5 ms·

Data hacked from U.S. government dates back to 1985

38 points by dsmithatx 11y ago

fweespeech 11y ago
Does anyone find it hilariously convenient the timing that as soon as something expired ... this announcement goes to all the papers within a few days while they basically pass a nearly identical thing?
- mmnnmmnn 11y ago
  I do. people predict it (this sort of timing), we all laugh it off, and then it happens anyway!
- logn 11y ago
  I do. Not only the timing of the Patriot Act expiration but also the recent NY Times/Snowden story (in which the government specifically cited state-sponsored cyber attacks as justification for mass surveillance). I read somewhere the actual breach was detected a month or two ago, so it doesn't seem that unreasonable they planned the announcement to coincide with the NY Times story and/or the Patriot Act end date. Also on all the cyber crimes I have a hard time believing anything. Definitely China's attacking us and we're attacking them, but on specific instances, we're never shown any proof at all. What are we to believe? And then I hear people asking about when a cyber attack constitutes an act of war. My god, I hope we don't go to war again on evidence that is unverified. And hopefully the media learned to be more skeptical of government claims after that whole Iraq WMD story, but it doesn't seem like it.
- nerdy 11y ago
  I'm not clear how the Patriot Act (if that's the "something" you mention) has anything to do with a state-sponsored advanced persistent threat. Can you explain?
  - fweespeech 11y ago
    > The federal personnel office learned of the data breach after it began to toughen its cybersecurity defense system. When it discovered malicious activity, authorities used a detection system called EINSTEIN to unearth the information breach in April, the Department of Homeland Security said. http://www.cnn.com/2015/06/04/politics/federal-agency-hacked-personnel-management/ http://www.cnn.com/2015/06/04/politics/federal-agency-hacked... They waited until Thursday to reveal it. The timing is more than coincidence. Lol.
    - nerdy 11y ago
      So why not release it Monday/Tuesday? Thursday is sneakier?
      - toomuchtodo 11y ago
        They knew in April, they waited until right after Section 215 of the Patriot Act expired June 1st. Section 215 is the piece of legislation the NSA used as justification for its carte blanche collection of data in the US.
        nerdy 11y ago
        What I'm trying to say is that I don't think it furthers their goal. It isn't like some terrorist act occurred which would've been uncovered with Section 215 still active. This happened on their watch and under the so-called protection of the Patriot Act. To me, it seems like just another example of the Patriot Act not protecting people.
        toomuchtodo 11y ago
        You're right on both counts, but keep in mind how few people are going to understand that. The media is going to report it as "rabble rabble rabble Chinese hackers because patriot act expired".
        fweespeech 11y ago
        How much would you like to bet that this will be spun as they need more powers like Section 215 and people will believe them in large numbers?
fru2013 11y ago
Too bad it wasn't encrypted.
gtrubetskoy 11y ago
I really do not understand how the origin country of the attack can be so quickly identified, and that based on that it gets attributed to the government of said country. The source IP of attack usually tells you absolutely nothing about the origin, it's typically a hacked server or a desktop which can be in China or in France just the same. I also heard on the news the so called "security experts" claim that certain "patterns" in the attack allow them to attribute it to a specific group of hackers. Anyone who's dealt with security for real knows that there are no patters (just like there really are no hacker groups). In 99.9% of these cases the best you can do is identify and close the hole they used and any others they've left behind, assess the damages and notify the affected people. You will never find who did it, from where and why.
- nerdy 11y ago
  It could boil down to having other intelligence fingering China, but the US doesn't want to expose and consequently draw attention to the source of the information. If the US doesn't have some 99.9999% assurance it was China and they made a statement like that with egg still on their face from the breach, it's pretty sad. I don't rule it out, but the US probably has more common sense than that. From a technical perspective, it sure was a fast "investigation".
  - shit_parade2 11y ago
    Because the US government has proven so trust worthy in recent memory with all the secret laws, torture, and murder of innocents. What an endless parade of jingoists to ever defend the exceptional American empire.
    - gred 11y ago
      Username checks out.
      - cmdrfred 11y ago
        BURN
fweespeech 11y ago
The sad part is this: http://www.nytimes.com/2015/06/06/us/chinese-hackers-may-be-behind-anthem-premera-attacks.html?_r=0 http://www.nytimes.com/2015/06/06/us/chinese-hackers-may-be-... > WASHINGTON — The inspector general at the Office of Personnel Management, which keeps the records and security clearance information for millions of current and retired federal employees, issued a report in November that essentially described the agency’s computer security system as a Chinese hacker’s dream.
ams6110 11y ago
There are no secrets. We can't put the genie back in the bottle. We need to change our approach. We need to figure out a way to establish identity that doesn't rely on information anyone else has, such as names, dates, government-issued numbers, fingerprints, DNA, etc.
wooster 11y ago
For those wondering how bad a data breach of OPM is, this is what a typical OPM clearance form looks like: https://www.opm.gov/forms/pdf_fill/sf86.pdf https://www.opm.gov/forms/pdf_fill/sf86.pdf
- simoncion 11y ago
  That's an SF-86. You fill that out for clearances as low as Secret. The bar for a Secret is roughly "Are you blackmailable? No? Here's your clearance.". You can ship Secret material through the USPS if you ship it as registered mail. There's no need to hand-carry it. There are many, many things that are classified as Secret that are either overclassified, are classified as such to cover someone's ass or prevent embarrassment. Secret material can be sensitive stuff, but should never be serious spy shit. If it is, someone seriously fucked up their classification guide.

38 points by dsmithatx 11y ago

Does anyone find it hilariously convenient the timing that as soon as something expired ... this announcement goes to all the papers within a few days while they basically pass a nearly identical thing?

mmnnmmnn 11y ago
I do. people predict it (this sort of timing), we all laugh it off, and then it happens anyway!
logn 11y ago
I do. Not only the timing of the Patriot Act expiration but also the recent NY Times/Snowden story (in which the government specifically cited state-sponsored cyber attacks as justification for mass surveillance). I read somewhere the actual breach was detected a month or two ago, so it doesn't seem that unreasonable they planned the announcement to coincide with the NY Times story and/or the Patriot Act end date. Also on all the cyber crimes I have a hard time believing anything. Definitely China's attacking us and we're attacking them, but on specific instances, we're never shown any proof at all. What are we to believe? And then I hear people asking about when a cyber attack constitutes an act of war. My god, I hope we don't go to war again on evidence that is unverified. And hopefully the media learned to be more skeptical of government claims after that whole Iraq WMD story, but it doesn't seem like it.
nerdy 11y ago
I'm not clear how the Patriot Act (if that's the "something" you mention) has anything to do with a state-sponsored advanced persistent threat. Can you explain?
- fweespeech 11y ago
  > The federal personnel office learned of the data breach after it began to toughen its cybersecurity defense system. When it discovered malicious activity, authorities used a detection system called EINSTEIN to unearth the information breach in April, the Department of Homeland Security said. http://www.cnn.com/2015/06/04/politics/federal-agency-hacked-personnel-management/ http://www.cnn.com/2015/06/04/politics/federal-agency-hacked... They waited until Thursday to reveal it. The timing is more than coincidence. Lol.
  - nerdy 11y ago
    So why not release it Monday/Tuesday? Thursday is sneakier?
    - toomuchtodo 11y ago
      They knew in April, they waited until right after Section 215 of the Patriot Act expired June 1st. Section 215 is the piece of legislation the NSA used as justification for its carte blanche collection of data in the US.
      - nerdy 11y ago
        What I'm trying to say is that I don't think it furthers their goal. It isn't like some terrorist act occurred which would've been uncovered with Section 215 still active. This happened on their watch and under the so-called protection of the Patriot Act. To me, it seems like just another example of the Patriot Act not protecting people.
        toomuchtodo 11y ago
        You're right on both counts, but keep in mind how few people are going to understand that. The media is going to report it as "rabble rabble rabble Chinese hackers because patriot act expired".
        fweespeech 11y ago
        How much would you like to bet that this will be spun as they need more powers like Section 215 and people will believe them in large numbers?

fru2013 11y ago

Too bad it wasn't encrypted.

gtrubetskoy 11y ago

I really do not understand how the origin country of the attack can be so quickly identified, and that based on that it gets attributed to the government of said country. The source IP of attack usually tells you absolutely nothing about the origin, it's typically a hacked server or a desktop which can be in China or in France just the same. I also heard on the news the so called "security experts" claim that certain "patterns" in the attack allow them to attribute it to a specific group of hackers. Anyone who's dealt with security for real knows that there are no patters (just like there really are no hacker groups). In 99.9% of these cases the best you can do is identify and close the hole they used and any others they've left behind, assess the damages and notify the affected people. You will never find who did it, from where and why.

nerdy 11y ago
It could boil down to having other intelligence fingering China, but the US doesn't want to expose and consequently draw attention to the source of the information. If the US doesn't have some 99.9999% assurance it was China and they made a statement like that with egg still on their face from the breach, it's pretty sad. I don't rule it out, but the US probably has more common sense than that. From a technical perspective, it sure was a fast "investigation".
- shit_parade2 11y ago
  Because the US government has proven so trust worthy in recent memory with all the secret laws, torture, and murder of innocents. What an endless parade of jingoists to ever defend the exceptional American empire.
  - gred 11y ago
    Username checks out.
    - cmdrfred 11y ago
      BURN

fweespeech 11y ago

The sad part is this: http://www.nytimes.com/2015/06/06/us/chinese-hackers-may-be-behind-anthem-premera-attacks.html?_r=0 http://www.nytimes.com/2015/06/06/us/chinese-hackers-may-be-... > WASHINGTON — The inspector general at the Office of Personnel Management, which keeps the records and security clearance information for millions of current and retired federal employees, issued a report in November that essentially described the agency’s computer security system as a Chinese hacker’s dream.

ams6110 11y ago

There are no secrets. We can't put the genie back in the bottle. We need to change our approach. We need to figure out a way to establish identity that doesn't rely on information anyone else has, such as names, dates, government-issued numbers, fingerprints, DNA, etc.

wooster 11y ago

For those wondering how bad a data breach of OPM is, this is what a typical OPM clearance form looks like: https://www.opm.gov/forms/pdf_fill/sf86.pdf https://www.opm.gov/forms/pdf_fill/sf86.pdf

simoncion 11y ago
That's an SF-86. You fill that out for clearances as low as Secret. The bar for a Secret is roughly "Are you blackmailable? No? Here's your clearance.". You can ship Secret material through the USPS if you ship it as registered mail. There's no need to hand-carry it. There are many, many things that are classified as Secret that are either overclassified, are classified as such to cover someone's ass or prevent embarrassment. Secret material can be sensitive stuff, but should never be serious spy shit. If it is, someone seriously fucked up their classification guide.