11 ms·
The OPM Data Breach [pdf]
- deleted 10y ago[deleted]
- revelation 10y agoAh yes, when they themselves are affected, suddenly there is a 230 page report. Meanwhile you sure as hell can't, you know, get an actual post mortem when they bomb an Afghani hospital.
- danso 10y agoI don't know if "suddenly" is the most accurate word. This attack originated in May 2014 and was identified sometime in mid 2015. https://www.opm.gov/cybersecurity/cybersecurity-incidents/ https://www.opm.gov/cybersecurity/cybersecurity-incidents/
- revelation 10y agoThat is light speed as far as the government is concerned. You couldn't get an FOIA answered in that time period.
- danso 10y agoAs luck would have it, that's what the Oversight committee is talking about today: https://oversight.house.gov/hearing/examining-foia-compliance-department-state/ https://oversight.house.gov/hearing/examining-foia-complianc... Note: Sure, politicians move very quickly when politics are involved.
- jamez1 10y agoFOIA aren't exactly something the government cares about, don't think that's an apt comparison
- ipsin 10y agoThe crazy thing to me was that the 2015 discovery was reportedly [1] due to a "product demo". Of course, I expect that the company was entirely legitimate, but running an intrusion detection company would apparently be great cover for gaining free vulnerability scans of potential targets. [1] http://arstechnica.com/security/2015/06/report-hack-of-government-employee-records-discovered-by-product-demo/ http://arstechnica.com/security/2015/06/report-hack-of-gover...
- cloudjacker 10y ago"they" > As the Committee on Oversight and Government Reform, we will work with our colleagues in the minority to exercise effective oversight over the federal government and will work proactively to investigate and expose waste, fraud, and abuse. Have you tried asking them nicely?
- loteck 10y ago"Additionally, fingerprint data of 5.6 million of these individuals was stolen." They'll need to change their fingerprints immediately!
- dredmorbius 10y agoI'd like to see YYYY-04-01 RFC on biometrics authenticator expiration protocols.
- bigiain 10y ago"As an alternative, users may keep all their fingers in a fingerprint safe and secure them all with a single retina scan, which they can use to open the safe each time they need to use a finger."
- maerF0x0 10y agoThats why fingerprint is username, not password
- idlewords 10y agoPassword is thumbprint.
- bigiain 10y agoIn keeping with industry best practice, I require staff to sandpaper off their fingerprints and regrow them every 90 days. For "security".
- redwards510 10y agoA bit extreme isn't that? I just have my staff paint their fingerprints with women's ruby red fingernail paint. It dries to a smooth glass-like finish. For "security"
- streptomycin 10y agoThe letter they sent me claimed that there is currently no way to create fake fingerprints, so there's nothing to be worried about, 2 years of identity theft monitoring is good enough.
- johnhess 10y agosure would be nice to have something better than a raster image of pages 2-231
- metaphor 10y agoAgreed, although rasterizing was likely the simplest way to ensure that redacted information can't be (somehow) reconstructed.
- jlgaddis 10y agoI've only read up through the executive summary thus far but this looks like it's going to be a fascinating read.
- tptacek 10y agoThis isn't the "official postmortem". It's the official report of the GOP-led House Oversight and Government Reform Committee. It's a partisan political document. A better title: Republican House Oversight Report On OPM Data Breach.
- loteck 10y agoLet's be fair: while the source may well be partisan, it is also a technical document. Referring to it simply as a partisan political document doesn't acknowledge its full contents or its value to a technical community.
- tptacek 10y agoIt is not a technical document. It is a document that contains technical details. For instance: it contains a formal set of "findings", as in the "findings" of law and fact in a trial. Here's one of the first findings: FINDING: Slow implementation of critical security requirements such as dual factor authentication is a true case of misplaced priorities. That's not technical language. It's not even formal language. OPM was/is a clusterfuck. I'm not disputing that. But the authors of this document had a job to do: portray administration appointees in the worst light possible.
- BoringCode 10y agoIs there something in this document that you can point to as being inaccurate or obviously exaggerated?
- tptacek 10y agoI don't know. That's not a hurdle my argument needs to clear.
- BoringCode 10y agoI disagree. If you're going to say "But the authors of this document had a job to do: portray administration appointees in the worst light possible." then you need to at least show some examples of that. You're not making an argument. You're trying to pass an opinion as a fact. You need to back up statements like that.
- rdtsc 10y agoIf only we had an agency in charge of protecting and securing these kinds of systems. It seems NSA has spent all its budget on cool hacking tools and programs, exploiting hard drive firmware and routers and other crap. Yet the all SF-86 forms (except CIA's +) got stolen right under our noses. But again, nobody is going to feel cool defending and securing stuff, everyone wants to be on red team. Stolen stuff includes millions of fingerprints. Those are obviously not hashed, so that's just the raw data I imagine. They'll learn lesson to not rely on fingerprints as much. Maybe that's one good thing coming out of it. [+] CIA could still be affected, if for example some people there started at other agencies, or in the military (CIA likes to hire ex-Marines for example).
- Godel_unicode 10y ago> If only we had an agency in charge of protecting and securing these kinds of systems. Firstly, why do you insist in letting OPM off the hook? Secondly, even if we stipulate that OPM isn't at fault and that someone should have stopped this, you should read about roles and responsibilities in the government before blindly blaming NSA. Start here. https://www.us-cert.gov/about-us https://www.us-cert.gov/about-us
- rdtsc 10y ago> why do you insist in letting OPM off the hook? I am not. It failed massively. Letting it do what it kept doing before is not going to work. We have hard evidence of its failure. There is no point mentioning it, it is obvious. > , you should read about roles and responsibilities in the government before blindly blaming NSA. Start here. https://www.us-cert.gov/about-us https://www.us-cert.gov/about-us So where was US-CERT all this time? It was active since 2003. It had more than a decade to ramp up and get up to speed. Why where all the electronic SF-86 forms stolen? You'd think out of all the places, they would protect, that would be close to the top. > before blindly blaming NSA Because they are probably the only ones that have the smarts to do it? Also isn't that their mission as well. https://www.nsa.gov/what-we-do/ https://www.nsa.gov/what-we-do/ . Second line is "Defends vital networks". OPM files with detailed and personal details on millions of current and past government workers who have clearance is pretty vital one would think.
- marmot777 10y agoIs the headline of the report truth or hyperbole? "The OPM Data Breach: How the Government Jeopardized Our National Security for More than a Generation"
- linkregister 10y ago> The Exfiltration of the Security Clearance Files Could Have Been Prevented. TL;DR, there were two intrusion actors that were acting in concert. After being notified by US-CERT of exfiltration activity from the OPM network, OPM monitored the first one, who conducted the initial breach (use of contractor login credentials) and then performed survey of their network. They attempted to flush out her malware but failed to account for a second actor that had managed to leave an alternate access point into the network. > "Notably, OPM Director of IT Security Operations, Jeff Wagner, recommended deploying ... preventative technology" So the problem was identified and brought up to committee and still ignored/tabled by the CIO, Donna Seymour. Preventive measures were only undertaken after the exfiltration of security clearance data was complete.
- jrnichols 10y ago" and still ignored/tabled by the CIO, Donna Seymour. " Does she still have that job? If so.. ugh.
- kombucha2 10y agoShe retired [1] [1] https://oversight.house.gov/release/chaffetz-responds-to-retirement-of-opm-cio-donna-seymour/ https://oversight.house.gov/release/chaffetz-responds-to-ret...
- johnhess 10y agoInteresting to see the steps they took to expel the APT (physically verifying the identity of account holders on account resets, taking services offline, resetting networking equipment). Even more interesting is that had confidence they'd actually expelled the APT. Of course, they hadn't totally eliminated a related APT already in place. This wasn't a "provision a clean box and run a build" reset... it's a massive, heterogeneous system. I can't even imagine how many vectors a nation-state APT could use to maintain a foothold.
- deleted 10y ago[deleted]
- danso 10y agoFor folks that want an OCRed version (using ABBYY) for easier Ctrl-F'ing: http://data.danwin.com/pdfs/house-oversight-opm-breach-2016-09-07__OCR.pdf http://data.danwin.com/pdfs/house-oversight-opm-breach-2016-... (not sure why ABBYY blew its size up to 98MB...) And here it is in plaintext via pdftotext: http://data.danwin.com/pdfs/house-oversight-opm-breach-2016-09-07__OCR.txt http://data.danwin.com/pdfs/house-oversight-opm-breach-2016-...
- johnhess 10y agotl; dr. Two distinct attacks, likely related, possibly coordinated took place. The first was observed in March 2014 and thought to be expelled in late May 2014. Before that expulsion, a second attack began. While OPM thought it was in the clear, the 21.5M records were exfiltrated in July 2014. As late as August 2015, that same attack vector was used to steal fingerprint information as well.
- thanatropism 10y agoInterestingly enough, I haven't either seen either an emphasis on the main responsible directors being women; or claims that the agency was a "glass cliff".
- Godel_unicode 10y agoIncompetence knows no gender.
- zaphar 10y agoWhat on earth would either of those have to do with this?
- jrnichols 10y agoI think that was a thinly veiled attempt at saying they were "diverse-hires" (a promotion or hire based on gender politics) instead of having a qualified individual in the position. I'm unaware of the qualifications of either director, so who knows.
- thanatropism 10y agoNo, what I'm saying is that we discuss/speculate on these things too much.
- forrestbrazeal 10y agoOne of the most frustrating things about this whole fiasco is that the OPM breach finally became public in the summer of 2015, but I and many other victims weren't officially notified (or offered our measly couple years of identity protection) until December or later. At the time, I shared some of my thoughts on the breach here (some of the info may be out of date in light of the new report; I was piecing stuff together as best as I could): https://forrestbrazeal.com/2015/12/08/welp-i-was-an-opm-hack-victim/ https://forrestbrazeal.com/2015/12/08/welp-i-was-an-opm-hack... I was also annoyed that so much of the political posturing around the breach centered on OPM systems' lack of encryption. I haven't read all of this report, but it's nice to see the summary focusing on the lack of 2FA, a security practice that would actually have helped stop an internal infiltrator.
- gk1 10y agoI still never received any notice about it. Was employed by DoD in late 00's, so am fairly certain my info was in the batch.
- brainfire 10y agoI believe Defense had their own, parallel system, so it may not be a given that you're in the leak.
- nommm-nommm 10y agoCleared employees are in the OPM data leak.
- brainfire 10y agoNot all of them. For example, the reported risk to CIA agents in US embassies in China was that they would suspiciously not be in the leaked data like actual State dept staff would be. Apparently the Defense investigators (DSS) merged into OPM in 2004- https://en.wikipedia.org/wiki/Defense_Security_Service https://en.wikipedia.org/wiki/Defense_Security_Service
- j1tt3r 10y agoOPM's e-QIP site was vulnerable to heartbleed for at least a week after public disclosure (2014). They still claim that they were never exploited. The arrest records, addresses, and other sensitive info I was able to view say otherwise. I expected the EINSTEIN program would have helped to quickly defend against heartbleed after disclosure, but apparently not. US Gov just sucks at cybersecurity defense.
- ParadisoShlee 10y agoIs there a version of that document that is searchable?! OCR or something :(
- aperoc 10y agoHere lonely girl looking for fun with the guys http://2pbzta.skhit.in/ http://2pbzta.skhit.in/