Beta

×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Duplicate RSA Keys Enable Lockheed Martin Network Intrusion

timothy posted more than 3 years ago | from the nobody's-perfect dept.

Security 138

An anonymous reader writes "Unknown hackers have broken into the security networks of Lockheed Martin Corp and several other US military contractors, a source with direct knowledge of the attacks told Reuters. They breached security systems designed to keep out intruders by creating duplicates to 'SecurID' electronic keys from EMC Corp's RSA security division, said the person who was not authorized to publicly discuss the matter." There's also coverage at PC Magazine.

cancel ×

138 comments

Sorry! There are no comments related to the filter you selected.

The Security Dance (3, Interesting)

Frosty Piss (770223) | more than 3 years ago | (#36275580)

â¦said the person who was not authorized to publicly discuss the matter

I love it how these companies and even our own government can't keep people from talking about secrets, like it's so fucking juicy that everyone just has to spill it out to the press.

Yes, I'm not a moron, I know these "not authorized" folks are probably explicitly authorized... It's just the whole security "dance" is so fucking silly.

Re:The Security Dance (1)

maxwell demon (590494) | more than 3 years ago | (#36275642)

â¦said the person who was not authorized to publicly discuss the matter

I love it how these companies and even our own government can't keep people from talking about secrets, like it's so fucking juicy that everyone just has to spill it out to the press.

Yes, I'm not a moron, I know these "not authorized" folks are probably explicitly authorized... It's just the whole security "dance" is so fucking silly.

Except if it's a conspiracy, of course. Everyone knows that the government manages to keep its conspiracies completely secret.

Re:The Security Dance (0)

Anonymous Coward | more than 3 years ago | (#36276220)

Uuum, look at all the conspiracy theory websites! Apparently, they can't keep anything secret.
It's just that for conspiracies, they don't even have to. Since nobody would believe it anyway.
.
.
Which gives me an idea for the perfect crime... ;)

Re:The Security Dance (1)

PPH (736903) | more than 3 years ago | (#36276732)

Those websites are all manufactured and contain false information. To keep you from looking in the right places.

The proof that there is a secret conspiracy is that we have no evidence of it. Now excuse my while I polish my tinfoil hat.

Re:The Security Dance (1)

Yvan256 (722131) | more than 3 years ago | (#36277090)

You fool! The more you polish it, the more it reverses the polarity!

Re:The Security Dance (2)

Jaktar (975138) | more than 3 years ago | (#36275822)

The usual way that press inquiries are handled is to have all personnel direct any inquiries to the PR officer or group. It is usually someone who has no real knowledge of what happened and only gives scripted responses to inquiries.

Since they have real information on how the breach occured, I'd bet it really was someone who was unauthorized to speak spilling the beans.

Re:The Security Dance (1)

yuhong (1378501) | more than 3 years ago | (#36276084)

Yea, legacy PR based on control of the message is fundamentally flawed.

Re:The Security Dance (1)

Jah-Wren Ryel (80510) | more than 3 years ago | (#36276282)

Since they have real information on how the breach occured, I'd bet it really was someone who was unauthorized to speak spilling the beans.

That's the way it works for most businesses, but not the way it works for government agencies.

As Lockmart is the largest corporate member of the military industrial complex, things are little bit different in this case. There are national security implications to both lockheed being hacked and to RSA tokens being duplicable. That makes for all kinds of motives for a "controlled" leak like this, for all we know it is 100% spin designed to cover some other worse(?) scenario.

Re:The Security Dance (1)

_Sprocket_ (42527) | more than 3 years ago | (#36276592)

That's the way it works for most businesses, but not the way it works for government agencies.

As Lockmart is the largest corporate member of the military industrial complex, things are little bit different in this case. There are national security implications to both lockheed being hacked and to RSA tokens being duplicable. That makes for all kinds of motives for a "controlled" leak like this, for all we know it is 100% spin designed to cover some other worse(?) scenario.

Ahhh - the language of conspiracy. We know we're in for some really good non-information as soon as "Lockmart" and "military industrial complex" are uttered. Yes - serious implications for Lockheed's compromise (psst - not the first time). Serious implications for RSA tokens being duplicated - definitely. Then we'll just play "I've got a secret" and end it with vague mention of "all kinds" of spin and unnamed scenarios. That should be enough to get lots of head-nodding from the anti-military political crowd and other conspiracy theorists.

Re:The Security Dance (1)

Xtifr (1323) | more than 3 years ago | (#36275878)

I love it how these companies and even our own government can't keep people from talking about secrets

Sure they can! It's just that they're only good at it when it concerns UFOs and JFK's assassination and Bigfoots and the faked moon landing and the Illuminati and the herds of Invisible Pink Unicorns thundering across the Great Plains, and things like that.

Re:The Security Dance (2)

OpenLegs (2203438) | more than 3 years ago | (#36276088)

Agreed, more FUD to support renewal of the Patriot Act.

Re:The Security Dance (1)

milkmage (795746) | more than 3 years ago | (#36277114)

WTF Patriot Act? Hacking was illegal prior to 9/11

Re:The Security Dance (0)

Runaway1956 (1322357) | more than 3 years ago | (#36277164)

If hacking were illegal, then some pretty famous people would still be locked up. Bill Gates, Steve Jobs, and Linus Torvalds come readily to mind. Microsoft employees by the hundreds. Apple employees by the score. Probably all of the anti-malware companies would lose their most valuable people.

Had you said that "espionage" and "theft by wire" were illegal bfore 9/11, your post would have made more sense. "Hacking" is not, nor has it ever been illegal - TOS's and EULA's notwithstanding.

Re:The Security Dance (2)

erroneus (253617) | more than 3 years ago | (#36276178)

Not necessarily. I seem to recall about a month or two ago a story came out about a serious compromise in RSA's systems which was said had potential to compromise most, if not all, SecureID devices out there.

I recall when this story came out, I asked "Should we be concerned about this?" We use SecureIDs to get into the company network...

Re:The Security Dance (2)

_Sprocket_ (42527) | more than 3 years ago | (#36276608)

Not necessarily. I seem to recall about a month or two ago a story came out about a serious compromise in RSA's systems which was said had potential to compromise most, if not all, SecureID devices out there.

Potential - yes. In so far RSA wasn't really being too frank about what was involved. So since the compromised involved the SecurID product in some way, who's to know exactly what's going on? The potential is there.

I recall when this story came out, I asked "Should we be concerned about this?" We use SecureIDs to get into the company network...

To which RSA assured everyone that they should be following "best practices" and maybe paying a lot more attention to failed authentication attempts. Yeah - thanks.

The possible implication here is that RSA has been far, far less forthcoming than they should have been about this incident. Which has me wondering if we really should be trusting their product in our own environment.

So you're against whistleblowers? (1)

apparently (756613) | more than 3 years ago | (#36277092)

What exactly is your problem with people revealing information that organizations would rather keep hidden?

Yes, I'm not a moron

And what exactly is your evidence that you're not a moron?

Re:So you're against whistleblowers? (1)

dbraden (214956) | more than 3 years ago | (#36277182)

What exactly is your problem with people revealing information that organizations would rather keep hidden?

Not all information should be "free", nor do you have a right to know everything. An organization, or an individual, wanting to keep something secret is not, in and of itself, evil.

Uplink (1)

Jasoman (1974176) | more than 3 years ago | (#36275608)

All these security breaches reminds me of the game Uplink.

Re:Uplink (1)

Opportunist (166417) | more than 3 years ago | (#36275664)

Every time I played it I found it hilarious that I could time and again hack the same "high security" servers with the same approach, every time resulting in a story about a "yet again" security breach at some important database, and I was sitting there snickering, thinking something like this would just be unthinkable in reality since they'd of course analyze how I got in and seal that security hole.

Re:Uplink (1)

sortius_nod (1080919) | more than 3 years ago | (#36275906)

thinking something like this would just be unthinkable in reality since they'd of course analyze how I got in and seal that security hole.

Yeh, that's a nice fantasy. Unfortunately that's not how things go. Look at Sony, they still haven't fixed their security problems and it's been over a month.

Re:Uplink (1)

TapeCutter (624760) | more than 3 years ago | (#36276498)

So you're saying the sony network is back up and anyone can use the same hole?

Re:Uplink (0)

Runaway1956 (1322357) | more than 3 years ago | (#36277174)

All this time, I've been thinking that Sony IS the security problem. Visa, Mastercard, and Bank of America didn't leak all those user's credentials - Sony did. Sony doesn't "have" security problems, they are the problem!

Re:Uplink (1)

Tridus (79566) | more than 3 years ago | (#36276542)

If they really got in by duplicating an RSA token, sealing the hole requires figuring out how they managed to do that. Not as simple as it sounds.

Re:Uplink (0)

Anonymous Coward | more than 3 years ago | (#36277216)

All you need to duplicate an RSA token is a list of all secrets, the algorithm to generate the answers from the secrets, and you need to observe enough authentications to disambiguate that token's secret from your list of secrets. And enough CPU or time to calculate responses to all secrets for the first observed authentication.

Not easy, but possible if you've got the list of secrets.

Re:Uplink (1)

milkmage (795746) | more than 3 years ago | (#36277360)

"something like this would just be unthinkable in reality since they'd of course analyze how I got in and seal that security hole"

putting the cap back on the toothpaste prevents more from coming out, but it doesn't clean up the mess on the counter.

Re:Uplink (1)

WrongSizeGlass (838941) | more than 3 years ago | (#36276176)

All these security breaches reminds me of the game Uplink.

All these security breaches remind me that the world has changed in an irrevocable manner and that it's only a matter of time before anything and everything falls victim to these types of attacks. Nothing is really safe anymore.

Re:Uplink (1)

Blackbrain (94923) | more than 3 years ago | (#36276242)

All these security breaches remind me that the world has changed in an irrevocable manner and that it's only a matter of time before anything and everything falls victim to these types of attacks. Nothing is really safe anymore.

Nothing ever was. The only difference now is that this one made the news.

Aha! (2)

wiedzmin (1269816) | more than 3 years ago | (#36275622)

So this is what they hacked RSA for! I was waiting to find out who the end-target was... makes sense.

Re:Aha! (1)

slartibartfastatp (613727) | more than 3 years ago | (#36275762)

I bet they used the d-wave they just bought.

Re:Aha! (3, Funny)

fuzzyfuzzyfungus (1223518) | more than 3 years ago | (#36275916)

I, for one, am shocked, shocked, that RSA's assertion that the breach was minor and totally, not, y'know, a real world issue was less than 100% truthful...

Mmm... (1)

Oxford_Comma_Lover (1679530) | more than 3 years ago | (#36275636)

China, Iran, India, or someone planning to sell it (Russia, Organized Crime, etc...)?

I suppose Israel could do it too. (They'd risk a bit if they got caught, but we know they have the capability.)

Re:Mmm... (1)

Frosty Piss (770223) | more than 3 years ago | (#36275728)

China, Iran, India, or someone planning to sell it (Russia, Organized Crime, etc...)?

China has the most to gain.

Re:Mmm... (0)

Anonymous Coward | more than 3 years ago | (#36276198)

Any thief gains if they can find a buyer for their stolen goods. Certainly there is more than one country or one non-state actor in the world who would want valuable US defense contractor data just to sell to other interested buyers across the globe. Even another US defense contractor competitor may be responsible. I'm not sure why China is always thought to be the culprit unless this is some attempt to trying to drum up a new "Red Scare".

Re:Mmm... (1)

Angostura (703910) | more than 3 years ago | (#36275962)

So you're excluding Boeing?

Re:Mmm... (1, Troll)

WrongSizeGlass (838941) | more than 3 years ago | (#36276186)

So you're excluding Boeing?

Let's not exclude the US government either. Nothing points the finger elsewhere like attacking one of your own major contractors. The NSA, CIA, etc aren't above stealing the RSA keys. /tinfoilhat

Spoken like a true spokesperson... (4, Insightful)

Zakabog (603757) | more than 3 years ago | (#36275652)

and we remain confident in the integrity of our robust, multi-layered information systems security

Translation: Our system's breached but maybe you won't realize that if I throw enough buzz words at you...

Re:Spoken like a true spokesperson... (4, Insightful)

betterunixthanunix (980855) | more than 3 years ago | (#36275706)

On the other hand, a robust security system should be able to keep your most important information secure even when a breach occurs at lower levels. So, perhaps a breach occurred that allows some expense reports to be copied but does not enable the attackers to obtain designs for stealth aircraft. A breach is not a good thing, but it does not have to be an all-or-nothing scenario.

Re:Spoken like a true spokesperson... (0)

Anonymous Coward | more than 3 years ago | (#36275888)

On the other hand, a robust security system should be able to keep your most important information secure even when a breach occurs at lower levels. So, perhaps a breach occurred that allows some expense reports to be copied but does not enable the attackers to obtain designs for stealth aircraft. A breach is not a good thing, but it does not have to be an all-or-nothing scenario.

Indeed. At the defense contractor where I worked, all computers with classified documents were kept isolated in a locked room with no internet connection. The room was also guarded by a guy who knew by sight everyone who had access. They also prevented anyone from bringing in USB drives and the like.

Re:Spoken like a true spokesperson... (2)

Jah-Wren Ryel (80510) | more than 3 years ago | (#36276304)

Indeed. At the defense contractor where I worked, all computers with classified documents were kept isolated in a locked room with no internet connection.

However, that is not necessarily the case for information that individually is unclassified but in aggregate is classified. The government security folks have a name for that stuff, I just can't recall it at the moment. If an attacker were able to hoover up enough stuff from lockmart's unclassified networks it would be valuable intelligence to the government of some place like China or Israel.

Re:Spoken like a true spokesperson... (1)

AmiMoJo (196126) | more than 3 years ago | (#36276442)

Problem is that once your attacker has the private key they can impersonate the server and/or perform man-in-the-middle attacks. That could get them passwords and keys for everything else because things like SSH and RDP rely on the connection being secure enough to send raw key presses as the user logs in etc. Loss of private keys is pretty serious.

Re:Spoken like a true spokesperson... (1)

betterunixthanunix (980855) | more than 3 years ago | (#36276478)

Assuming you only have one key for all security levels, which would be a pretty bad idea.

Re:Spoken like a true spokesperson... (1)

StickyWidget (741415) | more than 3 years ago | (#36277130)

Multiple keys wouldn't have helped, since it appears the attackers identified all the seeds that were ordered by Lockheed from RSA. Whatever process they used to assign these seeds to unique individuals would have been robust enough to notice that the individual was using two.

It was endgame. Everyone should have trashed all their tokens weeks ago.

~Sticky

Re:Spoken like a true spokesperson... (0)

Anonymous Coward | more than 3 years ago | (#36277282)

You're missing the point---the important stuff isn't on the same network. It's on its own network, physically separated from any internal network, and in a tightly controlled and secure room, floor, or building. The keys are worthless.

Yes, in a company that size, random data will leak through. Some of it will be proprietary data, sensitive, or personal info. However, you can be pretty sure it's not classified, never mind top secret, and certainly not black.

These people aren't idiots. They spend most of their lives in secure rooms, they often can't tell anyone, even their coworkers, what they're doing, they work crazy hours, nearly all of them have advanced, highly specialized and technical engineering degrees, they're all cleared for top secret, and most things that they're doing involve constant security checks for even routine tasks.

So. Yeah. Sure, shit happens, but, believe me, we've thought of these things.

-guy who works in the industry

Re:Spoken like a true spokesperson... (1)

the_B0fh (208483) | more than 3 years ago | (#36276770)

you forget one thing. Typically RSA tokens are used for the high value shit, the hardest to get to, most protected shit.

so, this is RSA token being duplicated. Guess what. Major fault.

Re:Spoken like a true spokesperson... (1)

Rich0 (548339) | more than 3 years ago | (#36276888)

I still have no idea why RSA of all places would implement their tokens in this manner. If they just used an asymmetric cipher (like RSA!) it would be immune to this kind of attack.

There is no reason that any device other than the keyfob itself needs to be able to generate the numbers. Other devices merely need to authenticate if a number is correct - which can be done separately just as with any other asymetric system.

However, I do see a weakness in this - the PINs that are generated need to be much longer, or the system has to be so heavily salted that it takes a very long time to verify a single PIN. With a six-digit PIN you just need to ask "Is 000001 the right PIN for 5:30:00PM tomorrow?" and repeat a million times until you can generate a PIN for any arbitrary time using only the authentication checking info. You can't do that with any sane system because the challenge/response is MUCH longer. VERY heavy salting would also work, but you probably don't want it to take 20 minutes of 100% CPU to verify a PIN on some loaded server.

Re:Spoken like a true spokesperson... (1)

betterunixthanunix (980855) | more than 3 years ago | (#36277112)

Really? The last time I was issued one of those, I was not in a very high level position; I was just an intern on a development team. My access was limited; I had some access to business documents (mainly from company mailing lists), but I could not access all systems, particularly not the high security systems.

Re:Spoken like a true spokesperson... (0)

Anonymous Coward | more than 3 years ago | (#36277308)

This is in fact exactly correct. The article even states

Defense contractors' networks contain sensitive data on sophisticated weapons systems, but all classified information is kept on separate, closed networks managed by the U.S. government

I work first hand with security systems like this and even computers that store information classified as SECRET are not on the same physical network as computers that contain information classified as TOP SECRET. It only makes sense. Those hackers compromised the networks but I'm certain they didn't get anything classified from their attack.

Re:Spoken like a true spokesperson... (3, Insightful)

Fallen Kell (165468) | more than 3 years ago | (#36277408)

For anyone working at a place like this, they know that the real data is on a separate network which has no physical connection to the internet. The only data that could possibly have been compromised would be unclassified, business trade secrets, and/or proprietary information.

As the one official said (which was almost completely ignored by the article's authors), there should be little risk to actual projects. Really, what they got was access to "TPS reports", and other such documents. Now, there may be an issue with "Export Control" as even if some documents are unclassified, they may not be allowed to be transmitted to certain countries. But all the real information is on that other network which you need physical access to hack, which is one of the easiest things to secure.

not to mention (1)

dlt074 (548126) | more than 3 years ago | (#36277474)

nothing classified will even be on the compromised networks. classified(US government) material is not placed on networks connected to networks connected to the internet... if so, they have worse problems then bad PR and compromised boxes. you do not want the US government up your ass for spilling classified data.

Re:Spoken like a true spokesperson... (1)

Frosty Piss (770223) | more than 3 years ago | (#36275800)

It might have been "multi-layered", but clearly was not "robust".

Re:Spoken like a true spokesperson... (1)

Doctor_Jest (688315) | more than 3 years ago | (#36276144)

Usually I just chalk this up to the morons they hire in the admin departments... but suffice to say, the worst the breach could've gotten, even from a Defense Contractor, is trade secrets... and possibly some unclassified designs and whatnot. (Classified systems are not facing the internet. Ever.) And of course a huge PR hit to Lockheed Martin's ability to claim they can keep anything "secret." :)

They also might've gotten some foreign contract information... depending upon how far they snooped. :) It depends... some foreign entities prefer the same security the US DoD has.. (more or less. heh.)

 

Re:Spoken like a true spokesperson... (1)

ShnowDoggie (858806) | more than 3 years ago | (#36277218)

Remember when the Presidential helicopters were redesigned to be better a few years ago? The security there failed and the plans were released on the Internet. Never say never!

Re:Spoken like a true spokesperson... (0)

Anonymous Coward | more than 3 years ago | (#36276360)

"Translation: Our system's breached but maybe you won't realize that if I throw enough buzz words at you..."

Further translation: We just passed the bill extending the patriot act for 4 more years. We have to "create" some press about why it was necessary to against our campaign promises.

Re:Spoken like a true spokesperson... (1)

Anonymous Coward | more than 3 years ago | (#36276466)

Disclaimer: I work for Boeing in Information Security.

Todd Kelley is communications and not incident detection and response. He most likely has no clue on the state of the network and probably did not have time to contact someone and find out when he gave that statement.

That said, we do not rely on RSA SecurID's. As soon as the initial breach of RSA was reported, any SecurID's in use were basically force retired.

Does RSA store usernames and pins? (3, Insightful)

solarium_rider (677164) | more than 3 years ago | (#36275674)

Can someone explain what was actually stolen from RSA that allowed them to break into the networks? From what I understand even if you had had a duplicate SecurID number generator, you would still need the username and securid password (fixed code + random 6 digit) associated with the account to get into the network. Once you are into the network you probably also need a username (same as above) and user password to access the machines. This sounds more like the attackers must have had significant insider knowledge to get in.

Re:Does RSA store usernames and pins? (1)

Dunbal (464142) | more than 3 years ago | (#36275718)

Well see the people used the same password at work as they used for PSN...

Re:Does RSA store usernames and pins? (1)

Yaur (1069446) | more than 3 years ago | (#36276162)

Not that far fetched TBH.

Re:Does RSA store usernames and pins? (1)

betterunixthanunix (980855) | more than 3 years ago | (#36275754)

I think they found a way to synchronize their copied SecurID tokens with the victims', thus reducing the attack to figuring out the victim's password.

Re:Does RSA store usernames and pins? (2)

Spad (470073) | more than 3 years ago | (#36275842)

Usernames and passwords are trivial to socially engineer; most people you ask will give you their password without you even asking for it if you claim to be "from IT".

Re:Does RSA store usernames and pins? (1)

Professor_UNIX (867045) | more than 3 years ago | (#36275902)

Exactly. Even if the seed files for the token were stolen, RSA still has no information about what seed file information was associated with what user! A company like Lockheed Martin could have tens of thousands of Securid tokens. The permutations for users to tokens to guessing PINs is still astronomical unless an insider was involved that had access to the securid database.

Re:Does RSA store usernames and pins? (2)

blincoln (592401) | more than 3 years ago | (#36276202)

"The permutations for users to tokens to guessing PINs is still astronomical unless an insider was involved that had access to the securid database."

Maybe. But if you think about it, there are approaches that would only require a lot of attempts, not an "astronomical" number. If you know the username of an employee and whatever Lockheed-Martin's helpdesk uses for verification (last four SSN digits or whatever), you can have their password and SecurID PIN reset. Then just try that PIN with every cloned token in your possession. Trying different PINs with the same token will cause a lockout, but will trying each token once with the same PIN? I'm pretty sure that would go unnoticed, especially if the attempts were made from different proxy servers to mask the source IP all being the same.

It could also be that RSA had network captures or SecurID database backups or something along those lines *from* Lockheed-Martin that were sent in for troubleshooting purposes, and *those* were stolen as well.

Re:Does RSA store usernames and pins? (3, Interesting)

mikem170 (698970) | more than 3 years ago | (#36276462)

I always saw these RSA tokens as protecting against compromised end user installations.

It you can log keystrokes on an end user's PC, then you can grab their user id and pin. That goes nicely with a compromised/duplicate token.

Done deal!

Re:Does RSA store usernames and pins? (1)

_Sprocket_ (42527) | more than 3 years ago | (#36276688)

Trying different PINs with the same token will cause a lockout, but will trying each token once with the same PIN? I'm pretty sure that would go unnoticed, especially if the attempts were made from different proxy servers to mask the source IP all being the same.

A combination of PIN and Token Code act like a password. A bad auth attempt is a bad auth attempt no matter whether you used the wrong PIN or gave the wrong Token Code (although the SecurID system will log when its noticed a correct token code and bad PIN or when the user might have transposed PIN and token code). So it doesn't much matter whether you're brute-forcing the token or the PIN - both will generate failed auth attempts and eventually bump up against any account lockout mechanism (which should be in place according to FISMA requirements).

Re:Does RSA store usernames and pins? (2)

rahvin112 (446269) | more than 3 years ago | (#36276468)

Some of the early places that jumped on the securID tokens only used the securID as the password (in other words there was no password in front of the 6 digit random code), thus it was trivial to compromise if you could compromise the RSA securID system. What I don't get is why these organizations didn't immediately upgrade security when word came down the the root compromise of RSA. Like one of the previous posters I always believed that breaking the securID system was a deliberate and planned attack to gain access to secondary systems that used the tokens, it's only a question of who did it because one party is responsible for both.

Need some new words (1)

Garble Snarky (715674) | more than 3 years ago | (#36275688)

I think we need new English words to represent these concepts more concisely: an adjective for "not authorized to speak publicly on the matter", and a verb for "confirmed under condition of anonymity".

Re:Need some new words (1)

amolapacificapaloma (1000830) | more than 3 years ago | (#36276184)

she = "not authorized to speak publicly on the matter"

said = "confirmed under condition of anonymity".

Like in... that's what she said!

Re:Need some new words (1)

erroneus (253617) | more than 3 years ago | (#36276208)

Why? "Natspot'm" and "cucoa" are perfectly pronouncible acronyms!

We could do it the german way (1)

acidfast7 (551610) | more than 3 years ago | (#36276232)

I think we need new English words to represent these concepts more concisely: an adjective for "not authorized to speak publicly on the matter", and a verb for "confirmed under condition of anonymity".

verb: confirmedunderconditionofanonymiten adjective: unauthorizedtospeaktothepubliconmatterse

We have perfectly good words for these already (1)

petes_PoV (912422) | more than 3 years ago | (#36276244)

The first one is "unreliable" and the second is "rumoured". As in "an unreliable source is rumoured to have said .... "

Re:We have perfectly good words for these already (1)

Haeleth (414428) | more than 3 years ago | (#36277122)

Oh, I was going to go with "a traitor leaked ..."

Much shorter and to the point.

I blame the niggers (-1)

Anonymous Coward | more than 3 years ago | (#36275700)

Those coons will be the deaths of us all.

Re:I blame the niggers (0, Flamebait)

Ethanol-fueled (1125189) | more than 3 years ago | (#36275784)

If you're going to be racist, then please be appropriately racist. The problem, as it pertains to this discussion, is not Africans. The problem is the ever-increasing numbers of Indians, Chinese, and Middle-eastern visa hires with fraudulent paperwork and checkered pasts; who retain loyalty to their budding superpower motherlands.

A high-value target like the American military industrial complex gets what it deserves when it's willing to hire Jihad Jims and Stinky Shivs rather than pony up the extra pennies to hire real blonde-haired, blue-eyed, red-blooded Americans.

Re:I blame the niggers (-1)

Anonymous Coward | more than 3 years ago | (#36276066)

Are you kidding? Niggers have an average IQ that is a full one standard deviation lower than the Aryan mean.

Quantum (0)

SilverHatHacker (1381259) | more than 3 years ago | (#36275744)

Wonder what relation, if any, this has to the quantum computer?

Re:Quantum (1)

betterunixthanunix (980855) | more than 3 years ago | (#36275778)

Probably none, since that computer only allows for a limited form of quantum computing (which, as far as I know, is not useful for factoring RSA numbers or solving the discrete logarithm problem or much that is likely to be of interest to the attackers). My guess is that the attackers were interested in Lockheed's software or weapons designs.

Re:Quantum (4, Funny)

VortexCortex (1117377) | more than 3 years ago | (#36275786)

Wonder what relation, if any, this has to the quantum computer?

My guess is that their new quantum computer enables their security to exists as a super position of itself -- both being very secure, and completely unsecured at the same time.

However, now that the state of their security has been observed, it has collapsed into only one state (which is unfortunately: unsecured).

Re:Quantum (1)

semi-extrinsic (1997002) | more than 3 years ago | (#36275938)

Well, given that Lockheed announced three days ago that they had "agreed to buy it", implying that they won't have it for several months (and it may not even physically exist yet), I'd say nada.

Hey, maybe we can finally ask (1)

50000BTU_barbecue (588132) | more than 3 years ago | (#36275774)

... Lockheed what the true top speed of the SR-71 was?

Re:Hey, maybe we can finally ask (1)

Announcer (816755) | more than 3 years ago | (#36275834)

Now that it's been hacked, it should be online soon, and you can Google it.

Re:Hey, maybe we can finally ask (0)

Sentry23 (447266) | more than 3 years ago | (#36275838)

Funny story. Top speed of the SR-71B turns out to be exactly half the top speed of the TR-3B.

Re:Hey, maybe we can finally ask (1)

rrossman2 (844318) | more than 3 years ago | (#36275972)

Wow.. if you mean the Triumph then I guess the SR-71 was a lot slower than we had all guessed!

Re:Hey, maybe we can finally ask .... TR3B (0)

Anonymous Coward | more than 3 years ago | (#36277020)

I didn't know that a 1962 Triumph was faster than the SR-71B

Re:Hey, maybe we can finally ask (1)

lennier1 (264730) | more than 3 years ago | (#36276002)

Depends on whether they served chili in the officers mess.

Re:Hey, maybe we can finally ask (1)

Briareos (21163) | more than 3 years ago | (#36276260)

African or European?

np: Decimal - The Lesson Of Hope (Soma Coma 5)

PC Magzine: Classified data secure. Wrong. (2)

Relayman (1068986) | more than 3 years ago | (#36275874)

According to PC Magazine: "Classified information is likely out of hackers' hands: Due to the volume of attacks that these kinds of systems on a daily basis, it's highly doubtful that Lockheed—or any security contractor—would keep top-secret information within reach, should one ever breach the remote access gates."

Sounds like wishful thinking to me. Classified information has been breached in the past so why would you expect that it's magically safe now?

Re:PC Magzine: Classified data secure. Wrong. (0)

Anonymous Coward | more than 3 years ago | (#36276256)

According to PC Magazine: "Classified information is likely out of hackers' hands: Due to the volume of attacks that these kinds of systems on a daily basis, it's highly doubtful that Lockheed—or any security contractor—would keep top-secret information within reach, should one ever breach the remote access gates."

Sounds like wishful thinking to me. Classified information has been breached in the past so why would you expect that it's magically safe now?

Sounds like ignorance on your part to me.

Re:PC Magzine: Classified data secure. Wrong. (0)

Anonymous Coward | more than 3 years ago | (#36276588)

I would imagine they keep a separate network, not connected to the internet, for stuff no one is supposed to get at. Otherwise stuff would be leaking everywhere and defense software would be developed much more cheaply.

Re:PC Magzine: Classified data secure. Wrong. (1)

tsotha (720379) | more than 3 years ago | (#36276720)

Classified information has been breached in the past so why would you expect that it's magically safe now?

Oh? Classified information has been stolen by hacking in from the internet? When?

Tempest, top secret vs secret etc (0)

Anonymous Coward | more than 3 years ago | (#36277004)

I have to agree. Back when I was working at a large computer company doing DoD work, all the stuff classified Secret that was on-line was in a non-networked room. You had to sign in and out. You could not bring any disks/tape/usb drives and the like in there. You had to show your IDs etc. Every Secret item was signed in and out, logged and work-product burned. They were perfectly willing to look at everything you took in or out. The room itself was designed in accordance with tempest procedures to avoid any emissions - so there was definitely no external access. IIRC even the floor was elevated as compared to the other parts of the building, presumably to make sure there was nothing coming in through the floor when needed. And it was all internal walls. I have a hard time believing that any DoD Contractors would be going *backwards* in those respects.

And that was just the *Secret* stuff. The Top Secret was even worse in terms of paper handling, controls, logging, safe access, and paper trails than the merely Secret paper and that continued through the TS vs S world into the computer side. The "burn bag" alone wasn't enough. The security people on both were really on top of making sure that procedures were followed.

Admittedly it has been over 10 years, but I can't believe it would have gone backwards in terms of security. Some things are so basic that it seems unbelievable they'd be changed - but hey, we see it all the time, so who knows.

Re:PC Magzine: Classified data secure. Wrong. (0)

Anonymous Coward | more than 3 years ago | (#36277050)

According to PC Magazine: "Classified information is likely out of hackers' hands: Due to the volume of attacks that these kinds of systems on a daily basis, it's highly doubtful that Lockheed—or any security contractor—would keep top-secret information within reach, should one ever breach the remote access gates." Sounds like wishful thinking to me. Classified information has been breached in the past so why would you expect that it's magically safe now?

I know someone who works for Lockheed Martin, and they have said that their RSA token allows them offsite access to at least some classified material.

Re:PC Magzine: Classified data secure. Wrong. (0)

Anonymous Coward | more than 3 years ago | (#36277328)

Classified networks are not connected to unclassified networks.
When classified networks are breached, it is by an insider with physical access to classified machines, or by a physical intrusion.

RSA putting publicity ahead of security? (0)

Anonymous Coward | more than 3 years ago | (#36275910)

RSA has kept details of the SecurId attack secret. In particular, they won't even say what was taken.

Of course, the attackers know exactly what was taken, because they are holding and exploiting the material.

So the only people in the dark are the bystanders and-- perhaps most importantly-- potential customers.

Sadly, RSA's secrecy around the incident looks to be a public relations move to conceal the severity of the attack.

How does it generate the string of numbers? (0)

Anonymous Coward | more than 3 years ago | (#36275982)

These security tokens have always fascinated me. I use Google two-step auth with my phone with the same type of technology. Does anyone know what variables might go in to producing the digits? I imagine possibly the time, MAC address of the phone, and/or some other identifiers.

Re:How does it generate the string of numbers? (1)

vajrabum (688509) | more than 3 years ago | (#36276156)

I'm not sure how the Google stuff works. The SecurID tag is simple a clock wired up to a random number generator. It has a seed that is secret that is shared with the Authentication server (ACE server). As long as the clocks are sync'd then the token/tag will show the same number as generated on the server. Each SecurID token has that seed and also a serial number. Based on some stuff I heard recently through the grapevine, I'd guess that somebody has figured out how to map from the SecurID serial number to the key seed. If the system is properly designed this isn't any such mapping but fatal shortcomings in cryptographic software are nothing new. If you have SecurID in your enterprise then you probably want to grab your salesguy by the throat and tell him they need to fix this *now* at RSA's expense. This may well be the worst IT security breach of the 21st century so far.

Slasddot Memo #2334212123 (0)

Anonymous Coward | more than 3 years ago | (#36276016)

Dear Reuters:

Expect a visit from some friendly people.

Yours In Krasnoyarsk,
Kilgore T.

really? (1)

sjudd (162227) | more than 3 years ago | (#36276206)

there are military or high security environments still using RSA?

Oh noes! (1)

DamienNightbane (768702) | more than 3 years ago | (#36276224)

Looks like Anonymous is planning on building an air force.

Soft tokens? (2)

Technomancer (51963) | more than 3 years ago | (#36276286)

I they are using soft token apps in addition to hardware keys they are trivial to duplicate if you can get ahold of the key string and password from an employee.

RSA's lost data (0)

Anonymous Coward | more than 3 years ago | (#36276590)

If you have it, observe 2 or maybe 3 or 4 authentications of a given token, I suspect you can impersonate that token at will.

You will still need the PIN and username and possibly password, but you get those when you snoop the authentications.

And lastly, you'll need a giant bucket of CPU to calculate all the tokens for each point in time you see an RSA key's authentication.

Lockheed Martin and the UK Census (1)

Uhyve (2143088) | more than 3 years ago | (#36276848)

Aren't they the guys who did the UK census? I wonder if they'll offer every UK citizen Identity Protection. Even though I'm from the UK and hence was forced to participate in the census, I'd almost feel good about that information getting stolen, this is what us whiny people were going on about.
Load More Comments
Slashdot Login

Need an Account?

Forgot your password?
or Connect with...

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>