Slashdot is powered by your submissions, so send in your scoop

 



Forgot your password?
typodupeerror
×
News

U.S. Department of Interior Ordered Offline 434

The whole of the U.S. Department of Interior has been forced off of the internet as a result of a court case Cobell v. Babbit. This was the result of compromises with the Microsoft Windows servers. A judge decided to take the whole of the organization down. Should this judge have this much power? Info here on the indian trust web site. This includes the BLM, USGS and the Park Service. Staggering, really. CD: Hold off on the blaming of MS, it's still not clear.
This discussion has been archived. No new comments can be posted.

U.S. Department of Interior Ordered Offline

Comments Filter:
  • by Skyshadow ( 508 ) on Thursday December 06, 2001 @09:27PM (#2668782) Homepage
    It seems to me that the Government wasn't taking proper steps to keep that which was entrusted to them safe.

    This would be like the Government sending my tax return in cash -- it's irresposible because anyone could easily open my mailbox and find almost $3 of totally spendible money ready and waiting.

    It seems to be that forcing the whole system offline until it's ready for the modern internet was the only responsible course of action here.

    • What's irresponsible is that the systems holding this accounting data should be on the internet at all, and to make it worse, entangled to such a degree with other Interior systems that it makes them have to take down the *USGS*? WTF?
    • by bourne ( 539955 ) on Thursday December 06, 2001 @09:34PM (#2668810)

      I agree. Think of it like a bank.

      If a bank was FDIC insured, and their physical security was absolutely horrible, then the government would yank the insurance and effectively shut the bank down. Fortunately for the banks, the government isn't competent enough to rate their Internet security as they are the physical and fiscal security.

      If no one ever lays the hammer down on something like this, people will never start to equate online security with the physical security they take for granted. And much better for the government to start policing itself before it makes more noises about policing the rest of us.

    • Re:Makes sense to me (Score:3, Interesting)

      by Syberghost ( 10557 )
      This doesn't surprise anybody who's worked with the DOI, and especially the BIA, before.

      I used to run an ISP for an indian tribe, and at one point the local BIA office asked us if they could run an Ethernet connection to our hub and use our link.

      We made it clear to them that we were providing a link, not security, both before and after the fact, but they nevertheless didn't install any kind of firewall. Their servers had active Guest accounts that could access pretty much all data, and literally EVERY one of their desktops had C: drives shared with no passwords.

      Oh, and BTW; they were the folks we were supposed to call if we got hacked and wanted it investigated for prosecution, since the FBI didn't have jurisdiction until brought in by BIA.
    • >This would be like the Government sending my tax return in cash --
      > it's irresposible because anyone could easily open my mailbox and find
      > almost $3 of totally spendible money ready and waiting.


      But that's not too far from how the government has handled these trust funds--assuming, of course, that the government was supposed to have sent you $3 Billion . . .


      The history of mismanagement of these moneys, and the sheer volume of missing records (they don't know how much they're supposed to have had, who it belongs, to, etc.) is shocking, even by banana republic standards. The existence of this case should have scared of Norton from *taking* the job as interior secretary . . .


      Add to that that the first rule of litigation is, "don't piss of the judge." They've done that in spacdes. And if you *are* going to piss of a judge with misconduct and feigned ignorance, this is the *last* judge in the united states to do that to . . .


      hawk, esq.

  • I have to agree... (Score:5, Insightful)

    by powerlinekid ( 442532 ) on Thursday December 06, 2001 @09:29PM (#2668790)
    Well at least there is one competent judge in the US. Personally this decision makes alot of sense, as in previously posted... if you can't keep confidential information confidential then you shouldn't have the information. All and all a good decision. I wonder how this affects Microsoft? Maybe now their get their collectively large asses moving and fix those damn security issues before each major release so we don't have to go updating to Microsoft Windows Service Pack 143.
  • Why bother (Score:2, Redundant)

    by lavaforge ( 245529 )
    This was the result of compromises with the Microsoft Windows servers

    Just wait until it crashes in a couple of weeks and the problem will be solved.
    • by Anonymous Coward
      Just wait until it crashes in a couple of weeks and the problem will be solved.

      In a couple of *weeks*?
  • of course. (Score:5, Insightful)

    by dangermouse ( 2242 ) on Thursday December 06, 2001 @09:30PM (#2668794) Homepage
    Of course the judge should have this much power.. it's what we called a "check" in civics class. The executive branch is sucking, and nobody could make it stop sucking if the judicial branch had no power.
    • Re:of course. (Score:4, Interesting)

      by fleener ( 140714 ) on Friday December 07, 2001 @01:54AM (#2669545)
      Exactly. Anyone who's heard anything about the case knows the goverment has been screwing the Indians out of billions of dollars (er, actually we don't know how much $$$ because of the ulta super crappy record keeping). The white man is still sticking it to 'em. It is an extreme disgrace.
  • I'm not trying to troll... do you have another source that says MS Windows was the problem? It doesn't even say what the problem was... it could have been a bunch of passwords set to "password" for all we know.
  • wow. (Score:5, Interesting)

    by shade. ( 125867 ) on Thursday December 06, 2001 @09:31PM (#2668798) Homepage
    so a judge cut off a computer network because it housed sensitive data important to particular individuals which was not secure.

    whats the problem here? i wish this would happen more often.
  • ah (Score:5, Informative)

    by nomadic ( 141991 ) <nomadicworld.gmail@com> on Thursday December 06, 2001 @09:31PM (#2668799) Homepage
    I know I ruined my slashdot credibility by actually READING THE ARTICLE, but this applies only to systems that provide access to the Indian Trust data, and its an emergency order designed to protect the people whose data is stored there. This was a "computer infrastructure so easily penetrable that a court investigator and his team of security experts were able to break in and repeatedly access, modify and even create trust data -- all without raising a response from the government." This involves the finances of over 300,000 people, I don't think the judge was out of bounds in ordering it closed.
    • I agree. If you check netcraft, you'll notice that www.doi.gov is running on flavors of UNIX with Apache, as is USGS, and BLM; nps.gov is using Netscape-Enterprise but again on UNIX. Only indiantrust.org is running on a Microsoft OS/Server.

      --Ben

    • Informative? *sigh* (Score:5, Informative)

      by cje ( 33931 ) on Friday December 07, 2001 @02:05AM (#2669561) Homepage
      Folks, this is not rocket science. The easiest way to determine if the DOI is on the net or not is to try to connect to the DOI homepage [doi.gov] itself. As of this moment (1:00 AM Central time), the entire DOI is off the net. It's not just the BIA or the agencies and sites directly related to it. It's the entire DOI. I am a DOI contractor and I can assure you that our facility (which has nothing to do with the Bureau of Indian Affairs) was most certainly yanked off the net this afternoon, and it remains off the net.

      This is really causing pandemonium at our workplace. We cannot access our electronic timesheets because the server is external to our network, and as a result, I've just finished filling out my timesheet from home (because otherwise, it's not going to get done.) The silly part of it is that the facility [usgs.gov] that I work at has quite robust security, and yet we were still forced offline. This is not an "intelligent decision." This is a knee-jerk reaction that is going to end up inconveniencing a lot of people that have paid a lot of money for Earth science data. It's going to cost the government (and, as a result, you, the taxpayer) a lot of money.

      By the time you read this comment, the whole issue may have been rendered moot; there was some hope that the court order might be rescinded overnight. If the order was rescinded and you are able to connect to the above links, then I'm glad (because I'll be able to do my job tomorrow.) But rest assured that the entire DOI lost network connectivity this afternoon. This is judicial idiocy, plain and simple; there is no more diplomatic way to put it.
      • by BeBoxer ( 14448 )
        This isn't judicial idiocy. This is the idiocy of your bosses at DOI. The judge in no way ordered the entire DOI offline, only the servers which are dealing with access to individual trust data. This is a decision your bosses made because they want to play hardball with the judge. The reason Gayle Norton is being sued is because of the continued incompetence shown in dealing with the Indian trust issue. Taking the entire department offline is just more of the same. The folks running DOI don't appear to have any desire to serve the public interest. Quite honestly, I don't know what they think they are accomplishing. They are probably hoping that they can spin this to look like it's another example of an 'activist judiciary' (which seems to have worked on you, since you think it's the judges fault.) In reality, it's another example of their continuing bad faith and incompetence when it comes to dealing with Indian affairs. Actually, their bad faith in dealing with all BOI affairs since they seem more than willing to punish all of their employees and constituents rather than fix the ongoing problems at BIA.
  • by hobbs ( 82453 ) on Thursday December 06, 2001 @09:31PM (#2668803)
    If you read the article, it states:
    brought on behalf of 300,000 American Indians whose assets are housed on a computer infrastructure so easily penetrable that a court investigator and his team of security experts were able to break in and repeatedly access, modify and even create trust data -- all without raising a response from the government.
    It basically points at gross (security) negligence on the part of some gov't types that are supposed to be responsible for sensitive data. It's not like they aren't allowed to maintain the data - just that they are supposed to secure it appropriately.

    It may seem a bit extreme to make the ruling so pervasive, but then again that may be the only way to get those brain-dead govt managers to create a real system (like perhaps without MS software to start).

  • by jwales ( 97533 ) on Thursday December 06, 2001 @09:35PM (#2668812) Homepage
    Yes, absolutely, a Federal Judge should have this much power. It's one of the best checks against the possibility of tyranny.

    Since the Executive and Legislative branches of government routinely ignore the U.S. Constitution, it is extremely important that we can count on the check of the Judiciary.
    • Just as long as we don't hear the President say (also in an Indian-related affair): "Mr. Marshall has made his decision, now let him enforce it." The judiciary is only as much of a check on the Executive as it is allowed to be.

      • The attentive reader will note that Mr. Jackson suffered one of his most serious historical black eyes following that quote. I hope in this day of 24 hour news, no president would make such a logistical blunder.

        Of course, we are talking about the folks who dusted off the Star Chamber and wrapped it in our paranoia. So disregard what I wrote. Time for the aluminum beanies.
  • You know, (Score:5, Funny)

    by Patrick Cable II ( 521813 ) <pc@p c a b le.net> on Thursday December 06, 2001 @09:35PM (#2668817) Homepage
    ...on the indian trust web site...

    You'd think they would use apache...

    Patrick Cable II
  • background info (Score:3, Interesting)

    by driver81 ( 261364 ) on Thursday December 06, 2001 @09:36PM (#2668818)
    it might be helpful if the person who posts the story actually provides some background info or a link to it. guess i have to go to google myself...
  • Microsoft servers? (Score:5, Informative)

    by Camel Pilot ( 78781 ) on Thursday December 06, 2001 @09:36PM (#2668823) Homepage Journal
    This was the result of compromises with the Microsoft Windows servers.

    However, I see no mention of the operating/database that was compromised. Following one of the background links there is reference to an IBM mainframe.

    Among the facts omitted was the name of the Denver firm that maintains the IBM computer mainframe for the trust system

    Just thought that should be pointed out.

    Now the webservers may be IIS but the database being hacked was IBM. Most likely just a poor implementation.
    • But if the credentialing scheme in place depends on Windows frontend servers being secure, you can damn well better bet that it will be dutifully serving up data to the wrong party.

      Can't do much about that. I don't perform ANY core business functions on Microsoft server software, their history of getting brutally hacked and denying it is far too pervasive. (Yes, Sun and IBM are terrible too. Frankly, Red Hat and the OpenBSD Project are valuable to me not because they're "perfect", but because they're honest and prompt when they fuck up! I cut both organizations a new check every 6 months of my own free will, NOT because they try and force my company to. The checks come out of my after-tax salary; as far as I know the company has never paid a dime for either project's media.)

      The consultants were probably lazy too, but don't get too overzealous to defend the most probable point of entry. I am somewhat less than surprised that a large gov't agency would screw up like this, although most of the dep'ts I work with at least have the sense to retain solid IT security consultants (I've met some very competent Lockheed employees, for example; I have no idea who was at fault in this incident).
  • by Josuah ( 26407 ) on Thursday December 06, 2001 @09:37PM (#2668824) Homepage
    Lots of information is available at the Indian Trust: Cobell v. Norton [indiantrust.com] web site. Press releases plus offical court documents.

    Of particular interest is this document [indiantrust.com], which more fully explains why the judge ordered all Internet access to the Department of Interior. Apparently, court investigators were able to break in and modify lots of important information without any response from the DoI.

    Seems like this sets a legal precendence for locking down an entire business, organization, or corporation involved in a legal situation. If it can be demonstrated that it would be possible for an outside entity to modify data crucial to the proceeding of the case (such data would be subpeonaed), the judge can order all external access to that data cut off.

    Since simply running a some Microsoft software makes it possible for a large number of outside entities to modify such data without difficulty, and to know that doing so is possible without having to figure it out, I could see this becoming a problem for businesses and organizations that run said Microsoft software.

    However, it also means that lax UNIX administrators could have their systems' access cut off if court investigators demonstrate that they are able to get in. Sounds like Mac OS 9 is the best protection against this now.
    • Seems like this sets a legal precendence for locking down an entire business, organization, or corporation involved in a legal situation.
      I was under the impression that the DoI did more than maintain a website, and this shutdown likely has little effect on most of it's missions. I know this is a nerd community, but lets keep things in perspective, ok?
  • sweeping action with far-reaching but unclear ramifications

    Okay, the dept of interior has leaky systems. That is bad. Very bad. Maybe forcing all their systems offline is the right answer. I don't know.

    A judge becoming your CTO at the behest of people making claims against you smells pretty stinky. From what I read, the complainants' investigators claimed to have edited trust records through the Internet. The interior department denied this happened. Who is right?

    From now on if a group claims that their personal information is at risk that organization can be forced go entirely offline?

    Scary because most judges are not technically competent nore do they have advisors technically competent enough to know who is making sense and who is just talking slick.
    • We don't need to have a judge to force Micros~1 IIS servers offline - we have Code Red, Nimda, etc etc et al worms to do that for us.
  • Whoa! (Score:5, Informative)

    by cscx ( 541332 ) on Thursday December 06, 2001 @09:40PM (#2668845) Homepage
    Before half of ./ creams their jeans, let's get the facts straight:

    Entering via the Internet, the "hackers" found they could break many of the passwords protecting accounts, using a tool called a "cracker." Many of the passwords, according to the report, were easy to guess, particularly one -- "passwd" -- which was frequently used.

    This had nothing to do with the fact that they were running IIS, Apache, Joe's Web Server, etc. The issue was weak database passwords.

    • Re:Whoa! (Score:2, Insightful)

      by nolife ( 233813 )
      using a tool called a "cracker."

      It is not the sites that have security problems, it is this "cracker" program. Maybe they should find the author of "cracker" and charge him/her with creating terrorist tools!
  • netcraft (Score:5, Informative)

    by Karma 50 ( 538274 ) on Thursday December 06, 2001 @09:44PM (#2668853) Homepage
    netcraft shows lots of different OS and servers are being used. The security breach could have been done through anyone of them, or the bad security could've been on the database itself.

    For example :

    The site doi.gov is running Lotus-Domino/5.0.8 on NT4/Windows 98.

    The site www.den.doi.gov is running Netscape-Enterprise/4.0 on Solaris 8.

    The site www.ios.doi.gov is running Apache/1.3.12 (Unix) on unknown.

    The site www.doi.gov is running Apache/1.3.12 (Unix) on Solaris

    I couldn't spot a document on indiantrust.org which went into technical details either ... then again, that's not the sort of information they want to make public if the DOI wasn't addressing the problem.
    • Security is only as good as your weakest link. What good is a locked tight OpenBSD firewall if you run Outlook behind it and make your databases trust some brain dead M$ platform?

      Security does not end on the server platform! It needs to be everwhere, and so there is no place for M$.

      Blame the admin and the luser is not going to work here. Others may be slow to cast blame, but I'm willing to bet good money the company with the poorest security record and the biggest ugly mouth is responsible for this mess. Let's hope this display of Federal common sense is catching. I'm really sick of all the BS, "that patch has been available for months", and "lazy sysadmins", and "stupid user should not have double clicked this or that". The judge seems to have seen the results and cared less about why.

  • by Dynastar454 ( 174232 ) on Thursday December 06, 2001 @09:45PM (#2668861) Homepage Journal
    Wow, the judge really got pissed... but then, I guess I would too, if I had to deal with...
    Fader [Govt. Lawyer] responded that he didn't know what was meant by such basic terms as "individual trust data" and "computer," to which Lamberth [judge] shot back: "I don't believe a word you're saying now." "You're just ruining your credibility talking to me that way."
    • by xah ( 448501 ) on Friday December 07, 2001 @12:54AM (#2669435) Homepage
      At least this guy didn't pull an Ashcroft. He would have "Pulled an Ashcroft" if he had accused his critics of harming the security of the data by criticizing his security measures. "Pulling an Ashcroft" is a new phrase. It is defined as saying that any criticism of a policy prevents that policy from being effective.

      Today, before the Senate, John Aschroft, the Attorney General of the United States, stated in plain terms that any criticism of Ashcroft's policies of extrajudicial military tribunals and other suspensions of civil and human rights will help terrorism. (LINK) [nytimes.com].

  • by uncleFester ( 29998 ) on Thursday December 06, 2001 @09:48PM (#2668874) Homepage Journal
    ..at least when I check a few minutes ago. And SamSpade is reporting the front-end NPS server is Netscape Enterprise v4.1.

    .. why let the facts hamper you? :)

    -'fester
  • by sllort ( 442574 ) on Thursday December 06, 2001 @09:49PM (#2668878) Homepage Journal
    If you have important data that you would like to give access to over the web, the secure solution to this problem exists and can be implemented regardless of your operating system.

    • Keep the "real" system completely disconnected from the Internet
    • On a periodic basis, write the entire DB to some compressed format. Optionally you can write only "changes" if your update interval is high, but that's a detail.
    • Send the compressed information via a temporary, read-only link to the Web-Connected system. Read-Only can be sneakernet with magnetic tape for the paranoid or an Ethernet cable with the Rx portion cut for the slightly less paranoid (yes you'd need custom software), or just a time-clock enabled FTP server for the appropriately paranoid.
    • Connect your read-only system to the Internet, protecting it with a decent firewall. Use SSL.
    • If you absolutely MUST allow web-enabled users to change data, write all change requests to a file which is shipped back to the real system on intervals and fed into the real system one-transaction-at-a-time while monitored by a human.

    Insurance companies do this. I know, because I helped enable one. When you have low-volume, high importance data (like the personal records of Native Americans!!) this approach is justified. I'm not surprised in the least, however, that our underfunded park service wasn't able to hire a government contractor that would take security seriously. We can be as condescending as we like (and we usually are) but if you've ever tried to work through federal procurement procedures, you understand you're dealing with a very limited talent pool.
    • That solution keeps hackers from modifying the database, but does nothing to keep them from gaining (read-only) access to confidential data.
    • Send the compressed information via a temporary, read-only link to the Web-Connected system. Read-Only can be sneakernet with magnetic tape for the paranoid or an Ethernet cable with the Rx portion cut for the slightly less paranoid (yes you'd need custom software)

      "Custom software"? More like a custom protocol stack! IP simply cannot work without both send and receive capability; without ARP, it wouldn't be able to even figure out the hardware address of an intended recipient. Is this data critical? You can forget about Quality of Service; TCP requires ACK packets to come back for every data packet sent. The only thing the receiving end can do is drop the data if the CRC doesn't check out... but there's no way of informing the sender of the need to retransmit!

      Having a Tx-only setup is not feasible for any transmission of important data.

      Remember... encryption is the backbone of network security.
      • "Custom software"? More like a custom protocol stack!

        I'm not very knowledgeable about IP, but wouldn't UDP with a checksum work just fine? Just send regular updates and have the recipient machine notify the admin if more than three or so timed updates didn't show up or were corrupted.
        • I'm not very knowledgeable about IP, but wouldn't UDP with a checksum work just fine?
          Yes, it would. It's not quite this simple, but this is the gist of what you'd do. Hardly rocket science.
  • by Anonymous Coward on Thursday December 06, 2001 @10:07PM (#2668950)
    This is bad. There have been many, many reports and firestorms about these computer systems according to the Special Master's Report released as a court document.

    Predictive (the security company) broke in and documented abysmal security -- no firwalls, blank administrator passwords, other stuff that would make any script kiddie drool. The response of the B. of Indian Affairs was "naw, it's not that bad; you cheated".

    So Predictive did it again. Got basically the same results. So after the .gov agency has the report detailing their secuirity holes, they left many of them wide open. So much so that Predictive could add bogus accounts and transfer real monies from real accounts into the bogus accounts, get sensitive documents and lots of other mischief. Really bad.

    In classic Dilbertesque style, the Gov blames the messenger, says it's not really that bad (again) and promises to do a whole lot of nothing -- just like it has been doing for 10 years according to the special master's report you can click on here:

    http://www.indiantrust.org/documents.cfm

    This is bad. Real bad. Sad to say this judicial action was necessary. Sad.
  • The mismanagement of these trust funds has been a problem for decades. It isn't surprising that a federal judge has to bitchslap the Department of Interior to get their attention. Maybe the government will start to act responsibly if the judge puts some political appointees and senior civil servants in jail for contempt of court .
  • by zaius ( 147422 ) <jeff@zaius.dyndns . o rg> on Thursday December 06, 2001 @10:12PM (#2668966)
    Umm... why is there a link to the DoI website if they've been forced off line...?
  • by ninjaz ( 1202 ) on Thursday December 06, 2001 @10:19PM (#2668979)
    Here's a snippet from an indianz.com article [indianz.com] which specifies what was actually compromised:

    With permission from U.S. District Judge Royce Lamberth, the special master's team logged onto computer servers, accessed databases, broke into Interior and Bureau of Indian Affairs networks, discovered they could modify and erase sensitive data and even created an Individual Indian Money (IIM) trust account in Balaran's name. All of these breaches occured repeatedly and with ease -- and all without being noticed, or even tracked, by the Interior's own computer officials.

    Here's a rundown of how it happened.

    Predictive originally planned a two-phase test of the Interior's computer infrastructure. First, it would try to access the system from the public Internet; and second, it would test the network from within.

    However, the company soon found it could scrap the second phase because protections were non-existent.

    "Early on in the testing it became apparent that it was possible to access the sensitive internal data from the Internet and that the internal on-site testing phase was not needed due to the lack of overall perimeter security," Predictive wrote in August after a first round of hacking.

    Using widely available, and free, tools employed by hackers all over the world, Predictive tapped into a number of systems the Interior deemed "critical" to bringing its trust duties into the 21st century. These systems included:

    • The Trust Asset and Accounting Management System (TAAMS)
    • Predictive was able to break into a TAAMS server because it had "no password." As a result, the firm could perform administrative, high-level functions typically not available to low-level users.

      Also, Predictive could access TAAMS because the BIANET, a BIA network accessible via the Internet, had "blank" passwords. Through this vulnerability, the firm gained administrative powers that allowed it to access data stored in a TAAMS database.

      TAAMS is housed on two AS/400 servers, made by IBM, in Addison, Texas. The servers, the database and all its associated logic (coded in dBase) are fully owned by a third party, Applied Terravision Systems, because the Interior failed to consider long-term ownership and development issues.

    • The Integrated Records Management System (IRMS)
    • A so-called "legacy" system in use since 1982, Predictive was able to gain "complete access" to IRMS, which tracks leases and distributes payments to account holders. Weaknesses on the BIANET allowed the firm to see every IRMS account that has ever existed.

      Predictive could modify and delete user accounts, meaning it could prevent authorized Interior users from entering the system and give access to non-authorized outsiders.

      Further, Predictive gained "complete control" to an IRMS server because it had a "blank" password. The firm was able to copy files and create links to sensitive data to outside networks via standard and highly vulnerable Microsoft Windows capabilities.

      IRMS is coded in Cobol 74, an outmoded but pervasive language, and is composed of six databases -- including individual and tribal ownership and leasing data -- that reside on a Unisys Clearpath NX server in Reston, Virginia. Reston is the location of the BIA's Office of Information Resources Management, whose controversial move from Albuquerque, New Mexico, was temporarily halted by Lamberth.

    • Other Unnamed Systems.
    • Additionally, Predictive found numerous problems on a number of systems, most of which are not specifically named because information in the report is redacted. The firm was able to access "sensitive" information including "gigabytes" of BIA e-mail, configuration files, log reports, and all usernames and passwords on an unnamed system. Many of these systems had weak password or no password protections.

      Certain Interior computers were also running web servers, file transfer programs, remote access servers and other technologies that could allow anonymous access by outsiders. Other systems were prone to well-known hacking techniques, including denial of service, buffer overflows, "Trojan Horse" programs and Microsoft Windows "scripting" attacks -- all of which are typically preventable by applying readily available "patches" to fix security holes.

    All of this hacking -- which took place between June 24 and July 8 -- led Predictive to conclude in an August report that the BIA lacks "basic security" measures. "Even if every security vulnerability in this report was corrected, BIA's overall lack of a secure network perimeter would still leave BIA exposed to additional risk," the firm wrote.

    Predictive recommended the BIA implement such standard protections as a firewall and intrusion devices. Along with Balaran, the firm informed BIA of the numerous problems at a meeting with Brian Bowker, then-director of OIRM.

    Despite Predictive's damaging report, Bowker indicated the company was successful only because he had "turned over the keys to the store." Balaran said he felt Bowker was trying to "discount" the findings, so he again instructed Predictive to break into the system on August 30.

    It was during this time that Predictive created a trust account for Balaran, whose report is not specific as to which system was accessed to perform this incredible breach. Predictive was able to create its own trust data and modify existing data on an unnamed system, leading the firm yet again to warn BIA of problems and make a number of specific recommendations to correct the deficiencies.

  • no surprise here (Score:3, Insightful)

    by Anonymous Coward on Thursday December 06, 2001 @10:25PM (#2668999)
    I used to work for the USGS as a student employee in their computer services dept. Lack of security and competent network administration would be too kind for me to say. Stupidity like, each and every government computer has a public ip address, regardless if it is serving up web services. NT4 servers running with service pack four. And worse yet, users with full admin rights on their PCs, installing software and changing settings that could open them up for god knows what.
  • If you read the report [indiantrust.org]

    They have a bunch of IBM mainframes, Unisys NX, AS 400 etc. They had troubles with security in 1989 - from the report by Andersen's auditors. They had troubles with ecurity, backups, procedures in 1994.

    They are plain lazy fucks.

  • Technical Details (Score:2, Informative)

    by Anonymous Coward

    The District Court's web site has the (redacted) Special Master's Report [uscourts.gov] (PDF) which gives the technical details.

    Whoever did the redacting didn't know much about the technology; it's frequently possible to infer what's been removed from context.

    After reading the report, I understand why the judge ordered the networks disconnected from the Internet. If I were in his place, I'd have ordered the systems shut down completely.

    The report is a case study in gross mismanagement of information systems; this isn't about holes in any vendor's software, but about people who, it seems, simply didn't care about data security or integrity.

    This District Court page [uscourts.gov] has copies of the other recent orders in the case, too.

  • by matth ( 22742 ) on Thursday December 06, 2001 @10:45PM (#2669072) Homepage
    You know.. I just thought of something. There is the WayBack Machine [archive.org] which lets you get past copies of ANY website. Do you think one could get a copy of the DOI [doi.gov] and get cached copies of the data, or some such stuff?
  • Uh Oh! (Score:3, Funny)

    by anticypher ( 48312 ) <<moc.liamg> <ta> <rehpycitna>> on Thursday December 06, 2001 @10:53PM (#2669103) Homepage
    Its time to withdraw my $4,000,000,000.12 from my BIA trust account. It seems their servers might get hacked from the internet. Darn /. hackers!

    the AC
  • ...And in other news the whole Dept of Interior was taken out a team of Elite HaXors known ownly as "7th Circut District Court". A spokesman for the group commented "Mad Props for da Indian brothers."

  • And in one of the finer details of the ruling, the judge ordered Microsoft to be implicated in a story posted to the popular hacker web site Slashdot, which would ensure that the government site would quickly be taken down by a measure known in the hacker community as the Slashdot effect.
  • there had been Microsoft stuff in there.

    "Nobody ever got fired for buying Microsoft"...

    Then we could say, "Heh, not just fired. Fired, fined and put in jail for incompetence".

    Oh, and noticed a link in a post:
    http://www.indiantrust.org/documents.cfm

    Coldfusion? Oye Veigh...someone needs some serious beatings with a clue stick.

    CF is a great app for creating webforms and webDB access, but it is a security hole in its own right (IIRC from people who use it and even love it).

    My favorite saying about CF is that it is an excellent benchmark...It runs slow on *everyone's* hardware (that it supports).

    Cheers,

    Moose.

    .
  • by jsse ( 254124 ) on Thursday December 06, 2001 @11:31PM (#2669215) Homepage Journal
    CD: Hold off on the blaming of MS, it's still not clear.

    Can I still bash Microsoft if I really, really want to?

    I just couldn't help blaming Microsoft whenever I see 'Microsoft Windows' in the news roundup. This is something like complusory-anti-microsoft something, I think I've medical clearance to back my action. People in 'Anti-Microsoft Anonymous' recommends me to post in /., they said it'd help.
  • by CaptainCarrot ( 84625 ) on Thursday December 06, 2001 @11:36PM (#2669230)
    Norton could easily blame someone else. The newest part of the system was put into place in 1999, and the personnel responsible for the more egregious security breaches (such as blank passwords) are civil servants who have likely been in their jobs for some time. If she wanted, she could easily point the finger at the Clinton administration which arguably is indeed responsible for the mess having procured the system, hired the people, and established the policies. That she is not doing this can be seen as admirable restraint. If only it didn't involve screwing over the people she's supposed to be serving.

    None of which changes the fact that her lawyer is apparently a total weenie.

  • college debate topic (Score:3, Interesting)

    by abe ferlman ( 205607 ) <bgtrio@nOSpaM.yahoo.com> on Thursday December 06, 2001 @11:47PM (#2669259) Homepage Journal
    This is interesting because the college debate topic for NDT/CEDA this year deals with increasing federal control over Indian Country, and these people research voraciously. I suspect a lot of future lawyers will begin to learn about how ridiculous Microsoft is as a result of this, and to think about the ways that policy and software interact (Lessig anyone?)

    We'll see.
  • I can still get my Earthquake Data [usgs.gov] here in Northern California.

    Some of us have our priorities.

  • by mcrbids ( 148650 ) on Friday December 07, 2001 @03:25AM (#2669711) Journal
    I remember about a year and a half ago, being called in to do some networking work in a department of a nearby county's office.

    I found that the system I was in front of was primarily used to process permits for construction and the like within that county. It was open to the Internet (I did a full, nasty, in-your-face port scan and nobody blinked) and the hard drive was shared - to the world!

    I was able to connect to the HD via SAMBA, from my HOME WORKSTATION! I bitched, complained, sent letters. They paid a consultant company something in the 6 figure range to do a "security survey" - and they recommended replacing the POP3 servers with MS Exchange!

    I gave up, having other profitable ventures to go for.

    But, do you think this doesn't happen like ALL THE TIME?!?!?

    People, this is GOVORNMENT!

One person's error is another person's data.

Working...