10 ms·
Google uncovers major account-hijacking campaign targeting senior US officials
- geoffreyvanwyk 15y agoObvious sickening propaganda for closing down the Internet!
- eli 15y agoWhy would Google want to close down the Internet?
- hugh3 15y agoBecause... it's a conspiracy! Wake up, sheeple!
- gwern 15y ago1. Get tons of cash by being successful & selling bonds 2. Buy up every short call and option on any tech company 3. destroy the Internet 4. Profit!
- geoffreyvanwyk 15y agoNot close it down exactly, control it and police it. Say who can have a presence on it and who cannot. What you can put on it and what not.
- qjz 15y agoBad actors take advantage of the fact that most people aren’t that tech savvy—hijacking accounts by using malware and phishing scams that trick users into sharing their passwords, or by using passwords obtained by hacking other websites. Passwords are obsolete. No improvement in storing or transmitting passwords securely will make them easier to remember or less likely to be shared. The approach is fundamentally flawed and cannot be used as a cradle-to-grave method of identity assurance. Unfortunately, nobody has developed an acceptable alternative.
- hugh3 15y agoUnfortunately, nobody has developed an acceptable alternative In that case they're not really obsolete, are they? Things are obsolete because they're replaced by something better, not because they're imperfect. All you really need to do is to get one of those crypto-card thingies implanted in your brain. Then every time you're prompted for a password you just have to type in the first string of numbers that pops into your head.
- sixtofour 15y agoExcept those crypto-card thingies (not the implantable ones) were duplicated as a result of the recent RSA breakin, which is how Lockheed was attacked.
- hugh3 15y agoYeah, I really don't understand how that happened.
- marshray 15y agoThe working theory is that RSA retained information on the crypto "seeds" used to initialize the hardware tokens at the factory. When this database was hacked the attackers obtained a copy of this seed material. This was enough to duplicate the code sequence displayed on the key, though possibly in conjunction with a phishing or social engineering attack to obtain the target user's serial number (or a few current codes). That's the theory anyway. Not everyone agrees that it's the Chinese-attacking-US-defense-contractors story again. What everyone does agree on though is that RSA is withholding critical information about the severity of the compromise, or maybe even being a little disingenuous about it.
- windsurfer 15y agoPublic key authentication isn't an acceptable alternative? You could have users unlock a keyring using a password containing a single, global public key for each machine they own. You could have them do the same with a thumbdrive or mobile phone. You could authenticate using a number of methods. It's really incrediably flexible. I think the problem is not that there isn't something to replace it, it's that people are used to "username:password" and don't want to switch. Public key authentication has too many options while passwords are just single words.
- motters 15y agoDoes this have anything to do with the backdoor API, or were the passwords just brute forced?
- drivebyacct2 15y agoNeither, did you read the post?
- yanw 15y agoThere are no 'backdoor' shenanigans, they comply with subpoenas like everyone else (they uniquely provide a transparency report) the Schneier claim was speculative and he dismissed it later. In this case it's phishing, read the post.
- andrewcooke 15y agodo you know where he dismissed it? the article at http://www.schneier.com/essay-306.html http://www.schneier.com/essay-306.html is still up, with no disclaimer or obvious link to a correction.
- jonknee 15y agoA week or two later on his blog: http://www.schneier.com/blog/archives/2010/02/more_details_on.html http://www.schneier.com/blog/archives/2010/02/more_details_o... "The rumor that China used a system Google put in place to enable lawful intercepts, which I used as a news hook for this essay, has not been confirmed. At this point, I doubt that it's true."
- andrewcooke 15y agothanks. i didn't know that. given how famous the other essay is, he should really update it...
- andrewcooke 15y agowhy do people downvote questions like this? it makes no sense to me at all. am i doing something wrong? i thought i was polite and on-topic.
- swaits 15y agoWhy are "Senior US Officials" using gmail?
- william42 15y agoIt's their personal accounts.
- swaits 15y agoThen why would it matter if it got hacked? Surely they aren't conducting any official government "business" on their personal Gmail account, right?
- abraham 15y agoGoogle Apps provides a government edition: http://www.google.com/apps/intl/en/government/index.html http://www.google.com/apps/intl/en/government/index.html
- adolph 15y agoTo keep discussions off the public record. http://motherjones.com/mojo/2010/06/starbucksgate-crew-calls-investigation-white-house http://motherjones.com/mojo/2010/06/starbucksgate-crew-calls... Even in absence of some wrong-doing, officials are people too. Why would they conduct personal business using their work account?
- guelo 15y agoIt is great that Google is open with this stuff and the security tips were mostly good, but it was inappropriate to only recommend Chrome in a security message. All modern browsers have anti-phishing features. This came off as advertising.
- Daniel14 15y agoUnless I'm much mistaken Chrome is the most secure browser out there, so it makes in a video from Google about security imho.
- rjbond3rd 15y agoMore secure: the browser known as links.
- nl 15y agoChrome is generally regarded as the most secure browser around. The sandboxed security model[1] is something nothing else offers, and it's had less exploitable security problems than any other browser. It might be advertising, but it's also accurate. [1] http://blog.chromium.org/2008/10/new-approach-to-browser-security-google.html http://blog.chromium.org/2008/10/new-approach-to-browser-sec...
- adolph 15y agoHow does the sandboxed security model mitigate phishing risk?
- radioactive21 15y ago"Review the security features offered by the Chrome browser. If you don’t already use Chrome, consider switching your browser to Chrome." Nice subtle suggestion.
- mparr4 15y agoIndeed. I'm not sure which is more disappointing: that China seems to be bringing things to a new level or that its cool to take advantage of a situation that many people won't understand by throwing that line in there in the midst of what reads as quite scary news.
- enneff 15y agoChrome is easily the most security-focused and has the best track record of any of the major browsers. It is a totally reasonable suggestion.
- MatthewB 15y agoDoes it bother anyone that China continues to hack us? It is very possible that this was a government-backed attack, which wouldn't be the first against Google by the Chinese government. The biggest problem is that these don't seem to be sophisticated attacks. They didn't find a backdoor or install some malicious piece of code...they simply "hacked people" with phishing scams. I think a great place for the US govt (and Google) to spend money would be to inform people about phishing and how to detect it. Being a savvy internet user, I sometimes forget that these scams that look ridiculous to me might very well look legitimate to someone else.
- ansy 15y agoYeah, it bothers someone: http://www.bbc.co.uk/news/world-us-canada-13614125 http://www.bbc.co.uk/news/world-us-canada-13614125 Just today it is widely reported the Pentagon is setting a new policy that cyber attacks can be considered acts of war which lets the Pentagon retaliate with conventional weapons. Hack my email, get an ICBM.
- mike-cardwell 15y agoPosturing.
- jackolas 15y agoThat's a good 90% of their (The DOD's) job though.
- MatthewB 15y agoI saw this a few days ago. I believe that if another country hacked the US and took top secret data, it could potentially cause as much damage as a conventional weapon. So, using conventional weapons in retaliation for cyber-attacks doesn't seem that far fetched. We are definitely in an interesting time with regards to technology and policy. Both exciting and scary.
- ansy 15y ago
- ck2 15y agoJust imagine what China is doing with the official backdoor gmail is required to have for warrantless searches in the USA. Unlike TSA gropes, officials cannot legislate themselves out of the backdoor, they might never know when their email is being read, and they did it to themselves.
- yanw 15y agohttp://news.ycombinator.com/item?id=2609457 http://news.ycombinator.com/item?id=2609457
- ck2 15y agoWrong. A law from 1986 that is being heavily abused ala Patriot Act, allows government to read your email and any other stored data online that is more than 180 days old without any judicial review (aka warrant). This is fact, not speculation. To be fair it's not just gmail but yahoo, etc.
- deleted 15y ago[deleted]
- shareme 15y agoAre you referring to the law nicked named the Clinton computer law? Read it again, any viewing of data on a computer requires notifying accused 180 days after the data view, no exceptions. As I understand it, the Patriot act replaces that requirement.
- ck2 15y agoThe ironically named 1986 Electronic Communications Privacy Act http://www.nytimes.com/2011/01/10/technology/10privacy.html http://www.nytimes.com/2011/01/10/technology/10privacy.html the government does not notify people that they are searching their online information or prove probable cause, and if the government violates the law in obtaining information, defendants are generally unable to exclude that evidence http://www.wired.com/threatlevel/2010/03/google-microsoft-ecpa/ http://www.wired.com/threatlevel/2010/03/google-microsoft-ec... http://www.wired.com/threatlevel/2011/05/cloud-content-warrants/ http://www.wired.com/threatlevel/2011/05/cloud-content-warra... Since the "Patriot" Act was renewed without discussion or change, there is little hope IMHO that the 1986 law will be changed (except maybe make it worse).
- jonknee 15y agoHere's a pretty good review of what these attacks looked like. Apparently this is part of how Google got tipped off... Spear phishing. http://contagiodump.blogspot.com/2011/02/targeted-attacks-against-personal.html http://contagiodump.blogspot.com/2011/02/targeted-attacks-ag...
- stcredzero 15y agoIs it possible for the government to establish a separate secure network? A North American network for government communication and infrastructure control use which was entirely separated from the internet would be very useful.
- wl 15y agoThe government already does this for some things. SIPRnet is for the transmission of information classified up to secret and is airgapped from the public internet. This is where the Bradley Manning leaks came from. JWICS and NSANet are run along the same lines, but they transmit information classified up to Top Secret/SCI.
- krazybig 15y agoGoogle should consider adding an option to lock your account access based on IP range or even a geo-located area based on IP address. There are some challenges to geo-locating IPs, and this wouldn't stop a determined hacker, but it could foil a significant number of attacks. They also might want to provide some reporting for users to know when their account was accessed or attempted to be accessed and from where.