China's hackers stole files on 4 MEELLION US govt staff? Bu shi, says China China is fending off accusations it was behind the theft of personal dossiers on four million US government workers – some of whom had applied for or were granted security clearances. China's foreign ministry spokesman Hong Lei told NBC News: "We hope the United States could discard this kind of suspicion and stop groundless …
I've said it before and I will openly say it again:
Security intrusions will continue to happen until the entire IT world accepts the fact that TCP/IP is not appropriate for 21st century needs. The IT world is living in denial: being inherently insecure, with no designed-in security protocols, TCP/IP was acceptable 20 years ago but is not going to cut it in today's government supported, hacker-filled & espionage-filled world. Firewalls, credentials and other add-on structures - patches to the system - can only go so far.
Data communication must be encrypted at the SOURCE, by DEFAULT, across the world. Period. Anything else is simply a continuous data theft, waiting to happen.
And yes, I've got my Nomex on. Go ahead and spread the hate as you wallow in the past, expecting what worked then to be perfectly acceptable now.
Good luck trying to replace IP on every computer in the world. We've been trying with IPv6 (which, incidentally, handles end-to-end encryption far better than IPv4) for 20 years, with 'limited' success.
And getting everyone to encrypt everything all the time would require some system of universal PKI. Even better luck getting that to work.
Finally, most of these large-scale data thefts have been carried out by internal malware, introduced because someone clicked a link on an apparently legitimate email. How will universal encryption prevent that? It might even make the problem worse by inhibiting scanning of incoming emails.
TCP/IP is not appropriate for 21st century needs
Yeah well maybe you should go back to the course on "Infosec 101" because if you think TCP/IP is the problem, I have a bridge in lower Manhattan, very cheap...
"He overdosed on alcohol? Clearly the fault of the glass bottles!"
Data communication must be encrypted at the SOURCE, by DEFAULT, across the world. Period. Anything else is simply a continuous data theft, waiting to happen.
You may want to explain how encrypting data communications will prohibit data being exfiltrated in the first place. Your voodoo is weak...
Ok, start with The Orange Book and work your way forward, slowly...
> Security intrusions will continue to happen until the entire IT world accepts the fact that TCP/IP is not appropriate for 21st century needs.
It's like you have had your house burgled but you are complaining that the fundamental design of roads makes it too easy to car-jack someone. You've rather missed the point.
The surprise was not the breach but the size of the breach. And I am going to blame the victim if this resulted from a single breach. Breaches will always happen no matter how careful you are. The issue is to minimise the consequences of a breach. This, and the Sony experience, suggest that their data wasn't properly compartmentalised. The hackers once in just ran riot.
I know this is difficult if you are trying to run a universal emergency patient database - but an HR database? This needs to be soundly sandbagged. Makes it much harder for the hacker with multiple opportunities for early detection as the hacker attempts to search across boundaries.
problem is that IT is woefully underfunded and its importance underrated
we really need to change that, because a world where a bored teenager will be able to wreck half the federal agencies is not a nice one when really malicious actors start using it
the only way to fix it is to start finger pointing and demanding real solutions, not just "security audits" that achieve squat
The victim is absolutely to blame! Everyone today is so fucking worried about how the l'users will feel about a change, instead of forcing the users to comply. You want a fucking benefit - YOUR JOB. Everyday I'm told how implementing best practices will inconvenience the user and therefore that sound architecture WILL BE SHELVED. WHAT?!?
You can't handle sensitive information and visit snaptwitter and facetube ON THE SAME FUCKING HOST! And yet, still you have compromise after compromise. If you take China's repressive network policy and apply it where it needs to be - @WORK, maybe that shit wont leak.
Everyone out here is like, "OMG, this place is so awesome to work. We get free this and free that, and I can bring in any device I want and connect and waste all day long planning my wedding that will last 2 years.....and my brats love the new retina display on my work PC, so I give it to them to play with to keep them outta my hair, and it's so awesome". TAKE A FUCKING BREATH!
I certainly am willing to concede that it is likely that their network security was lacking, since network security seems very rarely to be fully and well implemented. HOWEVER, poor security doesn't necessarily obfuscate who the attacker was any more than if there had been good security.
If I leave the doors to my house unlocked and then get robbed, a crime still took place, and the culprit is still the culprit. Poor security doesn't change the identity of or level of guilt of the attacker.
If the Chinese government was not to blame, so be it, but the level and quality of the security that was breached is tangential to the matter of assigning blame.
"HOWEVER, poor security doesn't necessarily obfuscate who the attacker was any more than if there had been good security ... the level and quality of the security that was breached is tangential ..." --- Badger Murphy
I disagree: the higher the level of security, the more restricted the pool of potential culprits. Some attacks are so sophisticated (Stuxnet?) that they are almost certainly nation-state sponsored; on the other hand, a very poorly secured system can be successfully attacked by a much wider range of attackers, including script kiddies and people emailing executable trojans. It must therefore be true that it is harder to justify allegations that a nation-state has attacked you if your security is of a level amenable to much less highly resourced attackers, unless you have very significant evidence of the origin of the attack.
If they say they didn't, then that's good enough for me! And of course, those growing "sand islands" in the South China Sea have nothing to do with territorial aggression ... after all, it's called the South China Sea for a reason, right? And I've taken great comfort in Putin's reassurances that Russia has nothing whatsoever to do with the rebellious discontent in eastern Ukraine.
The people who run our governments either proudly revel in their ignorance or feign a level of understanding that doesn't hold up under close examination. These are the same leaders who decided to turn over the administration of publicly owned computer systems to private contractors who were the lowest bidders and have over time demonstrated neither the competence nor the dedication needed to keep those systems safe. Our government agencies, including our militaries, lack the capability to run their own networks or systems.The truth is they have no way to independently verify that their chosen contractors are doing their jobs.
Considering a state-sponsored US criminal gang has been happily collecting data illegally on hunderds of millons of people in Europe alone (and gawd knows how many elsewhere in the wolrd), aided and abetted by Dear Old Blighty's own state-sponsored cybercriminals (I'm looking at YOU GCHQ, and feeling disgusted that you exist in a country I once signed up to help defend)) - I can only wonder how the US has the chutzpah to express any kind of outrage at having its own data snooped upon.
"You can't defend yourselves well if you don't know what systems you have and where your data is,"
True, but in a large organisation running many hundreds or thousands of server instances (most of them virtual, of course) the chances that the poor old admins are aware of every single one of them are slim to none. And even if you're confident that you have such control today, you probably won't tomorrow.
Your security defences need to be sufficiently powerful and flexible to cope with the inevitable 'rogue' server.
And, in fact, a processor API of their own. Yes, 'security by obscurity' is not real security, but it's a basic first step none the less. Except for machines such as IBM z System, Unisys ClearPath Libra and Dorado, and SPARC servers from ORACLE, all Federal government computers should use a customized secure version of Linux or BSD, running on some less-popular chip architecture like that of the PowerPC.
That way, all the zero-day vulnerabilities in Windows and even OS X would avail hackers not a bit; they'd have to really work at it to get into those computers. (Given the BSD license, that may be a better choice, because then Uncle Sam would be under no obligation to disclose the source of the version of the OS they're using.)
> running on some less-popular chip architecture like that of the PowerPC
Huuh? Exactly how would PowerPC have prevented this attack?
Which PowerPC? Big-Endian? Little-Endian?
You realize that, once the attacker has gained direct access to the data - which appears to have been the case here - the ISA the Operating System is running on is irrelevant?
I can't comment on this attack, but if you have a processor with a different instruction set, then many of the stack smashing and buffer overrun vulnerabilities disappear, at least until the malware becomes clever enough to identify the processor architecture before dropping machine code into the target system.
The issue here is that we are fast approaching a monoculture, with x86-64 processors becoming ubiquitous, so there is only one processor target. Granted that different OSs give some protection, but however you do it, if you can get some valid machine code injected and executing on a system, then many things are possible.
Obviously, x86-64 machine code is not valid on, say, a system with an ARM or POWER or Z processor, so this type of attack becomes invalid in the short term. But this only remains the case until another processor type is sufficiently widely deployed to make it worth attacking, where upon you have the existing problems, just with some additional wrinkles.
One pertinent contributor to the weaknesses of UK government infrastructure has been it overarching reliance and fondness for technology almost exclusively from Microsoft - until very recently - which has never been an advanced or formidable networking or technology security expert company - by any means.
While it may be near impossible to "totally" secure any national government (or enterprise) IT infrastructure, placing all one's bets on crappy 20th century technology in year 2015 and beyong is ridiculous, and maybe now the UK government will come from under the skirt of US technology dependance.
What this means, even if the US doesn't realize it yet, is that the entire clandestine service has been stripped naked. When Snowden talked about being able to turn out the lights on American intelligence, it would look something like the OPM hack.
Never again, with any current or former employee of the Federal government, can an American intelligence agency place an operative in China or Russia. Not only that, China now has all they need to hunt or turn these people the world over.
A lot of people are going to start disappearing from their posts soon, either voluntarily if they're smart, or involuntarily if they're not.
'And of course, those growing "sand islands" in the South China Sea have nothing to do with territorial aggression ... after all, it's called the South China Sea for a reason, right?'
Of course not, otherwise the US would have accused Vietnam and the Philippines of territorial aggression already because they have been building "islands" and outposts years before China got in on the act.
"And I've taken great comfort in Putin's reassurances that Russia has nothing whatsoever to do with the rebellious discontent in eastern Ukraine."
And so you should because Russia has as much to do with the rebellious discontent in eastern Ukraine as the US had to do with the overthrow of the previous democratically elected government of Ukraine.
Putin TV and smoking the opium bong.
Really, the previous "democratic election" in Ukraine had way too much in common with the "democratic elections" in Russia. The only thing "democratic" about it was you had a "choice" of handpicked Putin Oligarchs to choose from. The US had nothing to do with Ukraine or we'd have better relations with them right now. Nothing like the Russian invasions of eastern Ukraine and Crimea, all instigated by Putin the barechested and his cronies. Have to have someplace for the cronies to build vacation homes.
BTW Those "Islands" are out way beyond any concept of territorial waters that any sane rational country recognizes. They are there just to cause issues. This coming from the one country that has "good relations" with North Korea. Another indication China is off it's rocker.
Any network that is secure enough to prevent any hacking at all will be completely unusable. If you have files that absolutely positively must be kept private, store them on a machine that is PHYSICALLY isolated from the internet. The same goes for all other vital systems. If they cannot be messed about they must be isolated from the internet. Otherwise, you are tying your goat up in a public place. It WILL be stolen just of giggles if nothing else.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
