Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Security Government United States Politics

Unisys Investigated For Covering Up Cyber-Attacks 114

Posted by kdawson from the whadda-ya-know-a-trojan dept.
Stony Stevenson writes "Unisys, a major government IT contractor, is reportedly being investigated for failing to detect cyber-attacks, and then covering up its failings. Two US congressmen have called for an investigation into cyber-attacks aimed at the Department of Homeland Security, along with a contractor (that would be Unisys) charged with securing those networks. 'The House Committee on Homeland Security's investigations led them to believe the department is under attack by foreign powers, and could be at risk because of "incompetent and possibly illegal activity" by a US contractor. The congressmen didn't name the contractor in the letter. However, the Washington Post on Monday reported that the FBI is investigating Unisys, a major information technology firm with a $1.7 billion Department of Homeland Security contract, for allegedly failing to detect cyber break-ins traced to a Chinese-language Web site and then trying to cover up its deficiencies.'" Unisys denies it all.
This discussion has been archived. No new comments can be posted.

Unisys Investigated For Covering Up Cyber-Attacks More

Unisys Investigated For Covering Up Cyber-Attacks

Comments Filter:

  • One Million Dollars. (Score:3, Funny)

    by Gary W. Longsine ( 124661 ) on Tuesday September 25, 2007 @01:58AM (#20739691) Homepage Journal
    Dr. Evil: Here's the plan. We get the warhead, and we hold the Department of Homeland Security ransomed for.....One MILLION DOLLARS!!

    No.2: Ahem...well, don't you think we should maybe ask for *more* than a million dollars? I mean, a million dollars isn't exactly a lot of money these days. Unisys alone makes over one million dollars a year!

    Dr. Evil: Really?

    No.2: Mm-hmm.

    Dr. Evil: That's a number. Okay then. We hold the Department of Homeland Security ransom for.....One Point Seven BILLION DOLLARS!!

    • No.2: Ahem...well, don't you think we should maybe ask for *more* than a million dollars? I mean, a million dollars isn't exactly a lot of money these days. Unisys alone makes over one million dollars a year!


      Have you seen Unisys' quarterly reports recently? I'm not quite sure that's the case.

      (joking. They still make a ton of money. Just not as much as they need to support themselves.)
  • ...those nice and jolly GIF-Patent folks? i really do love'em!
    • Translation: some wonk at DHS caught an MSN IM virus from a chick on a dating site.

      Hey DHS, look for servicer.exe in the registry. Put a semi colon in front of the key. I'll sent you a bill. With lots of zeros.
      • Sounds like you're an "experience-expert" :)

        • Re: (Score:2)

          by rs79 ( 71822 )
          No, my 13 year old fixed my 15 year olds computer. I just watched.

          If I could get her to lie about her age I swear I'd rent her out as a consultant. She can evrn make the VCR stop flashing 12.

          Come to think of it I'll paypal anybody $5 who can show me a picture of a vcr flashing 12 inside Unisys.

  • Incompetence on both ends (Score:3, Interesting)

    by Ekhymosis ( 949557 ) on Tuesday September 25, 2007 @02:03AM (#20739735) Homepage
    This is incompetence on both ends, really. Security is not something that only the contractor has to worry about, its something the users also have to worry about. The government should freaking train their employees and get them to pass classes of security, especially in the DHS. If you don't pass, your pay gets docked or whatever. The NIST has some damn good guidelines for securing XP boxen, so I don't understand why they don't implement those policies (they are free, right???) and train their personnel to use them.

    Yes, Unisys may have screwed up, but then again, its all about the better mousetrap and all...

    • Re: (Score:3, Informative)

      by rindeee ( 530084 )
      Don't know about DHS, but DoD requires this annually. Don't finish it, bad things happen. It's not the greatest training, but it's 'okay' and repeating it annually drives it home. The problem is that many of the breaches are not in fact the fault of (or involving) end-users. Rather, they can be traced back to poor perimeter security, lack of patching, etc...all responsibility of admin types.

      • Re: (Score:1)

        by tacarat ( 696339 )
        The problem is that many of the breaches are not in fact the fault of (or involving) end-users.

        1/2 right, 1/2 wrong. The biggest problem with most IT departments is that end users are treated as customers rather than sources of security risks and unnecessary work. Computer usage is viewed as a right rather than a revokable resource. If they didn't have to kiss asses (especially of those higher up in the food chain) many problems wouldn't occur. There would be less people with admin rights to their bo

        • Re: (Score:2)

          by mpe ( 36238 )
          The biggest problem with most IT departments is that end users are treated as customers rather than sources of security risks and unnecessary work. Computer usage is viewed as a right rather than a revokable resource. If they didn't have to kiss asses (especially of those higher up in the food chain) many problems wouldn't occur. There would be less people with admin rights to their boxes,

          Probably less software which "needs" admin rights in order to be used.

          less unapproved software installed and less ge

          • Re: (Score:1)

            by tacarat ( 696339 )
            Probably less software which "needs" admin rights in order to be used.

            In all honesty, the vast majority of users don't need anything more than email, a word processor and a web browser. You're right, though. There are specialized programs that need to have admins rights to work. Unfortunately this is the fault of developers being lazy. When I did Help Desk, some of the newer folks could never replicate problems on tickets because they didn't try using regular user accounts instead of their admin acc
      • Curious here. Apparently you're employed by DoD? You stated that "bad things happen" in your post. Do you know, first hand, of any DoD firings because of this lack of action?

    • Re: (Score:3, Insightful)

      by Opportunist ( 166417 )
      Security first and foremost is not a product you buy. Security is a process or procedure you develop and stick to, review constantly and readjust to match the requirements of an ever changing "market" of threats. And as long as neither companies nor governments realize that (let's not even get to the users, they can only stick to the policy created, even if they knew better), no security will be seen.

      Security is actually the quest for the better mousetrap. The problem is, as soon as you have it, you get to

      • Re: (Score:2)

        by jofny ( 540291 )
        What does this have to do with the article? The issue isn't a lack of security really that's at issue. a) Managed Security Services never find really bad stuff except by accident b)The Chinese are in and out of our entire government largely at-will (it always takes them months or longer to detect the intrusions and exfiltration c) MSSP's -always- have clients that dispute their installation process and billing. Given these, UNISYS really is no worse off than anyone else in the industry and the conversation
        • Unisys is probably not worse than the rest, but, honestly, is that the way it should be? "I'm not worse than the rest, so why try harder?"

          What I blame is the way contracts are. A contract specifies what is to be done, and a company will do that, to the point, and not an inch more. There is some regulation, written more than a year ago (in security terms, somewhere in antediluvian times), and that regulation is upheld. Why or for what, nobody cares.

          And unless that attitude towards security, or any procedure,

          • Re: (Score:2)

            by jofny ( 540291 )
            Right. But all of that is essentially old news and oft covered here. In fact, it's such conventional wisdom that long after it IS fixed, youll still hear people saying it on Slashdot. The NEW information - which is what makes this more than yet-another-article-about-the-same-old-crap is the alleged -intentional- deception and that they're being criminally investigated for it (vs dealing with it withing the scope of contractual control)

            Some security rules or procedures are drafted and never reviewed.

            E

      • Re: (Score:2)

        by mpe ( 36238 )
        Security is actually the quest for the better mousetrap. The problem is, as soon as you have it, you get to face the better mouse and the race is on again.

        Thing is that even the initial mice are "smart rodents".

    • Re:Incompetence on both ends - Gov't BS (Score:3, Insightful)

      by Anonymous Coward
      Anyone that has worked inside government IT whether directly or as a contractor will know that this is government politics at play. There are exceptions, but most highly skilled and trained system administrators are going where the money is, and it's not working as a gov't employee. I know. A gov't IT department may have policies and procedures up the wazoo, but at the same time no budget or authority to ensure compliance. Exception is the rule in gov't. Here's an example:

      "Sir, there appears to be atta
    • I still remember the security training video.

      A VAX sysadmin leaves for a new job in the same facility but on a different government contract.
      A few days into his new job, he realizes he could really use a script he wrote for the old job.
      Rather than asking his replacement to e-mail / print / backup to tape / whatever the script,
      he checks and finds he still has access to the old gear. One FTP later, Mr. Sysadmin is
      doing 3-5 in Federal prison. These guys don't fark around.

      Its sort of like taking out a credit

  • Page 2? (Score:2, Informative)

    by clarkkent09 ( 1104833 )
    I guess if nobody reads the article, they figure it's not that important where they (don't) start reading from? Or else Stony Stevenson likes to read articles from back to front? I wonder how many /. readers will even notice.

    Here is page 1 anyway: http://www.washingtonpost.com/wp-dyn/content/article/2007/09/23/AR2007092301471.html?nav=rss_business [washingtonpost.com]

    • Re: (Score:3, Interesting)

      by Stony Stevenson ( 954022 )
      Hey don't shoot the messenger. The linking to the Washington Post was a mod job. I had originally linked to a different site which referenced the Washington Post in its article, but which overall was more a summary of the whole affair.

  • Cyber (Score:3)

    by julesh ( 229690 ) on Tuesday September 25, 2007 @02:12AM (#20739789)
    Can people please stop abusing the term "cyber". I mean, it once had a useful meaning (electronic control of physical processes) that is now on the verge of being lost.
  • Shouldn't the government be hiding their own ineptitude? Lou dobbs should be rolling in his..oh..he's alive ain't he.
    • I think we can find a government contractor that will put Mr. Dobbs in a position to roll, however due to this month's annual red tape increase, we might have to form a committee to discuss the appointment of those that will oversee the bidding procedure of the swiss banks that will reroute the deferred compensation from the winning contractor to the appropriately untraceable accounts. The whole process might realistically be completed in 50 years or so, which may seem like a long time, but rest assured the

  • Well... (Score:4, Insightful)

    by Bananatree3 ( 872975 ) on Tuesday September 25, 2007 @02:16AM (#20739813)
    Security of critical gov't systems SHOULDN'T be left to some missionary IT support. It should be done in house. period.
    • missionary = mercenary

      • Re: (Score:1, Offtopic)

        by Opportunist ( 166417 )
        Oh, missionary is just as right. They sell you promises of salvation if you turn away from your old salvation bringer, who is first of all slandered 'til you don't believe in him anymore, but if something blows up, your best hope is to pray 'cause there ain't much more you can do.
    • There is this thing called COMPELLING GOVERNMENT INTEREST that seems to be ignored in this age of civil rights and political correctness [wikipedia.org]. In the interests of national security there ought to be departments that should look like Hart-Celler [wikipedia.org] never became law. Persons with sufficient pedigree to allow a runback to their ancestral lands should not be seen in such departments. Praat jy Amerikaans? [nuclearweaponarchive.org]
  • This is nothing new. Think of Blackwater, Halliburton, Boeing, ..., ...

    Big contractors like these simply get slapped on the wrist and keep going on with business as usual. The same thing will happen with UNISYS
  • And here I thought the free market would protect me from that stuff.

    • Re: (Score:3, Insightful)

      by Opportunist ( 166417 )
      This is about government and contractors. Free market is next door. Actually, it's down the corridor, then right, then ... ask again, I forgot where it was, we hardly use it today anymore.

  • Typical govt C&A hokum (Score:5, Interesting)

    by mbstone ( 457308 ) on Tuesday September 25, 2007 @03:14AM (#20740143)
    Among my various other gigs, I've often worked as a contractor doing certification and accreditation (C&A) paperwork for half a dozen fed. govt. agencies. "C&A" is the required paperwork that is supposed to certify that an agency's systems have been secured in accordance with applicable NIST, DoD, etc. standards. Understand that many, if not most, agencies devote far more time, money, and effort to making the paperwork look good than they do to actually securing the systems. Some agencies, and some of their contractors, think the NIST SP 800-37 C&A process, DIACAP, FISMA reporting, etc. is just a worthless paper shuffle. Some are even still using SP 800-26 risk assessment questionnaires in lieu of a full C&A. I can't tell you how many job interviews I've gone on where the contractor company's hiring manager would actually brag about how they are going to falsify the C&A and snow the agency's inspector general, OMB, or whomever. My standard response to that has been, "Can I visit you in prison?" (Usually this spells the end of that particular interview process.) Since, up to now, nobody has actually gone to federal prison for submitting bogus C&A documentation, some people thought they could get away with this kind of bogosity forever. A strange and unlikely confluence of events caused the Unisys situation: they (allegedly) cheated on the C&A process, AND the intruders pwned the DHS network, including the main admin password. The successful intrusions caused an audit which exposed the C&A fraud (which otherwise would have slid on by). Too bad, so sad.

    • Re:Typical govt C&A hokum (Score:4, Informative)

      by Rich0 ( 548339 ) on Tuesday September 25, 2007 @06:04AM (#20740893) Homepage
      I'd say the same thing applies in many regulated industries where it is required to document that a computer system meets various quality standards.

      Far more money gets spent on documenting that the system works correctly than actually making the system work correctly. Often you end up with a system that looks great on paper that has lots of bugs in actual operation. Lots of tests get written that look like they test something but which rarely uncover bugs. The whole exercise costs a fortune, and largely exists to satisfy auditors (whether internal or external to the company performing the exercise).

      Techniques like agile programming, automated testing, code reviews, etc are shunned because they're non-traditional and don't generate lots of paper. There is a fear that in an audit a government representative who hasn't signed on to the methodology might hammer you to death over not having a 2000 page design specification and a load of tests written and executed by everybody from the programmers, to IT QA, to end users (often the same exact test gets reformatted and run by all parties just so that it can be said that everybody had a hand in testing).

      I once had to evaluate whether it was safe to directly modify a particular database field in an application, and was relieved to see that this application had one of those aforementioned thick design specifications. Then I was dismayed to find out that the only documentation there was on the field was the fact that it existed, what table it was in, what it was called, what kind of field it was, and what it contained (WidgetCorrectionFactor = Factor used to Correct the Widget value - really helpful as if I couldn't have guessed that much from the field name!). Absent was any kind of documentation as to what code might reference that field or what tables might join to it. I could search the source for the field name, but then there wasn't any kind of documentation or flow charts indicating the typical system workflow or in what order the various routines might get called. It was like documenting all the cell types in an animal without bothering to indicate what the actual animal looked like and how everything went together. But the auditors loved the document.

      The issue is that most often QA and management and external auditors have no way of knowing whether a piece of code actually works or not. So, instead they look for stuff they can understand - paperwork. The paperwork does tend to lead to some basic form of quality, but rarely does it lead to code that doesn't break down on all the various one-off-cases that don't make their way into human-executed tests. I'll take a simple automated test that can be executed against a matrix of input values against a complex human-executed test that only ever gets run once (and is likely not repeated every time a piece of seemingly-unrelated code is touched) any day!

      • Re: (Score:3, Funny)

        by jafac ( 1449 )
        To quote a rigorous defender of such regimes from a previous employer:
        "Configuration Management is a serious engineering discipline!"
    • I, too, have done my share of govt. C&A work, and share a lot of your observations and frustrations.

      One of the problems with the system is that it lets someone ignore the deficiencies by simply checking a box that says it's acceptable risk to their organization.

      Not to defend Unisys's actions here, but in one article I read about this it indicates that Unisys told them they needed XYZ, but DHS responded with "But we want ABC", so that's what they gave them.

      I was on a gov agency C&A a few yea

  • Unysis (Score:2, Interesting)

    by syedelyas ( 1159799 )
    "Security Unleashed - At Unisys, we're looking at security in an entirely new way. Security is no longer a defensive measure. It's an enabling catalyst for achievement. Unisys Secure Business Operations help to unleash your full potential." taken from Unisys web it says they can make everything possibility with their motto "we help you adapt quickly to meet ever-changing market demands and be resilient, agile and open" is a trash after all and hoping for a big fish to come after.. but the quote that they h
    • Actually, this webpage speaks the truth, and I do believe them. Security is for them appearantly not defending you against threats but rather covering you in enough buzzwords that you don't notice that nothing is being done.

    • Re: (Score:1)

      by ShakaZ ( 1002825 )
      Heh that reminds me of when i worked for them here in Belgium a few years ago. Outsourcing was the big new trends in IT with reports of huge cost savings being made. So a new team was made to join the juicy business. After 3-4 months they hadn't really achieved anything, yet around that time i saw an interview of a Unisys manager saying the new section had been making great advances and was providing loads of opportunities, pure spinning...
  • Any hacker worth his salt covers his tracks and leaves no traces, what did they expect?
    • This isn't needed with Unisys! Unisys' kind of security is (quote from the reply above) "an enabling catalyst for achievement. Unisys Secure Business Operations help to unleash your full potential."

      Appearantly they mean whoever wants to hack their customers and not their customers with that statement, but you can't say that they're lying.
  • The press office must be having a great day... http://www.tradingmarkets.com/.site/news/Stock%20News/637040/ [tradingmarkets.com]

  • Although the hackers lifted data from unclassified systems, Paul Kurtz, a former White House cyber-security adviser, said that even unclassified data, if stolen in large enough quantities, could provide important clues about U.S. military and corporate trade secrets.
    In my country it is impossible to steal unclassified data. That doesn't even make any sense.

    • Re: (Score:3, Insightful)

      by argent ( 18001 )
      What? Look... things like credit card numbers and passwords to online accounts aren't "classified data", but they certainly *can* be stolen. Plans for as yet unreleased products can still be stolen, even if they're plans for devices with no military application at all.

      On the other hand, classified data can include material that people CAN find out from their own observation if they happen to be in the right place at the right time. Like whether a particular vessel is in a particular location... individual o
      • We are talking about DHS data, right? Unless I am grossly mistaken, it is governmental and, therefore, either "classified" or "unclassified". If it is unclassified, there can be no theft of data to speak of.

        On the other hand, again if I understand you correctly, what is being stolen is the ease of access to the data, not the data itself (which, being governmental and unclassified, can not be stolen). That ease of access can enable the thieves to gain insight into some of the classified data.

        If most o

        • Re: (Score:2)

          by argent ( 18001 )
          We are talking about DHS data, right?

          I don't know. You don't know, either.

          Not all data on government systems belongs to the government. Some of it is proprietary information owned by private individuals and institutions and licensed or otherwise made available to the DHS (for a rather obvious example to prove my point, Windows is licensed from Microsoft, you can't get a copy of Windows for the price of a FOIA request).
    • "Unclassified" doesn't mean valueless or null, etc. "Classified" data is that which has an impact (of varying degrees) on national security. "Unclassified" is all data that isn't in one of the "Classified" categories.
      By itself or in normal amounts or normal handling, Unclassified has no impact on nat'l security. Nat'l security has nothing to do with what *the*company* considers important. Examples: almost all contractor's business info that doesn't overlap class. stuff, source code to company tools, blue
    • When I was in the Air Force, operational security also included something called EEFIs. Essential Elements of Friendly Information: little pieces of "seemingly" non-important information that, when put together with other pieces, equal real intelligence data.

      Actually, it does make sense.

  • Unisys? (Score:3, Funny)

    by Guppy06 ( 410832 ) on Tuesday September 25, 2007 @07:03AM (#20741201)
    "Unisys denies it all."

    They Have the Way Out!(TM)
  • Reminds me of this...

    11-13-91
    Scores of newspapers and commentators denounce a Doonesbury series about Dan Quayle's DEA file and Brett Kimberlin, a federal prisoner put in solitary confinement to keep him from repeating his claim that he sold marijuana to the vice president. "Who cares what a comic strip may or may not say about me or anyone else," said Quayle. Trudeau is denounced on the floor of the U.S. Senate, as numerous papers withhold the series and some drop the strip.
    -- Doonesbury timeline, 1990 [doonesbury.com]

    As

  • From the Wash Post article: "...under the follow-on contract, "DHS, citing lack of funding, elected to stop paying for security monitoring services," but that the firm continued to provide the monitoring anyway." The follow-up contract started in '05. DHS wasn't PAYING for security monitoring, but Unisys did it anyway (which is illegal, I believe). Therefore during the breach in 2006, DHS basically got what they paid for. This is DHS's management utterly failing and Unisys getting the blame for it.
    • More on that line of thought in Wall St Journal, http://online.wsj.com/article/SB119067563990437958.html?mod=googlenews_wsj [wsj.com]

      Federal law-enforcement officials said the FBI was taking a look at the incidents -- and Unisys's response -- but said the allegations were so far not viewed as a major breach of national security. "The FBI is making sure that this was not something out of the ordinary," one official said, noting that attempts by hackers to infiltrate U.S. government computers are "everyday occurrences.

  • Not surprising (Score:1, Interesting)

    by Anonymous Coward
    I worked for Unisys some time ago as helpdesk support for their DHS account, and this is no surprise to me at all. They are absolutely inept and have no concern for security. Among the things that just amazed me:

    1. When a user asked for a password change, we were not supposed to challenge them in any way. This included people as high up as the Secretary(or more accurately-the secretary's assistant), but we didn't even have a list of who his assistants were.
    2. Each desk had two systems, one Unisys and one DH
  • Didn't you guys read the memo? Paying for resources to detect/prevent cyber-attacks is way more expensive than simply covering up the tracks after a cyber-attack. They're just watching out for their bottom line like every other corporation in America. Can't blame them for that.

    ;)

  • 1.7 billion (Score:3, Funny)

    by greenbird ( 859670 ) on Tuesday September 25, 2007 @01:29PM (#20746587)

    What I want to know is what the hell could cost 1.7 billion dollars? Are they putting HA systems with redundant fiber channel SANs on every desktop? How big is the DHS? If were talking even 100,000 people that's over $17,000 per person in IT costs. For that kind of money they should have had big time segmentation with all kinds of traffic monitoring and IDSes along with honeypots and tarpits. Hell, for that kinda money I would even include fart detectors.

  • damnit Unisys! I TOLD you to turn off telnet in your inetd.conf!! but you just didn't listen..

Slashdot Top Deals

"Hello again, Peabody here..." -- Mister Peabody

Close