Pentagon Hit by Unprecedented Cyber Attack

FoxNews ^ | 11/20/08

[Sammy67]

Thursday, November 20, 2008 The Pentagon has suffered from a cyber attack so alarming that it has taken the unprecedented step of banning the use of external hardware devices, such as flash drives and DVD's, FOX News has learned.

The attack came in the form of a global virus or worm that is spreading rapidly throughout a number of military networks.

[stevie_d_64]

Ohhhhh, I can see the big MacAttack coming down the road with lights and sirens on...

;-)

[FroggyTheGremlim]

I would recommend eComStation

www.ecomstation.com

[nw_arizona_granny]

Ping.

[FroggyTheGremlim]

The *real* problem is homogeneity of OSes. The *only* answer is heterogeneity.

Some Windows, some Macs, some Linux, some OS/2 ...

Throughout history monocultures have come crashing down with crushing consequences. Yet we never seem to learn.

[indthkr]

bump...

[southlake_hoosier]

Seems to me like it would be pretty simple to block a group of IP addresses to stop an attack. Unless someone brought something inside, then it might be more difficult to isolate, but not impossible to stop.

[Salo]

Once the system is compromised and your internal servers become the attack vector, you’re screwed.

[antiRepublicrat]

Isn't enough money in the universe, much less the defense budget, for that.

Integrity-178B from Green Hills Software is the only EAL6+ certified operating system. But it's not suited to desktop or server use, more real-time embedded. Aside from that, the highest OS-related thing I know of in use is IBM's z partitioning system for mainframes (LPAR isolation), at EAL5.

At last estimate it would cost $10 billion to rewrite Linux. Count at least a decade and ten times the money to make a modern EAL7 desktop/server OS kernel since every single element of it must be formally designed and verified using mathematical models and proofs. I'm not even sure it can be done for a whole OS. The guy who can pull it off is a god among OS designers. I only know of one piece of software that has achieved EAL7, and it's a specialized network program.

[antiRepublicrat]

How about a 17 year old kid from Lithuania?

Possible. Not only is China a great source of attacks, it's also a great source of open proxies for others around the world to use for attacks.

[antiRepublicrat]

I remember in the late 90's the .mil net was getting beaten up pretty badly by a certain kind of virus

ILOVEYOU, a.k.a., VBS/Loveletter, a.k.a., Love Bug.

[antiRepublicrat]

I was reading a report on a Linux site that told of how at a recent security conference, the Mac was the first OS to be taken over using "known vulnerabilities" in browsers.

It was first because they worked for weeks in advance to find and exploit a bug and first publicly used it at the conference. The bug was there, but the relative time to hack was meaningless.

[antiRepublicrat]

Let’s see.....who could have done this? Does it start with a c and end with an a?

We're being attacked by Canada?

[Swordmaker]

I was reading a report on a Linux site that told of how at a recent security conference, the Mac was the first OS to be taken over using "known vulnerabilities" in browsers. The PC was second, and Linux wasn't taken over at all during the 3 days, but the report stressed that ALL OS are vulnerable to attacks targeting browsers.

The conference you are referring to was CANSEC WEST (Canadian Security Conference West) and the Mac was indeed taken over first... and it took only two minutes to accomplish. However, the security consultant who did it, Charles Miller, is an ex-NSA computer expert whose team of himself and two other ex-NSA computer experts worked THREE WEEKS to find the security vulnerability and construct a means of exploiting it.

They did NOT use a "known vulnerability" (except that it was known to them because they had discovered it in the preceding three weeks) in OS X, but rather a vulnerability in JAVA. Miller stated that his exploit would have worked on any of the three OSes in the challenge as well. He just wanted the MacBook Air, which was the prize if he compromised it.

None of the three machines failed during the first day when the attack had to work via an external attack. The winning exploit only worked after the first day of the contest when the rules were relaxed and user participation was allowed. The exploit worked because the referees were required to navigate to a prepared site and click on a link or download a file and install it.

Incidentally, the team that broached the Windows Vista machine did it in under six hours with no prior preparation...

[Swordmaker]

We're being attacked by Canada?

Nope... California.

[rjp2005]

From Seven Steps to a Caliphate:

“The Fourth Phase. Between 2010 and 2013, Hussein writes that al-Qaida will aim to bring about the collapse of the hated Arabic governments. The estimate is that “the creeping loss of the regimes’ power will lead to a steady growth in strength within al-Qaida.” At the same time attacks will be carried out against oil suppliers and the US economy will be targeted using cyber terrorism.

[Palladin]

How does it present itself? Black screen or what?

My screen has been fading in and out since yesterday.

But maybe that’s another problem.

I run McAfee every day, but I guess some worms and viruses still get through.

[cmurphy]

They'd be better off banning the use of Windows.

That is a very profound statement, and true statement. DoD already has moved toward Apple servers. They should adopt Mac desktops and laptops also. Our troops deserve the best.

Any system can be hacked!!! Not just Windows. If they want a more difficult system to hack, then they need something that is proprietary to the DoD. Apple is JUST as hackable, it's just not as popular so you have less main stream viruses hitting those systems, as is Linux and other Unix based systems.

[El Gato]

As for thumb drives and other externals, many offices purchase them for their senior mgmt as a way for them to work at home w/o having to take the laptop home. Much more can be lost if a laptop is misplaced or stolen.

Not only that, but they must interface with contractors and others, even within DoD, who prefer to send copies of presentations and such on thumb drives, rather than going to the trouble of burning CD-ROMS. But of course a worm or Trojan could ride back to the DoD internal net on a CD/DVD ROM just as easily as on a flash drive.

[El Gato]

My fear is that we are woefully unprepared for Chinese cyber attacks

These guys are likely on them like white on rice.

[antiRepublicrat]

Any system can be hacked!!!

True.

Apple is JUST as hackable

False. A bump-proof, pick- and drill-resistant, boron alloy steel MUL-T-LOCK is less "hackable" than a Wal-Mart Master Lock. They're both padlocks, and both can conceivably be compromised, but one is just designed and built better to make it harder to compromise. That there are far fewer of them on the market is irrelevant.