Gov.t getting h4x0red

story from the register

Why do we hear about the gov.t getting hacked so much? Shouldn't this be a very rare thing? I mean... IMO I think you'd hear more about private parties being attacked than the gov.t. Although this guy's foreign... (why a brit... they are okay with us right? dont hate americans?) I duno just... seems like u hear about the .mil getting hacked way more than it should be... you'd think with the military's resources they'd give this crap higher priority. Anyone here know why it doesn't seem to be that way? :confused:

IMO I think .mils get attacked more because they are high-profile hacks, that are guaranteed to get someone lots of attention, very fast. I mean you break into a business, they loose a million dollars, no big deal, everyone makes and looses money on large scales these days, but somone shutting down a Goverment machine or swiping some 4 star generals email password seems to be a big thing. And you're right, with the money the military has to throw around buildling nukes, new planes and such, you'd think they would take just a few million to spend on making their computer systems a bit more secure.

America is a good target for anything because we like to get involved with everything. Sure for hacker and the like Private party hacking would be a good target but imagine the feeling of getting into one of the worlds strongest armed forces and Intelligence communities and roaming around freely getting information and such.

Its no suprise that we are targeted for this and i believe the military does have a lot of money poored into security but for every lockdown there is a way around. What baffles me is that it took a year for them to catch this guy. I mean if they want to hire some civilians to work on security sign me up :)

wow 80 years in jail. LOL and all the guy did was use a remote admin tool to gain root and get info. I also heard somewhere that this guy did a few attacks cause he didn't like the whole U.S. and Iraq thing. I dunno which is more sad, A 30 something year old s.kiddie or the fact that he'll probably be locked up for 80 years.

lol Spy... yeah me too... my contract's almost up!

the gov't just OK'd a bill that would supply some 900 million dollars towards new cybersecurity training for FBI agents... hmmm... sounds good to me.... might want to get a gov't job ;-)

tampa... would you pass the UA to even be considered for it? hehehehe... j/p :D

Quote:

---

LOL and all the guy did was use a remote admin tool to gain root and get info

---

Last time I checked that was against the law? Times what was it, 96 systems? That is alot of counts (offenses), alot of counts * small sentence = big sentence. Ever since Sept. 11, the military has been saying they take a very dim view on people compromising their systems (wanting to say it is deemed a terrorist attack, there were many articles about it on security focus, I will try to find some of them and post them here in an edit), script kiddie or not, the result was the same, compromised systems.

80 years is harsh, but the way the legal system is in the US, he will probably be out in a couple of years. Dunno, personally I feel that the old cliche about not dancing if you don't want to pay the band comes to mind...

I suspect that Syini666 is pretty much on the right track, those .mil's and .gov's draw alot of attention from any wannabe out there or even the skilled who are out to make a point (protesting attacks on Iraq, protesting military in saudi, protesting support of israel, and on and on and on)...

/nebulus

EDIT: Ok, finding it is turning out to be harder than I thought, have only found vague references so far to it, will keep looking. I know it was on securityfocus though, if anyone else remembers, help clue me in, I know I saw it, just I guess to old to get the gears in the brain turning...


Bush Adviser Warns Cyberterrorists (Elsewhere)
url: http://www.washingtonpost.com/wp-dyn...2002Feb13.html
Last modified on: 2002-02-14
(article appears expired and washington post wants money to look at it)

sort of a "David and Goliath" type of situation. lol.

i bet they just hire the guy to work for us and then he leaks information or Britain uses him for intelligence. rofl

lol... it was a "sneaker-net" hack... install trojan off a floppy. :D hehe

The .gov .mil is going to be a target for some of the reasons Syini666 and others mentioned, however there are other reasons they get hacked; First off, there are so many different .mil systems and they are hooked to so many machines both in and out of the .mil establishment that you can't even count the terminals and they all have modems. You get root in one, you got access to all in the system. Also, you would *think* that the servers and workstations were all under the same rules and control but they are not. Each branch of the government service, and actually each subgroup (like, maybe a division in the Army) has it's own IT section, and if you think the neighborhood dog is jealous of who gets into the farmer's manger you never met a military IT section leader. Seems most are worried that some junior enlisted dogface will prove (s)he's smarter in security than the "specialist" is. To aggravate the situation, many large .gov units are IT'd by civilian employees who hire on at attractive payrates, and they are sometimes viciously jealous of anyone, military or civilian, who shows more knowledge than they have. I think no matter how much the gov spends on super-training the Fibbies it won't do any good except when the various .gov or .mil servers get whacked the Fibbies will be able to trace the intrusion, maybe. This may sound a bit harsh, but it's pretty close to the truth in most cases. And i'm a card-carrying patriot who really hates to lay blame on our government. Actually, i'm not blaming the "government", it's just that some of the employees seem to be not quite up to par, and go to great lengths to cover their inadequacies in this terribly complex and moving environment. Wish all .gov and .mil servers, terminals and the programs on them were controlled (actually SysOp'ed) by the same highly qualified IT guru, you'd probably see a different level of security. And if some general gets his .mil email hacked he either has a very poor password or he should fire his IT specialist! :D

It really is not Net Admin fault here nor is throwing money going to solve the problem. Fact is the dot mil pays nothing in pay scale wise that could afford any sort of life outside a US base. Check out employment with any goverment agency and look at the sad pay scales. A State Dept Admin that is supposed to secure systems, get top grade security clearence, code, decode all communications etc pay scale tops out at 65k per year not much unless you get into a consultant office where the exchange rate is good. It also shows that this guy was being watched for a long time by sys admin and it will take about one year for a goverment agency to react to something sys is telling them. Fact is scan any dot gov edu mil and you are being watched by really under paid people. The guy did cause damages and should pay the price. Matter of fact with this new "Homeland Security Agency" has inserted this http://www.msnbc.com/news/834875.asp (hate MSN but I read lots of news daily from many sources to form an objective prespective) Will this guy be the first to get life?

I find it amusing in a way. Think back to when Los Alamos Labs and, I think, Sandia Labs were hacked into. The people handling their security are all college grads and somebody in their mid teens can beat them. It's curious that the Govt and the various Labs all require college degrees, when they should be looking at ability and qualifications. Letters after a name don't mean much in the computer industry these days. Just my very humble, unlettered after name, opinion.

Quote:

---

It really is not Net Admin fault here nor is throwing money going to solve the problem. Fact is the dot mil pays nothing in pay scale wise that could afford any sort of life outside a US base. Check out employment with any goverment agency and look at the sad pay scales.

---

I have two buddies who have and still are subcontracted "civilians" that work for the government on their network systems, so I know they pay outside people, you were right on the need for security clearnances and such. Both had intensive screenings and both say you really have to watch where you go and what you see while on base or else MP's pop out of no where. They both make far in excess of 65k a year too, so don't get down on the idea just quite yet.

Well Chuck56 you have to remeber that when all this came about that when it came to ethics and computer use yes only people with a U degree had access to main frames. Did the kids beat us nope we only errored in believing that computing would be treated by respect and honor for the true tool it is unlike any other really. Fire is a tool can make one warm keep the house comfortable, but I seeing "burning down the house" (Talking Heads tune)...go on laugh OldMan :) we deserve it! Actually the mid teens did not beat them they just downloaded programs that other Admins developed over time most crackerjack tools are used by people that know nothing more then point and click. Butt puckers I knew I could use the tools for that but have ethics, after all I don't hit women, grab canes, flatten wheel chair tires or park in handicap spaces, not cause I can't do all these things..I choose however to respect what is not mine and peoples diginity. Amusing that the very systems being hacked so often now days provide an income for people to live, or pay for that pesky script kiddie's internet connection. We are not talking binary programs but compiled programs hack what using what program? LOL always loved the blinking cursor in Nix..ok now what? LMAO

Im glad that the .gov is no longer sitting by mindlessly putting their PCs in danger but come on.... I've seen bank robbers beat peaple up and cost more money & harm to companies then any s.kiddie ever could yet peaple like that will get a much easyier sentencing now than some s.kiddie ever will. And with this homeland "security" they think that its ok to invadeing many inoccent peaple's privacy without warrent will be justified if they catch a s.kiddie within their watchful eyes.

Good points, Palemoon. I think computer security is basically defensive and you can't win being on the defensive. Somebody just works until they find a way in. Trouble is, at this point in time, what constitutes offensive computer security?

I am not really getting this, but as i understand it, I agree with who ever that said that America gets involved in too many things going on in the world. If a counrty is having a priblem with their economy or their neighbors, if they have a problem solving the problem, and it gets to the point that it might lead to a very destructive war, then we can get in it. If we keep jumping in everytime we hear something about countries in like a cold war or something , we just jump in and try to be the super country.