“EPIC” fail–how OPM hackers tapped the mother lode of espionage data

http://arstechnica.com/security/2015/06/epic-fail-how-opm-hackers-tapped-the-mother-lode-of-espionage-data/

by ghosh • 11 years ago

77 37 11 years ago

arh68• 11 years ago

C, for the Central Verification System (CVS), ... contains ... Personal Identification Verification (PIV) credentials ... and polygraph data

Good lord.

Yet, somehow, someone might still present the solution as needing to spend more money sooner: It was only when OPM was assessing systems to actually implement the sort of continuous monitoring tools ... that OPM security officers discovered traffic outbound from the network. If only they'd demo'd the software a year ago, right? /s

Is anyone getting fired? Why should anyone lift a finger during this 30-day sprint? And what happens on Day 31?

rodgerd2• 11 years ago

This is the shit the NSA should be worrying about. Securing the US IT infrastructure against nation-state intrusion. Not dragnets of everyone's naked selfies.

fname2• 11 years ago

I don't disagree. Unfortunately, this all falls on DoD-DISA. The NSA works with DISA to write the policy for how to secure systems (called STIGs) and also has 'Red Teams', but they aren't the arm that certifies these systems before coming online, nor are they the ones the ensure the systems stay secured as new vulnerabilities are found and patched -- that's DISA again.

walshemj7• 11 years ago

If this was the UK the home secretary would have resigned by now - why has the secretary of state (which I understand is the US equivalent) not done so.

dublinben• 11 years ago

The Secretary of State has no responsibility over the agency at question. It is an independent agency with a director appointed by the President. That is who should be resigning over this.

jrochkind1• 11 years ago

The secretary of state isn't the equivalent of the home secretary. The secretary of state is mainly responsible for foreign policy, so probably more like equivalent to the Foreign Secretary? Although definitely not a strict equivalency.

There isn't really any U.S. equivalent to the Home Secretary, the responsibilities are divided over several offices reporting to the president.

djKianoosh2• 11 years ago

For some background here is the way DHS is organized: http://www.dhs.gov/components-directorates-and-offices

fweespeech• 11 years ago

None of the secretaries have direct control or authority over the OPM.

Additionally, the Secretary of State is foreign affairs and not the equivalent of the Home Secretary.

https://en.wikipedia.org/wiki/Katherine_Archuleta

That is the person who is responsible for the OPM.

It operates on a fee-for-service model for 90% of its budget and isn't properly funding IT and IT security. Given she has only been there 18 months, I'm not sure how you can really blame her beyond the fact she didn't follow the "shutdown and repair" recommendation...except for the fact if she did that, she'd have to burn through the OPM's cash reserves as the only way to fund it.

Its honestly more of a flaw in the way Congress built the OPM incentive structure and the fact the director is a revolving door position that changes every 2-4 years.

The government simply just doesn't fund/prioritize IT & IT security properly outside of the intelligence services. They also build these psuedo-private-sector funding models that create the incentive to "ignore" cost centers like Security into critical infrastructure like the OPM. Its really horrific.

pascalmemories• 11 years ago

I don't think so.

It's a long time since any UK politician resigned on principle or on honor. I think the late Robin Cook was the last (over the Iraq invasion which he believed was illegal).

Private Eye has an endless stream of 'highly suspect' (since any suggestion of 'corrupt' may get HN into trouble, just to be clear, I'm not saying 'corrupt'.) activities of various government ministers, none of whom resigned or even came close - despite their misdeeds being exposed. Look at how many were caught in the expenses scandal - some UK politicians even tried to hold on while being convicted of fraud and other criminal convictions (with some initial success too, https://en.wikipedia.org/wiki/Nazir_Ahmed,_Baron_Ahmed). That's never going to fly in the US.

You really need to go back to Margaret Thatcher's cabinet before you can really find many examples of resignation on the back of government screwups.

I think a resignation is more likely in the US than the UK. And it's not at all likely in the US.

amyjess• 11 years ago

Gotta love the government obsession with acronyms.

Where I come from, CVS and PIV mean completely different things. One of them is an abomination before God, and the other is a natural act of biology.

tripzilch• 11 years ago

Good lord, not the polygraph data! I wonder if the Chinese have a database with I-Ching divinations?

rodgerd2• 11 years ago

And to think the UKUSA agencies tried to cover up this clusterfuck by having the Murdoch rags blame it on Snowden.

(JRun and Windows XP? Really?)

walshemj7• 11 years ago

That's a different thing and BTW Bruce Schenier thinks that the FSB and the Chinese have Snowdens data by now the.

Now id believe Bruce more than a Murdoch Rag

beagle33• 11 years ago

If I understood Schneier's piece correctly, he believes that they had it before Snowden did (and independently of him), which seems extremely plausible - if Snowden could take all those files with nobody noticing, it's likely that a well funded, well equipped and well trained espionage agency has done that independently of him, likely all of them --

And for disinformation and source hiding, I'm sure they all (even internally and to their own "customers") claim now that the source is Snowden. I would if I were in their place.

rip747• 11 years ago

They are using Adobe ColdFusion which prior to version 10 was using JRUN as the JVM. Adobe doesn't even support nor let you download version 9 and below anymore.

Granted there are a couple hiccups moving from 9 to 10 but mostly (and understandably) it involved if you were calling Java directly. For the most part its pretty painless to upgrade.

emiliobumachar• 11 years ago

'The $20.8 million "first call" was for 3.2 million "units" of credit monitoring and identity theft recovery services'

At seven bucks a piece, this seems very cheap, especially for a rushed government purchase. Any thoughts? Am I missing something?

sqeaky2• 11 years ago

It will likely be one or a few larger forensic investigations. I would wager that a team of a dozen experts or so will start one big investigation calling in other help as needed. In one big windfall they will determine how 80% or more of the data was taken. Then whatever is left will be handled on a case by case basis.

Likely the Unit thing was done to make the bureaucracy that pays for things happy. I have worked places where a 1,000 payments of $1 each was easy to make happen than one $600 purchase.

Lancey• 11 years ago

I feel like the OPM isn't doing enough about this breach. Espionage or not, American citizens outside the IC were affected and deserve to know if they've been compromised. More efforts need to be made to inform potential victims before any more harm comes from this, including greater transparency with regards to what systems have been affected and what the OPM could have done to better secure this data. That, and an apology would be nice.

at-fates-hands• 11 years ago

"Among the things the inspector general found that could have helped hackers was that nearly a quarter of the agency's systems did not have valid authorization procedures," she said. "The reason that's important is because one of the departments that didn't have the correct procedures was the Federal Investigative Services. That's the group responsible for background investigations of federal employees. So that data's very sensitive, and as we know now, this is one of the databases that was hacked."

Let me get this straight. You had really sensitive data, you knew it wasn't secure and huge portions of the systems didn't have valid authorization procedures?

This is pretty eye opening, even for a governmental agency. The scary thing is, this is just the tip of the iceberg. It seems this breach was inevitable considering how many other EPIC FAILS are mentioned in the article.

amitparikh• 11 years ago

Hypothetically, could U.S. persons who were affected by this breach claim any sort of financial reprieve for future lost wages? I'd imagine those affected would not be very desirable or even eligible any more for secure work.

frandroid• 11 years ago

In theory, yes, but in practice, that's the entire government apparatus that requires security clearance which is suddenly not eligible for getting a new job (or even keeping their current one). So nothing is going to happen there.

tomjen3• 11 years ago

While it would be bad for the spies I don't think it matters much for the people who, eg analyse geospatial data, since they would only need to be vetted for access to the data.

logn• 11 years ago

"The ability of consumers to sue for future harm has, in many cases, been limited by a Supreme Court ruling that on its face had little to do with big commercial breaches. [...] In 2013 the Supreme Court ruled 5-4 against them, concluding that the fear of future harm from surveillance wasn’t enough for plaintiffs to have standing to sue."

from https://firstlook.org/theintercept/2015/06/12/data-breach-th...

The article also mentions a pending Supreme Court case (Spokeo v. Robins) which could "'open up the floodgate for lawsuits, in all contexts, but especially in data breach litigation'".

_Marak_• 11 years ago

Would not be surprised if this was related to the US temporarily stopping the issuance of visas.

http://travel.state.gov/content/travel/english/news/technolo...

“EPIC” fail–how OPM hackers tapped the mother lode of espionage data

Related Stories