Chinese Hackers Pursue Key Data on U.S. Workers

http://www.nytimes.com/2014/07/10/world/asia/chinese-hackers-pursue-key-data-on-us-workers.html&assetType=nyt_now&_r=0

by aeonflux • 12 years ago

52 38 12 years ago

nytimes.com

dm25• 12 years ago

Whose responsibility is it to prevent this?

USCYBERCOM? http://en.wikipedia.org/wiki/United_States_Cyber_Command

The NSA should also play a role in defending the US from attacks via the internet.

The hackers must have used a US based VPN, because it would be retarded to allow connections directly from China to access any US DoD systems, right?

Someone12345• 12 years ago

The department itself is responsible for preventing this.

Cyber Command shouldn't be operating on US soil (or constitutional reasons), at least outside of "training exercises" and securing inter-DoD systems (of which the federal government is not). The NSA can help other departmental and non-departmental organisations secure their system either through consulting or potentially even pen testing (that's legal and part of their remit).

The FBI has also taken an on-again/off-again role in trying to secure inter-US systems but they don't really have the budget or remit to be doing that fully.

The hackers must have used a US based VPN, because it would be retarded to allow connections directly from China to access any US DoD systems, right?

As you yourself eluded to, blocking connections based on GeoIP is utterly utterly pointless. The internet is designed such that you can route around those types of blocks fairly trivially (e.g. proxies, VPNs, foreign servers, private interconnect agreements, et al).

dragonwriter2• 12 years ago

Cyber Command shouldn't be operating on US soil (or constitutional reasons)

Could you elaborate the specific constitutional bar to Cyber Command operating on US soil?

dm25• 12 years ago

Is it reasonable to expect every department, organization, and agency to have flawless security?

Not necessarily blocking based on IPs, but requiring VPNs to access these networks, which would be a requirement for another level of authentication and another point of monitoring who accesses the systems.

jdong• 12 years ago

USCYBERCOM is only responsible for .mil networks. DHS is in charge of the security of .gov networks.

r00fus• 12 years ago

Well great. Does DHS have the appropriate competency to handle this kind of stuff?

sampsonjs3• 12 years ago

The most uncomfortable thing on an SF-86 would probably be your past convictions, but it's unlikely you would get a TS in that case. After that, maybe the names of family members. It also would have your current address and foreign investments, but nothing extremely personal.

walshemj3• 12 years ago

It also has a huge ammount of personal information that would be a gold mine for identity theft.

Let alone the security issues.

sampsonjs3• 12 years ago

Right, that just occurred to me.

sampsonjs3• 12 years ago

Worst possibility is folks email are now targets, and there's enough info to get past password reset questions.

walshemj3• 12 years ago

No the worst possibility is an undercover Officer gets blown and ends up staring in the latest Al Quaida "happy decapitation videos" series

lawnchair_larry3• 12 years ago

It's both a target list, and a list of people who would be useful to impersonate in spear phishing attacks.

People open attachments and click URLs when they appear to come from TS cleared people.

knowaveragejoe• 12 years ago

From the comments:

Not to sound like Chicken Little, but just looking at the information on my e-Qip form, there's a lot more in the database than the NYT reports. For starters, I'm not, nor have I ever been a federal employee. So, the scope is actually anyone who has, or has applied for a clearance. That means contractors too. The header of each of the 37 pages on my form has my Social Security Number. In the document you will find the SSN's for my ex-wife, son, and current girlfriend. Other tidbits include the Naturalization numbers for my mother, ex-wife, and girlfriend. Full names, and contact information for people who've known me at the places I've lived for the past ten years. Same for employers. Living in the DC Metro area, many of my references, both personal and professional, have clearances, so they each have the same form in the database. The only financial information asked for in the version I have had to do with accounts that were past due or in arrears, so the typical bank account, credit card, mortgate, and car loan stuff isn't in the form.

vonmoltke3• 12 years ago

The SF-86 is a gold mine as a starting point for exploitation. It does not provide much useful blackmail material in itself, but all the contacts and life history information are very valuable for focusing further efforts if a person is chosen for exploitation. It also provides clues, particularly when combined with other open source material, as to who may have shit lying around that could be exploited. Remember, one purpose of this form is to allow OPM to do exactly the same thing, but from a defensive standpoint.

mturmon2• 12 years ago

You are soft-pedaling this. There is much, much more on the SF-86 (http://www.opm.gov/forms/pdf_fill/sf86.pdf)

They have extensive sections on psychological health (e.g., have you seen anyone for a mental health issue in the last 7 years, if so who, and their contact information). There are extensive sections on criminal history and past employment, including reason for leaving, especially if it was Federal employment.

There are also sections on past friends, past addresses, and spouses and ex-spouses, and foreign contacts.

Furthermore, it's not just convictions, you also have to report being charged with any felony offense, even if not convicted. Also, drug and alcohol related history, and gambling. And repossessions, liens, etc.

The SF-85 is a less intrusive version of the SF-86. I think a typical contractor working on open projects would use a SF-85. But note, when you sign the SF-85, you allow the government to collect additional information from various sources (but not medical information). This compiled information would presumably be stored on the systems that were targeted in this hack.

I know people who resigned from their job rather than fill out the SF-85. Part of their reason was that something like this might happen.

vonmoltke3• 12 years ago

But in this case there was no announcement about the attack. “The administration has never advocated that all intrusions be made public,” said Caitlin Hayden, a spokeswoman for the Obama administration. “We have advocated that businesses that have suffered an intrusion notify customers if the intruder had access to consumers’ personal information. We have also advocated that companies and agencies voluntarily share information about intrusions.”

That's rich. I'm a Facility Security Officer and this article is the first I have heard of this breach.

Also, as indicated by an article comment someone else posted here, e-QIP is used for all clearance investigations handled by OPM, regardless of who the candidate works for. They cover DOD, DOE, DHS, and other base-level security clearances. The complete records are supposed to be destroyed once the clearance is adjudicated, so it should only affect personnel who are in the process of an initial or periodic investigation.

For reference, here is what the SF-86 is: http://www.opm.gov/forms/pdf_fill/sf86.pdf

danielweber• 12 years ago

this article is the first I have heard of this breach.

FWIW, the article is 8 days old. Did you find out through this article before, or did you just find out from this article being posted to HN today?

vonmoltke3• 12 years ago

A brief NPR report on the subject last week was the absolute first I heard, but this article is the first detail. The NPR story didn't say what the hackers had tried to get, just that they breached OPM and tried to get a list of government employees in sensitive positions. This article I did not see until it was posted here

Edit: clarifications

JPKab2• 12 years ago

Most FSOs I've met and worked with don't at all keep up with anything relevant to their jobs. Its known to be a complete dead-end job in the Federal Gov't, with exception of people employed at Defense Contractors who have the role of FSO on top of another role. For those folks, its just a task of assisting with clearances and the like on top of their normal duties.

JPKab2• 12 years ago

I'm assuming that you deviate from this, but the reputation for FSO's in the Federal government is do-nothings who answer to nobody.

The security clearance process is a joke. Everything about DoD IT security is a joke. Polygraphing people and pretending its scientific is a joke. It's all just a bullshit machine to ensure left of center people are excluded from the Department of Defense and other agencies.

I'm done in 2 weeks. Can't wait to leave every FSO and Information Assurance manager behind me. A bunch of do-nothing paper pushers who conduct the security theater and hamstring decent software with paperwork while approving anything with Oracle or Microsoft written on it.

mcguire• 12 years ago

This is indeed a big deal. I believe e-Qip is used for HSPD-12 processing, so you would be looking at information for almost everyone who was directly or indirectly employed by the federal government. And their references, relatives, and so forth. It's not just security clearances; I got to use it last year applying for a public trust clearance.

Also, OPM is essentially the human resources department for the federal government, overseeing a bunch of stuff including currently running usajobs.gov.

acdha• 12 years ago

Definitely not just sensitive jobs – I first encountered it as a contractor working for NASA (where I set foot in a government building no more than twice a year).

That's a LOT more people, many of whom have probably gone on to work in other interesting places.

mturmon2• 12 years ago

You are 100% correct. It's a very big net.

flyrain• 12 years ago

How do you know these are Chinese Hackers?

Someone12345• 12 years ago

The US just claims every "cyber attack" is the work of Chinese hackers. It is very politically useful both for the continued demonification of what they see as a large adversary but also because it makes the US government appear less incompetent (as they often play up the "elite Chinese hacker" architype).

watwut• 12 years ago

That was my impression too.

lawnchair_larry3• 12 years ago

They usually come from Chinese IP addresses and leave Chinese comments in scripts, Chinese symbols in binaries, and so on.

In many cases, the systems used in the attack also correlate to actual individuals through other means, such as the attacker logging in to their personal email account and doing daily activities, not being aware that they have been "hacked back" so to speak.

There is probably some percentage of attacks falsely attributed to China, but it's usually obvious, and no one else has much incentive to go to great lengths to impersonate them.

Russians don't care enough to train their operatives to learn Chinese and impersonate them in an attack for example, they'll just hack the US in Russian.

Chinese Hackers Pursue Key Data on U.S. Workers

Related Stories