CIA Email Hackers Return with Major Law Enforcement Breach

They probably figured out an individual's password. Maybe the system shouldn't allow outside access to individuals with just a password, but it isn't really that shocking that they got into it.

I like how grandiose that tweet is, as if Xi Jinping starts every meeting by making fun of a few felony mug shots, look at the mustache on this guy, hahaha.

> How is it possible for a country with the resources of the U.S. to miss such important areas of technological security

The US is a democracy. Most of the voters are not very intelligent. That means, most of the politicians elected to run the government aren't very intelligent either. I mean, voters would have to be intelligent themselves in order to tell the difference between a dumbass political candidate and an intelligent one. And I think it's the politicians who usually hire the people who run intelligence agencies, law enforcement agencies etc.

the real issue on this is you don't know what you don't know. the IT directors/management may even have a security dept which is doing "work", but doesnt have talented enough folks who recognize the real risk and address it. Im sure some project manager in the department has been producing vulnerability reports and defects closed to management, demonstrating how secure they are.

> “CWA did, indeed, have access to everybody in USA’s private information, now imagine if we was Russia or China.”

You can safely assume that many organisations and governments would have access to a database like that.

I don't think it's a question of resources, it's a question of priorities. The US government spends tons of money on all sorts of things, but spending that money instead on security would mean they'd have to stop doing some of those other things that we actually pay them to do. The Navy could stop buying warships and spend all the extra money on security, but then they wouldn't have any warships, which is what the Navy is actually for.

This is by no means a government only issue. Multi-billion dollar companies keep getting hacked for basically the same reason. They too have lots of resources, but they are also spending those resources actually doing something. The BEST result you can get from spending on security is...nothing bad happens.

I completely understand the counter-argument that spending on security saves you the costs associated with getting owned, but that's clearly a hard argument to make to people who see all the other ways their money can be spent directly producing the results expected of them. It's the same basic problem IT has always faced ("it costs money, it doesn't MAKE money"), but it's worse with security since you don't even see it for the most part, except maybe as an annoyance.

To be fair, as long as you are building systems on top of general purpose operating systems and exposing them to the internet, you're going to be vulnerable to one hack or another. No matter how much money you throw at the problem, this won't be the last time someone hacks someone's email account or figures out a password to a police computer.

I don't disagree that cyber-warfare is becoming a more important consideration in the context of modern military doctrine, but electronic warfare has been around since long before the internet. It's just one more evolution.

In defense of kinetic war-fighting, it's easier for us to turn off the internet than it is for the other guys to turn off an aircraft carrier.

As I mentioned in a recent thread[1], the government's approach to cybersecurity has been 100% offense. I suspect this may be a pre-network strategy being applied to a networked world, where concepts like border security and enumerating threats[2] actually worked.

In the late-80s/early-90s, I used to laugh at the common sci-fi trope of always having some convenient way to hack into anything. I originally assumed this was literary license[3]; surely nobody would actually be dumb enough to to put critical systems on a publicly-accessible network! Well... I guess I was wrong. Not only were we stupid enough to connect everything to a network, some people are trying to start an entire industry based on the idea of plugging things into the internet.

We've simply gotten lucky so far; we have barely scratched the surface of what can be done. I know rare problems are notoriously hard to model. Getting people to properly prepare for these events or even simply understand the actual cost of failure can be incredibly difficult, but that doesn't mean the problem can be ignored.

I almost see a similarity to the martingale[4] betting strategy. It works ok until you get your first rare set of consecutive losses and you bottom out your bankroll. The core problem in martingale is that it requires you to have an unbounded pool of cash to work with, so maybe the answer insecurity is related to only accepting risks if the risk has known bounds.

[1] https://news.ycombinator.com/item?id=10482498

[2] http://www.ranum.com/security/computer_security/editorials/d...

[3] JMS has talked about the need for license when he wrote Babylon 5, where he said that the ships always move "at the speed of plot".

[4] https://en.wikipedia.org/wiki/Martingale_%28betting_system%2...

Boils down to the question - who wants to go work on security for the government?

It's probably a result of the early days of the internet. Nobody knows we have this network, and we have passwords after all so we're good. On top of that base, the contracts that built these systems probably didn't specify much in the way of security.

Even with the recent OPM breaches, probably nobody thinks it's their problem, and weak contracts are probably still being bid.

"Only" in this context doesn't mean "few". If you take it out of the quoted sentence, then the portal could also be available to veterinarians, carnival barkers, and scuba instructors. But it's not supposed to be available to those people, only to the FBI and other law enforcement agencies.

Yeah, I don't think this is going to turn out well for them. Granted lulzsec was broken up by having a mole so it might make it more difficult for law enforcement, but then again the FBI has been known to use blackhat means to track people across tor[0] and use malware to obtain information[1].

[0] http://www.wired.com/2013/09/freedom-hosting-fbi/

[1] http://www.wired.com/2014/08/operation_torpedo/

Classic and common modus tollens. That you don't know of one does not mean they don't exist.

But to your question yes, I have seen one. It all hinged on people actually internalizing security measures such that it was part of how they lived their lives.

I used to work for a major telco and any sensitive lines here monitored looking up C or Liz II's telephone details would ring a lot of alarms.

And then you and had better hope MI5 got to you before BT's internal security did.

The fact that the DCI's details where not secured is shocking the CEO, Chairman head of security should be fired.

Id probably fire the entre call centre shift to make the point as well.

It's pretty clear since they even wrote about the motive in the article.

>I'm the bad guy in the news that's targeting the US government for funding Israel.

> US government to stop funding Israel and for them to stop killing innocent people

> Did you know there was over 26,000 civilian deaths due to war-related violence in the Afghanistan war

> Did you know the US military bombed an Afghan hospital? [0]

So, basically it's about freedom from the US government suppressing other states.

[0] http://pastebin.com/KtN8FqPu that is linked in the article

Without any proof for or against, it is interesting to view this attack as a state-sponsored PSYOP.