• We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.

HACKED! Multiple Federal Agencies Including Treasury.

Page 2 - Seeking answers? Join the AnandTech community: where nearly half-a-million members share solutions and discuss the latest tech.
Yeah the FireEye breach is a big deal. We have FireEye appliances as well as use Solarwinds. We have physically turned off our FireEyes, and the patch for Solarwinds came out today. So we're safe.
 
TheVrolok said:
Which election computers, specifically?
Click to expand...


That's what I'd like to know, too. In GA, at least, the voting machines are not internet connected and neither are the ballot counting machines. Those put their results on portable storage media, like thumb drives. And this doesn't even count the fact the ballot machines in GA produce a paper record, so there's that, too.

Don't know whose actual balloting machines are internet connected....can't imagine anyone with a lick of sense would set it up that way.
 
blackangst1 said:
Yeah the FireEye breach is a big deal. We have FireEye appliances as well as use Solarwinds. We have physically turned off our FireEyes, and the patch for Solarwinds came out today. So we're safe.
Click to expand...
The patch for SolarWinds is out? We are waiting for directives from DHS to apply. We had to turn ours off as well.
 
Now the we know Russia is behind the hacks anyone notice the silence coming from the White House?

Remember when everyone was accusing Biden of hiding during the election? Where the hell is Trump? He's still supposed to do his job and I don't mean regulating showerheads.
 
HomerJS said:
The patch for SolarWinds is out? We are waiting for directives from DHS to apply. We had to turn ours off as well.
Click to expand...

Yeah we patched last night; however, I was in a SANS meeting yesterday, and they explained how the vulnerability works, the payload actions, etc. In SANS opinion, ANY version of SolarWinds is venerable.
 
HomerJS said:
Now the we know Russia is behind the hacks anyone notice the silence coming from the White House?

Remember when everyone was accusing Biden of hiding during the election? Where the hell is Trump? He's still supposed to do his job and I don't mean regulating showerheads.
Click to expand...
Didn't care about bounties being paid by Russian to have American soldiers killed. Why change.
 
Ya’ll know in about six month there will be some kind of deep state Wikileaks type thing released. Like every current federal agency wanted the God Emperor gone so they made shit up and fiddled with the vote totals.
I predict it will happen.
 
Fanatical Meat said:
Ya’ll know in about six month there will be some kind of deep state Wikileaks type thing released. Like every current federal agency wanted the God Emperor gone so they made shit up and fiddled with the vote totals.
I predict it will happen.
Click to expand...
So the government will still be paying for my coverage. I guess the OMB, the Blue Cross, and I forget what else has probably run out already, time for renewal.
Just the cost of doing business.
 
nakedfrog said:
Did everyone see that SolarWinds was told last year that their update server password of "solarwinds123" left them, uh, kinda vulnerable?
Click to expand...
Their standards suck bigly. In my old job, I wouldn't have been able to use a password like that for at least the last 8 years or so.
 
This is really, really bad folks.

Nuclear weapons agency breached amid massive cyber onslaught - POLITICO

The Energy Department and National Nuclear Security Administration, which maintains the U.S. nuclear weapons stockpile, have evidence that hackers accessed their networks as part of an extensive espionage operation that has affected at least half a dozen federal agencies, officials directly familiar with the matter said.

On Thursday, DOE and NNSA officials began coordinating notifications about the breach to their congressional oversight bodies after being briefed by Rocky Campione, the chief information officer at DOE.
 
CISA is now publicly admitting to the severity and ongoing difficulty in getting the hackers out of systems. This is not simply shut down/patch solarwinds and be home free, but is an advanced and persistent threat. This deep level intrusion can't be easily rooted out (if you were even a moderately high priority target that was exploited).

"CISA expects that removing this threat actor from compromised environments will be highly complex and challenging for organizations."

Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations | CISA

CISA is aware of compromises of US government agencies, critical infrastructure entities, and private sector organizations by an advanced persistent threat actor beginning in at least March 2020.
us-cert.cisa.gov us-cert.cisa.gov
Compromise Mitigations
If the adversary has compromised administrative level credentials in an environment—or if organizations identify SAML abuse in the environment, simply mitigating individual issues, systems, servers, or specific user accounts will likely not lead to the adversary’s removal from the network. In such cases, organizations should consider the entire identity trust store as compromised. In the event of a total identity compromise, a full reconstitution of identity and trust services is required to successfully remediate. In this reconstitution, it bears repeating that this threat actor is among the most capable, and in many cases, a full rebuild of the environment is the safest action.

Operational Security
Due to the nature of this pattern of adversary activity—and the targeting of key personnel, incident response staff, and IT email accounts—discussion of findings and mitigations should be considered very sensitive, and should be protected by operational security measures. An operational security plan needs to be developed and socialized, via out-of-band communications, to ensure all staff are aware of the applicable handling caveats.
 
Add a pinch of salt :

www.forbes.com

‘We're Being Hacked’: As Trump Stays Silent, Ex-Security Adviser Sounds Alarm About Russian Infiltration

Recent SolarWinds hack could allow Russia to peer into U.S. intelligence briefings, former Trump security adviser has warned.
www.forbes.com www.forbes.com

"The Russian infiltrators could have had complete access to many important and sensitive networks for six to nine months, Bossert warns, adding that Russia’s Foreign Intelligence Service (SVR) could have used this to gain high-level control over priority networks and then covered its tracks. "

One last kick in the nuts before the puppet leaves?

AH...

"Bossert wrote that the National Defense Authorization Act (NDAA) — which Trump has threatened to veto — is essential as it would authorize the Department of Homeland Security to hunt for infiltrations in federal government networks. "

He's gonna veto it ... wait for it.

add this
https://twitter.com/x/status/1339594787133919239

"and allow for removal of military from far away, and very unappreciative, lands."
- Another stab at NATO?

He is fluffing Putin so hard right now he is either way overdue or about to go limb (Putin ed).
 
Last edited:
You must log in or register to reply here.

TRENDING THREADS

Back
Top