Typo Leaks Millions of US Military Emails To Mali Web Operator (ft.com) 52
Millions of US military emails have been misdirected to Mali through a "typo leak" that has exposed highly sensitive information, including diplomatic documents, tax returns, passwords and the travel details of top officers. Financial Times: Despite repeated warnings over a decade, a steady flow of email traffic continues to the .ML domain, the country identifier for Mali, as a result of people mistyping .MIL, the suffix to all US military email addresses. The problem was first identified almost a decade ago by Johannes Zuurbier, a Dutch internet entrepreneur who has a contract to manage Mali's country domain.
Zuurbier has been collecting misdirected emails since January in an effort to persuade the US to take the issue seriously. He holds close to 117,000 misdirected messages -- almost 1,000 arrived on Wednesday alone. In a letter he sent to the US in early July, Zuurbier wrote: "This risk is real and could be exploited by adversaries of the US."
Zuurbier has been collecting misdirected emails since January in an effort to persuade the US to take the issue seriously. He holds close to 117,000 misdirected messages -- almost 1,000 arrived on Wednesday alone. In a letter he sent to the US in early July, Zuurbier wrote: "This risk is real and could be exploited by adversaries of the US."
get rid of up or out for IT / tech roles! (Score:2)
get rid of up or out for IT / tech roles!
also maybe get ride of need to go to basic / ocs / etc to work them as well.
Re: get rid of up or out for IT / tech roles! (Score:1)
lol not happening; in these trying times, it's more important than ever to keep plebs under one's thumb. they're working on "separate but equal" ladders for nerds, while hoping for chatgpt to be the golden ticket to finally drop em.
Re: (Score:2)
The biggest problem the Fed. Gov. has is post-modern doofuses like you who, no matter what happens, is gleefully ready blame the government. Hint: the world is a complicated place, you should see it sometime.
Re: get rid of up or out for IT / tech roles! (Score:2)
uh when did i refer to the government AT ALL in that post???
the basic idea of postmodernism is that everyone's "interpretation" of a text is valid even if it has nothing to do with what it says or the author intended, so it looks like you're pretty good at it!
Steady flow? (Score:2)
Re: (Score:1)
how can a "steady flow of emails" exist?
The answer is right there in the summary:
as a result of people mistyping
Re: (Score:2)
No...if I typo gijoe@sealteam6.usnavy.ml....there would have to be MX records for sealteam6.usnavy.ml in order for delivery to occur.
Delivery doesn't need to occur. The server received the message and all attachments.
Re: (Score:2)
Delivery doesn't need to occur. The server received the message and all attachments.
Tell me you have no idea how SMTP works without telling me you have no idea how SMTP works?
Re: (Score:2)
Paywall removed. https://archive.li/K3NSz [archive.li]
Re: (Score:3)
Well, even if no system is configured to actually deliver the messages, they are still transiting servers that you never intended the messages to transit.
Never Heard Of Typo. Is That A New Company? (Score:2)
Sounds a little sketchy to me.
Typo in the company name (Score:2)
The real company name is "Hypo", but people creating it intended to call it "Typo", and made a typo.
Yet Another Reason (Score:2)
Yet another reason why you should not allow children near an Internet-connected keyboard.
Oh wait! It is being done by stupid adults who do not watch or even bother to review what they type before hitting "Send". And they probably use "Reply All" constantly.
Re: (Score:2)
Children use tablets and touchphones anyway, not keyboards.
Russia (Score:5, Informative)
Control of the
Blame Sans (Score:3, Interesting)
New Hotness:
fred.flintstone@ssf.ml
fred.flintstone@ssf.mil
Old and Busted:
FRED.FLINTSTONE@SSF.ML
FRED.FLINTSTONE@SSF.MIL
Now imagine your Major General's eyes are old and busted too.
The fools will say you'd better ask a 23-yr-old 'web developer' what looks good. He'll believe it's not worth keeping military secrets if the site looks lame.
Next week he's swirching to light gray text on a white background. "Beautiful!" his buddies will say.
Maybe the PLA can offer this ISP free hosting.
Re: (Score:1)
But it's trivial to block a domain?!?! (Score:2)
Re: (Score:2)
and when you give an hotel .ML in error vs .MIL you don't have control over the hotel email system.
Re: (Score:2)
You should, in a hotel, be using a VPN to a secure email server, and said secure email server had better be one inside of government and not gmail. You really want the message to stay inside a virtualised military-controlled network (or government-controlled, for government stuff in general), travelling over public servers and the public networks as little as possible and ONLY for physical transport, not for any processing.
Re: (Score:3)
The problem is not if the user is in a hotel or not.
The problem is that the user gave the hotel (or other recipient) a reply-to address of user_name@example.ML instead of the intended user_name@example.MIL
Once that happens the hotel (or other recipient) will be more likely to use the @example.ML address to send email intended for the user whose correct address ends in @example.MIL.
The contents of the incorrectly addressed email will then be more likely to be read by those who shouldn't have access to it.
Add
Re: (Score:2)
Hotels shouldn't be sending classified information. Indeed, they shouldn't even have classified information. Since that's the information people are apparently sending, it's not the hotels sending email that is the problem.
Which countries MIL? (Score:4, Insightful)
Why isn't it .mil.us?
Re:Which countries MIL? (Score:4, Funny)
Because the American government has yet to admit to the existence of other countries. Parts of it are still struggling with the whole "world is round" idea.
Re:Which countries MIL? (Score:4, Informative)
Another way of looking at it is that .mil actually predates country code TLDs, but when you look at it that way it doesn't offer an opportunity to America-bash.
Re: (Score:2)
But we COULD use ".mil.us", and if we did it would be easier to secure.
Re: (Score:2)
Less chance of typosquatting.
Re: (Score:2)
Back when I worked for a shitty little manufacturing outfit, we had our own intranet. With firewalls and proxy servers (and hookers and blackjack). What we also had was our own DNS services. So any request to resolve acme- widgets.com from inside the firewall would be directed to an entirely different host than in the outside world. Or directed to a proxy gateway. Or denied with a rather rude message (No. You can NOT view Pornhub from your work computer).
This allowed us to have a private internal namespac
Link to non-paywalled coverage (Score:2)
MSN has a syndicated version of the Verge's 'Millions' of sensitive US military emails were reportedly sent to Mali due to a typo [msn.com] article, which at least provides a more thorough summary of the paywalled FT article than we have here.
Here's a tasty tidbit:
I've said it before. (Score:1)
If you depend on end users knowing what they're doing, your security is going to fail. No amount of training can fix tired, lazy or distracted users. If the client software doesn't stop users from making mistakes, they can and will happen. High security email users should not be typing addresses, they should be using contacts. Contacts created by security personnel who know how to vet contacts and make sure the person end users think they are communicating with is actually that person.
It's not just emai
Not a Technical Problem. Wrong Conclusions. (Score:5, Interesting)
First of all, ".mil" is for unclassified content only. Sensitive but unclassified requires the use of encryption.
"
While typos happen, none of this should have been sent unencrypted to a ".mil" address even without a typo! Most of the examples are from organizations that already have direct access to a classified secure secure network exchange, that's why it exists.
This isn't a technical problem, it's a stupid problem. It's not ignorance because every one of these persons and organizations are subjected to regular training so it's not a question of education, it's just plain stupidity.
Re: (Score:3)
That's not an argument in favor of the current approach. You've identified a second problem, but that doesn't eliminate the one being pointed at, and this is a (largely) technical site, not an administrative or legal site, which is the kind of answer you're asking for.
The proper approach is to peruse solving BOTH problems. The one this site has expertise available on is the technical one. And it *IS* a real problem.
P.S.: You can't fix stupid. You need to reframe the problem so it's a different kind of
Re: (Score:1)
As Number 1.0 would say-- You are technically correct--the best kind of correct
The problem is that the services aren't always on the same PKI cert management system. DoD, DHS, and DoJ have even more problems as do communications between Govt and government contractors not using an official govt email address. The result is encrypted emails can be a real pain in the ass. Combine with not everyone being tech and information security savvy, and mistakes will be made.
Are there ways around this? Yes, SAFE, e
Re: (Score:3)
Your are correct, you don't understand. Let me try again:
DNS checking and routing verification are a
Re: (Score:2)
A case for end-to-end encryption. (Score:2)
just saying
Email address checksum. (Score:2)
So a very quick play in Python. The idea is that you use some method (e.g. sha256) to hash the domain components.
Probably only the first two or three. But anyway, this is a quick play. Basically all you need to do is to check that the
checksum matches. You could use an email address of the form "andy=dda1-85d9@my.uni.ac.uk" where the convention
is that the "dda1-85d9" is a checksum of the domain name. Then a mail client could notice that "andy=dda1-85d9@my.uni.ac.at"
fails the checksum whereas "andy=dda1-85d9@
I wonder if you can validate identity ...? (PGP) (Score:2)
Since PGP can mitigate incorrect email address, and you can set up the systems to check against key rings, then any misplaced or misdirected email is intentional through incompetence.