DoD and Net Attacks 125
Chernyakov writes "The Washington Post has an article about attacks on DoD systems. According to the article, the Pentagon's chief information officer said 'The Defense Department suffered more than 22,000 electronic attacks on its computer systems in 1999 and about 14,000 in the first seven months of this year.' " Those numbers apparently count port scans too, but the article is interest, talking about many things, including the fact that they don't run any commercial software on their most classified systems for fear of backdoors. I imagine the DoD's sysadmins are a scary bunch.
True story... (Score:1)
No surprise (Score:1)
But, is this really any surprise as to the numbers they're getting?
Just a bunch of morons trying to act cool and using dumb little programs they download online, and as for the more serious ones, I'm not sure what they're trying to prove.
This comes as no surprise, considering how some consider it "cool" to hack some big system.
I'm not incredibly surprised that they're not using any commercial software, it may be a hassle, but then it sure does make it way harder to break through.
Will there ever be a day when computers need not be worried about being "hacked" into?
I've never heard anyone on Star Trek say, "they've hacked into our computer systems." No, I guess they just blow the bad guys up if that happens. And if someone does the same type of thing to the Defense Department (ie, getting access to high level computers) will do the next best thing, find those responsible and hunt them down.
Looks like they use Solaris... (Score:2)
What's really odd about the Netcraft link above is the history of the DoD website. As of 11 Oct 00, their OS was listed as "unknown" (and the DTIC's OS was unknown as of 12 Oct 00; looks like they all swicthed at the same time). Maybe that's what the article was referring to?
And if you want to see something really odd, try Netcrafting to the DTIC's IP addr [netcraft.com]. Their httpd/OS information was changed 9 Dec 00, which is tomorrow. And if you're not into conspiracy theories, then just tell yourself that it's because the run on GMT and they just made the switch to a new machine like ten minutes ago (it's currently 00:41 as I write this).
-B
Counter Attack (Score:2)
Of more interest, to me, is how this also coincides with the DoD's interest in performing attacks of this nature on other countries. It looks like cyberwarfare is picking up, with the increased use in the Isreali-Palestine conflict going on and the inherent spillover to US domains.
I wonder how good the in house hackers are at intrusion of other systems?
Re:What OS's do they use? (Score:1)
If you really want to find out, quite a few portscanners will do OS detection for you - by identifying subtle differences in the TCP/IP packets (like sequence number choices, etc.) Privided that they haven't written their own OSes, you could always just nmap the DoD's machines and find out. It's only one more portscan to add to their pile...
Re:hey retard (Score:1)
Re:Just how far do they go? (Score:1)
Re:waste of money (Score:1)
why develop all this code inhouse? i would feel secure with OpenBSD nicely firewalled / services configured correctly. If not a regular distro of UNIX why not simply a heavy mod, apparently they have a full new operating system in place. Of course, this is from the same people who thought ADA was a good idea :)
It is not that OpenBSD isn't secure, but as the Department of Defense, they are obligated to ensure that any software that they use is secure. Not that someone else says it is secure, but that it has been show through a software audit that is really is secure. Anything less is negligence. I do not want my government to use software that may have a backdoor in it.
ADA is a good idea. It's a very powerful language. I don't like coding it, but it is a good idea. :)
Re:Stupidity of attacking a DoD site (Score:1)
conspiracies aside the CIA is hardly the paragon of law adibism
Re:DoD computer systems. (Score:1)
I'd be willing to bet this is true. Most intelligence-gathering is done through technological means now--spy satellites, analyses of trends in economic releases, monitoring network traffic, etc. Human operations make up about 10% of intelligence gathering now. It's mainly kept around to keep up an aura of cloak and dagger--in the CIA's case, it makes the pencilnecks in Congress feel like they're in charge of James Bond, so they'll give the CIA more money in the budget.
---
Zardoz has spoken!
Classified Systems on the net (Score:1)
Re:What OS's do they use? (Score:1)
Re:You think the government really understands Sys (Score:1)
They've got spy satellites in orbit that can identify somebody peeing in a corner of a training camp. I think they probably have some people who can grasp basic network security. :)
---
Zardoz has spoken!
Re:Port Scan's (Score:1)
Re:Port Scan's (Score:4)
Another poster comments "how much of an "attack" is it to scan to see if FTP is open?" What kind of "scan" would anyone do to see if FTP is open? The user check to see if port 21 is open, and thats it.
I remember reading once on slashdot how an @Home nameserver was "port scanning" some guys machine, because it responded to his machine's DNS requests. Come on -- that's not a scan.
If checking one port is a "scan", then I'm afraid I probably scan hundreds, or even thousands, of machines a day. I'm such a 'leet hacker. Most of our webservers get tens of thousands of "scans" a day (generally, by people "scanning" port 80), from people all over the world. The mail servers get thousands of scans, too. What are you guys talking about?
Re:DoD computer systems. (Score:1)
Pronunciation: "s&r-&p-'ti-sh&s, "s&-r&p-, &-"rep-
Function: adjective
Etymology: Middle English, from Latin surrepticius, from surreptus,
past participle of surripere to snatch secretly, from sub- + rapere to
seize -- more at RAPID
Date: 15th century
1 : done, made, or acquired by stealth : CLANDESTINE
2 : acting or doing something clandestinely : STEALTHY
synonym see SECRET
- surreptitiously adverb
eudas
Re:Pointless Quote (Score:1)
In the DOD's first rush to put up websites 5 or more years ago a lot of sensitive information was thrown up on web pages to provide useful/interesting content for the web. I heard some real horror stories from some infosec people in the DOD about stuff they had found on open servers. In '97 or '98 the DOD suddenly woke up and tried to clamp down on their public servers.
ISS (Score:1)
Re:Open Source Software security (Score:3)
Fundumentally, OpenBSD is still UNIX. Remember the Orange Book codes? You don't see many UNIX systems past C2 because they really weren't designed for it. The A's and high B's belong to operating systems designed with security in mind from the start. Not insecure OSes that have been patched up.
Not to say OpenBSD isn't secure, it's just not at the right level of paranoia.
Microsoft Happend... (Score:1)
The solution to back doors was to pay the extra $50k for the source code and review it yourself. Companys did so happly just to know they were reasonably safe.
What happend? Managers would pick operating systems in office and on the network. They'd pick what they knew.. Windows NT..
With that a freshly minted MSCE is more valuable than years of experence. With that any security rule that makes it hard for Microsoft to sell software gets throw out the window.
Related Article (sort of) (Score:1)
Re:Quality of DoD sysadmins (Score:1)
Their programmers died of old age so the backdoors (Score:1)
Pointless Quote (Score:1)
Re:Port Scan's (Score:1)
A general description of a host scan would be x connections from host(a) to y ports on host(b) within time delta.
A general description of a distributed port scan would be x connections from host(a) to y hosts port(n) within time delta.
Most of the time these two types of scans are lumped together and refered to as port scans. Bammkkkk
Depends on what you count (Score:1)
Re:Open Source Software security (Score:1)
Sorry, those are UNCLAS systems, you know! (Score:1)
Logistics runs on COTS equipment: we've had public talks on the fun we had getting IP links up between ports during the Gulf War, to help manage the shipment of equipment and men. The networks are private, though, you understand.
Tactical systems run on odd collections of stuff: Canadian equipment in my era was custom-built, reliable but not terribly secure. If I sent a flash message that I'd run into the enemy, it wasn't super critical to deny it to the enemy: they were busy send a flash message that they'd just encountered me!
Systems used in a strategic role were different. As many of these as the military could afford were ran on "Trusted Computer Systems", like Multics. At the U.S. DOD's insistance, commercial computer vendors build Trusted OSs based on their standard ones.
Any sort of planning document, or anything that would tip an enemy off early enough to matter, was closely held. Our term for these kinds of systems was "word processors for generals", and was done, sometime with COTS software, on commercial Trusted Systems.
I have one of these, Trusted Solaris, on a box in my basement, mostly out of curiosity. Some people (HP, for example) use them as the basis on which to build firewalls, as B2-grade systems can block a surprisingly large number of kinds of exploits.
These are the systems that the military keep secret stuff on, and which they indeed do lock behind closed doors and network with encryption devices (blacker boxes) on the cables.
They're very different from the normal unclassified stuff that might get hooked to public networks: the unclas boxes are the same kind of machine any one of us might have. With all the usual security holes.
Re:Pointless Quote (Score:2)
The classified stuff is not on the unclassified nets, so you have to get inside the base to breach them.
Re:Port Scan's (Score:1)
One thing I can say for the DoD, is that their SIPRNet (Secure IP Router Network) or classified network, is pretty damn secure. What secures it first hand is that it is completely isolated from the internet. There are absolutely no connections crossing the SIPRNet/Internet. Physical security is also extremely tight around just workstations for this network. That would explain though why there really haven't been too many reported cases of intrusions into the SIPRNet from the outside, pretty much the only possibility of a threat to that network would be disgruntled employees.
Re:DoD computer systems. (Score:2)
DoD sysadmins (Score:1)
(If you didn't get that one, read User Friendly.)
"Off my systemzisch, zlotniks!"
Re:Stupidity of attacking a DoD site (Score:1)
Re:2000 Mission Critical Computers? (Score:1)
Re:Port Scan's (Score:2)
Re:Open Source Software security (Score:1)
So where do they get their trusted systems from? Either the commercial guys listed here [ncsc.mil], or from an OS written internally at say, NSA. The hordes of math geniuses they have probably come in real handy for writing trusted systems.
Elligible Receiver (Score:1)
They get attacked because they don't prosecute (Score:2)
I used to for as a contractor for DISA (they run/own the computers for the US AF and other branches) and the only time we could get anyone excited about attempted hacks was by informally asking the OSI guys if they had time to drop by and hassle some kid. When that happened, it involved two guys in cheap suits dropping by some kids house and asking a few questions.
I like how they talk about the 1998 event. At that time hadn't learned their lession yet.
Who cares? (Score:1)
Sure, if you can get onto Intelink, you can hack your way into boxes by whatever means are currently in vogue. In fact, because of the removal of threat from the outside world, many machines actually have less security, since (right or wrong) we tend to trust people on the inside. Fortunately, getting access to Intelink is impossible for the average hacker. In this sense, the biggest threat is from the inside, as many noted security experts have said all along.
Re:What OS's do they use? (Score:1)
but what if they aren't. say they did write thier own OS. I wonder what it would be like....
DOD's laziness (Score:2)
I believe that DOD learned the lesson. And learned to NOT TO TRUST the media. Since then I have less learned about Pentagon's generals crying over journalists shoulders and more real work on their defenses. Since then I saw even some real though stuff on security coming from the inners of DOD. My congratulations people to have learned the lesson.
If you kept that wave in 1998 then you could have got the third hackers counter-attack wave and this one could have been very heavy to hold. As people were getting really mad for seeing another Sundevil Operation coming up. Bashing hackers for the lass lazy security of your admins is not the way to operate. If you have a sleepy admin coming 8 o'clock to play minesweeper until 17:00 (time to go home!) is not our problem but yours. Fortunately it seems you got something out of what happened in 98.
From Russia with nukes... Just kiddin'...
Re:hey retard (Score:1)
Re:Port Scan's (Score:2)
Re:Port Scan's (Score:1)
Re:But would they go from scratch? (Score:1)
Re:Only 22,000? (Score:1)
scan: n, To look over quickly and systematically.
Um... portscanning involves probing more than one port. All possible ports are probed in a typical portscan, one right after another, in rapid succession - hence the term 'scanning'.
Re:Port Scan's (Score:2)
Re:But would they go from scratch? (Score:1)
Well they need to spend some on me, my P166 is driving me crazy......
Re:I'll confess, (Score:1)
Re:Ultra Paranoid but they are usually nice about (Score:1)
Re:Port Scan's (Score:3)
So... if I type http://www.monkey.com/ into the address bar of my web browser, just to see what comes up, I'm doing a "port scan" on that server? Should the administrator of www.monkey.com be aware that I'm trying to hack into the site?
If I decide I want to download the latest version of NetBSD, and I just randomly guess am I doing simething the administrator of the domain should be aware of? (In fact, last night I did exactly this. I had no idea where to download NetBSD -- that was just my first guess. I had no idea if there really was machine named ftp.netbsd.org, or what services it may provide. By trying to connect, I really was trying to discover something I didn't already know.)
The only thing I'd call a real "port scan" is the kind of thing you can do with a program like nmap -- scanning dozens or hundreds of ports at once, just to see which are open. It shouldn't be a suprise to anyone that those "port scans" are easy to log, but next to worthless to break into the machine.
Re:forgive my ignorance (Score:1)
i think all the goats.ex trolls killed all the natalie portman trolls. i find the new group much more disturbing.
Re:one high security net i saw (Score:2)
--
I can name at least 8 computers (Score:1)
So all this classified stuff isn't on the net is a joke to me. Also the 2 missing laptops that still have yet to be found with classified information are floating around somewhere in the US (this was in 1999 and people were dismissed over it). I just suspect that someone stole them and they aren't being used by terrorists but then again I could be wrong.
Our nations policy; when it comes to computers is a damn joke. What they need to do is create a security division in the military and deploy them to secure information systems everywhere. Until then we will be unsecure as all hell.
I'd suspect that they are talking about the not-connected DOS operated computers to order military parts because thats the only thing I can think of thats not really connected in some form or fashion. However you can press ESC and copy *.* A:\ and leave with that info. Order yourself some hummer parts or weapons etc. Anyway
Have a good day.
Re:Open Source Software security (Score:1)
What OS has an A or B?
I heared NT4 was classified for C2, but I never heared about the others out there.
Any URL's/links?
--
DoD Computer Systems, OSs, and Commercial Software (Score:3)
To address a few issues that others have brought up:
Attacking a military system with more than a port scan or mild probing WILL earn you a visit from some very terse (but polite) gentlemen.
At the facility I work at we use Solaris, AIX, Windows NT, Windows 98, OS/390, MVS, and even Linux on an S/390. I'm sure there is a project somewhere that uses OpenBSD.
Backdoors in commercial software are a VERY big issue, especially when the system is connected to the Internet. We DO use software like Emacs, and other Open Source software on our systems. Having the source code available for perusal by a programmer is EXACTLY the reason we use OSS. There is nothing hidden in OSS like there is in proprietary packages. Ever tried asking Microsoft for their code for any of their products so you could verify C2 compliance?
The DoD does NOT engage in monitoring the public on the Internet (that's the FBI's job
As for programmers putting backdoors into software that the DoD creates, that chance is nearly 0%. When a mission critical software package is written, it is done by more than one person, often by more than one team of people. The code is then subjected to multiple peer reviews. Everything that is done by the program is questioned and re-evaluated at each step of the development cycle. Why else do you think that the government is still using computers from the 70's and 80's? We haven't finished the code reviews yet!
Trusting foreigners - Well, you can't even get a clearance if you were not born in the U.S. (at least that's the way they say it's supposed to work).
The DoD is NOT stupid or careless; unfortunately, there are times when people make mistakes and accidentally compromise classified information. This happens through laziness and cockiness on the part of users AND Admins; the same reasons that commercial sites get cracked.
And, yes, many of us are not in this job for the pay, rather out of a sense of duty toward our country.
So what they're talking about... (Score:1)
Sorry...couldn't help it
2000 Mission Critical Computers? (Score:1)
How the DOD responds to port scans (Score:2)
The DoD uses the same techniques as any other organization who values privacy. If you're hitting a port for protocol foo on a machine that isn't dedicated to protocol foo, then that will earn you an IP block at the router level. The block lasts for quite a while (months, not minutes) and is then often dropped, unless you keep trying.
If you're looking at the public FTP server, it isn't an attack; that's what the server is there for.
But if you're outside the firewalls, looking for FTP on a machine inside the firewalls that isn't advertised for FTP, that's what's called "recon," and will earn you an IP block, automatically.
The DoD sysadmins, it is to laugh... (Score:1)
Re:DoD Computer Systems, OSs, and Commercial Softw (Score:1)
Most people I know want to get the hell out of service now. Not because they don't get to use cool stuff but because they get paid absolutely shit compared to their counterparts. They also don't get any perks. Then they also have to deal with a ranking situation and if anyone knows sysadmins/programmers. Sometimes when you know you're right you don't necessarily want to have to tell your commanding officer and/or general in some cases to fuck off.
I see alot of talent in the army specifically, It's just not being used.
Port Scan's (Score:4)
Open Source Software security (Score:2)
And for the rest, do they actually go through the code to make sure that there are no vulnerabilities, or do they just assume that if there were then they would have been already found?
Re:slashdotting .mil servers (Score:1)
I think that servers like the US military (or NATO in general, IIRC Nato HQ in Brussels also had some being hacked problems from time to time), and sites like Microsoft.com, are simply grand prizes for hackers.
And where real hackers are interested, the script kiddies follow (because it is kewl).
Re:Port Scan's (Score:1)
It is like knocking on the door to see if anyone is home, then if someone is home, see if the door is open to be able to get in.
There are many legitimate reasons to knock on the door to see if anyone is home (looking for the FTP port on a machine that you KNOW is running a warez FTP), but there is no reason to check for vulnerabilities (within the program with the port open)
ok this could've been better, but it is late.......
Stupidity of attacking a DoD site (Score:2)
But come on, attacking a Dept. of Defense site is just begging for some spookly looking heavily armed jerks to interrogate you under some hotlamps before hopping into the way-back machine and making it so you were never born!
Oy vey, just my cent or two.
Mike Thacker
Re:2000 Mission Critical Computers? (Score:4)
Re:Open Source Software security (Score:1)
It would at least be a decent start.. If you had good programmers with code auditors from there, you could build a system that would be as close to attack-proof as you wanted.
Hm.
slashdotting .mil servers (Score:3)
Re:I can name at least 8 computers (Score:2)
but there are also bad people around planning bank robberies. such is the nature of our planet.
note that you are legally obligated to share your knowedge of those 8 computers with your infosec POC.
in fact, anyone whith a clearance who reads your post is legally bound to report it.
Re:I'll confess, (Score:1)
At least, you thought he did until you felt a hand on each shoulder.
Sorry; just an old construction worker's joke about a visit to the proctologist.
--
DoD computer systems. (Score:2)
--
waste of money (Score:1)
if not a regular distro of UNIX why not simply a heavy mod, apparently they have a full new operating system in place.
Of course, this is from the same people who thought ADA was a good idea
No Commercial Software? (Score:1)
Using Off-the-Shelf Software (Score:2)
There was a report [ieee-security.org] in 1996 that said that 65% of in-house testing hacks were successful. According to this more recent article, 3% of attempts caused damage, and only 1% managed to break into unclassified systems. That's a good sign, I think. Hacks are increasing at 10% a year, and security is increasing faster.
The Pentagon is trying to protect itself from future attacks by deciding to "to carefully consider the origin of all software used in developing or upgrading information technology or national security systems." It sounds like they're mostly worried about those "foreigners" trying to put in backdoors. I'm not sure why they trust Americans more. But by using commercial software, like Microsoft and Lotus Notes, they're not only making their task impossible (anyone want to parse Win2000 to figure out which parts were written where?), but are focusing on the wrong worries. They should use smaller software packages, that can actually be reviewed, instead of huge bloatware that permits backdoors to be hidden.
Thalia
Re:double standards (Score:2)
Yeah, that was my first thought, too.
I have a feeling that this article may have some substantial repercussions in the IT industry. If the DoD won't use closed-source software due to fear of backdoors, do you sleep well knowing that your workstation uses it?
Your bank?
Your voting machine?
OSS advocates might get some mileage out of showing this to The Man.
--
Re:Using Off-the-Shelf Software (Score:1)
Perhaps they (the DoD, U.S. government) have a reason to suspect that companies in other countries could be persuaded/coerced into putting backdoors in their software by foreign powers? I can think of two reasons.
The first being that they believe governments in other countries can exhibit more influence over companies in those countries. This is probably true, at least in some cases. In fact, in the U.S. I think it is far more likely that businesses exhibit influence over the government, rather than vice versa. : )
The other reason I can think of is that they are able to coerce US companies to put in back doors, so they assume it is the cause in other countries.
Just a thought.
n8_f
Quality of DoD sysadmins (Score:5)
The DoD has tens of thousands of computers at thousands of locations. They have over 10,000 different software applications that they have had written for them. I'm not exaggerating. Organizations as large as the DoD need a lot of admins. But, the admins are, for the most part, civil servants. They fit into the standard scale of civil servants jobs and wages. In other words, they don't get paid very well.
Let's say your a good admin. Would you work for $70K at a computer company or for $40K for the DoD and have a BGen. screaming at you for not allowing him to receive his granddaughter's cute annimation in the mail even though you've explained that the latest DoD mandate forbade ActiveX in emails? Simple choice. Industry pays better and has a better working environment.
So, what are you left with? One of the admins we deal with (let's call her Betty) was a typist in the secretarial pool (yes, the DoD still has those). She was promoted to an admin. Why? Because of her vast knowledge of networking? Because of her ability to troubleshoot hardware? No. Because she could type fast. This is a real story. Only the name has been changed.
There are good DoD admins out there. They do it not for the environment or the money, but for the sense of pride out of helping the country. On average, the quality of the DoD admins is very low.
Dave.
P.S., this post does not reflect the opinions of my employeer.
Re:What OS's do they use? (Score:3)
What makes you think we're any different than a very large corporation? We are not one giant monolithic organization. We have well run firewalled networks...we have isolated networks...we have public webservers and database servers. Some I don't doubt will be defaced, others I have confidence that they are basically impenetrable.
We have smart users that can setup their own systems, and we have some of the stupidest users you've ever seen (I got 3 trouble calls from one person for the same printer in 10 minutes... out of paper, offline, and then he printed to a printer 10 feet away and couldn't find the printout)
the article is interest? (Score:3)
what kind of interest does this article get? I would hope it would get at least 5% compound interest anually.
Re:Only 22,000? (Score:1)
Failing Grades in Government Computer Security! (Score:1)
See here [ttp] for a copy of the "report card."
The Social Security Administration got the highest grade, a B.
The National Science Foundation got a B-.
The Department of Education and the Department of State got the grade of C.
HUD, the Department of Commerce, and the Agency for International Development got the grade of C-.
The Defense Department got a D+.
The Department of Veterans' Affairs and the Treasury Department got a grade of D.
The EPA, the Global Services Administration, and NASA got a grade of D-!
The Office of Personal Management, the Health and Human Services Department, the Department of Agriculture, the Small Business Administration, the Department of Justice, the Labor Department, and the Department of the Interior got a grade of F!!
The Department of Energy, the Nuclear Regulatory Commission, the Department of Transportation, and FEMA never even had a completed test!
The overall grade for the government was a D-!
Re:Port Scan's (Score:1)
Re:DoD Computer Systems, OSs, and Commercial Softw (Score:1)
As an Army officer (but not speaking officially as such at the moment), I can tell you it is your duty to tell your CO she or he is full of shit (when that is the case), though I would suggest being a lot more polite and tactful. Don't just complain--provide actionable solutions to problems you see! However, once a decision is made, you need to support that decision as if it was your own.
If you are affiliated with the Army, check out the Integrity and Loyalty "Army Values." Most Army officers I know are trying to do the best job they can, within a framework largely designed to support the combat arms branches, rather than the combat support or combat service support elements.
--
jvev atvf gurm rabs pern gvba
I feel more sorry for "Betty" than her managers (Score:2)
Re:Port Scan's (Score:1)
Re:Open Source Software security (Score:1)
Many commercial OSes have some kind of evaluation of some version, and some have TCSEC (Orange Book) class B or above (or equivalent under other schemes). If you are really interested, here are some links:
The field has its own specialist jargon, so it may take some effort to make sense of all that. Also remember that resistance to penetration is not required until you get a long way up the scale although it is probably what most people expect to get, only to be disappointed. It is actually very hard to show that a system is penetration resistant, much harder than merely making it penetration resistant (which is hard enough in itself if you want to keep some functionality).
Last Post!!! (Score:2)
Must burn karma to make the whoring game fun again. Damn karma cap.
DoD sysadmins (Score:2)
Heh...probably neurotic, too. It's not a job I would want. I consume too much caffeine as it is.
I'll confess, (Score:3)
You scan a DoD computer and several large men come over to talk to you.
They humiliate and scold you.
If you're lucky, you get a cavity search!
My favorite is a guy called Agent Wesley, he's got reaaaly long fingers.
Anyway, just wanted you guys to understand my script kiddie motivations.
--Shoeboy
Only 22,000? (Score:2)
65535 - 22,000...
My sources predict another 43,000 + attacks before the end of next year!
--Spence
Well.. YES. (Score:2)
I'm not saying there is anything whatsoever wrong with doing such a thing. I'm saying that, as part of an IDS, if I run a server that does NOT have an ftp server on it, then I would like to know about all the network traffic coming into my box, period. Even something as simple as an attempted FTP session, yes, is a concern.
Please understand I don't mean to say you should compain about it, or even assume that something bad is happening, only that it is something you should not simply ignore. YOu should record it, make note of it. I'm saying that it has relevance in overall tight network security analysis, period.
I'm not saying portscans are 'bad' to do either, I'm just saying that from a security point of view, as a sysadmin, you DO want to know about ANY non-prescribed network connection attempts or other traffic on your network, so you can properly make *informed* decisions as to what is a threat and what is not.
What OS's do they use? (Score:2)
I wonder what the odds are that they use something like Open BSD? Its similar enough to Solaris (Only BSD init as opposed to sysV) and they have the source code. Still, the article says that they don't use any "commercial" products, does that mean that they code thier own, including the operating system? I doubt it, while they might have their own in house apps, I bet that the OS is open source and widely avalible, I am willing to bet that its Open BSD. It would have been great to ask Theo on the Ask Slashdot that was here recently, but then, I doubt if Theo would know if the DoD is using his little BSD system anyhow...
double standards (Score:2)
My mom is not a Karma whore!
OpenBSD in the government (Score:2)
Ultra Paranoid but they are usually nice about it (Score:2)
Got a letter a few days later asking me to confirm that the machine WASN'T compromised and please explain why we were tracrouteing them ... Being this paranoid makes sense actually ... by firing off a letter to machines acting suspisciously, they undoubtedly make life harder on their would be attackers by making compromised machines known to their owners.
The only complaint I have about the whole thing is it scared me shitless thinking we'd been compromised :-) The letter follows, although I removed the IP addressess ...
Gentlemen, Greetings, the U. S. State Department Computer Incident Response Team (CIRT) received a report from our Security staff that we were being touched from IP address ***.***.***.*** which translated to host name *******.***.*** Interestingly the packet ttl is 1 and source port of 60704 did not change. The events occurred on Sep Sep 23 20:51:17 (all times are local). All attempts appeared to originate from host name ******.***.*** We understand that this may be due to operational activity. Please examine your security logs during this time period and let us know if this was indeed authorized activity. Your assistance and cooperation are greatly appreciated. Susan L. Tanoe US Department of State - Bureau of Diplomatic Security Computer Incident Response Team 301-985-8347 Report computer security incidents to: CIRT@state.gov 301-985-8375 (24-hour contact number) For more information, visit us on the IntrAnet at: http://acd.ds.state.gov/high/cif/cifmain.htm CLASSIFICATION: UNCLASSIFIED This e-mail is unclassified based on the definitions provided in E.O. 12958
In reaction to the DOD not using open-source... (Score:2)
one high security net i saw (Score:2)
all you do is hook a basic box to the web for normal https processing, but on the back end you convert critical data to udp packets and broadcast those via a one-way phiber link to a transaction box.
the transaction box burns the transaction packets onto write-once cds.
note that although it is possible to lose *some* info from the insecure side, or to have *some* incoming data distorted by the wiliest of hacker, it is impossible, without inside help or truly clueless administration, to have anyone get/distort all the records.
the one-way link trick is pretty standard for sensitive data. truly hi-level secret stuff isn't connected to the web in any fashion. that would be idiocy.
Ah, it must be DoD budget time ... (Score:2)
Face it, they just want an excuse to spend more money on eavesdropping on civilians on the Net, and this is just their way of making it sound like they're not looking for pr0n.
Re:Port Scan's (Score:3)
If you are intent on breaking into a machine to which you have no access, a port scan is the first step.
For any kind of attack (whether with guns or with computers), reconnaissance is the first step.
If you're not the DoD, though, I wouldn't worry about portscans. I don't count them as attacks just because they're so common. Besides, if I have a machine that runs several websites (some of which have files available for download), how much of an "attack" is it to scan to see if FTP is open? It could just be somebody who got a partial file download and wants to see if they can finish the download.
Also, with most of your machines, there is *some* kind of legitimate access the public has to it. The SMTP port or HTTP or something like that. For many DoD machines, there is *no* legitimate access for most of the public.
Only 5 a *week*? Wow. That's low. I think the main machine I do any admin for gets that many in an hour.