5 ms·

>“Just to clear this up,” Cracka tweeted on Thursday about the breach of the JABS database. “CWA did, indeed, have access to everybody in USA’s private informat

>“Just to clear this up,” Cracka tweeted on Thursday about the breach of the JABS database. “CWA did, indeed, have access to everybody in USA’s private information, now imagine if we was Russia or China.” If this is true, I'm a little surprised and disappointed. The U.S. can spend trillions on its military conflicts around the world, but can't do good cyber security? Even when handled with the highest precision, a massive cyber security team would be much less costly than building warships and the next space-age jet fighter, surely. How is it possible for a country with the resources of the U.S. to miss such important areas of technological security, such that a team of "crackas", as they call themselves, can come along and exploit it? Is awareness of the needs of the digital age really so far behind the technology itself?

maxerickson 11y ago
They probably figured out an individual's password. Maybe the system shouldn't allow outside access to individuals with just a password, but it isn't really that shocking that they got into it. I like how grandiose that tweet is, as if Xi Jinping starts every meeting by making fun of a few felony mug shots, look at the mustache on this guy, hahaha.
- hellofunk 11y ago
  >Maybe the system shouldn't allow outside access to individuals with just a password Well that is exactly my point. If that is indeed possible, then why? Who is running the American government networks? Are they really so naive?
  - wfo 11y ago
    They are just like every IT worker in a large non-software industry: instructed by their boss that more important employees than you are currently unable to do their jobs because of your security restrictions, so remove them or be fired.
deleted 11y ago
[deleted]
jensen123 11y ago
> How is it possible for a country with the resources of the U.S. to miss such important areas of technological security The US is a democracy. Most of the voters are not very intelligent. That means, most of the politicians elected to run the government aren't very intelligent either. I mean, voters would have to be intelligent themselves in order to tell the difference between a dumbass political candidate and an intelligent one. And I think it's the politicians who usually hire the people who run intelligence agencies, law enforcement agencies etc.
spydum 11y ago
the real issue on this is you don't know what you don't know. the IT directors/management may even have a security dept which is doing "work", but doesnt have talented enough folks who recognize the real risk and address it. Im sure some project manager in the department has been producing vulnerability reports and defects closed to management, demonstrating how secure they are.
lcswi 11y ago
> “CWA did, indeed, have access to everybody in USA’s private information, now imagine if we was Russia or China.” You can safely assume that many organisations and governments would have access to a database like that.
rainsford 11y ago
I don't think it's a question of resources, it's a question of priorities. The US government spends tons of money on all sorts of things, but spending that money instead on security would mean they'd have to stop doing some of those other things that we actually pay them to do. The Navy could stop buying warships and spend all the extra money on security, but then they wouldn't have any warships, which is what the Navy is actually for. This is by no means a government only issue. Multi-billion dollar companies keep getting hacked for basically the same reason. They too have lots of resources, but they are also spending those resources actually doing something. The BEST result you can get from spending on security is...nothing bad happens. I completely understand the counter-argument that spending on security saves you the costs associated with getting owned, but that's clearly a hard argument to make to people who see all the other ways their money can be spent directly producing the results expected of them. It's the same basic problem IT has always faced ("it costs money, it doesn't MAKE money"), but it's worse with security since you don't even see it for the most part, except maybe as an annoyance.
- akshatpradhan 11y ago
  >The BEST result you can get from spending on security is...nothing bad happens. That's crap =]. A secret about security compliance (aka defense in depth) is that it actually reduces your technical debt, doesn't increase it. That's the best result in the world, low technical debt!
  - bburshteyn 11y ago
    Right, and also good security solutions should have active defense features that fight breaches as they occur. Most breached organizations don't know they've been breached until months later... We're working on this at https://www.trycryptomove.com https://www.trycryptomove.com
rcurry 11y ago
To be fair, as long as you are building systems on top of general purpose operating systems and exposing them to the internet, you're going to be vulnerable to one hack or another. No matter how much money you throw at the problem, this won't be the last time someone hacks someone's email account or figures out a password to a police computer. I don't disagree that cyber-warfare is becoming a more important consideration in the context of modern military doctrine, but electronic warfare has been around since long before the internet. It's just one more evolution. In defense of kinetic war-fighting, it's easier for us to turn off the internet than it is for the other guys to turn off an aircraft carrier.
- akshatpradhan 11y ago
  >To be fair, as long as you are building systems on top of general purpose operating systems and exposing them to the internet, you're going to be vulnerable to one hack or another. No matter how much money you throw at the problem, this won't be the last time someone hacks someone's email account or figures out a password to a police computer. This is crap =]. There's only 3 ways an attacker can get in. 1. Software Bug - 0-day exploits are only effective until the developer fixes the bad code (patch). 2. Configuration Drift - Attackers can only pop boxes that have drifted away from being updated or hardened. That's why they can only pop one of the boxes...not all the boxes. That's why you Recon more than Infiltrate. 3. Social Engineering - Why does the person who is easily susceptible to phishing have keys to the castle? All-the-time diligence (not point-in-time diligence) implemented on security controls is what's needed. Not more cyber-offense (e.g. Penetration Testing, Vulnerability Scanning, Risk Assessments)
pdkl95 11y ago
As I mentioned in a recent thread[1], the government's approach to cybersecurity has been 100% offense. I suspect this may be a pre-network strategy being applied to a networked world, where concepts like border security and enumerating threats[2] actually worked. In the late-80s/early-90s, I used to laugh at the common sci-fi trope of always having some convenient way to hack into anything. I originally assumed this was literary license[3]; surely nobody would actually be dumb enough to to put critical systems on a publicly-accessible network! Well... I guess I was wrong. Not only were we stupid enough to connect everything to a network, some people are trying to start an entire industry based on the idea of plugging things into the internet. We've simply gotten lucky so far; we have barely scratched the surface of what can be done. I know rare problems are notoriously hard to model. Getting people to properly prepare for these events or even simply understand the actual cost of failure can be incredibly difficult, but that doesn't mean the problem can be ignored. I almost see a similarity to the martingale[4] betting strategy. It works ok until you get your first rare set of consecutive losses and you bottom out your bankroll. The core problem in martingale is that it requires you to have an unbounded pool of cash to work with, so maybe the answer insecurity is related to only accepting risks if the risk has known bounds. [1] https://news.ycombinator.com/item?id=10482498 https://news.ycombinator.com/item?id=10482498 [2] http://www.ranum.com/security/computer_security/editorials/dumb/ http://www.ranum.com/security/computer_security/editorials/d... [3] JMS has talked about the need for license when he wrote Babylon 5, where he said that the ships always move "at the speed of plot". [4] https://en.wikipedia.org/wiki/Martingale_%28betting_system%29 https://en.wikipedia.org/wiki/Martingale_%28betting_system%2...
- akshatpradhan 11y ago
  >the government's approach to cybersecurity has been 100% offense. I also read your other comment that you posted in the comment >This is a serious problem, not only from the problems intelligence angies with many powers and poor oversight; ignoring defense is going to bite a lot of people in bad ways. We are already seeing the beginnings of this with the escalating impact computer-based attacks are having on their victims. I agree. Yes its embarrassing and they keep claiming "Do more Penetration Testing, more Vulnerability Scanning, more Risk assessment" Nobody even knows what the hell that even means and we're still getting breached! The biggest mistake we've made is to claim, "a great offense is always the best defense." We should be doing Security Compliance aka Defense in Depth! But everybody seems to think Defense in Depth is somehow different from Security Compliance. >Defense in Depth is when multiple layers of security controls are placed throughout a critical environment. It is a layering tactic, conceived by the National Security Agency (NSA) as a comprehensive approach to information and electronic security. If they actually went through the diligence of conforming with the security controls (ISO 27002, FEDRAMP, NIST 800-53) that they defined (much like financial compliance conforms to policies, standards, or laws), they'd be in a much more comprehensive shape. Even PCI-DSS...just replace the word cardholder data with sensitive data and you have more defense than whatever snake-oil Security Risk Plan is out there. I champion for compliance =).
Sven7 11y ago
Boils down to the question - who wants to go work on security for the government?
a3n 11y ago
It's probably a result of the early days of the internet. Nobody knows we have this network, and we have passwords after all so we're good. On top of that base, the contracts that built these systems probably didn't specify much in the way of security. Even with the recent OPM breaches, probably nobody thinks it's their problem, and weak contracts are probably still being bid.

maxerickson 11y ago

They probably figured out an individual's password. Maybe the system shouldn't allow outside access to individuals with just a password, but it isn't really that shocking that they got into it. I like how grandiose that tweet is, as if Xi Jinping starts every meeting by making fun of a few felony mug shots, look at the mustache on this guy, hahaha.

hellofunk 11y ago
>Maybe the system shouldn't allow outside access to individuals with just a password Well that is exactly my point. If that is indeed possible, then why? Who is running the American government networks? Are they really so naive?
- wfo 11y ago
  They are just like every IT worker in a large non-software industry: instructed by their boss that more important employees than you are currently unable to do their jobs because of your security restrictions, so remove them or be fired.

deleted 11y ago

[deleted]

jensen123 11y ago

> How is it possible for a country with the resources of the U.S. to miss such important areas of technological security The US is a democracy. Most of the voters are not very intelligent. That means, most of the politicians elected to run the government aren't very intelligent either. I mean, voters would have to be intelligent themselves in order to tell the difference between a dumbass political candidate and an intelligent one. And I think it's the politicians who usually hire the people who run intelligence agencies, law enforcement agencies etc.

spydum 11y ago

the real issue on this is you don't know what you don't know. the IT directors/management may even have a security dept which is doing "work", but doesnt have talented enough folks who recognize the real risk and address it. Im sure some project manager in the department has been producing vulnerability reports and defects closed to management, demonstrating how secure they are.

lcswi 11y ago

> “CWA did, indeed, have access to everybody in USA’s private information, now imagine if we was Russia or China.” You can safely assume that many organisations and governments would have access to a database like that.

rainsford 11y ago

I don't think it's a question of resources, it's a question of priorities. The US government spends tons of money on all sorts of things, but spending that money instead on security would mean they'd have to stop doing some of those other things that we actually pay them to do. The Navy could stop buying warships and spend all the extra money on security, but then they wouldn't have any warships, which is what the Navy is actually for. This is by no means a government only issue. Multi-billion dollar companies keep getting hacked for basically the same reason. They too have lots of resources, but they are also spending those resources actually doing something. The BEST result you can get from spending on security is...nothing bad happens. I completely understand the counter-argument that spending on security saves you the costs associated with getting owned, but that's clearly a hard argument to make to people who see all the other ways their money can be spent directly producing the results expected of them. It's the same basic problem IT has always faced ("it costs money, it doesn't MAKE money"), but it's worse with security since you don't even see it for the most part, except maybe as an annoyance.

akshatpradhan 11y ago
>The BEST result you can get from spending on security is...nothing bad happens. That's crap =]. A secret about security compliance (aka defense in depth) is that it actually reduces your technical debt, doesn't increase it. That's the best result in the world, low technical debt!
- bburshteyn 11y ago
  Right, and also good security solutions should have active defense features that fight breaches as they occur. Most breached organizations don't know they've been breached until months later... We're working on this at https://www.trycryptomove.com https://www.trycryptomove.com

rcurry 11y ago

To be fair, as long as you are building systems on top of general purpose operating systems and exposing them to the internet, you're going to be vulnerable to one hack or another. No matter how much money you throw at the problem, this won't be the last time someone hacks someone's email account or figures out a password to a police computer. I don't disagree that cyber-warfare is becoming a more important consideration in the context of modern military doctrine, but electronic warfare has been around since long before the internet. It's just one more evolution. In defense of kinetic war-fighting, it's easier for us to turn off the internet than it is for the other guys to turn off an aircraft carrier.

akshatpradhan 11y ago
>To be fair, as long as you are building systems on top of general purpose operating systems and exposing them to the internet, you're going to be vulnerable to one hack or another. No matter how much money you throw at the problem, this won't be the last time someone hacks someone's email account or figures out a password to a police computer. This is crap =]. There's only 3 ways an attacker can get in. 1. Software Bug - 0-day exploits are only effective until the developer fixes the bad code (patch). 2. Configuration Drift - Attackers can only pop boxes that have drifted away from being updated or hardened. That's why they can only pop one of the boxes...not all the boxes. That's why you Recon more than Infiltrate. 3. Social Engineering - Why does the person who is easily susceptible to phishing have keys to the castle? All-the-time diligence (not point-in-time diligence) implemented on security controls is what's needed. Not more cyber-offense (e.g. Penetration Testing, Vulnerability Scanning, Risk Assessments)

pdkl95 11y ago

As I mentioned in a recent thread[1], the government's approach to cybersecurity has been 100% offense. I suspect this may be a pre-network strategy being applied to a networked world, where concepts like border security and enumerating threats[2] actually worked. In the late-80s/early-90s, I used to laugh at the common sci-fi trope of always having some convenient way to hack into anything. I originally assumed this was literary license[3]; surely nobody would actually be dumb enough to to put critical systems on a publicly-accessible network! Well... I guess I was wrong. Not only were we stupid enough to connect everything to a network, some people are trying to start an entire industry based on the idea of plugging things into the internet. We've simply gotten lucky so far; we have barely scratched the surface of what can be done. I know rare problems are notoriously hard to model. Getting people to properly prepare for these events or even simply understand the actual cost of failure can be incredibly difficult, but that doesn't mean the problem can be ignored. I almost see a similarity to the martingale[4] betting strategy. It works ok until you get your first rare set of consecutive losses and you bottom out your bankroll. The core problem in martingale is that it requires you to have an unbounded pool of cash to work with, so maybe the answer insecurity is related to only accepting risks if the risk has known bounds. [1] https://news.ycombinator.com/item?id=10482498 https://news.ycombinator.com/item?id=10482498 [2] http://www.ranum.com/security/computer_security/editorials/dumb/ http://www.ranum.com/security/computer_security/editorials/d... [3] JMS has talked about the need for license when he wrote Babylon 5, where he said that the ships always move "at the speed of plot". [4] https://en.wikipedia.org/wiki/Martingale_%28betting_system%29 https://en.wikipedia.org/wiki/Martingale_%28betting_system%2...

akshatpradhan 11y ago
>the government's approach to cybersecurity has been 100% offense. I also read your other comment that you posted in the comment >This is a serious problem, not only from the problems intelligence angies with many powers and poor oversight; ignoring defense is going to bite a lot of people in bad ways. We are already seeing the beginnings of this with the escalating impact computer-based attacks are having on their victims. I agree. Yes its embarrassing and they keep claiming "Do more Penetration Testing, more Vulnerability Scanning, more Risk assessment" Nobody even knows what the hell that even means and we're still getting breached! The biggest mistake we've made is to claim, "a great offense is always the best defense." We should be doing Security Compliance aka Defense in Depth! But everybody seems to think Defense in Depth is somehow different from Security Compliance. >Defense in Depth is when multiple layers of security controls are placed throughout a critical environment. It is a layering tactic, conceived by the National Security Agency (NSA) as a comprehensive approach to information and electronic security. If they actually went through the diligence of conforming with the security controls (ISO 27002, FEDRAMP, NIST 800-53) that they defined (much like financial compliance conforms to policies, standards, or laws), they'd be in a much more comprehensive shape. Even PCI-DSS...just replace the word cardholder data with sensitive data and you have more defense than whatever snake-oil Security Risk Plan is out there. I champion for compliance =).

Sven7 11y ago

Boils down to the question - who wants to go work on security for the government?

a3n 11y ago

It's probably a result of the early days of the internet. Nobody knows we have this network, and we have passwords after all so we're good. On top of that base, the contracts that built these systems probably didn't specify much in the way of security. Even with the recent OPM breaches, probably nobody thinks it's their problem, and weak contracts are probably still being bid.