4 ms·

I wrote about this one almost a month ago: http://caseysoftware.com/blog/why-this-security-breach-is-worse-than-all-the-others-combined http://caseysoftware.com

I wrote about this one almost a month ago: http://caseysoftware.com/blog/why-this-security-breach-is-worse-than-all-the-others-combined http://caseysoftware.com/blog/why-this-security-breach-is-wo... (spent a day on the front page here) Every time OPM says "it was only X" it comes out a few days later that they're lying. My original statements have applied since day one: "Whoever took this data has all the relevant information on anyone (and their families and their friends) who has received a security clearance. Not some. Not parts. ALL." and "If someone just steals your identity, consider yourself lucky." It was also uncovered that the so-called "hackers" had read/write access to the system so therefore EVERYTHING in it - whether good or bad - should be considered suspicious. People who shouldn't have gotten clearances, may have. People who should have been cleared, may have been blocked.

mokus 11y ago
Another aspect worth considering, which I haven't seen mentioned yet, is that this database clearly fits the standard criteria for Top Secret classification (potential to cause "exceptionally grave harm" if compromised). I really think Archuleta and Seymour should be brought up on criminal charges for mishandling information that should have been classified Top Secret and likely also should have been associated with a special-access program. Even if the records for an individual person don't rise to that level, 20-ish million of them together absolutely do. That's 1/15 of the entire population of the nation. There just are no words for the asininity of storing all of that data in a single database in the first place, IMO - let alone a database that is actually accessible through any number of network pivots from the internet.
- x0x0 11y ago
  Storing all that data live in a db almost certainly predates Archuleta, and to be honest, I doubt she was in a position to fix this. Consider the political capital needed to say, "This system is insecure, and insecurable by design, so we're taking it offline until it can be secured." Until you have a breach, essentially nobody would be willing to have that happen. the "secure" Web gateway to OPM's background investigation systems is a contractor-hosted website at an application service provider. That Web gateway is reached through a Windows Web server running JRun 4.0, Adobe's Java application server, as well as ColdFusion [...] In 2013, someone hacked into Adobe and stole the ColdFusion source code. And Adobe dropped the JRun product line entirely in 2013—with extended "core" support ending in December of 2014. There is no evidence that OPM or its application provider had purchased expensive extended, dedicated support, but JRun would hardly be the only unsupported platform still used by OPM. The agency still has systems based on Windows XP (supported under a custom support agreement with Microsoft), and many of the core systems run by the agency are based on mainframe applications that haven't been updated since their COBOL code was fixed for the Y2K bug in the late 1990s. [1] A gateway running windows, java, and coldfusion. Not to even mentioned fucking eol-ed versions of the aforementioned. That simply cannot be secured in any meaningful fashion. [1] http://arstechnica.com/security/2015/06/epic-fail-how-opm-hackers-tapped-the-mother-lode-of-espionage-data/ http://arstechnica.com/security/2015/06/epic-fail-how-opm-ha...
  - toyg 11y ago
    The political and economic capital. Big stack updates like this cost a pretty penny. Who's going to advocate for increased taxation to secure a bunch of admin databases?
tomjen3 11y ago
>People who shouldn't have gotten clearances, may have. People who should have been cleared, may have been blocked. Stealing the information is bad enough, but that utterly shocks me. It should be a huge scandal - what if the Chinese has put sleeper agents in key positions? Heck it almost makes sense to steal the data just to cover your tracks. Why isn't this a bigger deal?
dredmorbius 11y ago
it comes out a few days later that they're lying. A slightly more charitable explanation is that it's very difficult to grasp the scope of a data breach initially. This is similar to most disasters, in that it takes time for a full awareness of what's transpired to sink in -- initial stages are almost always a period of increasing damage estimates as prevoiusly cut-off or not-heard-from locations file reports. I've written on how it took hours for Japan to realize the extent of damage in Hiroshima, and a full day to realize just what had happened. And that only because the United States told them. https://www.reddit.com/r/dredmorbius/comments/1wf9yc/on_disasters_wwii_japanese_leadership_wasnt_aware/ https://www.reddit.com/r/dredmorbius/comments/1wf9yc/on_disa... And that was an event which left highly tangible physical evidence. For data loss, you're dealing with little by way of physical evidence, almost always an unknown attacker, and a case of forensic log analysis, trying to sort legitimate traffic from non. If you _can_ determine that specific accounts or IPs are known compromised or hostile, you may be able to make some guess as to what data were accessed, but that depends entirely on the level of logging and other design elements of your systems. The evolving rule of thumb is that any data breach will be larger than first reported. But it's not appropriate to assume this is on account of intentional deception.

mokus 11y ago

Another aspect worth considering, which I haven't seen mentioned yet, is that this database clearly fits the standard criteria for Top Secret classification (potential to cause "exceptionally grave harm" if compromised). I really think Archuleta and Seymour should be brought up on criminal charges for mishandling information that should have been classified Top Secret and likely also should have been associated with a special-access program. Even if the records for an individual person don't rise to that level, 20-ish million of them together absolutely do. That's 1/15 of the entire population of the nation. There just are no words for the asininity of storing all of that data in a single database in the first place, IMO - let alone a database that is actually accessible through any number of network pivots from the internet.

x0x0 11y ago
Storing all that data live in a db almost certainly predates Archuleta, and to be honest, I doubt she was in a position to fix this. Consider the political capital needed to say, "This system is insecure, and insecurable by design, so we're taking it offline until it can be secured." Until you have a breach, essentially nobody would be willing to have that happen. the "secure" Web gateway to OPM's background investigation systems is a contractor-hosted website at an application service provider. That Web gateway is reached through a Windows Web server running JRun 4.0, Adobe's Java application server, as well as ColdFusion [...] In 2013, someone hacked into Adobe and stole the ColdFusion source code. And Adobe dropped the JRun product line entirely in 2013—with extended "core" support ending in December of 2014. There is no evidence that OPM or its application provider had purchased expensive extended, dedicated support, but JRun would hardly be the only unsupported platform still used by OPM. The agency still has systems based on Windows XP (supported under a custom support agreement with Microsoft), and many of the core systems run by the agency are based on mainframe applications that haven't been updated since their COBOL code was fixed for the Y2K bug in the late 1990s. [1] A gateway running windows, java, and coldfusion. Not to even mentioned fucking eol-ed versions of the aforementioned. That simply cannot be secured in any meaningful fashion. [1] http://arstechnica.com/security/2015/06/epic-fail-how-opm-hackers-tapped-the-mother-lode-of-espionage-data/ http://arstechnica.com/security/2015/06/epic-fail-how-opm-ha...
- toyg 11y ago
  The political and economic capital. Big stack updates like this cost a pretty penny. Who's going to advocate for increased taxation to secure a bunch of admin databases?

tomjen3 11y ago

>People who shouldn't have gotten clearances, may have. People who should have been cleared, may have been blocked. Stealing the information is bad enough, but that utterly shocks me. It should be a huge scandal - what if the Chinese has put sleeper agents in key positions? Heck it almost makes sense to steal the data just to cover your tracks. Why isn't this a bigger deal?

dredmorbius 11y ago

it comes out a few days later that they're lying. A slightly more charitable explanation is that it's very difficult to grasp the scope of a data breach initially. This is similar to most disasters, in that it takes time for a full awareness of what's transpired to sink in -- initial stages are almost always a period of increasing damage estimates as prevoiusly cut-off or not-heard-from locations file reports. I've written on how it took hours for Japan to realize the extent of damage in Hiroshima, and a full day to realize just what had happened. And that only because the United States told them. https://www.reddit.com/r/dredmorbius/comments/1wf9yc/on_disasters_wwii_japanese_leadership_wasnt_aware/ https://www.reddit.com/r/dredmorbius/comments/1wf9yc/on_disa... And that was an event which left highly tangible physical evidence. For data loss, you're dealing with little by way of physical evidence, almost always an unknown attacker, and a case of forensic log analysis, trying to sort legitimate traffic from non. If you _can_ determine that specific accounts or IPs are known compromised or hostile, you may be able to make some guess as to what data were accessed, but that depends entirely on the level of logging and other design elements of your systems. The evolving rule of thumb is that any data breach will be larger than first reported. But it's not appropriate to assume this is on account of intentional deception.