; otherwise they would not have gone public.

    I speculate that the government probably already knew that such security problems could exist -- most organizations do. ForensicTec acted like a loose canon and did not help matters, but instead simply pointed out the obvious.

    Immediately upon stumbling across the government computer network two months ago, ForensicTec should have obtained permission before attempting to "help".
    Providing proof afterwards does not justify the means.

    Let's hypothesize that ForensicTec did ask to perform a security audit in the first place, and the request was declined by the government. Well, in the words of president O'Keeffe, "We could have easily walked away from it,".

    It was a self-serving stunt by ForensicTec for publicity purposes, and they dug themselves in too deep while hoping for the publicity (well, they got publicitly even though it's probably not the exact type they were looking for). The articles quotes: "get some positive exposure for themselves,".
    I don't believe any penalty will be too harsh, and it will hopefully set a precedent for other companiess to take a more discerning approach to such a sensitive matter in the future.

    I'm not saying that security holes shouldn't be researched when there looks to be a problem. But come on ... it can be done in a much better way than ForensicTec handled it. The government can't be blamed for taking exception to the method.

  • The Army suddenly realizes that the string of text "b3 411 7h47 U c4n b3" on its recruitment site was not, in fact, an error message.

  • Don't they know about the military's "Don't ask, don't tell" policy?
  • See no evil, hear no evil... Therefore, there must BE no evil! Get it?
  • Rule number one of hacking dot-MIL:
    You do not talk about hacking dot-MIL

    Rule number two of hacking .MIL:
    YOU DO NOT TALK ABOUT HACKING DOT-MIL!

    But then, they also broke rule number zero:
    Anyone with half-a-brain stays the FSCK away from dot-MIL.

    Funny thing though, I once did an ordinary google search that returned a page that I think was supposed to be internal use only, if not actually classified. It listed the current location of a warship. Hmm, I can't recall if it was when we first sent ships over by Afghanistan, or back during Desertstorm.

    -
  • If I recall, the head of Bush's computer security team said not too long ago that he believed government should take a less belligerent tone with white-hat hackers who crack systems without malice.

    While maybe these guys should have approached this exploit differently, the fact is that they meant no harm in their actions and in fact have probably done us all a service by exposing, without exploiting (except perhaps for some cheap publicity), somebody else's fuckup in the US ARMY.

    Does anyone really believe that any greater good is served by pursuing criminal sanctions against these guys?
  • Now, if this "company" hadn't bragged about their "accomplishments," do you think the Army would have noticed that their computers had been infiltrated?
  • I think the mistake these chaps made was to go public, without giving the DoD folks time to rectify the problem. If they had talked to DoD in secret, and helped them identify the weaknesses and secure their networks, they would have gotten something out of the whole thing. Going public with it was like throwing a stone at a large hornets' nest while standing 6 ft away. Of course the hornets will come after you!

    I think these guys got too greedy. They went public in the hopes that they'll get noticed and jump straight to "Step 3. Profit!!".

    I hope they learn their lessons.

Slashdot Top Deals

We are Microsoft. Unix is irrelevant. Openness is futile. Prepare to be assimilated.

Close