Civil Servant Watching Porn At Work Blamed For Government Malware Outbreak (techcrunch.com) 180
An anonymous reader quotes a report from TechCrunch: A U.S. government network was infected with malware thanks to one employee's "extensive history" of watching porn on his work computer, investigators have found. The audit, carried out by the U.S. Department of the Interior's inspector general, found that a U.S. Geological Survey (USGS) network at the EROS Center, a satellite imaging facility in South Dakota, was infected after an unnamed employee visited thousands of porn pages that contained malware, which downloaded to his laptop and "exploited the USGS' network." Investigators found that many of the porn images were "subsequently saved to an unauthorized USB device and personal Android cell phone," which was connected to the employee's government-issued computer. Investigators found that his Android cell phone "was also infected with malware." The findings were made public in a report earlier this month but buried on the U.S. government's oversight website and went largely unreported.
EROS center?! (Score:5, Funny)
The jokes write themselves!
Re: (Score:2)
Those cheeky bastards!!!
Re: (Score:3, Funny)
Re: (Score:2)
Re: (Score:2)
You are not the only one to take note.
To quote Buck Murdock (Airplane II: The Sequel), "Irony can be very ironic."
I bet (Score:2, Offtopic)
He go a promotion. Its not like they fire employees.
Re: (Score:2)
Nope, not offtopic. The problem with these public organizations is that they are allowed to do these things due to the fact they are rarely fired for them. Its almost impossible to get fired from a government job. This person will most likely get a little slap on the wrist and after a year or so be promoted and or receive a raise. The IT in their organization will most likely not face any penalty for not having secured their network and the devices operating on it. They talk about a blacklist of sites
Re:I bet (Score:4, Insightful)
They talk about a blacklist of sites when they should be talking about a whitelist of allowed sites.
While this sounds nice in theory, in practice it is very hard to implement in a way that works and doesn't just hinder work. The people who administer the whitelist are not going to know what is needed for every job function. Nor will they have the capacity to monitor every whitelisted object to ensure that it remains safe. (One of the whitelisted sites might start serving ads proxied through their server - ads which aren't safe.)
And for the users, requesting sites being added to a whitelist as needed can delay entire teams for days on end. What do you mean, we cannot download the schematics for the microcontroller we just discovered a problem with until it's added to a whitelist? And when it delays a high level manager who needs to look at a web site of a potentially new supplier or customer, the whitelist system will be gone.
Re: (Score:3)
I admit its not easy on the front end but you can easily get a good start by logging sites visited for a month and start with that. I've helped with the implementation of a white list at a few businesses and after a month or two its just a matter of maintenance.
Re: (Score:2)
At a business. Where everyone works in the same industry, and needs the same sites. My emplyers (Home Depot and H and R Block) would generate very different whitelists.
If you're talking about the government the scale of required sites goes up exponentially. A single IRS office will probably need access to most of the finance sites H and R Block uses, plus all the sites Home Depot uses (might be auditing a contractor and need to find out how many boxes of nails are needed for a $50k expense to be justified),
Re: (Score:2)
Its obvious that a whitelist would be specific to the business. It depends on weather you want you're employees to be able to access the whole of the internet. One eye doctor had us lock it down until they literally couldn't access anything unrelated to the job. She maintains the list herself and since it was installed none of her machines have become infected. On a larger scale it would require someone to work that desk full time but it would have the benefit of reducing this types of breach. You don'
Re: (Score:2)
I didn't actually bring up cost. I brought up the scale of he whitelist, and the difficulty of administering it, but not the cost. This is the Federal government, there are literally millions of users, so any costs would be trivial on a per-user basis. The problem is creating some system that will actually whitelist the right websites for the right offices. A single small business does like one thing, for one segment of the market. The government does almost everything.
Knowing the Feds, what you'd end up wi
Re: (Score:2)
Yeah, its called a typo. You should look that up.
Not the only one at blame (Score:5, Interesting)
The porn-watcher might have been the patient-zero of this outbreak, but I think as much if not more blame needs be laid at the feet of the IT staff that allowed the malware to get as far as it did. Limit user privileges, lock down access ports and use secure operating systems and the damage would not have been as severe; it might only have been limited to that single user's machine.
But that sort of thinking would require a costly revamping of the entire computer infrastructure, so better to put the blame on a single user, who could just as easily have gotten the malware from an ad on a perfectly legitimate site. Fortunately, he was viewing porn (naked bodies entwined together! The most evil threat America has ever faced!) so it's easy to throw him to the wolves.
Re:Not the only one at blame (Score:5, Insightful)
use secure operating systems
Let me know when you find one. All browsers are vulnerable to something. Every OS has privilege excalation exploits and zero-days.
Or were you just thinking "don't use Windows XP"? Yeah, I think everyone gets that now.
so better to put the blame on a single user, who could just as easily have gotten the malware from an ad on a perfectly legitimate site. Fortunately, he was viewing porn (naked bodies entwined together! The most evil threat America has ever faced!) so it's easy to throw him to the wolves.
Paid porn sites have damn good security, and are about the safest place on the web. The problem is the sites that come up when you google for porn (SEO malware sites), plus the ad networks used by free porn sites.
To your point: an ad blocker would probably have prevented this, along with the default behavior of most browsers to block known malware sites.
Re: (Score:2)
Every OS has privilege excalation exploits
There are OSes with no privilege separation, and thus no privilege escalation, and thus no privilege escalation exploits.
Of course, that's not the type of operating systems an end-user would use, but still, your "every" is wrong.
Re: (Score:1)
Re: (Score:3)
There are some older operating systems like DOS where users did have full control, but there are also modern operating systems where there is no privilege separation, like microcontroller operating systems. Your kitchen scales don't need to prevent privilege escalation exploits.
(Although it would be a good hack to have the scales report too high weights of anything healthy and too low weights of anything unhealthy, slowly increasing the risks of death for the users.)
Re: (Score:1)
Let me know when you find one.
While no browser is completely secure, EVERYTHING is more secure than I.E./Edge. And while no operating system is completely secure, most everything is more secure than Windows (which has very little to do with its market dominance; its security is like Swiss cheese) or MacOS (which sacrifices a lot of security to make it shiny).
Yes, Linux is WAY more security than both of them combined, but Javascript and Intel-based CPU's are the major vectors for concern nowadays. Both of them significantly negate all
Re: Not the only one at blame (Score:2)
"In particular, we have verified Spectre on Intel, AMD, and ARM processors."
Re: (Score:2)
hile no browser is completely secure, EVERYTHING is more secure than I.E./Edge.
Edge is definitely more secure than Firefox. Pay attention the the Slashdot stories on hacking events and the like: IE and Firefox are being excluded as "too easy", while Chrome and Edge are harder targets. It's not 1998 any more, or even 2008.
most everything is more secure than Windows
That stopped being true with Vista, which was a long time ago now. XP sucked because in practice most people ran as local admin, and had admin privileges. Vista was much like Ubuntu: you get a pop-up whenever you need to elevate to admin/root. It's not 1998 any m
Re: (Score:2)
And while no operating system is completely secure, most everything is more secure than Windows (which has very little to do with its market dominance; its security is like Swiss cheese) or MacOS (which sacrifices a lot of security to make it shiny).
Yes, Linux is WAY more security than both of them combined, but Javascript and Intel-based CPU's are the major vectors for concern nowadays. Both of them significantly negate all operating system security, and should be relegated to the shitcan of history.
You're exaggerating. Back in the days of the "I'm a Mac"/"I'm a PC" commercials Apple was absolutely right to mock the fuck out of Windows security. It sucked. But these days almost all the holes are gone, and with Windows Defender you don't even really need Windows Anti-Virus software anymore. Which is just like OS X.
As for the rest of "most everything," I respectfully a couple of clusters of Unixen used primarily by Sysadmin/High Geek types better be more secure then the shit us hoi polloi use.
Re: (Score:2)
Paid porn sites have damn good security, and are about the safest place on the web. The problem is the sites that come up when you google for porn (SEO malware sites), plus the ad networks used by free porn sites.
Never really thought about it before but this is a damn good point. Too bad pay-for-porn doesn't market it as such.
now if there are stuck on old IE ActiveX may admin (Score:2)
now if there are stuck on some old IE ActiveX software then users may admin to get work done.
Re: (Score:2)
Windows and IE just don't provide that level of control
Windows lets you lock down just about anything via GPO. IE is being end-of-lifed, but you did have decent control over it. The big problem IE always had was lack of a common ad-blocker to force people to use (there were some, but none free).
Re: (Score:3)
Here in the UK, the government makes sure the potential infection is huge so it makes all that work to protect them from it worth the investment. https://www.telegraph.co.uk/ne... [telegraph.co.uk]
Re:Not the only one at blame (Score:5, Insightful)
His manager, who didn't realize thus guy is spending a lot of time not working
The network support, who didn't notice high band with use and try to figure if it was legit
His coworkers who almost certainly knew he wasn't working
Watch porn (Score:2)
Re: (Score:1)
Not necessarily. He/she could be an efficient worker who does in 3 hours what most do in 8. I've met some like that.
Normally such a person would go to the private sector instead, but maybe they valued "play time" over money.
Re: (Score:2)
Or his manager may have decided the less work he does the less damage he can do.
Or his manager liked watching porn on his computer.
Re: (Score:3, Insightful)
The porn-watcher might have been the patient-zero of this outbreak, but I think as much if not more blame needs be laid at the feet of the IT staff that allowed the malware to get as far as it did. Limit user privileges, lock down access ports and use secure operating systems and the damage would not have been as severe; it might only have been limited to that single user's machine.
But that sort of thinking would require a costly revamping of the entire computer infrastructure, so better to put the blame on a single user, who could just as easily have gotten the malware from an ad on a perfectly legitimate site. Fortunately, he was viewing porn (naked bodies entwined together! The most evil threat America has ever faced!) so it's easy to throw him to the wolves.
The porn-watcher might have been the patient-zero of this outbreak, but I think as much if not more blame needs be laid at the feet of the IT staff that allowed the malware to get as far as it did. Limit user privileges, lock down access ports and use secure operating systems and the damage would not have been as severe; it might only have been limited to that single user's machine.
I do agree with you regarding the IT policies that are severely lacking, but I'll believe there was an actual "outbreak" when the evidence presents itself. Neither TFS or TFA really says anything about the extent of this "outbreak" or the true damage that was caused, which tends to turn this entire article into nothing more than sensationalist bullshit. In fact, if you read the actual report, it states quite clearly that a single computer was found to have malware present, and it "exploited the USGS' netw
Re: (Score:1)
Don't blame IT so quickly. "Scientists" utterly rage at any attempt to "control" they're usage of computer resources. Having local admin is common place and expected from the user base, and supported by management. Even content filtering tends to be a "taboo", again also supported by management who are often or were scientists themselves.
Re: (Score:2)
at the feet of the IT staff that allowed the malware to get as far as it did.
Why are we talking about malware? How about the IT staff that allowed someone to visit "thousands" of porn sites without being flagged down for disciplinary measures. I'm willing to bet that this happened over quite a period of time.
Re: (Score:2)
The press could have written "Government Malware Outbreak caused by web browsing", but no, they had to violate someone's privacy in passing. It's like writing "car accident on Main Street, the faulty driver was on his way to an extramarital affair". Why do reporters do this?
Ex-reporter here to inform you that, if it's in a police report, it's not private.
Yeah, this happens. Not just in the USG either. (Score:5, Informative)
If you work computer security for any company of decent size, you're gonna discover someone surfing porn. Most times we give folks the benefit of a doubt the 1st time in case it's some porn ad something on an otherwise "okay" site (gray, but not really a policy violation), but once a pattern of porn surfing is discovered, it usually results in someone getting written up, potentially ending with them losing their job.
Don't do this at work. You're not on your personal computer, it could be a shared computer (ewwww), and it's not your network. There's always someone watching to the benefit of the company, not you. It makes for an awful work environment for the people in the office, and can bring in malware. There's a joke I heard, of people clicking on the Yes/Accept/Install buttons ... "do I have porn yet?" [click] "do I have porn yet?" [click]. Lots of malware comes down in the form of a "video codec" or plugin you need to watch the media. It's just awful.
Re: (Score:2)
And just how many people is that, precisely? 20? 50? 100? 1000?
Re: (Score:1)
And just how many people is that, precisely? 20? 50? 100? 1000?
2.
Re: (Score:2)
And just how many people is that, precisely? 20? 50? 100? 1000?
I really don't see how that is relevant, do you expect me to quote a scientific study that shows MTTP (mean time to pr0n)? "decent size" was very obviously a generalization.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Most times we give folks the benefit of a doubt the 1st time in case it's some porn ad something on an otherwise "okay" site (gray, but not really a policy violation)
Had that happen to me once, but it wasn't a bad ad but a bad search result. Was looking for how to solve some SQL Server issue clicked on a link that looked like it had relevant info, but nope, porn site. My boss was behind me and saw it and asked what I was doing. I explained to her the problem I was working on showed the search result page with the relevant search result I clicked on and then showed that it went to the porn site instead. Thankfully it was at a small company so there was not a HR battle to
Re: (Score:2)
LOL, and that is why I do all of my porn watching on a FreeBSD VM with a locked down Firefox which doesn't allow scripts or plugins.
No way in hell I trust a bloody porn site to not be infested with malicious shit.
YouDaRealMVP.jpg
You did notice where he worked? (Score:1)
"The EROS Center..." Oh, can irony get any better than this??!!
“G” stands for Geological (Score:5, Funny)
But this dude apparently thought he worked for the United States Gynecological Survey.
Re: “G” stands for Geological (Score:5, Funny)
Re: (Score:2)
I was going to reply with *rimshot* but then realized that might not be the best choice, given the context.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
There are multiple announced vulnerabilities per month that allow this to happen. Mostly in Flash the last few years, but also in image decoders, sound decoders, and web browsers in general.
Software security sucks.
Re: (Score:2)
Re: (Score:2)
Mr Anderson... (Score:1)
So? (Score:2)
It's 2018 and the report suggests a blacklist? (Score:2)
"Investigators recommended that USGS enforce a “strong blacklist policy” of known unauthorized websites and “regularly monitor employee web usage history.”
WHITELIST FFS. Not perfect but infinity better than a blacklist, also know as wack-a-mole.
Re: (Score:2)
WHITELIST FFS.
Or better yet, just turn off their internet complete. But on a more serious note, white-listing the internet is a recipe for disaster. A far better solution is to generate a blacklist and then flag up people who hit one of the blacklisted sites for further surveillance.
Blacklisting allows the internet to still be a usable resource. Whitelisting just pisses off your workers at best or cripples your productivity (depending on the work you do) at worst.
Lax network security. (Score:1)
But, Oh noes! The BOGEY-MAN PORN is to blame. What a crock! How do you know it wasn't from sports sites, shopping sites, joke sites, running your mouth sites? No, it has to be the BOGEY-MAN PORN!
The #MeToo movement is a collective witch-hunt that is not interested in justice for those legitimately wronged (which there are a lot of), they are only interested in using sex as a weapon to seize more and more power for ineffectual, weak, dictator wannabes!
Re: (Score:1)
Says the guy who likes to watch porn at work on his employer's dime.
Re: (Score:2)
Says the guy who likes to watch porn at work on his employer's dime.
Oh, snap . . .
Re: (Score:2)
Were you actually frothing at the mouth when you typed that?
Ad Blockers (Score:2)
Lighten Up (Score:2)
He's helping pay for repairing potholes and clearing snow from streets . . .
Oh the irony! (Score:2)
Of course he was watching porn! He worked at the EROS center!
Should not be possible (Score:2)
Lack of insight on how to lock computers down. (Score:2)
Most government entities don't have a clue on their network infrastructure let alone on locking the computers down. Too many different standards and different ways of their networks are built. Guess how many system admins come and go over the years without an once of documentation. Router passwords changed and no one seems to know them. Since no one bother to enforce industry standards of best practices this is what got them.
Best they could do in the interim is enforce policy rules on the firewall to d
Re: (Score:2)
Wait, What? (Score:2)
OMG, it wasn't a contractor? Seriously, this is typical government workforce in the US.
Re: (Score:2)
Wanna bet it was Windows based?
Re: (Score:2, Insightful)
Wanna bet that since the person is a civil servant, that even after being caught, will still NOT be able to be fired?
Re:Single Rogue Host (Score:5, Insightful)
Wanna bet that he will be? You need a scapegoat after something like that, after all, and he's neither a politician nor a CEO.
Re: (Score:1)
Just because the idiot is a government employee doesn't make him any worse than the millions of employees in corporations and schools who also watch porn. I agree the network should be more locked down, but that assumes one is able to hire higher quality sysadmins, and most likely the gov't can't afford to pay them. (remember, our current fearless leader thinks we ought to reduce the size of our federal government.)
Re: (Score:2)
If he had so much time to surf porn at work, and none of his superiors noticed, clearly they should have all been part of that reduction of government.
Re: Single Rogue Host (Score:2)
Clearly at $3t and with its ability to afford to pay people to watch porn, it needs to be reduced. He was stealing from tax payers.
Re: Single Rogue Host (Score:5, Interesting)
Seriously?
My base perspective is...the idiot is getting paid my MY (and yours) tax dollars, and I"m guessing the job description says nothing about surfing porn on the federal dollar?
Are you telling me that someone that did this very same thing in the private sector wouldn't be canned in a new york minute??
Seriously...are you saying you think it is acceptable to surf porn at work?
Sure, better security, that's a given, but you think this person should not be held directly responsible for doing something that EVERYONE knows they are not supposed to do at work on the clock on work computers.
Hell, government computers come with all kinds of warnings the second you try to log onto them, it isn't like anyone on a federal computer wouldn't know this a forbidden thing to do.....
Re: (Score:2)
Re: (Score:3)
Old IT admin here but also knowledgeable about legal frameworks. You shouldn't be investigating anyone for anything illegal, you don't have the knowledge, legal standing or tools for proper forensic examination. If you did find something, the evidence would be declared botched by any first year attorney and a mistrial would be declared, you may even become liable yourself.
If your employer wants to know if your employee did something illegal, get the right people involved to do the right kind of investigatio
Re: Single Rogue Host (Score:4)
With that in mind, let me say that the duly appointed sysadmin or anyone from the IT staff can look at things without it being considered to "taint" evidence, otherwise we'd never be able to convict the sick (and stupid) people who take their computer into Best Buy for repair while leaving a folder full of child pornography.
What I was taught in school, and instructed to do at several jobs (including one internship at the provincial gov't level) was this: Do your job, which may include examining data a user has stored on their work issued equipment. IF you see anything that you think is illegal or even questionable, tell the boss and call the cops. Do not touch the machine any further. Do not even shut it down. The boss will then see to it that physical access to the device is restricted and the police will show up to handle the disconnection from the network and possible shut down. (did you know the police actually have a device that lets them fake a network connection and keep a desktop machine fully powered while driving it across town? I found the bit where they slipped a probe between plug and outlet to seamlessly transfer power source from wall to battery pack particularly fascinating).
The reason for this policy is three fold:
1) A lot of successful prosecutions, especially for illegal porn, rely on happen-stance. A tech stumbling over something, a creep forgets to log out and his wife finds it, whatever. As long as the discoverer can swear in court that they just stumbled across it and did nothing that would alter the data, then the data is still admissible.
2) The police just do NOT have the manpower to handle every "we fired John for surfing porn at work, can you come and check his machine to see if he did anything illegal as well?
3) The report of the discoverer is often the basis for probable cause and issuance of a warrant. If I didn't tell the police I saw something off, they would have no legal basis from which to proceed with an investigation.
One last thought: Even if a guy does surf or create child porn on the work issued equipment, while sufficient for conviction, it may not always be the sole source of such evidence. Any one making illegal porn on a work machine probably has more of it on his personal machine back home as well. (pedos are also notorious for amassing large collections) Thus, even if the evidence I uncover is not enough to convict on its own, it's still enough to justify warrants and investigation to collect more, better quality evidence.
Re: (Score:2)
Yes, I agree, you can "stumble across" something but you can't go out and hunt for evidence. If your company is truly worried but has no sufficient proof, get a professional third party forensic investigator (and an attorney to give you advice). Otherwise it's just a suspicion/allegation/gut feeling but in many cases you can't just go out and look for something you suspect.
I had something similar fairly recently (allegations of sexual harassment with HR-goons subsequently botching the thing) and the CIO sim
Re: (Score:2)
My base perspective is...the idiot is getting paid my MY (and yours) tax dollars, and I"m guessing the job description says nothing about surfing porn on the federal dollar?
.
Maybe he was working on a government study of Pr0N use when monkeys are given a computer. It could happen, I have seen governments study stupider stuff.
Re: (Score:2)
Nope.
And even if I were...it isn't pr0n.
And, work policies allow for some personal web time during the work day, as long as it isn't against company policies such as viewing pr0n, etc.
Most workplaces allow some person computer time, but I don't know of any that allow pr0n surfing on the clock on work equipment...save maybe at FB searching for bad content to remove.
Re: (Score:1)
but I don't know of any that allow pr0n surfing on the clock on work equipment...
My old boss just told me to - Put it on the server and send me a link.
Re: (Score:3)
Wanna bet they used IE 6 on XP to support some gawd-awful "legacy system" built by a low bidder back in the 90's?
Re: (Score:2)
This is, sadly, all too common.
Re: (Score:2)
If it ain't broke don't fix it, but broke is highly subjective. It might happen slowly, but at some point the reliance on outdated, unsupported, insecure tech crosses the threshold into broke territory, and your frog gets boiled.
Re: (Score:1)
Well we know his infected phone was Linux based, what's your point?
Re: (Score:2)
For this to occur, there couldn't have been a firewall with content filtering, anti-virus, or likely even a patch management policy.
For gross network security management negligence like this, any operating system would likely have been compromised.
Re: (Score:2)
Re: (Score:2)
The Android seems to have been a carrier of the data. Not how the Windows host got infected, as far as I know there isn't any malware that infects both Android and Windows
Re: (Score:2)
Presumably he got an Android virus doing stupid shit on his Android phone, and got a Windows virus because he was doing stupid shit on his desktop.
Re: Single Rogue Host (Score:1)
This is why you don't make all government computers openly connect to one another, or else some jerk-off (being literal here) infects your military/etc through some gardening branch of government.
Re: (Score:2)
Securing hosts from other, rogue hosts doesn't do much to protect them if the attack vector is a rogue user.
This is a data management agency and if you compromise the right user's devices those devices can be used to launch attacks on many hosts.
Re: (Score:2)
In my experience (with more than a decade in IT security), the weakest link is that CEO secretary that curiously needs to bypass the corporate content filter and also needs for some godawful reason admin access on her PC, despite the fact that she can't turn on the machine without causing a security incident.
Re: (Score:2)
or other non job web use.
Like, oh, say, Slashdot?
Re: (Score:2)
A reasonable amount of non-work at work makes the employees more content, and content workers is usually a plus.
It should of course be reasonable, but if you expect people to work like slaves for hours straight with no amount of non-work activity interspersed, expect malcontents and burn-outs.
Fifteen minutes of shopping or news reading or something a couple of times a day might be acceptable. Hours on end, not so much.
Re: (Score:2)
Many security experts say the weakest link is the employee who does stupid things. But let's also consider the amount of wasted time as well. If its not porn, its shopping, social sites, or other non job web use
Two points to that.
One, shopping sites (at least such as Amazon and the like) in my experience actually have far more benefits than not to allow.
I commonly see and hear of people doing their grocery shopping on their 3pm break to line up with 2 hour prime delivery for when they get home.
Those who have managers that disallow it have a *far* higher rate of requests to leave a full hour early to do the same shopping physically.
That's the difference between a quarter sized chunk of time the employee is legally
Re: (Score:2)
So now slashdot has brought it to the front to publicly shame the individual?
You must be new here...
Re: (Score:2)
So now slashdot has brought it to the front to publicly shame the individual?
Trial by media... shame on you slashdot.
Welcome to the Internet. Have a good time!