Hackers stole 21.5 million SSN's.

[John Connor]

http://www.foxnews.com/politics/201...ecurity-numbers-from-215-million-govt-admits/

Hackers swiped Social Security numbers from 21.5 million people -- as well as fingerprint records and other information from background check investigations -- in the massive breach earlier this year of federal personnel files, the government acknowledged Thursday.
The Office of Personnel Management included the findings in a statement Thursday on the investigation into a pair of major hacks believed carried out by China.

I really don't get this hacker crap. Set up honey pots and block China FFS! I bet my own site is more secure. The government can't do crap right! 他妈的中国

 

[fleshconsumed]

I'm not going to defend the government track record here, but let's not pretend that this problem is unique to government. Target, Home Depot ring a bell? Security is hard, not only from technological standpoint, but also from organizational - tighten up security too much and you'll be impeding productivity.

 

[John Connor]

The thing that gets me is if they know it's China or Russia just block those countries. I do at home and on my websites. How do they know it's China all the time? Yeah, proxies and crap can be used, but if it has a finger print from China you could block it. Thus the honeypots. Study their little evil ways and block that crap.

 

[John Connor]

Looks like some law makers are calling for Obama to fire the OPM director.

 

[matricks]

The thing that gets me is if they know it's China or Russia just block those countries. I do at home and on my websites. How do they know it's China all the time? Yeah, proxies and crap can be used, but if it has a finger print from China you could block it. Thus the honeypots. Study their little evil ways and block that crap.

Blocking "suspicious" countries will block lots of basic, automated stuff. OPM was obviously an interesting target, and was done through actual effort by real people. It's not difficult to gain control of some box located in a less "suspicious" country, but they would save it for a worthwhile target.

 

[Spacehead]

Looks like some law makers are calling for Obama to fire the OPM director.

Whatever her name director is stepped down today. Fired, quit, whatever.

The initial info that was taken wasn't even encrypted. The CIO said basically..."encryption is a new technology & we're working to get that into our databases".



Are these massively large corporation/government databases too big to secure?

 

[boomerang]

It's worse than is being widely reported in the mainstream media. The management of the databases was sourced out to contractors in Argentina and China and the top guys had root level privileges. In other words, we essentially gave them the information.

 

[Spacehead]

The management of the databases was sourced out to contractors in Argentina and China and the top guys had root level privileges.

Really???

 

[boomerang]

Really???

I know how everyone has disgust for P&N so this is just one post by me. It's easier than providing the information a second time.

http://forums.anandtech.com/showpost.php?p=37552158&postcount=52

 

[Spacehead]

I know how everyone has disgust for P&N so this is just one post by me. It's easier than providing the information a second time.

http://forums.anandtech.com/showpost.php?p=37552158&postcount=52

Thanks.
It's getting hard to keep up with all the threads on this topic. 2 here in Security, 1 in OT & i guess 1 in P&N.

 

[MongGrel]

Whatever her name director is stepped down today. Fired, quit, whatever.

The initial info that was taken wasn't even encrypted. The CIO said basically..."encryption is a new technology & we're working to get that into our databases".



Are these massively large corporation/government databases too big to secure?

It's worse than is being widely reported in the mainstream media. The management of the databases was sourced out to contractors in Argentina and China and the top guys had root level privileges. In other words, we essentially gave them the information.

:ninja:

 

[MongGrel]

http://www.foxnews.com/politics/201...ecurity-numbers-from-215-million-govt-admits/


I really don't get this hacker crap. Set up honey pots and block China FFS! I bet my own site is more secure. The government can't do crap right! 他妈的中国

Half of US manufacturing has probably been shipped to China.

How are you going to block access to them and keep those corporations fed info on a daily basis ?

 

[John Connor]

Facedesk. Not companies, the freaking government! But that's beside the point. You can block inbound and still allow outbound.

There's a lot they could do. I could write an essay. The prime vector for most of this crap is through E-mail.

 

[Chiefcrowe]

This is ridiculous. I mean come on!!

"By 2012, the IG was still complaining that OPM "does not have the ability to detect unauthorized devices connected to the OPM network."

Last year, it said OPM lacked "a comprehensive inventory of servers, databases and network devices," didn't do routine scans of its network for trouble and had substandard authentication requirements."

 

[John Connor]

The feds, got to love 'em.

 

[smakme7757]

Do keep in mind that the networks that are getting comprised have more than:
1xModem, 1xRouter and a bunch of devices.

These network are comprised of multiple 10s/100s of switches, firewalls and routers. These networks are all sliced up into VLANs and different IP ranges making them extremely complex.

The people who built it move on or quit, then someone else comes in to take their place. Then over a period of years holes creep in due to oversights, misunderstanding and misconfiguration.

Too many people compare their own tiny home network to that of big business and government.

Keeping the seal airtight isn't as easy as you might think.

 

[John Connor]

Everything has a WAN...

 

[smakme7757]

Everything has a WAN...

Not "A" WAN. Most likely multiple. And the gateway might not even be in the same building or even the same region of the country.

They will also most likely have multiple public IPs for all the different services they run. Which means that there are multiple entry points into their network.

Like I said. A long way from your typical home network.

 

[Chiefcrowe]

Right, good points. However, having an accurate inventory of servers is not that difficult. That should be a no brainer really and if they need to, just get an inventory program!

Do keep in mind that the networks that are getting comprised have more than:
1xModem, 1xRouter and a bunch of devices.

These network are comprised of multiple 10s/100s of switches, firewalls and routers. These networks are all sliced up into VLANs and different IP ranges making them extremely complex.

The people who built it move on or quit, then someone else comes in to take their place. Then over a period of years holes creep in due to oversights, misunderstanding and misconfiguration.

Too many people compare their own tiny home network to that of big business and government.

Keeping the seal airtight isn't as easy as you might think.

 

[smakme7757]

Right, good points. However, having an accurate inventory of servers is not that difficult. That should be a no brainer really and if they need to, just get an inventory program!

It's not inventory that's the problem. The word is "Configuration".

In a perfect world every administrator will document every single change they make to a system. All companies worth their salt have a configuration database, usually linked to an inventory database.

However in the real world the biggest changes are always documented. Most smaller changes will also be documented, but sometimes things get forgotten. (ITIL is the framework used in most organizations around the world)

And its the build up of these " forgotten" changes that can lead to a misconfiguration down the road. Which can then lead to a breach.

That's presuming the attacker finds a way in via a misconfiguration and not a 0-Day or software bug In the application/appliance that hasn't been fixed by the vendor or unpatched by the user.

I agree with what you guys are saying (if only it was so easy) but you have to keep in mind the scale here and the amount of people and processes involved.

Keeping human error to a minimum at home is easy. Try adding 1000 boxes and 100 full time staff and a 24/7 uptime policy and try to keep everything 100% perfect. Not easy.

PS: I might add in that's its VERY BAD when data gets stolen and there is no excuses. But the reality is that anything attached to any network is vulnerable by design.