The OPM Data Breach [pdf]

https://oversight.house.gov/wp-content/uploads/2016/09/The-OPM-Data-Breach-How-the-Government-Jeopardized-Our-National-Security-for-More-than-a-Generation.pdf

by daveloyall • 10 years ago

162 114 10 years ago

oversight.house.gov

loteck4• 10 years ago

"Additionally, fingerprint data of 5.6 million of these individuals was stolen."

They'll need to change their fingerprints immediately!

dredmorbius2• 10 years ago

I'd like to see YYYY-04-01 RFC on biometrics authenticator expiration protocols.

bigiain2• 10 years ago

"As an alternative, users may keep all their fingers in a fingerprint safe and secure them all with a single retina scan, which they can use to open the safe each time they need to use a finger."

maerF0x0• 10 years ago

Thats why fingerprint is username, not password

idlewords• 10 years ago

Password is thumbprint.

bigiain2• 10 years ago

In keeping with industry best practice, I require staff to sandpaper off their fingerprints and regrow them every 90 days.

For "security".

redwards5103• 10 years ago

A bit extreme isn't that? I just have my staff paint their fingerprints with women's ruby red fingernail paint. It dries to a smooth glass-like finish.

For "security"

streptomycin• 10 years ago

The letter they sent me claimed that there is currently no way to create fake fingerprints, so there's nothing to be worried about, 2 years of identity theft monitoring is good enough.

loteck4• 10 years ago

I'm sure you're very comforted by that addition of the qualifier "currently."

Correlated letter from 2011: "Dear streptomycin, your fingerprint data is currently not stolen!"

biafra3• 10 years ago

In what world are they living, where there is "no way to create fake fingerprints"? Of course that is possible. Here is one example: http://dasalte.ccc.de/biometrie/fingerabdruck_kopieren.en

It is easily possible to create fake fingerprints that can fool any known finger print scanner. If you know one, that supposedly can't be tricked, please let me know.

mtgx2• 10 years ago

They lied to you. But what else is new.

UlyssesSKrunk• 10 years ago

That was a blatant lie tho.

jandrese• 10 years ago

I wasn't sure if they were lying or merely incompetent when they said that. Mythbusters has an episode of them defeating fingerprint locks using a print lifted from a glass, and the technique they used was anything but sophisticated.

johnhess3• 10 years ago

sure would be nice to have something better than a raster image of pages 2-231

metaphor• 10 years ago

Agreed, although rasterizing was likely the simplest way to ensure that redacted information can't be (somehow) reconstructed.

jlgaddis• 10 years ago

I've only read up through the executive summary thus far but this looks like it's going to be a fascinating read.

tptacek8• 10 years ago

This isn't the "official postmortem". It's the official report of the GOP-led House Oversight and Government Reform Committee. It's a partisan political document.

A better title:

Republican House Oversight Report On OPM Data Breach.

loteck4• 10 years ago

Let's be fair: while the source may well be partisan, it is also a technical document. Referring to it simply as a partisan political document doesn't acknowledge its full contents or its value to a technical community.

tptacek8• 10 years ago

It is not a technical document. It is a document that contains technical details. For instance: it contains a formal set of "findings", as in the "findings" of law and fact in a trial. Here's one of the first findings:

FINDING: Slow implementation of critical security requirements such as dual factor authentication is a true case of misplaced priorities.

That's not technical language. It's not even formal language.

OPM was/is a clusterfuck. I'm not disputing that. But the authors of this document had a job to do: portray administration appointees in the worst light possible.

web007• 10 years ago

Perhaps https://www.opm.gov/cybersecurity/cybersecurity-incidents/op... is more informative technically, but this "post-mortem" is a fascinating read for me. It's like The Cuckoo's Egg for modern times, as writ by government subcommittee.

caf• 10 years ago

In some places its typical for such legislative committees to also issue minority/dissenting reports - does that happen in the US?

tptacek8• 10 years ago

They can issue statements, as the ranking Democrat did here, contesting the findings of the report:

http://democrats.oversight.house.gov/news/press-releases/cum...

jessaustin3• 10 years ago

Yes the minority members of a committee can issue their own reports, e.g. [0]. It probably won't happen in this case because the "other" party just wants this issue to go away. Arguing in public would only draw attention.

[0] http://democrats-benghazi.house.gov/sites/democrats.benghazi...

marmot7773• 10 years ago

It's a political document in other words based on limited information and perspective?

rdtsc6• 10 years ago

If only we had an agency in charge of protecting and securing these kinds of systems.

It seems NSA has spent all its budget on cool hacking tools and programs, exploiting hard drive firmware and routers and other crap. Yet the all SF-86 forms (except CIA's +) got stolen right under our noses. But again, nobody is going to feel cool defending and securing stuff, everyone wants to be on red team.

Stolen stuff includes millions of fingerprints. Those are obviously not hashed, so that's just the raw data I imagine. They'll learn lesson to not rely on fingerprints as much. Maybe that's one good thing coming out of it.

[+] CIA could still be affected, if for example some people there started at other agencies, or in the military (CIA likes to hire ex-Marines for example).

BoringCode7• 10 years ago

One of NSA's primary missions is information assurance. I'm sure they have blue teams. But their mandate is pretty limited in regards to what they can do with civilian infrastructure.

rdtsc6• 10 years ago

Technically DHS should do it. I don't see DHS having the expertise and brainpower for it.

linkregister4• 10 years ago

It seems NSA has spent all its budget on cool hacking tools and programs

From the report: On March 20, 2014, US-CERT notified OPM that a third party had reported data exfiltration from the OPM's network.

I think it's likely it was NSA that made the notification. Maybe not. Either way, what further could NSA have done about it? The NSA can't make another federal agency improve its computer security. At best it can perform audits: which it appears to have done; OPM had the lowest security posture of any agency.

Should the NSA have prevented the exfiltration? How would that work? Do you want the NSA to have the authority to cut network connections occurring in the U.S. internet? Should the NSA have authority over civilian government agencies? What about hacking and wiping the intruders' endpoints? Sounds like an act of war to me, if those endpoints are on Chinese soil.

I doubt the vast majority of HN'ers want an increase in NSA's authority or scope.

rdtsc6• 10 years ago

The NSA can't make another federal agency improve its computer security.

Maybe it should have the power to intervene and stop it? This is still the federal government (it is not about walking into Facebook and shutting it down). I think it is the only agency with the brainpower to do it. It should be been trying to hack it and test the system periodically to identify flaws in it. Then mandate changes.

Do you want the NSA to have the authority to cut network connections occurring in the U.S. internet?

To the federal agencies. Cyber defence doesn't work with current bloated beaurocracy. Nobody seems to be in charge.

I doubt the vast majority of HN'ers want an increase in NSA's authority or scope.

I don't know. I would rather them spend more time defending, wouldn't mind expanding their power and diverting more budget towards that.

atdt3• 10 years ago

The NSA can't make another federal agency improve its computer security.

Maybe not directly. But the NSA could play a much more positive role in information security generally by moving out of the shadows and making more of its research public. The expertise that the NSA has acquired in securing information needs to be widely disseminated to work its way into engineering curricula and praxis, and that won't happen as long as the NSA communicates by whispering.

missed_out• 10 years ago

After 28 years of DoD service, civilian engineer, I just called it quits. I got tired of the retaliation for turning in security violations. The last one: sharing of passwords on a secured network. One violator's response: Where is it written we cannot share passwords? Why the retaliation? It portrays a bad image. Nice!

rewrew• 10 years ago

This kind of stupidity is why I think I can never take a gov't job. I don't think I'd last a week. Sorry you had to put up with it.

kardashian007• 10 years ago

Sucks. Consider writing a book / get in touch with theintercept on a new machine from public wifi. https://theintercept.com/securedrop/

FWIW: Someone I know whom worked for DIA as a sysadmin about 10-15 years ago recalled multiple instances of TS/SCI folks being fired for surfing for porn over monitored networks... career- & clearance-ending. Maybe that's the only culturally-unacceptable sin in that community, apart from making the org/folks look bad?

jrnichols3• 10 years ago

Sounds like one of those situations where you're damned if you do and damned if you don't. Even the most eloquent bitchslap directed at such users, even if you disguise it as user education, can still cause strife. :/

wrs• 10 years ago

Seriously? I don't think I've ever seen a security policy where it was not written that you cannot share passwords!

throwawayReply• 10 years ago

241 pages and not one mention of NIST or FIPS.

noahkunin• 10 years ago

There's actual several mentions of NIST, ATOs, and FISMA, all of which implicitly cover FIPS by reference.

#acronymheatdeath

unimpressive• 10 years ago

It seems NSA has spent all its budget on cool hacking tools and programs, exploiting hard drive firmware and routers and other crap. Yet the all SF-86 forms (except CIA's +) got stolen right under our noses. But again, nobody is going to feel cool defending and securing stuff, everyone wants to be on red team.

Damn right. This is one of the aspects of the Snowden leaks that was underplayed. The NSA seems to think that the best defense is a good offense, and maybe they have good reasons for that but from the outside it seems like they're just overly affected with wanting to feel 'l33t'.

https://medium.com/@bruces/the-ecuadorian-library-a1ebd2b4a0...

superuser22• 10 years ago

Exactly this. The US government thinks about computer security as a kind of war - cyberwar - and for better or for worse it has adapted the mindset that "security by demonstrated capability to drop scary bombs with brutal precision and efficiency" is more realistic than "security by making every building bomb proof."

Geopolitics these days isn't about impenetrable borders, it's about deterrence by ability to project force. They are looking at IT security the same way.

Kalium3• 10 years ago

As other people touch on, a good offense is something the NSA can actually do themselves. They don't have the authority to be a good defense. They had - and have - no ability to compel OPM to get their shit together.

In terms of defense, they've got a severe case of Congress-induces toothlessness.

batbomb• 10 years ago

NIST sets the standards (FIPS).

Most programs for security guidelines seem to be descendants and ongoing implementations of HSPD-12.

I believe the Office of the Inspector General would be in charge of auditing in some cases, but it's usually up to each individual agency.

kevin_thibedeau2• 10 years ago

Yet the all SF-86 forms

Not quite all of them. OPM doesn't seem to keep track of any paper SF-86s that were phased out in favor of the first web site iteration around 2001. Those earlier records may be safe. The image PDF isn't searchable so I couldn't confirm this.

rdtsc6• 10 years ago

Yap, 2000 or sounds about right.

jonnybgood• 10 years ago

Correct me if I'm wrong, but I thought NSA is only in charge of protecting classified systems. OPM data wasn't in a classified system.

treebeard901• 10 years ago

At least you can change your password. Good luck getting new fingerprints.

Godel_unicode4• 10 years ago

If only we had an agency in charge of protecting and securing these kinds of systems.

Firstly, why do you insist in letting OPM off the hook?

Secondly, even if we stipulate that OPM isn't at fault and that someone should have stopped this, you should read about roles and responsibilities in the government before blindly blaming NSA. Start here. https://www.us-cert.gov/about-us

rdtsc6• 10 years ago

why do you insist in letting OPM off the hook?

I am not. It failed massively. Letting it do what it kept doing before is not going to work. We have hard evidence of its failure. There is no point mentioning it, it is obvious.

, you should read about roles and responsibilities in the government before blindly blaming NSA. Start here. https://www.us-cert.gov/about-us

So where was US-CERT all this time? It was active since 2003. It had more than a decade to ramp up and get up to speed.

Why where all the electronic SF-86 forms stolen? You'd think out of all the places, they would protect, that would be close to the top.

before blindly blaming NSA

Because they are probably the only ones that have the smarts to do it? Also isn't that their mission as well. https://www.nsa.gov/what-we-do/ . Second line is "Defends vital networks". OPM files with detailed and personal details on millions of current and past government workers who have clearance is pretty vital one would think.

linkregister4• 10 years ago

The Exfiltration of the Security Clearance Files Could Have Been Prevented.

TL;DR, there were two intrusion actors that were acting in concert. After being notified by US-CERT of exfiltration activity from the OPM network, OPM monitored the first one, who conducted the initial breach (use of contractor login credentials) and then performed survey of their network. They attempted to flush out her malware but failed to account for a second actor that had managed to leave an alternate access point into the network.

"Notably, OPM Director of IT Security Operations, Jeff Wagner, recommended deploying ... preventative technology"

So the problem was identified and brought up to committee and still ignored/tabled by the CIO, Donna Seymour. Preventive measures were only undertaken after the exfiltration of security clearance data was complete.

jrnichols3• 10 years ago

" and still ignored/tabled by the CIO, Donna Seymour. "

Does she still have that job? If so.. ugh.

kombucha2• 10 years ago

She retired [1]

[1] https://oversight.house.gov/release/chaffetz-responds-to-ret...

johnhess3• 10 years ago

Interesting to see the steps they took to expel the APT (physically verifying the identity of account holders on account resets, taking services offline, resetting networking equipment).

Even more interesting is that had confidence they'd actually expelled the APT. Of course, they hadn't totally eliminated a related APT already in place.

This wasn't a "provision a clean box and run a build" reset... it's a massive, heterogeneous system. I can't even imagine how many vectors a nation-state APT could use to maintain a foothold.

danso• 10 years ago

For folks that want an OCRed version (using ABBYY) for easier Ctrl-F'ing:

http://data.danwin.com/pdfs/house-oversight-opm-breach-2016-...

(not sure why ABBYY blew its size up to 98MB...)

And here it is in plaintext via pdftotext:

http://data.danwin.com/pdfs/house-oversight-opm-breach-2016-...

johnhess3• 10 years ago

tl; dr.

Two distinct attacks, likely related, possibly coordinated took place. The first was observed in March 2014 and thought to be expelled in late May 2014.

Before that expulsion, a second attack began. While OPM thought it was in the clear, the 21.5M records were exfiltrated in July 2014. As late as August 2015, that same attack vector was used to steal fingerprint information as well.

thanatropism2• 10 years ago

Interestingly enough, I haven't either seen either an emphasis on the main responsible directors being women; or claims that the agency was a "glass cliff".

zaphar• 10 years ago

What on earth would either of those have to do with this?

jrnichols3• 10 years ago

I think that was a thinly veiled attempt at saying they were "diverse-hires" (a promotion or hire based on gender politics) instead of having a qualified individual in the position.

I'm unaware of the qualifications of either director, so who knows.

Godel_unicode4• 10 years ago

Incompetence knows no gender.

forrestbrazeal2• 10 years ago

One of the most frustrating things about this whole fiasco is that the OPM breach finally became public in the summer of 2015, but I and many other victims weren't officially notified (or offered our measly couple years of identity protection) until December or later. At the time, I shared some of my thoughts on the breach here (some of the info may be out of date in light of the new report; I was piecing stuff together as best as I could): https://forrestbrazeal.com/2015/12/08/welp-i-was-an-opm-hack...

I was also annoyed that so much of the political posturing around the breach centered on OPM systems' lack of encryption. I haven't read all of this report, but it's nice to see the summary focusing on the lack of 2FA, a security practice that would actually have helped stop an internal infiltrator.

gk1• 10 years ago

I still never received any notice about it. Was employed by DoD in late 00's, so am fairly certain my info was in the batch.

brainfire2• 10 years ago

I believe Defense had their own, parallel system, so it may not be a given that you're in the leak.

forrestbrazeal2• 10 years ago

My understanding is that if you submitted an SF-86 form in the last 10 to 15 years, you were affected.

daveloyall• 10 years ago

You'd remember filling out an SF-86. But yes, I was definitely in the breach, yet I have not been notified.

redwards5103• 10 years ago

I just got my postcard informing me I was affected last month. I tossed the offer of credit protection because I'm already stacking multiple "we're sorry" credit protections from other breaches.

The thing that burns me though, is that the credit protection is for a limited time. The severity of this breach and they can't give us a lifetime of protection?!?

biafra3• 10 years ago

What is "credit protection"?

Gelob• 10 years ago

You should take it. The opm breach offers the best credit and identity theft monitoring you can get. You can actually input your emails and other information and they will notify you when it's found in online dumps, etc. They also tell you the source of the dump.

ashurov• 10 years ago

as a foreign citizen, previously living and working for the DoT through a contractor, i was never notified as well. pretty sure my data got leaked as well.

j1tt3r• 10 years ago

OPM's e-QIP site was vulnerable to heartbleed for at least a week after public disclosure (2014).

They still claim that they were never exploited. The arrest records, addresses, and other sensitive info I was able to view say otherwise.

I expected the EINSTEIN program would have helped to quickly defend against heartbleed after disclosure, but apparently not. US Gov just sucks at cybersecurity defense.

ParadisoShlee• 10 years ago

Is there a version of that document that is searchable?! OCR or something :(

marmot7773• 10 years ago

Is the headline of the report truth or hyperbole?

"The OPM Data Breach: How the Government Jeopardized Our National Security for More than a Generation"

The OPM Data Breach [pdf]

Related Stories