Cyber attack on German parliament still active, could cost millions

http://ca.reuters.com/article/technologyNews/idCAKBN0OQ2GA20150610

by draugadrotten • 11 years ago

26 44 11 years ago

ca.reuters.com

wiz21c• 11 years ago

1/ Replace with Linux 2/ Understand that security is not easy 3/ Conclude that given 1/ you can work on 2/

v4n4d1s• 11 years ago

All servers are already on linux since about 10 years. https://de.wikipedia.org/wiki/Open-Source-Software_in_%C3%B6... [german]

Rockslide• 11 years ago

4) Understand that every IT system is vulnerable as long as people are involved

boroboro8• 11 years ago

Some years ago there was some press about how many German politicians were complaining about the state phones and would bring in and use their own shiny phones, probably this goes for laptops too. I assume this was against the wishes of IT security. Then boom, and the politicians are complaining again.

mauricemir3• 11 years ago

All it takes for a "friend" to donate some new shiny to a MP who then plugs it and its game over.

TazeTSchnitzel• 11 years ago

If the attack is ongoing, why not unplug the Ethernet cable?

iMerNibor• 11 years ago

Oh no that's not possible. Think of all the politicans who couldn't do work.. That's unacceptable!

mauricemir3• 11 years ago

Well they would have to go back to paper and maybe even voting physically rather than pushing a button remotely.

tacone• 11 years ago

Hello, fellow German office here.

We don't know what ethernet is, we thus started unplugging everything we could: pension funds, welfare spending, army spending. We even unplugged portugal, spain and greece, but nothing worked.

Please help.

totallynotcool2• 11 years ago

Merkel takes her tweets seriously.

boroboro8• 11 years ago

1. People want to work, and I assume the 'productivity' of politicians (meaning "we don't want security") brought this in the first place. 2. If sophisticated, the outflow of information might be with a mobile device plugged in, or other means to jump the air gap when ethernet is disconnected.

matt4077• 11 years ago

This is an attack on the Parliament, not the executive. Only very few parliamentarians actually work with sensitive data.

fwn11• 11 years ago

For this "we are being attacked" reason, they want to get the parlamentarians to let secret services manipulate their laptops / phones. It's a classic.

As if the local agencies are somehow less dangerous for the individual politician than the foreign agencies.

The actual costs, "millions", are rather irrelevant.

r3m6• 11 years ago

as if the local agencies are somehow less dangerous

And in what way are they dangerous? And if not these experts, who should do this (expert) work?

fwn11• 11 years ago

In what way are foreign agencies dangerous? Now remember that they do the same thing.

The other question is pretty easy: Every involved party should use own trusted experts for the hardware/software part it manages.

If you are a parlamentarian and it feels suspicious to you that a secret service wants to get your phone: Don't hand it.

relet• 11 years ago

Who do these experts report to? The individual parlamentarian (who is supposed to be independent), or the individual parties, or the governing coalition, or unknown third parties?

At the moment, this is not even well disclosed.

mauricemir3• 11 years ago

Then why does the parliament not have some one looking after it's cyber security and answerable directly to it.

fwn11• 11 years ago

They should totally have someone looking after the parliaments part of the it infrastructure. I don't see why they shouldn't have someone in charge of it.

boroboro8• 11 years ago

"As if the local agencies are somehow less dangerous for the individual politician than the foreign agencies."

So your point is the German IT sec agency BSI is as dangerous to German politicians as the Russian GRU and SWR?

fwn11• 11 years ago

Without denying the currently very present principal–agent problem between parliamentarians and the statefunded intelligence community all other claims seem sappy to me.

I bet they earned your trust for a reason. Nevertheless it should be the decision of the specific MP to assign IT responsibilities for the own hardware/software.

boroboro8• 11 years ago

The German BSI is not a "secret service".

fwn11• 11 years ago

I had the same confusion in the beginning. The BSI is responsible to fix the infrastructure, to report on the problem, etc. You might not be aware of the discussion regarding the Federal Office for the Protection of the Constitutions involvement.

Remeber that this is not about the BSI.

http://www.spiegel.de/netzwelt/web/cyberattacke-auf-bundesta...

cstuder• 11 years ago

It get's even better: According to some reports[1], the german IT-security office (BSI) recommended completely replacing the IT-infrastructure with new hardware and software. They say the situation has gone out of control and that they are unable to stop the leaking of data from parliament computers to unknown third parties.

[1] http://www.heise.de/newsticker/meldung/Nach-Trojaner-Angriff...

totallynotcool2• 11 years ago

You would think they'd have SIPR/NIPR networks in place.

rndn• 11 years ago

Are they incompetent or is this a result of unforeseeable circumstances?

draugadrotten• 11 years ago

It is not a sign of incompetence to know when it's time to abandon a burning building.

pluma3• 11 years ago

I love how these stories always tend to focus on the "cyber attacks" rather than the incompetence that allowed them to be attacked in the first place.

These days, if a website gets defaced because of an outdated Wordpress installation, the media instantly rallies to the victim's defence and portrays the script kiddies that did it as terrorists. And if they're not personally identifiable, they're government agents of wherever their IP addresses originate from (or whoever the current political go-to villain happens to be).

I wouldn't be surprised if this major government IT SNAFU paves the way to more aggressive "cyber crime" laws and more posturing against Russia. It'll also likely be used to make the public forget about the entire NSA ordeal (because hey, we totally need the US to protect us against evil Russia).

Keep in mind that the entire "we're under attack" narrative isn't as popular or widely accepted in Germany as it is in the US. The last attempt to portray us as having to defend ourselves against an attack was during our involvement in Afghanistan, which the public generally disagreed with (although our politicians promised unlimited solidarity to the US).

We're also in a really awkward position: politically we're very dependent on the US (up to the point where US agencies can legally do what it wants in Germany thanks to post-WW2 agreements) but economically we're also very dependent on Russia -- as is a lot of Europe, for that matter.

rayiner2• 11 years ago

I love how these stories always tend to focus on the "cyber attacks" rather than the incompetence that allowed them to be attacked in the first place.

For the same reason stories about home invasions or robberies don't blame the victim for leaving their house or car unlocked.

fwn11• 11 years ago

Just that it's the internet. So it's more like parking your ferrari with open doors in Somalia.

zimbatm• 11 years ago

The victim here is not the government but the people it's supposed to serve. They are providing a bad service if data (likely ours but they don't say) gets stolen away.

Cyber attack on German parliament still active, could cost millions

Related Stories