Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
Security Communications Government United States

US State Department Can't Get Rid of Email Hackers 86

An anonymous reader sends this quote from a Wall Street Journal report: Three months after the State Department confirmed hackers breached its unclassified email system, the government still hasn't been able to evict them from the network, say three people familiar with the investigation. Government officials, assisted by outside contractors and the National Security Agency, have repeatedly scanned the network and taken some systems offline. But investigators still see signs of the hackers on State Department computers, the people familiar with the matter said. Each time investigators find a hacker tool and block it, these people said, the intruders tweak it slightly to attempt to sneak past defenses. It isn't clear how much data the hackers have taken, the people said. They reaffirmed what the State Department said in November: that the hackers appear to have access only to unclassified email. Still, unclassified material can contain sensitive intelligence.
This discussion has been archived. No new comments can be posted.

US State Department Can't Get Rid of Email Hackers

Comments Filter:
  • by Dr_Barnowl ( 709838 ) on Friday February 20, 2015 @06:23PM (#49097425)

    Isn't asking the NSA to secure your system like asking the fox to check the barbed wire fence around the henhouse?

    • Re: (Score:2, Funny)

      by Shakrai ( 717556 )

      The National Security Agency (NSA) is a United States intelligence agency responsible for global monitoring, collection, decoding, translation and analysis of information and data for foreign intelligence and counterintelligence purposes - a discipline known as Signals intelligence (SIGINT). NSA is also charged with protection of U.S. government communications and information systems against penetration and network warfare. The agency is authorized to accomplish its mission through clandestine means, among

      • by Anonymous Coward

        Well, that explains why the NSA hacked into computers belonging to congress! They were "protecting U.S. government communications and information systems," obviously.

        With a reputation like that, I can't see why anyone would even consider it a possibility that they also were responsible for this.

        • by rmdingler ( 1955220 ) on Friday February 20, 2015 @08:24PM (#49098121) Journal
          If you've lived in the U.S. long enough, you may find yourself of the opinion that the real enemies of the state are in Congress.
          • In all actuality, Congress was a part of a democracy, to put a finger on Congress would be like the pot calling the kettle black. What we have is a first world problem and they don't run a democracy. There cannot be a single order over the entire world with respect to individuality or culture.

          • ANSWER: use real post office mail. Not hackable AND we can save the US post office from looking for additional revenue too. Sometimes convenience needs to be examined under a microscope. Send a hard copy. Then the NSA will get a paper cut opening envelopes and quit spying...Naaaaaah! At least it won't be so easy to spy on the disgruntled crowd.
    • Re: (Score:2, Funny)

      by Anonymous Coward

      Yes but all the fox does is record all the clucks between chickens and run cluck search algorithms to make sure none of the chickens are actually terrorists chickens. The fox apparently did nothing about the chicken outside the henhouse clucking.

    • For some reason we have the civilian crypto folks, the overseas & local info spies and the cyber warfare command all packed into the same agency. It's a bad design that compromises their mission.
  • by DaHat ( 247651 ) on Friday February 20, 2015 @06:27PM (#49097437) Homepage

    ... or is that 'too nuanced’ [nationalreview.com] of an explanation?

    Maybe we just can't clean our way out of these attacks?

  • Does 'Unclassified' is this context mean not yet given a class, or is it the same as 'declassified'?

    • by Anonymous Coward

      No, unclassified means that it has never been classified. It may still be "sensitive" material though.

  • by Razed By TV ( 730353 ) on Friday February 20, 2015 @07:01PM (#49097715)
    ...how to get them off of your network, then I don't think I'd trust you to accurately determine what the hackers have and haven't accessed.
  • The US may have to allow more immigrants in order to be competitive with China and perhaps other populous countries in a potential cyber-war. It's more or less a game of man-power. Either that, you siphon techies off of other fields. Maybe the "secret plan" is to send all non-military IT work to India, freeing the rest to be cyber warriors? Our trade deficit will be Jupiter-sized, though.

  • by Noryungi ( 70322 ) on Friday February 20, 2015 @07:17PM (#49097789) Homepage Journal

    Hellooooooooo NSA! Do you like having a taste of your own medicine?

    This is the future, people. Hack and counter-hack. Ad infinitum. In other words, bleak and without hope.

    • News Flash: The NSA isn't part of the US State Department. They are part of the US Department of Defense.

      Generally those are departments are considered to be substantially at odds; one is in charge of diplomacy, the other is in charge of blowing things up. They have different wants and needs, and generally would not feel each others pain.

      If you hate something but don't understand it, what do you really hate? Answer: You really hate yourself, because without understanding you must be hating a thing that exis

  • by Narcocide ( 102829 ) on Friday February 20, 2015 @07:55PM (#49098001) Homepage

    Assuming its not actually one of their own employees/consultants helping re-infect the systems maybe one or more of these fairly common situations applies:

    * Using Cisco routers with default configurations and firmware that hasn't been updated in years...
    * Using unencrypted, plain text authentication for systems instead of public key auth...
    * No password strength standards (some employees predictably using "911" or "123456" for their passwords)
    * Employees allowed to re-use the same passwords after the supposed "clean sweep"
    * Windows filesharing services
    * Wireless networking at all, or possibly using WEP or even completely open
    * Microsoft office documents from outside sources
    * HP printers, or really any network/wifi enabled printers
    * That one old Windows XP box nobody is allowed to reformat clean because its "mission critical"
    * Employees are allowed to bring in their own laptops/cellphones and other usb/bluetooth/wifi enabled devices

    Did I miss anything? Anyone else seen this crap enough times to know the intrusion vector is probably nothing highly advanced or original?

    • Did I miss anything?

      The massive slashdot paradox in this thread? - In other stories the NSA are seen as omnipotent hackers who know more about me than my closest friends, but in this thread they suddenly don't know their arse from their elbow?

      • I think its more accurate to say "The left hand does not know what the right hand is doing."

      • There's no paradox.

        When you have a budget of millions of dollars AND practically unrestricted access to everyone's Internet transmissions then it is a lot easier to appear to be "omnipotent" in your ATTACKS.

        But DEFENSE is a lot more difficult.

      • The NSA is not charged with defending the government from hackers.

        The NSA is fucked up already ... let's not give them more stuff to fuck up.

  • by Anonymous Coward

    This article and the PR folks for the government presume or falsely claim there is a different system for unclassified email as classified email. If so, why doesn't the government use the classified methodology for unclassified messages starting tomorrow?

    The fact is even the classified system uses about the same hardware and services. It might have some additional encryption, that as we all know have already been breached by "five eyes". Based on what we have seen there are at least six.

  • Who are the hackers? The United States Federal Government (NSA, CIA, etc). No mystery. You're biting youself and getting sick; bruch your own teeth. Seriously, the climate of paranoia and total espianage that is Uncle Sam today promotes hacking everyone, including "youself". If the Pentagon is encouraged to hack the German State Department, why shouldn't it hack the U.S. State department while it's at it? Sure, Germany is supposed to be an ally, and the US is supposed to be an ally, but Uncle Sam hacks alli
  • Pay the price.
  • This is the same government we trust with our healthcare data which on the black market is worth much more than verified usable credit card data?

    I'm no conspiricay theorist, but as many in government have said "Let no crisis go to waste". I suspect they will use this and other examples to advocate more government control over the internet in the name of "national security". Because regulation will do so much more than hiring people who know how to properly secure a network...

  • US State department cannot get rid of the ultimate hackers and never will -- their rivals for taxpayer dollars at the NSA.

Science is what happens when preconception meets verification.

Working...