7 ms·

“EPIC” fail–how OPM hackers tapped the mother lode of espionage data

77 points by ghosh 11y ago

arh68 11y ago
> C, for the Central Verification System (CVS), ... contains ... Personal Identification Verification (PIV) credentials ... and polygraph data Good lord. Yet, somehow, someone might still present the solution as needing to spend more money sooner: It was only when OPM was assessing systems to actually implement the sort of continuous monitoring tools ... that OPM security officers discovered traffic outbound from the network. If only they'd demo'd the software a year ago, right? /s Is anyone getting fired? Why should anyone lift a finger during this 30-day sprint? And what happens on Day 31?
- rodgerd 11y ago
  This is the shit the NSA should be worrying about. Securing the US IT infrastructure against nation-state intrusion. Not dragnets of everyone's naked selfies.
  - fname 11y ago
    I don't disagree. Unfortunately, this all falls on DoD-DISA. The NSA works with DISA to write the policy for how to secure systems (called STIGs) and also has 'Red Teams', but they aren't the arm that certifies these systems before coming online, nor are they the ones the ensure the systems stay secured as new vulnerabilities are found and patched -- that's DISA again.
    - walshemj 11y ago
      I could see the CIA NSA taking their vetteing back in house every CIA and NAS employee must be incandesant with rage over this cock up.
    - djKianoosh 11y ago
      You obviously know what you're talking about, but DISA can't enforce STIGs across the entire government can they? Some say that's DHS's job, or some Office within DHS (or within an Agency under DHS).
      - fname 11y ago
        > but DISA can't enforce STIGs across the entire government can they? No, with a small caveat: If that civilian agency (say DHS) is connected to the GIG[1], then DISA has a say-so and can threaten to disconnect them for failing security audits. Something to keep in mind is that the STIGs are merely implementation guides to secure a system. Therefore, different agencies have different interpretations. In some cases specific secure implementations break systems and applications (mostly legacy ones), so they avoid securing those particular settings all together. 1: https://en.wikipedia.org/wiki/Global_Information_Grid https://en.wikipedia.org/wiki/Global_Information_Grid
    - DickingAround 11y ago
      That makes sense from an org-chart level. But if that's actually the thinking inside, it represents a total lack of ownership on their part to get to the overall goal of security.
- walshemj 11y ago
  If this was the UK the home secretary would have resigned by now - why has the secretary of state (which I understand is the US equivalent) not done so.
  - dublinben 11y ago
    The Secretary of State has no responsibility over the agency at question. It is an independent agency with a director appointed by the President. That is who should be resigning over this.
  - deleted 11y ago
    [deleted]
  - jrochkind1 11y ago
    The secretary of state isn't the equivalent of the home secretary. The secretary of state is mainly responsible for foreign policy, so probably more like equivalent to the Foreign Secretary? Although definitely not a strict equivalency. There isn't really any U.S. equivalent to the Home Secretary, the responsibilities are divided over several offices reporting to the president.
    - walshemj 11y ago
      Ah I see ty
  - djKianoosh 11y ago
    For some background here is the way DHS is organized: http://www.dhs.gov/components-directorates-and-offices http://www.dhs.gov/components-directorates-and-offices
  - fweespeech 11y ago
    None of the secretaries have direct control or authority over the OPM. Additionally, the Secretary of State is foreign affairs and not the equivalent of the Home Secretary. https://en.wikipedia.org/wiki/Katherine_Archuleta https://en.wikipedia.org/wiki/Katherine_Archuleta That is the person who is responsible for the OPM. It operates on a fee-for-service model for 90% of its budget and isn't properly funding IT and IT security. Given she has only been there 18 months, I'm not sure how you can really blame her beyond the fact she didn't follow the "shutdown and repair" recommendation...except for the fact if she did that, she'd have to burn through the OPM's cash reserves as the only way to fund it. Its honestly more of a flaw in the way Congress built the OPM incentive structure and the fact the director is a revolving door position that changes every 2-4 years. The government simply just doesn't fund/prioritize IT & IT security properly outside of the intelligence services. They also build these psuedo-private-sector funding models that create the incentive to "ignore" cost centers like Security into critical infrastructure like the OPM. Its really horrific.
- amyjess 11y ago
  Gotta love the government obsession with acronyms. Where I come from, CVS and PIV mean completely different things. One of them is an abomination before God, and the other is a natural act of biology.
- tripzilch 11y ago
  Good lord, not the polygraph data! I wonder if the Chinese have a database with I-Ching divinations?
rodgerd 11y ago
And to think the UKUSA agencies tried to cover up this clusterfuck by having the Murdoch rags blame it on Snowden. (JRun and Windows XP? Really?)
- walshemj 11y ago
  That's a different thing and BTW Bruce Schenier thinks that the FSB and the Chinese have Snowdens data by now the. Now id believe Bruce more than a Murdoch Rag
  - beagle3 11y ago
    If I understood Schneier's piece correctly, he believes that they had it before Snowden did (and independently of him), which seems extremely plausible - if Snowden could take all those files with nobody noticing, it's likely that a well funded, well equipped and well trained espionage agency has done that independently of him, likely all of them -- And for disinformation and source hiding, I'm sure they all (even internally and to their own "customers") claim now that the source is Snowden. I would if I were in their place.
    - walshemj 11y ago
      I though his point was that they would have got it from the Journalist's - His other point was more speculative that there are other spies working for the FSB etc inside the wire at the nsa
      - beagle3 11y ago
        All his points are speculative. He basically said "I think they probably have it - either directly or from the journalists". Why do most people believe the journalists are the easier target? They have certainly, at any point in time when stuff was in their possession, been more paranoid and careful than the NSA was before Snowden's reveal.
        11y ago
emiliobumachar 11y ago
'The $20.8 million "first call" was for 3.2 million "units" of credit monitoring and identity theft recovery services' At seven bucks a piece, this seems very cheap, especially for a rushed government purchase. Any thoughts? Am I missing something?
- sqeaky 11y ago
  It will likely be one or a few larger forensic investigations. I would wager that a team of a dozen experts or so will start one big investigation calling in other help as needed. In one big windfall they will determine how 80% or more of the data was taken. Then whatever is left will be handled on a case by case basis. Likely the Unit thing was done to make the bureaucracy that pays for things happy. I have worked places where a 1,000 payments of $1 each was easy to make happen than one $600 purchase.
deleted 11y ago
[deleted]
Lancey 11y ago
I feel like the OPM isn't doing enough about this breach. Espionage or not, American citizens outside the IC were affected and deserve to know if they've been compromised. More efforts need to be made to inform potential victims before any more harm comes from this, including greater transparency with regards to what systems have been affected and what the OPM could have done to better secure this data. That, and an apology would be nice.
at-fates-hands 11y ago
"Among the things the inspector general found that could have helped hackers was that nearly a quarter of the agency's systems did not have valid authorization procedures," she said. "The reason that's important is because one of the departments that didn't have the correct procedures was the Federal Investigative Services. That's the group responsible for background investigations of federal employees. So that data's very sensitive, and as we know now, this is one of the databases that was hacked." Let me get this straight. You had really sensitive data, you knew it wasn't secure and huge portions of the systems didn't have valid authorization procedures? This is pretty eye opening, even for a governmental agency. The scary thing is, this is just the tip of the iceberg. It seems this breach was inevitable considering how many other EPIC FAILS are mentioned in the article.
amitparikh 11y ago
Hypothetically, could U.S. persons who were affected by this breach claim any sort of financial reprieve for future lost wages? I'd imagine those affected would not be very desirable or even eligible any more for secure work.
- frandroid 11y ago
  In theory, yes, but in practice, that's the entire government apparatus that requires security clearance which is suddenly not eligible for getting a new job (or even keeping their current one). So nothing is going to happen there.
- tomjen3 11y ago
  While it would be bad for the spies I don't think it matters much for the people who, eg analyse geospatial data, since they would only need to be vetted for access to the data.
- logn 11y ago
  "The ability of consumers to sue for future harm has, in many cases, been limited by a Supreme Court ruling that on its face had little to do with big commercial breaches. [...] In 2013 the Supreme Court ruled 5-4 against them, concluding that the fear of future harm from surveillance wasn’t enough for plaintiffs to have standing to sue." from https://firstlook.org/theintercept/2015/06/12/data-breach-threat-of-future-harm/ https://firstlook.org/theintercept/2015/06/12/data-breach-th... The article also mentions a pending Supreme Court case (Spokeo v. Robins) which could "'open up the floodgate for lawsuits, in all contexts, but especially in data breach litigation'".
deleted 11y ago
[deleted]
_Marak_ 11y ago
Would not be surprised if this was related to the US temporarily stopping the issuance of visas. http://travel.state.gov/content/travel/english/news/technological-systems-issue.html http://travel.state.gov/content/travel/english/news/technolo...

77 points by ghosh 11y ago

arh68 11y ago

> C, for the Central Verification System (CVS), ... contains ... Personal Identification Verification (PIV) credentials ... and polygraph data Good lord. Yet, somehow, someone might still present the solution as needing to spend more money sooner: It was only when OPM was assessing systems to actually implement the sort of continuous monitoring tools ... that OPM security officers discovered traffic outbound from the network. If only they'd demo'd the software a year ago, right? /s Is anyone getting fired? Why should anyone lift a finger during this 30-day sprint? And what happens on Day 31?

rodgerd 11y ago
This is the shit the NSA should be worrying about. Securing the US IT infrastructure against nation-state intrusion. Not dragnets of everyone's naked selfies.
- fname 11y ago
  I don't disagree. Unfortunately, this all falls on DoD-DISA. The NSA works with DISA to write the policy for how to secure systems (called STIGs) and also has 'Red Teams', but they aren't the arm that certifies these systems before coming online, nor are they the ones the ensure the systems stay secured as new vulnerabilities are found and patched -- that's DISA again.
  - walshemj 11y ago
    I could see the CIA NSA taking their vetteing back in house every CIA and NAS employee must be incandesant with rage over this cock up.
  - djKianoosh 11y ago
    You obviously know what you're talking about, but DISA can't enforce STIGs across the entire government can they? Some say that's DHS's job, or some Office within DHS (or within an Agency under DHS).
    - fname 11y ago
      > but DISA can't enforce STIGs across the entire government can they? No, with a small caveat: If that civilian agency (say DHS) is connected to the GIG[1], then DISA has a say-so and can threaten to disconnect them for failing security audits. Something to keep in mind is that the STIGs are merely implementation guides to secure a system. Therefore, different agencies have different interpretations. In some cases specific secure implementations break systems and applications (mostly legacy ones), so they avoid securing those particular settings all together. 1: https://en.wikipedia.org/wiki/Global_Information_Grid https://en.wikipedia.org/wiki/Global_Information_Grid
  - DickingAround 11y ago
    That makes sense from an org-chart level. But if that's actually the thinking inside, it represents a total lack of ownership on their part to get to the overall goal of security.
walshemj 11y ago
If this was the UK the home secretary would have resigned by now - why has the secretary of state (which I understand is the US equivalent) not done so.
- dublinben 11y ago
  The Secretary of State has no responsibility over the agency at question. It is an independent agency with a director appointed by the President. That is who should be resigning over this.
- deleted 11y ago
  [deleted]
- jrochkind1 11y ago
  The secretary of state isn't the equivalent of the home secretary. The secretary of state is mainly responsible for foreign policy, so probably more like equivalent to the Foreign Secretary? Although definitely not a strict equivalency. There isn't really any U.S. equivalent to the Home Secretary, the responsibilities are divided over several offices reporting to the president.
  - walshemj 11y ago
    Ah I see ty
- djKianoosh 11y ago
  For some background here is the way DHS is organized: http://www.dhs.gov/components-directorates-and-offices http://www.dhs.gov/components-directorates-and-offices
- fweespeech 11y ago
  None of the secretaries have direct control or authority over the OPM. Additionally, the Secretary of State is foreign affairs and not the equivalent of the Home Secretary. https://en.wikipedia.org/wiki/Katherine_Archuleta https://en.wikipedia.org/wiki/Katherine_Archuleta That is the person who is responsible for the OPM. It operates on a fee-for-service model for 90% of its budget and isn't properly funding IT and IT security. Given she has only been there 18 months, I'm not sure how you can really blame her beyond the fact she didn't follow the "shutdown and repair" recommendation...except for the fact if she did that, she'd have to burn through the OPM's cash reserves as the only way to fund it. Its honestly more of a flaw in the way Congress built the OPM incentive structure and the fact the director is a revolving door position that changes every 2-4 years. The government simply just doesn't fund/prioritize IT & IT security properly outside of the intelligence services. They also build these psuedo-private-sector funding models that create the incentive to "ignore" cost centers like Security into critical infrastructure like the OPM. Its really horrific.
amyjess 11y ago
Gotta love the government obsession with acronyms. Where I come from, CVS and PIV mean completely different things. One of them is an abomination before God, and the other is a natural act of biology.
tripzilch 11y ago
Good lord, not the polygraph data! I wonder if the Chinese have a database with I-Ching divinations?

rodgerd 11y ago

And to think the UKUSA agencies tried to cover up this clusterfuck by having the Murdoch rags blame it on Snowden. (JRun and Windows XP? Really?)

walshemj 11y ago
That's a different thing and BTW Bruce Schenier thinks that the FSB and the Chinese have Snowdens data by now the. Now id believe Bruce more than a Murdoch Rag
- beagle3 11y ago
  If I understood Schneier's piece correctly, he believes that they had it before Snowden did (and independently of him), which seems extremely plausible - if Snowden could take all those files with nobody noticing, it's likely that a well funded, well equipped and well trained espionage agency has done that independently of him, likely all of them -- And for disinformation and source hiding, I'm sure they all (even internally and to their own "customers") claim now that the source is Snowden. I would if I were in their place.
  - walshemj 11y ago
    I though his point was that they would have got it from the Journalist's - His other point was more speculative that there are other spies working for the FSB etc inside the wire at the nsa
    - beagle3 11y ago
      All his points are speculative. He basically said "I think they probably have it - either directly or from the journalists". Why do most people believe the journalists are the easier target? They have certainly, at any point in time when stuff was in their possession, been more paranoid and careful than the NSA was before Snowden's reveal.
      - 11y ago

emiliobumachar 11y ago

'The $20.8 million "first call" was for 3.2 million "units" of credit monitoring and identity theft recovery services' At seven bucks a piece, this seems very cheap, especially for a rushed government purchase. Any thoughts? Am I missing something?

sqeaky 11y ago
It will likely be one or a few larger forensic investigations. I would wager that a team of a dozen experts or so will start one big investigation calling in other help as needed. In one big windfall they will determine how 80% or more of the data was taken. Then whatever is left will be handled on a case by case basis. Likely the Unit thing was done to make the bureaucracy that pays for things happy. I have worked places where a 1,000 payments of $1 each was easy to make happen than one $600 purchase.

deleted 11y ago

[deleted]

Lancey 11y ago

I feel like the OPM isn't doing enough about this breach. Espionage or not, American citizens outside the IC were affected and deserve to know if they've been compromised. More efforts need to be made to inform potential victims before any more harm comes from this, including greater transparency with regards to what systems have been affected and what the OPM could have done to better secure this data. That, and an apology would be nice.

at-fates-hands 11y ago

"Among the things the inspector general found that could have helped hackers was that nearly a quarter of the agency's systems did not have valid authorization procedures," she said. "The reason that's important is because one of the departments that didn't have the correct procedures was the Federal Investigative Services. That's the group responsible for background investigations of federal employees. So that data's very sensitive, and as we know now, this is one of the databases that was hacked." Let me get this straight. You had really sensitive data, you knew it wasn't secure and huge portions of the systems didn't have valid authorization procedures? This is pretty eye opening, even for a governmental agency. The scary thing is, this is just the tip of the iceberg. It seems this breach was inevitable considering how many other EPIC FAILS are mentioned in the article.

amitparikh 11y ago

Hypothetically, could U.S. persons who were affected by this breach claim any sort of financial reprieve for future lost wages? I'd imagine those affected would not be very desirable or even eligible any more for secure work.

frandroid 11y ago
In theory, yes, but in practice, that's the entire government apparatus that requires security clearance which is suddenly not eligible for getting a new job (or even keeping their current one). So nothing is going to happen there.
tomjen3 11y ago
While it would be bad for the spies I don't think it matters much for the people who, eg analyse geospatial data, since they would only need to be vetted for access to the data.
logn 11y ago
"The ability of consumers to sue for future harm has, in many cases, been limited by a Supreme Court ruling that on its face had little to do with big commercial breaches. [...] In 2013 the Supreme Court ruled 5-4 against them, concluding that the fear of future harm from surveillance wasn’t enough for plaintiffs to have standing to sue." from https://firstlook.org/theintercept/2015/06/12/data-breach-threat-of-future-harm/ https://firstlook.org/theintercept/2015/06/12/data-breach-th... The article also mentions a pending Supreme Court case (Spokeo v. Robins) which could "'open up the floodgate for lawsuits, in all contexts, but especially in data breach litigation'".

deleted 11y ago

[deleted]

_Marak_ 11y ago

Would not be surprised if this was related to the US temporarily stopping the issuance of visas. http://travel.state.gov/content/travel/english/news/technological-systems-issue.html http://travel.state.gov/content/travel/english/news/technolo...