Government Cyber Storm Ends 124
Bemmu writes "Mainichi Daily News and BBC News are reporting that the 'Cyber Storm' operation, for testing how prepared America is for fending off cyber attacks, has now concluded. Apparently they even used bloggers as part of the operation, as relayers of misinformation!"
Misinformation? (Score:5, Funny)
Re:Misinformation? (Score:2, Interesting)
Re:Misinformation? (Score:5, Insightful)
This lot don't want people to take information from anywhere else than themselves, Fox News and the Washington Times.
But I suspect that the reason Blogs were in the simulation was because of their speed of reaction rather than anything else.
The biggest cyberwar effect being seen today is freebooting groups of partisans launching unofficial (and possibly sometimes official) actions. A big concern in the intel community is that these unofficial actors my tip an international incident into a crisis.
Take the current spate of attacks by Islamist hackers attacking targets in Denmark. Imagine if Denmark was a crazy-actor like Libya or Iran and a cyberattack by one of those unofficial freebooters took out a major infrastructure. Or imagine what might happen if Iranian hackers attacked Denmark, took out a major infrastructure and Danish hackers retaliated in kind.
Add freebooter hackers into an environment where diplomats are doing everything they can to avoid escalation and the potential for disaster is large.
Re:Misinformation? (Score:2)
Re:Misinformation? (Score:3, Interesting)
Re:Misinformation? (Score:1)
Re:Misinformation? (Score:1)
I can't take it anymore!
Re:Misinformation? (Score:2)
Worst Fears Realized (Score:2)
Re:Misinformation? (Score:1)
Lies! (Score:5, Funny)
Re: (Score:2)
Internet attack? (Score:5, Funny)
Sounds realistic...
Re:Internet attack? (Score:5, Funny)
Dude, the simulation is supposed to be accurate, remember? I bet the SS guys playing the 3v1l h4x0rs even drew pimples on their faces, wore CCC-branded shirts, didn't wash for 2 weeks, bought the latest issue of 2600 and messed up the basement with old slices of pizza before doing their simulated deeds...
Re:Internet attack? (Score:1)
Re:Internet attack? (Score:1)
Re:Internet attack? (Score:4, Funny)
Re:Internet attack? (Score:1)
"Apparently they even used bloggers..." (Score:5, Funny)
Press Release (Score:2, Funny)
- Emperor Bush
Re:Press Release (Score:5, Interesting)
Uh oh (Score:5, Insightful)
Re:Uh oh (Score:5, Insightful)
Cyber-BS (Score:5, Insightful)
What? they finally told Microsoft to release a secure OS or else...?
Seriously, most "cyber-attacks" are as much the result of criminals, professional spammers and teenage virus writers as it is the result of the single shoddy OS they target. Both are needed for an attack to work. The rest can easily be taken care of by training IT professionals better and by selecting more secure OSes.
And no, before you ask, I'm not trying to push *nix or MacOS against Windows: while I do believe Windows is badly designed at core and will always be insecure one way or the other, if Microsoft could make it secure, it would most certainly give a lot less headaches to the DHS folks.
Re:Cyber-BS (Score:3, Interesting)
Articles like this [bbc.co.uk] are the ones that we need to be worried about.
Re:Cyber-BS (Score:1)
Re:Cyber-BS (Score:1)
CYBER STORM LOL (Score:2, Interesting)
Right... This way they're not actually vulnerable to anything, such as BotNet attacks by little script kiddies who want ad revenue. Or maybe they just were afraid of Windows Update.
Re:CYBER STORM LOL (Score:2)
Re:CYBER STORM LOL (Score:1)
Re:CYBER STORM LOL (Score:2)
Re:CYBER STORM LOL (Score:1)
Re:CYBER STORM LOL (Score:3, Insightful)
This just in... (Score:5, Funny)
Bloggers eh? (Score:1, Interesting)
Re:Bloggers eh? (Score:2, Informative)
It was carried out on secure computers in the basement of the Secret Service in Washington DC.
There was no effect on the internet.
Re:Bloggers eh? (Score:1)
Re:Bloggers eh? (Score:1)
Crack (Score:5, Funny)
Mock attack = Mock results (Score:5, Insightful)
"IT companies and state and foreign governments also played a role in responding to the mock attacks."
These "simulated" attacks are all well and good, but they are being performed by entities meant to keep the system secure. Isn't that only attacking from one angle? Did these groups attack the systems like scriptkiddies would? Like seasoned professionals not skewed or influenced by "standard corporate security measures"? Did they take into account social engineering and attacks from the inside?
Re:Mock attack = Mock results (Score:1)
Take it easy. they're public servents.
Re:Mock attack = Mock results (Score:2, Interesting)
Re:Mock attack = Mock results (Score:2)
Re:Mock attack = Mock results (Score:1)
Besides..."EMP" is too cool to pass up.
Re:Mock attack = Mock results (Score:2)
Re:Mock attack = Mock results (Score:1, Insightful)
Ya gotta start somewhere.
Ya gotta make sure your doors and windows are locked before you install an alarm system. Ya gotta make sure your alarm system works before you install surveillance cameras. Ya gotta make sure your surveillance cameras work before you hire armed guards.
This may become an annual or biannual event. Maybe they're only at the stage of making sure the
Re:Mock attack = Mock results (Score:2)
Re:Mock attack = Mock results (Score:2, Insightful)
So that's what it was (Score:1, Offtopic)
That would explain the "Nude Paris Hilton demonstrates latest version of FireFox while denouncing Bush administration" links that mysteriously went to the Bonneville Power Administration.
raises the profile of computer security (Score:2)
People truly rely on the internet now. Perhaps it is not as important as the telephone system, at least in terms of preserving life and limb, but the economic damage from a sustained, widespread internet outage would be tremendous.
On the plus side, if the internet was unavailable, I think many people would at leas
Re:raises the profile of computer security (Score:2)
I was going to joke about me not knowing about the real world and ask you to point me to a wikipedia article or website which explains it, but I was foiled by the article on real world [wikipedia.org].
Maybe the real world is inferior to the fake world (Score:1)
Re:raises the profile of computer security (Score:3, Funny)
The only thing I want fom the RealWorld is a few electrons, and a continuous supply of caffeine.
And maybe a little less light.
Now let me get back to my LCD Tan...
They apparently forgot ..... (Score:3, Interesting)
perpatrated by their own employees, for former disgruntled employees.
The Cyber Storm exercise appears yet again a vender dog and pony show to
impress the current check signing crowd to buying more worthless stuff.
Some years ago MS tried to wire-and-run a crusier off the Virginia coast in
a test of Windows NT at ship control with a minimal crew. NT crashed about
30 minutes into the test and the ship had to be towed back to port.
Toodles!
Re:They apparently forgot ..... (Score:4, Insightful)
I can't provide references off the top of my head, bu IIRC some estimates suggest that up to 70% of "attacks" come from within - disgruntled or corrupt employees being the most obvious example.
Naturally, most companies aren't too keen to issue a press release saying "Yeah, this chap we employed walked out the door with a couple of thousand customer records when we sacked him last week", so these estimates are little more than educated guesses. But even so, if there's only the tiniest grain of truth to them it demonstrates how important it is to consider both internal and external security.
Re:They apparently forgot ..... (Score:3, Interesting)
I hate to put cold water on this parade, but cyber attacks aren't nearly as effective as good old infrastructure attacks. Most of the control systems used for distribution networks are designed with an awful lot of fail-safe behavior. You can damage things, but doing it in a way that will bring th
Re:They apparently forgot ..... (Score:2)
People divulge their passwords/access tokens easily in comparison to spending days/weeks cracking a system.
There's an article here about http://www.theregister.co.uk/2002/04/11/give_your_ password_to_complete/ [theregister.co.uk] people willing to hand over their passwords.
You should also be careful of where you are- for example, people q
Re:They apparently forgot ..... (Score:2)
True, but you don't often see a botnet bribing people in exchange for specific passwords. (I'm excluding phishing at this point and thinking about corporate espionage rather than bank fraud).
If someone's hanging around your offices offering people brown envelopes in exchange for passwords, they've gone to some trouble and they're clearly determined to attack you in particular. There's probably not a
Re:They apparently forgot ..... (Score:1)
Re:They apparently forgot ..... (Score:2)
Bloggers in a basement (Score:2, Funny)
How many bloggers can be crammed into the basement of the Secret Service in Washington?
Re:Bloggers in a basement (Score:2)
Quick - someone save the internet (Score:5, Funny)
I've got this picture of DHS undercover agents running around screaming "the sky is falling, the sky is falling!", and then making chicken-clucking noises. Nobody panics, and they proclaim "Right then, all is well".
My tax dollars hard at work...
Re:Quick - someone save the internet (Score:1)
Why then... (Score:3, Funny)
Say it's not so! (Score:2, Funny)
But, but, but... Like, it so HAS to be true! I mean, like, 20 people on my Livejournal friends list linked to it just today.
From TFA (Score:1)
There was no effect on the internet.
The exercise was the latest in a series of simulated attacks, including a gas attack on the New York subway.
------------
New York Subway, Interior
A loud booming noise, followed by the sound of escaping gas is heard. People fall on ground, writhing in agony. Two gas-masked figures enter.
OFFICER ONE: Remain calm, people! I am with the ATF, and this subway gassing was just a test of our nation's emergency contingency plans! Please resume what yo
Re:From TFA (Score:2)
An amazing similarity. In either scenario, the bodies on the ground weren't consulted as to whether or not the problem was serious.
As for recovery in New Orleans and that general area, it will be a very long time if ever coming. Why? Even to me, sitting in front of a monitor a thousand miles away, its extremely obvious that the only recovery the feds are interested in is just enough to the port itself to get the oil flowing ag
Well, there you go (Score:2)
Astroturfers are terroristss.
Slashdot Headlines (Score:3, Funny)
Well, that explains most of the recent Slashdot headlines.
Harbinger of bad news? (Score:4, Interesting)
What the world knows of virus and malware programs is only what has been discovered AND disclosed to the public. It is quite probable that there are malicious programs out there that are stealthily eating away at personal and business data or waiting till the right moment to do so, or worse, transmitting small bits and pieces of it back to the 'boss' on a regular basis. The latter has already been shown to be effective.
Any exercise done to improve or test computer security is farsical in comparison to what the imagination of any geek can dream up. No, I don't have the program sheet for the tests done, but I do know that they cannot have tested for security against what I can dream up... and trust me, if I can dream it up, its probably already being done.
Imagine a program that replicates itself, is small, does not trigger AV software, is executed by the computer user, does no damage, but propels itself across the networks until it finds itself on the computer of some user whose first name is Bill, and belongs to the domain microsoft.com. Now, every time that Bill lets his screen saver run, or recalculates some values in MS Excel, the program looks to see what the oldest file on the computer is, and queues it for transmission to another host when such transmission is likely to be unnoticed. (you figure out when that would be). Its not so hard to see such a program working, and going undetected by AV software. Yes, yes, I'm sure you could figure out how to catch it, but the time from zero-day to erradication would be a long time indeed.
The selectivity of this program would make it very difficult to identify and get rid of. Especially if it is passing data from one infected machine to another so that final destination is impossible to find. I hate to say it, but Tor and BT could be used for impossibly complex industrial and government spying.
The only way to stop malware is to disconnect the network cables, or very strictly control what passes over them to your computer or network. That gets difficult when such programs can mutate and then try tunneling via http etc. An http post request would be difficult to defend against if you are running an http server?
Now, to get modded down: Didn't the US government think they were prepared for natural disasters? I'm sure that people in charge of such things do all they think reasonable to be prepared, but that force5 program is just waiting for them....
Re:Harbinger of bad news? (Score:2, Interesting)
I think I get what you mean, but in the interest of humor: when was the last time a porno site popup killed you? For a more realistic bridge between far out sf and reality, read Peter Watts. The first two books in his Rifters trilogy are scheduled for reprint in 2007, and until then , he has made them available for download in PDF format on his website under the CC licencse http://rifters [rifters.com]
But is it self-aware? (Score:2)
If the program can actually think, I'll be impressed. The only algorithms humans have been able to come up with would take far more than the combined processing power available on the planet to simulate anything approaching a human consciousness.
And, if the program doesn't have a human consciousness, it can't mutate as you describe:
That gets difficult when such programs can mutate and then try tunneling via http etc.
No program is smart enough to "mutate", wholly on its own, to try tu
Re:Harbinger of bad news? (Score:2)
That'll Never Work (Score:1)
Naturally I'm one of the bloggers for whom that does not apply.
Slashdot CyberSecurity Consulting (Score:4, Insightful)
Also keep in mind that the information security profession is still very immature. Remember that doctors and lawyers "practice" their professions. Do we "practice" information security? Engineers are legally required to submit their designs for peer review for all municipal projects. Is that same level of review required for information security for government efforts?
We still have quite a way to go, but we are making steps forward.
Re:Slashdot CyberSecurity Consulting (Score:2)
Regarding Katrina, there was an exercise conducted beforehand called Hurricane "Pam" that forecast many of the problems that were encountered while providing relief to Katrina victims. If the government is unable to integrate the results of disaster management exercises, what guarantee is there that the lessons of *this* drill will be integrated before the nex cyberattack.
In many ways this situation is worse.
Re:Slashdot CyberSecurity Consulting (Score:1)
Say I make the kid down the block, who happens to be good with computers, the head of security at a very large company. He's secured a few machines with Linksys routers, and maybe installed Zone Alarm. Then the company gets hit with a large attack and he crumbles under the stress of trying to deal with it. That's incompetence,
Re:Slashdot CyberSecurity Consulting (Score:2)
I fear the same thing will occur due to this cybersecurity drill. The drill will point out problems, but the entire exercise will be treated like Cassandra and will be forgotten about until the actual disaster hits. Then everyone will r
Re:Slashdot CyberSecurity Consulting (Score:1)
The hope is that the same mistake doesn't get repeated for whoever has the lead on dealing with the cyberwar stuff.
Re:Slashdot CyberSecurity Consulting (Score:2)
We have someone in charge of cyberwar? I know that there was some sort of cybersecurity coordination post created by Clinton, but I lost track of it in the huge shuffle that followed the consolidation of the Department of Homeland Security.
Scratching my head..... (Score:1, Offtopic)
Considering the massive digital leakage that has been being reported (information leaking from all sorts of places, includintg the IRS - the real reason they dropped teletax).... and the most popular OS being one produced by what is primarily a marketing company, not even a secondary technology company, but a legal firm and buyout company (Microsoft)...where their own anti-spyware disables third part anti-virus software (Symantec - a cpu and resource hog)...
Lets get real here. Stop wasting Tax payer m
So.... My blogs can be censored? (Score:3, Interesting)
Re:So.... My blogs can be censored? (Score:2)
Yes, and the summary and all of the articles that I've read never discussed How they dealt with the threat of bloggers spreading misinformation. Of course, they can't--that would give valuable aid to the enemy.
How would the government respond--in theory, during a crisis--to misinformation being spread via a popular blog? Do you have any guesses?
I don't think that it's a huge step to say that--during a crisis, of course--whoever hosts the blog would wo
How do they do this? (Score:2)
Re:How do they do this? (Score:2)
1. Employees of the NSA sign in to computers in a sealed lab with a secured, high-speed connection to the internet.
2. They begin to surf Russian porn sites, skipping the innocuous Playboy knockoffs and looking for hardcore fetish sites, usually along the lines of http://goatse.ragingfist.net/ [ragingfist.net] . Warez sites are also checked with the following top-secret search terms: "OMG BF2 TRAINER LOL".
3. All viruses and portscans are logged from above activity.
4. After 36 hours of non
Let's hope there's no sequel (Score:1)
It's been said before... (Score:1)
Some mock attacks were aimed at causing a "significant cyber disruption" that could seriously damage energy, transportation and health care industries and undermine public confidence, said George Foresman, an undersecretary at the Homeland Security Department.
Then why are they on the pulic internet amd not their own private one? I guess cost is one factor.
qz
Auch! (Score:2)
That one's gotta hurt! Expecting some awesome replies to that one.
Re:Auch! (Score:2)
What, Hannity and colmes aren't good enough anymore?
Which blogs? (Score:2)
Re:Which blogs? (Score:1)
Hmmm let me guess... (Score:2)
No way! (Score:2)
In Russia...
Misinformation? (Score:1)
*Whew!* I knew it! I knew that there was no way that they would have let Bush be President. I told my friends "I think that it's some sort of misinformation campaign, maybe they're just testing us!", and I was right! So now that it's over, do we get to find out who the real guy in charge is?