Former US Army Sergeant pleads guilty after amateurish attempt at selling secrets to China

A former US Army sergeant has admitted he attempted to sell classified data to China. Joseph Daniel Schmidt last Friday pled guilty after the Feds charged him with using his top secret clearance to steal classified data that he retained until after he left the military. Schmidt later travelled abroad and while outside the US …

[Steve Graham]

I asked my system for dependencies on libxml: a whopping 518 packages would have to be removed. On the other hand, it's not vulnerable to the udisks issue because neither it nor polkit (which provides this vulnerability, and potentially many others) are installed.

[Jonathan Richards 1]

Hope that gets fixed pretty quickly...

jonathan@Aesir:~$ apt-cache rdepends libxml2 | wc -l

843

That's coming on for a quarter of all packages installed on this machine (KDE Neon) - makes libxml2 fairly fundamental!

[Anonymous Coward]

Good for you (no polkit ...). For other folks though (eg. Fedora workstation) it seems prudent to follow Qalys and do:

grep -rl 'allow_active.*yes' /usr/share/polkit-1/actions

then check to see if the following file is listed:

org.freedesktop.UDisks2.policy

and if so, open it as root in an editor, search for org.freedesktop.udisks2.modify-device (maybe around line 1900), scroll down to <allow_active>yes</allow_active> and change the yes to auth_admin (like the others). Then possibly (at shell): sudo systemctl restart polkit.service

[Anonymous Coward]

That's why he was a general...

...because his knowledge wasn't very specific.

[The Oncoming Scorn]

Re: That's why he was a general...

His scheme was a Major Cockup in planning & execution!

[teebie]

"Spam emails now contain fewer spelling and grammar errors, because crooks have started using AI to write them."

I was always told that the errors were a feature, rather than a bug, because you only want responses from people who lack the sophistication to think "would our IT department send a mail with the subject 'secruity lert' asking me to send them my password"

[doublelayer]

Some of them probably were, but some of that was also spammers trying to do it cheaply and not having great English skills. It also really depends on what kind of phishing this is. The kind that says you won a prize, but you need to follow some steps by talking to them is the kind that benefits most from deliberate errors, because they're sending that to millions of people and can only talk to so many to get payment details from them. The kind that gets sent to you looking for you to click a link and enter a password benefits a lot from not having those errors because they benefit from a very brief level of trust. A lot of phishing can work well without those deliberate errors, and a lot of the people using it as a tool aren't good enough at their job not to make them.