Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

FBI, US Marshals Hit By Virus

Soulskill posted more than 5 years ago | from the nothing-tommy-lee-jones-can't-handle dept.

Security 156

Norsefire writes "The FBI and US Marshals were forced to shut down part of their computer network after being hit by a 'mystery virus.' FBI spokesman Mike Kortan said, 'We are evaluating a network issue on our external, unclassified network that's affecting several government agencies.' Nikki Credic, spokeswoman for the US Marshals, said that no data has been compromised but the type of virus and its origin is unknown."

cancel ×

156 comments

Sorry! There are no comments related to the filter you selected.

They should use macs (0)

Anonymous Coward | more than 5 years ago | (#28066435)

Although it is the FBI. Maybe they are use macs and we just don't know it.

Re:They should use macs (5, Funny)

psnyder (1326089) | more than 5 years ago | (#28066563)

They DO use Macs. And Dell. They were shown VERY CLEARLY inside FBI headquarters during season 7 of 24.

Re:They should use macs (1, Redundant)

CarpetShark (865376) | more than 5 years ago | (#28066897)

Which, of course, is because Dell and Apple are sponsoring the show. This has been happening for years; Amiga used to sponsor the Neighbors soap, and so people had Amigas on the show. They went with Macs later, probably because they got better/alternate sponsorship from Apple then.

Re:They should use macs (0)

Anonymous Coward | more than 5 years ago | (#28066941)

*whoosh*

Re:They should use macs (3, Informative)

sopssa (1498795) | more than 5 years ago | (#28066663)

Mac is in no way less vulnareble than Windows, specially in targeted attacks. It seems most people have been brainwashed quite good. Yes, the amount of malware for mac's is lower than Windows, but so is mac userbase. However there are many OSX malware circumventing already and it seems to be just going up.

And no, not all malware require root to run. They can easily run under your user account aswell and still steal lots of data, passwords and keylog etc. If they require root, then social engineering attack will get past most users as they happily enter their root password.

Re:They should use macs (3, Insightful)

clang_jangle (975789) | more than 5 years ago | (#28066761)

Yes, the amount of malware for mac's is lower than Windows...

Correct, zero is a tad less than ~ninety-three thousand.

...but so is mac userbase

Considering that UNIX-like systems are ubiquitous in the server world (and OS X is a UNIX-variant), that is a really lame argument.

However there are many OSX malware circumventing already and it seems to be just going up

[citation needed]

Re:They should use macs (4, Informative)

Anonymous Coward | more than 5 years ago | (#28066803)

93,000?
That's a mighty low [bbc.co.uk] estimate.

Re:They should use macs (3, Informative)

sopssa (1498795) | more than 5 years ago | (#28066821)

Re:They should use macs (4, Insightful)

sopssa (1498795) | more than 5 years ago | (#28066861)

Also, most mac users think and they're told that theres no malware and they're secure, so they have the mentality of "nothing can hit me" and even tho theres a few mac av's, almost noone runs them.

Hell, there's botnets running inside _routers_. What makes it think that mac is somehow some bulletproof solution. You dont need root to send spam or ddos either.

Mac is also a standardized os, so its a lot easier to make malware for it than the tons of different linux os's. And its already true, but because of this mentality Apple and Mac users have given to everyone, they think they're safe. It's really stupid from Apple's part, because the problem keeps just rising and one day it gets hit badly and no one has prepared because of their assumptions.

Re:They should use macs (0)

Anonymous Coward | more than 5 years ago | (#28066923)

Funny that Linux people have exactly the same mentality.

We'll see in a couple of years when Joe sixpacks with Ubuntu meet Jane with Kubuntu.

Re:They should use macs (4, Insightful)

clang_jangle (975789) | more than 5 years ago | (#28066865)

Trojans can run on any OS, once the user is tricked into installing them. IOW,they're extremely easy to avoid. However, viruses are only found in the wild on Windows systems. And only Windows can be infected by simply visiting a web site.

Re:They should use macs (2, Insightful)

DrgnDancer (137700) | more than 5 years ago | (#28067191)

Every example in your list is a social engineering trojan. They all require the user to literally INSTALL the malware and enter their admin password to do it. No system can defend against that. There are proof of concept viruses and worms on the Mac, but pretty much everything in wild is a trojan and requires significant user intervention to work. That's hardly fair. Of course stupid Mac users are still stupid users. That doesn't make the system itself less secure. I'm not one of the "OMG, it's completely secure!" fanbois. There are definitely holes in OS X, and Apple has not always been quick to fix them. The fact remains, however, that their are virtually no Mac viruses or worms in the wild (for the proper, security profession, definitions of "virus" or "worm").

Re:They should use macs (0)

Anonymous Coward | more than 5 years ago | (#28067251)

Meh -- the winboiz just need some comforting lies to reassure themselves -- that's how it is when people insist on sticking with stupid choices.

Re:They should use macs (1)

mail2345 (1201389) | more than 5 years ago | (#28067355)

This is a military organization under attack. Why not just have explanations about social engineering, and have punishments for those who fall for the regular fake social engineering tests?

Re:They should use macs (1)

Crazyswedishguy (1020008) | more than 5 years ago | (#28067793)

I'm not saying there is no malware for Macs, but of the 5 you listed, only one of them is really *decently* hidden, the last one that can be found in a pirated copy of iWork 09.
All the others require the user to either accept a transfer or installation and in several cases even type in his root password. And for the one that came in the pirated iWork 09 installer, you're downloading pirated software - not the most trusted sources, imho.

To quote one of the articles (the second one you listed):

This is not a virus, and users must actually launch the app for it to install its payload. [...] Many Mac OS X-based malware seems to be similar in nature, requiring users to actually launch the installer and give it permission to install the payload. Unlike Windows-based malware, you shouldn't need to install any anti-malware apps to annoy you and slow down your Mac. Just make sure to follow the basic rules of Internet safety -- don't install applications that aren't legitimate or visit Web sites that you don't trust.

Sure, there is malware for Macs, but there are a lot fewer things that automatically install when you open an email or visit a website.

Re:They should use macs (2, Insightful)

erroneus (253617) | more than 5 years ago | (#28066771)

This should be modded up.

Generally, I also recommend Mac for brain-dead users whose computers I don't want to fix every 3 days. There is simply less chance of such problems... randomly. Most exploits target Windows and MSIE, simple as that. But that is only GENERALLY...randomly...blindly.

More and more, we are seeing targeted attacks. The targetted attack is most successful when the contents of the network are known. So get one machine compromised (advanced scout), survey the network to see what's out there, then plan the real attack. There are abundant attacks for Mac and even Linux. In the event of targeted attacks, all bets are off. "Reputation" for security only serves the attacker because the defences of the machines will likely be lower on those machines considered "more secure."

Re:They should use macs (1)

Antique Geekmeister (740220) | more than 5 years ago | (#28067661)

Oh, my, yes.

Linux and UNIX are not immune: the Morris Worm proved that in 1988, and many of the flaws it revealed about people using bad passwords and not doing security updates remain true today in most personal and corporate environments. I just had a lot of fun explaining to a corporate partner that they _will not_ run VMware ESX in the exposed network network because it is RHEL 3 based, and VMWare basically refuses to provide access to RedHat registration to get updates or install necessary tools to manage the system as a member of a managed environment. So kiss realistic security on any ESX server goodbye. Tripwire? nmap? What do you need those for? You paid VMware good money for this, yo udon't need to manage these systems!

But the ridiculous joke that is providing security for the HR and purchasing departments of any serious bureaucracy (and believe me, the FBI has a _massive_ bureaucracy) is itself a nightmare. Couple that with slapping civil servants in the head to stop having their secretaries with the boss's personal passwords, and the bosses having to have everyone's passwords as a matter of policy, and you have a nightmare waiting to happen. The FBI may have the "FBI Computer Security Center", but have you ever tried to deal with those bozos to actually report a computer crime? They're like a Delhi call center but with American caccents. They have neither the competence nor the authority to actually do anything about day to day crimes: they are a giant, expensive department to soak up federal money and absorb complaints and do _nothing_ about crime.

Has anyone, ever, actually had the FBI provide anything resembling help with a computer crime? Hands up, please, anyone who's actually gotten help from those red-nosed Bozo the clowns with badges in actually securing a system or convicting anyone of a theft of data or a breakin?

Re:They should use macs (3, Informative)

mark-t (151149) | more than 5 years ago | (#28066969)

The reason windows systems are more vulnerable than Unix-like OS's is because in Windows, the default status of the computer is that the end user is running an administrator-type account, with full privileges to install new system software and replace drivers. In a properly administrated Unix system, only a few root-level processes are running, and the logged-in user does _not_ constantly have access to such privileges except when they are specifically requested by the user, and only then within the process that the end user specifically escalated privileges on. This leaves social engineering as the only real means by which a unix-type of machine is liable to be compromised, and avoiding that is also a matter of maintaining established sound system-administration practices.

Of course, maintaining such practices on windows systems would cause a significant (HUGE, even) drop in viruses on that platform as well (possibly even to the point that a resident virus scanner could be considered wasteful, and regular on-demand checks for compromises alone would likely be adequate). However, most windows users simply are not interested in learning how to be sysadmins, so the problem remains.

Re:They should use macs (1)

clang_jangle (975789) | more than 5 years ago | (#28067347)

Actually, Apple has pretty much led the way in how to make becoming your own sysadmin dead easy. The problem has been that MS makes backwards compatability a priority -- and also, possibly they have decided that insecure systems are ultimately more profitable. I've never heard of a Mac user buying a new machine because the old one was a year old and too slow to be useable. But that's a common scenario for non-geek windows users, which means a lot more profit for MS and the OEMs.

Re:They should use macs (1)

gmuslera (3436) | more than 5 years ago | (#28067369)

"Lower" in this context is like saying that the ocean is wet.

Mac (and linux, bsd, and probably the rest) are not invulnerable to malware, specially if you count what is run by the user. But the ladder you must climb (both in social and software engineering) is far higher for those cases than for the average windows installation, where the culture teaches you to install/run things from open internet without even worrying if there is a source that could be checked and is pretty documented how easy is to get into, and already there are plenty of "bad boys" doing nasty and complex stuff for it (conficker et al)

Re:They should use macs (1)

CarpetShark (865376) | more than 5 years ago | (#28066879)

Although it is the FBI. Maybe they are use macs and we just don't know it.

Last I heard, the FBI was embarrassingly under-tech'd. They probably use paper and pencil a lot of the time.

Re:They should use macs (1)

Antique Geekmeister (740220) | more than 5 years ago | (#28067459)

No, that's the FBI Computer Crime Center, and only because they got upgraded from chalkboards.

Houston's Hobby Airport (2, Funny)

WED Fan (911325) | more than 5 years ago | (#28067559)

Maybe the virus writer is a disgruntled Pisser that didn't like DHS invading his personal pee space during a lay over in Houston?

Re:Houston's Hobby Airport (-1, Offtopic)

Anonymous Coward | more than 5 years ago | (#28067597)

I have an aquaintence that feels its should be considered patriotic to oppose your government at every step, no matter the flavor of politics in office that term. I voted Obama, but I'm getting worried and a little tired of the lovefest that the press is giving him. They should be questioning why he leaves in place all the worst aspects of the Bush administration. They should be trying to find dirt. The press and the American people should be the loyal opposition for EVERY administration.

I thought they blamed DrudgeReport (0)

Anonymous Coward | more than 5 years ago | (#28066437)

Wasn't last week's news cycle that the Justice Department was hit by a virus that was claimed to come from an ad on DrudgeReport?

It cou

We have to hit back and hit back HARD (2, Funny)

Anonymous Coward | more than 5 years ago | (#28066455)

You wanna know how you do it? Here's how, they hit you with a virus, you pull a gun. He sends one of your servers to the IT department, you send one of his to the morgue. That's the Chicago way, and that's how you get Capone! Now do you want to do that? Are you ready to do that?

There's a name for that virus (3, Funny)

davidwr (791652) | more than 5 years ago | (#28066741)

It's known as the "fastlead" virus, and it's frequently game over if you get infected.

Terminator opening weekend (0, Offtopic)

Anonymous Coward | more than 5 years ago | (#28066457)

This is not a coincidence, skynet is obviously behind this.

Re:Terminator opening weekend (0, Redundant)

ImYourVirus (1443523) | more than 5 years ago | (#28066601)

Might first thoughts exactly, skynet...

The are requesting a hard-target search... (0)

Anonymous Coward | more than 5 years ago | (#28066459)

...of every gas station, residence, warehouse, farmhouse, henhouse, and Dr. House.

Linux... (1, Insightful)

Darkness404 (1287218) | more than 5 years ago | (#28066467)

Why doesn't the government switch to Linux already? Sure, you can get a Linux virus, but to get one it takes work. On the other hand merely browsing a site in IE can give you viruses in Windows.

Re:Linux... (-1, Troll)

Anonymous Coward | more than 5 years ago | (#28066491)

Have you peered through the open sores code behind Linux? It is as vulnerable as Windows, if not more so.

Re:Linux... (4, Interesting)

Darkness404 (1287218) | more than 5 years ago | (#28066559)

How many people have gotten a virus from surfing a site using Linux? Very, very, very, few, to non existent. Sure, Linux is vulnerable but it isn't targeted, the diversity in distros, kernel versions, browsers, etc. help keep the target moving. About the only way to get a virus, in the wild is to download and explicitly install a virus or a trojan.

Re:Linux... (1)

ElKry (1544795) | more than 5 years ago | (#28066593)

Of course, the USA government choosing a Linux distro would not make Linux more vulnerable, and its sourcecode more scrutinized at all.

Re:Linux... (1)

Darkness404 (1287218) | more than 5 years ago | (#28066673)

Who said they had to choose one? Just create your own. As long as you aren't distributing or selling it, you are free to keep the source to yourself.

Re:Linux... (1)

ElKry (1544795) | more than 5 years ago | (#28066729)

Step 1: Ditch a closed-source product Step 2: Choose a better open-source alternative Step 3: Close the source.

Did you even think that before posting it?

Re:Linux... (3, Insightful)

Norsefire (1494323) | more than 5 years ago | (#28066811)

Step 1: Ditch a closed-source product notorious for exploits and viruses
Step 2: Choose a better open-source alternative notorious for its security and stability
Step 3: close the source

Re:Linux... (4, Insightful)

Animaether (411575) | more than 5 years ago | (#28066895)

Step 4: watch a lower ranking employee click on the HappyFunTime executable in their mail
Step 5: Priceless.

Re:Linux... (2, Informative)

psnyder (1326089) | more than 5 years ago | (#28067151)

You mean like SELinux [nsa.gov] ?

SELinux Background

Researchers in the National Information Assurance Research Laboratory of the National Security Agency (NSA) worked with Secure Computing Corporation (SCC) to develop a strong, flexible mandatory access control architecture based on Type Enforcement, a mechanism first developed for the LOCK system. The NSA and SCC developed two Mach-based prototypes of the architecture: DTMach and DTOS. The NSA and SCC then worked with the University of Utah's Flux research group to transfer the architecture to the Fluke research operating system. During this transfer, the architecture was enhanced to provide better support for dynamic security policies. This enhanced architecture was named Flask. The NSA integrated the Flask architecture into the Linux® operating system to transfer the technology to a larger developer and user community. The architecture has been subsequently mainstreamed into Linux and ported to several other systems, including the Solarisâ operating system, the FreeBSD® operating system, and the Darwin kernel, spawning a wide range of related work.

Re:Linux... (1)

DrgnDancer (137700) | more than 5 years ago | (#28067285)

Yes, but as far as I can tell the only thing SELinux accomplishes is to make the Operating system virtually useless as anything other than a desktop. The first thing most admins I know do upon installing a new server is disable SELinux. It's possible (possible) to use SELinux on a server, but it usually requires days of tweaking settings, and winds up eliminating a good part of the benefit of the hardening.

Re:Linux... (2, Insightful)

TubeSteak (669689) | more than 5 years ago | (#28066807)

Sure, Linux is vulnerable but it isn't targeted, the diversity in distros, kernel versions, browsers, etc. help keep the target moving.

1. If the Government switches to Linux, there will not be a diversity in distros, kernel versions, browsers, etc.
2. Assume that, like the current windows installation, there will be gaping security holes due to mismanagement and misconfiguration.
3. The US government is an awfully big target and if they switch, you will see significant, concentrated effort on exploiting whatever distro and apps the Feds chooses.

Re:Linux... (1)

chill (34294) | more than 5 years ago | (#28067315)

Then contract the NSA to train a bunch of people to properly configure SE Linux with targeted policies.

Develop targeted policies for the various government departments and offices. Create proper images so machines are correctly locked down from the install.

It isn't *hard* to configure systems to be secure, it is unpopular and time consuming. Apply the same logic used with firewalls -- default deny -- and you're much further along the path of secure computing. That is, explicitly allow only needed binaries to run and deny all others. In certain environments, such as law enforcement, this should be a bit easier than others.

I've done this. It is very unpopular and always fun to explain why people are not allowed to plug their iPod, camera or other gadget into their office PC. No, you can't download the software to automatically change your cursor, screensaver or desktop wallpaper. Etc.

Re:Linux... (3, Interesting)

DrgnDancer (137700) | more than 5 years ago | (#28067439)

Especially 2. I work for a government contractor. The amount of stupid pointless shit we have to do in the name of "security" while leaving HUGE GAPING HOLES untouched just hurts my head. It's like our security policy is designed by ADD addled five year olds. They read about something in a magazine and think "Oh, shiny!" They quickly write some insane, over the top, policy to "solve" the "problem" and keep reading the magazine. It's great assuming that the article covers all possible security problems ever, or that it contained actual solutions instead of stuff that kinda sounds like it ought to fix a problem.

The latest brainstorm is that we are switching to 12 character passwords which change every 60 days. This is almost certain to result in:

a) People forgetting their passwords, requiring continuous password resets
b) People writing down their impossible to remember, constantly changing, password
c) Both (a) and (b)

Meanwhile, we still have a number of systems that use rsh (No, not Kerberized rsh, the plain 30 year old version with .rlogin files.). Granted this is an isolated network, with no Internet access at all. We're not likely to be attacked by outside entities. But if you trust the users of the isolated network enough to assume that they are not going to take advantage of the multiple and well published rsh vulnerabilities, why don't you trust them enough to assume that they are not running password crackers?

UNIX email virus (4, Funny)

Gary W. Longsine (124661) | more than 5 years ago | (#28066623)

Please copy this file to your hard drive, decompress it, untar it, chmod it, and place an entry in the root crontab... so I can have your advice.

Re:UNIX email virus (1)

TheLink (130905) | more than 5 years ago | (#28067175)

Nah just save it as "dancing_pigs" and then run: perl dancing_pigs

While most users will jump through hoops to see dancing pigs/bunnies, if you make it easier, more of them will do it.

Re:Linux... (2, Interesting)

santax (1541065) | more than 5 years ago | (#28066657)

Don't get me wrong, I love linux, Debian-fanboy for many a year. Everyday I have to run apt-get update && apt-get upgrade to keep my system secure. Not everyday it is a possible remote exploit, but there is always some security related bug to fix. Linux may have a better implementation to keep those risks from escalating quickly compared to windows, but I would not run nation-critical apps on it. Not at this point in time. I would look at Openbsd. And saying that, I noticed a lot of comments about openssh lately on fulldisclosure... And another major factor is economics. MS won't take to kindly to people switching on them. And that really is something to take with you when deciding to switch. There is a lot on stake. And there is a lot to lobby for. Linux doesn't lobby, openbsd even less. I don't see Theo explaining to them why they should switch to openbsd and if he did... they would probably tazer the crap out of him. Opensource and especially OpenBSD has a lot going for it when it comes to security, but there is nobody out there who really understands,that you need a lobby to make it happen. And goverments need things like 'support'... Ever asked a question on the openbsd-mailinglist? Without being flamed?

Re:Linux... (1)

wh1pp3t (1286918) | more than 5 years ago | (#28066825)

Large organizations and especially the government would disable sudo sysadmin_command for users (so, no apt-get/aptitude/etc..); furthermore, patches are tested prior to deployment; which happens on a scheduled basis. We all know how dynamic IT project management is...
They (IT) would have to work closely with a vendor, such as RedHat or Novell to manage patch rollouts.

Good bye quick and timely security updates.

Re:Linux... (0)

Anonymous Coward | more than 5 years ago | (#28066841)

Agreed.

OpenBSD is very solid, well-designed and secure operating system. Linux does not come to even close with these criteria.

Yet I do not use it because I can not take the community. OpenBSD would have done so much, so much better without the hostile attitude and the general asshattery that plagues the whole community.

Re:Linux... (0)

Anonymous Coward | more than 5 years ago | (#28067307)

But at least we can conclude: Move away from Windows!

Re:Linux... (1)

thatkid_2002 (1529917) | more than 5 years ago | (#28067515)

BSD would be too hard and expensive to implement. Why not a commercial distro with SELinux to make sure it is an extremely hard nut to crack? I think that would be the best way to spend tax-payer monies.

There is many consultants and support vendors for Linux and many people to create and run the systems. Linux admins are generally much more aware of how systems work so with good admins, enterprise grade distro and SELinux I think Linux can run "nation-critical" systems just fine... Just as long as you don't install Adobe Flash

9 times out of 10 issues like these usually can be attributed to lazy Windows admins.

Re:Linux... (2, Interesting)

Niten (201835) | more than 5 years ago | (#28067811)

Everyday I have to run apt-get update && apt-get upgrade to keep my system secure. Not everyday it is a possible remote exploit, but there is always some security related bug to fix. Linux may have a better implementation to keep those risks from escalating quickly compared to windows, but I would not run nation-critical apps on it. Not at this point in time.

I think you're making the classic mistake of equating the number of patches seen with the actual number, and severity, of vulnerabilities. Of course Debian gets more patches more often than Windows: the Debian security team sends out fixes for security vulnerabilities as soon as they're discovered, rather than leaving users exposed by waiting up to a month and fixing (some, but often not all) of the most critical known vulnerabilities in monthly roll-ups. And of course Debian sees more patches, when nearly all of the desktop applications on a Debian system are handled by apt; Windows Update only takes care of patching the operating system itself.

So when it comes to a question of which operating system to run sensitive government services on, patch counting is worse than useless. Things that are worth considering are the tractibility of the system's security model, and exploit mitigation techniques or fine-grained mechanisms for least-privilege, such as SELinux.

Linux is not the ultimate in security (1, Insightful)

davidwr (791652) | more than 5 years ago | (#28066773)

Well, maybe some hardened versions but not the run of the mill version.

If you want hardened computing, you want:

*A hardened network, with hardened human access
*A hardened computer, with hardened human access
*A hardened OS or one that comes pre-hardened by design. SELinux, OpenBSD, some specialty flavors of MS-Windows, some small/embeded-systems OSes, some Unix-style OSes, and some mainframe-type OSes qualify
*Hardened sofware all the way around
*People who are trained in security in general and trained how to use the computer properly and how to spot people who are trying to compromise it or the network

Do you really want hardened computing?

Re:Linux is not the ultimate in security (1)

Mashiki (184564) | more than 5 years ago | (#28067749)

You seemed to have forgotten something: You don't want it connected to the internet.

Re:Linux... (2, Insightful)

Krneki (1192201) | more than 5 years ago | (#28066797)

They are too lazy to learn a new desktop.

They rather get infected every now and then. After all it's your money they are spending.

Re:Linux... (1)

mrmeval (662166) | more than 5 years ago | (#28067683)

Geektas are too elitist to design a comfortable desktop for people switching from winodws. If it all "Just worked" like windows no one would give a fuck in a locked down environment. Same look and feel, same hot keys in every app.

FUCKING CUT AND PASTE THAT FUCKING WORKS.

Re:Linux... (1)

Antique Geekmeister (740220) | more than 5 years ago | (#28067241)

Because of two key applications. Microsoft Word, which many bureaucrats throughout the world but especially in civil services use to write their paperwork. And Microsoft Exchange, which although it is a security issue is widely deployed and has a pretty good calendar function.

Re:Linux... (0)

Anonymous Coward | more than 5 years ago | (#28067351)

Because the government is too stupid to use anything other than windows.

Not troll/flamebait, it's just the truth.

Re:Linux... (1)

Thad Zurich (1376269) | more than 5 years ago | (#28067629)

Lawyers. The government does not really recognize the concept of FOSS, only "COTS" and "GOTS". If the government didn't write it, then the lawyers insist on having a vendor to sue, even if that vendor can disclaim all liability, and/or limit remedies to "refund of purchase price". The number of government-operated facilities capable of GOTSifying FOSS is relatively limited, and doing so is not part of their mission. Finally, there is no political incentive to do this (quite the reverse, thanks to vendor lobbying).

the net (0)

Anonymous Coward | more than 5 years ago | (#28066475)

the net is becoming self aware... quick, write down the internet in the notebook.

Sensitive networks should be treated as such (5, Interesting)

davidwr (791652) | more than 5 years ago | (#28066485)

More and more, sensitive corporate and government networks will need to be isolated or at least mostly isolated from non-sensitive networks and the Internet.

They may not need an air gap [wikipedia.org] but they will need to be isolated enough to prevent general problems like viruses.

They also need to be run with the philosophy of "every other machine or user on my network could become compromised (infected or bribed) at any time."

A couple of possible solutions:
*Give employees 2 computers with a KVM, one for surfing the web and access to non-secure data, one to access secure data.
*Give employees a multi-homed, ROM+read-only-USB-stick-for-configuration-data-boot "thin client" that's stripped down and hardened, with no copy-and-paste, no network bridging, and other designed way for one remote server to influence the other. Then have them connect to different servers on different networks for different needs.

If your security requirements are extreme, use an air gap.

In either case, don't forget to take countermeasures against human idiocy, ignorance, and bribery/blackmail.

Re:Sensitive networks should be treated as such (1)

mbone (558574) | more than 5 years ago | (#28066649)

Security regs in the USG mandate this sort of stuff for Classified information.

classified vs sensitive (3, Interesting)

davidwr (791652) | more than 5 years ago | (#28066721)

True, US-government-classified material does have to be regulated.

But what about the human resource database of the United States Postal Service, with its employee birth dates and social security numbers? What about the customer database at American Airlines, with its juicy collection of credit card numbers? What about your medical insurer, which may have lots of information about your or your children's health you don't want entering the public domain? What about the bank teller whose terminal let's her do almost anything with people's money?

It's probably a bad idea to let computers which have access to that kind of data, particularly write-access, to access the Internet or an unsecured network unless absolutely necessary to do the job. Sometimes, you have to allow such access if you are going to allow certain services, like allowing people to order products or services with credit cards from home, or do home banking. However, at least in these cases you can limit the potential damage to what that customer is allowed to access. If you allow people with wholesale access to sensitive databases to "work from home," give them a separate, secure computer that runs on an isolated LAN at the person's house, tunnel everything over a VPN, and block all non-VPN traffic except that needed to establish the VPN. Better yet, give them a separate real connection straight back to the corporate glass tower, bypassing the Internet entirely. Even better yet, don't let them work from home.

Re:Sensitive networks should be treated as such (0)

Anonymous Coward | more than 5 years ago | (#28066805)

Generally, I recommend Mac for brain-dead users whose computers I don't want to fix every 3 days. There is simply less chance of such problems... randomly. Most exploits target Windows and MSIE, simple as that. More and more, we are seeing targeted attacks. The targetted attack is most successful when the contents of the network are known. So get one machine compromised (advanced scout), survey the network to see what's out there, then plan the real attack. There are abundant attacks for Mac and even Linux. In the event of targeted attacks, all bets are off. "Reputation" for security only serves the attacker because the defences of the machines will likely be lower on those machines considered "more secure."

Re:Sensitive networks should be treated as such (0)

Anonymous Coward | more than 5 years ago | (#28067073)

They do have very similar practices like the ones you mentioned above at the NSA

multilevel security (1, Interesting)

Anonymous Coward | more than 5 years ago | (#28067303)

*Give employees 2 computers with a KVM, one for surfing the web and access to non-secure data, one to access secure data.

Or use one operating system that allows different levels of security on one system, with different applications each running at different levels, and with access to variously segmented networks spanning from unclassified to top secret:

http://en.wikipedia.org/wiki/Trusted_Solaris

It's called multi-level security, and the DoD already uses it.

US Marshals! (1)

schmidt349 (690948) | more than 5 years ago | (#28066501)

What I want from each and every one of you is a hard-target search of every JPEG, MPEG, EXE, PXE, hard drive, flash drive and floppy drive in that area. Firewalls go up on every computer. Your fugitive's name is Neeris. Go get him.

Bold claim (4, Insightful)

Daimanta (1140543) | more than 5 years ago | (#28066503)

"said that no data has been compromised but the type of virus and its origin is unknown."

How do they know that there was no data compromised if they don't even know the type of the virus?

Re:Bold claim (2, Insightful)

maxume (22995) | more than 5 years ago | (#28066647)

Perhaps the network is reasonably self contained?

The article says they shut down internet access, but it doesn't really make it clear if the computers in question have any connection to the internet or not.

LOL!... Re:Bold claim (0)

Anonymous Coward | more than 5 years ago | (#28066685)

Don't tickle yourself because they don't know what's missing yet. Just waiting to hear the screams in the next few days when they do. Something tells me this is directly related to the recent Virginia medical record fiasco [slashdot.org] , and more importantly the governments complete ignorance of the incident in light of the Obama administration pushing the private healthcare industry into government mandated electronic records (only to be supplied by GE, whom financed Obama's compaign).

On a broader note: Seriously, you didn't think people would be upset by any form government oppresion? Common people, wake up.

Typical Bold Claim, Scenario A14 (5, Insightful)

Gary W. Longsine (124661) | more than 5 years ago | (#28066687)

This claim is made by nearly every spokesperson for any major organization which is forced to disclose a malware attack to the public. In nearly every case the claim cannot be substantiated. Run of the mill malware often scans hard drives and uploads data to remote servers over encrypted connections. Most organizations have no way of knowing if these even happened. They don't know how long they have been infected. They don't know if the attack is directed at them, specifically (and thus might be smarter about hiding its activity). These folk really don't know yet what the extent of the damage is. The stock line should be, "we don't know", not, "nothing bad happened". Something bad happened -- malware got on your network and spread. That much is clear.

Libel (1, Funny)

Anonymous Coward | more than 5 years ago | (#28067555)

They're the government, they're not supposed to lie.

Re:Bold claim (2, Insightful)

Psyborgue (699890) | more than 5 years ago | (#28066819)

How do they know it's even a virus. "virus" is often a silly excuse for "embarrassing human error".

Re:Bold claim (0)

Anonymous Coward | more than 5 years ago | (#28066883)

Perhaps the machines with data that could be compromised have an access log that can't be without direct physical access.

Re:Bold claim (1)

Celeste R (1002377) | more than 5 years ago | (#28066911)

Compromised can mean various things, according to the context. Flexible English is wonderful, isn't it?

In the mental context of a person who deals with valuable data (like criminal scenes and such), compromised data is missing data. And what would you know, the FBI and the US Marshal's offices both deal with valuable data.

In the mental context of say... a spy, compromised data is known (copied) data. The FBI isn't a spy agency, and the US Marshal's office isn't either, even if they can be secretive.

I personally would opt to use the word 'compromised' in a manner that would give people the closest idea to the truth, and not in a vague manner that could be the next misunderstanding.

Granted I'm biased because I've seen a lot of spy and police movies... but what do you know, even government agents could use an English lesson!

Re:Bold claim (0)

Anonymous Coward | more than 5 years ago | (#28067417)

Because they say they know.

1984 Being unrolled before our eyes ladies and gentlemen. Obedience is Freedom

Re:Bold claim (2, Insightful)

Thad Zurich (1376269) | more than 5 years ago | (#28067591)

There would seem to be a high probability that such a network is monitored by one or more IPS' that log and archive all outbound packets. If the time of infection can be established, then it should be possible to estimate the amount of exfiltrated data.

Re:Bold claim (1)

noidentity (188756) | more than 5 years ago | (#28067615)

So basically, "We aren't aware of any compromised data, so we're assuming there are none. Also, we don't know the type of virus or its origin, so we're likewise assuming it has no type and came from nowhere."

quick! (1)

papabob (1211684) | more than 5 years ago | (#28066515)

We need to start looking for destroyed helicopters in order to find John McLane!!

Maybe they recently bought some new computers? (2, Informative)

sk999 (846068) | more than 5 years ago | (#28066517)

"Malware found on brand new Windows netbook"

http://www.itbusiness.ca/it/client/en/home/news.asp?id=53225 [itbusiness.ca]

Re:Maybe they recently bought some new computers? (1, Funny)

ImYourVirus (1443523) | more than 5 years ago | (#28066641)

Yeah it's called windows *laughs*

Re:Maybe they recently bought some new computers? (1, Insightful)

Anonymous Coward | more than 5 years ago | (#28067543)

If they aren't dropping their own image on new computers they get, there's something wrong with their IT department.

DGHFJ (0)

Anonymous Coward | more than 5 years ago | (#28066523)

nice RTICLE -- [banat-style.com]

How do they know ? (3, Interesting)

mbone (558574) | more than 5 years ago | (#28066589)

The spokeswoman said :

"no data has been compromised but the type of virus and its origin is unknown"

That is an extraordinary statement. How would they know ?

If I was head of IT there I would assume that that was not true. Even if there was a completely different computer system for any sensitive information, data has a way of leaking to where it shouldn't be. Of thousands of people, not one put notes or passwords or whatever on the insecure side of the line ?

Regardless of what they tell the press, I hope that internally they are assuming that this is a breach, and acting accordingly.

Re:How do they know ? (1)

Celeste R (1002377) | more than 5 years ago | (#28066937)

Compromised data isn't always copied data; sometimes it's missing data.

To someone who forgot some of the meaning of their college English lessons, they may have also forgotten there's a difference between the two.

Re:How do they know ? (3, Insightful)

tendrousbeastie (961038) | more than 5 years ago | (#28067505)

Well exactly. What their spokeperson says doesn't necessarily have any correlation to what their head of IT thinks.

The spokesperson's job is to put the best spin on things. Saying "We lost loads of public data" would not be doing their job well.

Tommy Lee Jones (0)

Anonymous Coward | more than 5 years ago | (#28066633)

Tagged tommyleejones. :)

The government should retaliate in force (3, Funny)

David Gerard (12369) | more than 5 years ago | (#28066769)

US Air Force General Kevin Chilton, head of US Strategic Command, has said that attacks on the United States via the Internet could merit a conventional military response [today.com] .

"I don't think you take anything off the table. We're particularly looking toward one group in Seattle."

The Seattle-based insurgent group is thought to have seeded American government and military computers with millions of copies of malware that allows attackers easy access to any data stored on the computer, or indeed to take complete control of the computer and use it for their own ends as part of a massive "botnet" to mount further attacks. The malware, "Windows," makes securing a computer running it almost impossible.

"Turning Seattle into a glass crater would only be undertaken strictly as the minimum required surgical military action," emphasised Chilton, "and not in any way out of twenty-five years' bitter resentment and frustration at computing machinery."

Chilton stressed that members of the US military must begin to think of their computers as the front lines. "Do you realize that in addition to adding Windows to computers, why, there are studies underway to Windowsize salt, flour, fruit juices, soup, sugar, milk ... ice cream. Ice cream, Mandrake, children's ice cream! I can no longer sit back and allow Windows infiltration, Windows indoctrination, Windows subversion and the international enterprise licensing conspiracy to sap and impurify all of our precious bodily fluids!"

The Obama administration is currently reviewing the United States' cyberspace defense policy. "We're considering all options thoroughly," said the President, closing his MacBook and looking lingeringly at the red button on his desk.

Weird, the article does not mention the OS (-1, Troll)

Teun (17872) | more than 5 years ago | (#28066809)

Is it because we all expect and accept Windows to be vulnerable that it is no longer necessary to mention the OS involved?

Am I completely paranoid (1)

Psyborgue (699890) | more than 5 years ago | (#28066833)

Or does this sound like a cheap stunt to cook up funding for "cyber warface" and somesuch. Virus my butt... Some idiot probably tripped over a server power cord, sent half the FBI down, and now the bozos in charge are trying to use it as an excuse to get more taxpayer cash.

What, really? (0)

Anonymous Coward | more than 5 years ago | (#28066857)

There is absolutely no tag for this article saying "haha" or anything similar?
Shocking /., shocking.

Sure some mysterious virus. (2, Insightful)

PieceofLavalamp (1244192) | more than 5 years ago | (#28066943)

Sure some mysterious unknown virus. Or Someone broke/deleted something and didn't know how to fix it. I mean would you want to tell the FBI you broke their computers?

Merely a virus? It could be worse, much worse. (1)

hoarier (1545701) | more than 5 years ago | (#28067077)

This is sounding more and more like Plan Nine from User Space [swtch.com] .

Any comments from the WHO on this topic ? (1)

dottedBrain (527028) | more than 5 years ago | (#28067153)

Any known vaccines ? And what is the fatality rate ?

Dangerous!!! (0, Troll)

kkandnathan (1560885) | more than 5 years ago | (#28067283)

so many virus !!! no Internet would be not much danger . http://www.nowgoal.com/17.shtml [nowgoal.com]

FBI, US Marshals Hit By Virus (0, Flamebait)

captnbmoore (911895) | more than 5 years ago | (#28067335)

That's why it's called the swine flu

Hmmm Cui Bono or could be the sibling rivalry... (1)

Phizzle (1109923) | more than 5 years ago | (#28067399)

Check with the lads at the CIA.

virus and the urinals (1)

juggledean (792527) | more than 5 years ago | (#28067469)

somehow this seems related to the urine candid camera post earlier today

Simple Solution (1)

omb (759389) | more than 5 years ago | (#28067601)

__STOP__ USING WINDOWS, and don't allow users to get root.
Load More Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>