Federal Reserve confirms hackers breached site | Hacker News Reader

Federal Reserve confirms hackers breached site

thehill.com

26 pointstaylorbuley14 comments

Anon are denying their involvement and seem to believe this is a propaganda operation aimed at getting public support for SOPA style laws:

The same day literally hours before this release Department of Homeland security named Cyber threats a severe issue and is trying to use this threat to enact SOPA style laws with executive order. This operation gives them a perfect example of WHY.

From http://pastebin.com/9aB9vB62.

Anyone can be Anonymous; one person saying they didn't do it means nothing.

The related XKCD http://xkcd.com/932/ ... however, despite it, we should think about how close web hosting can be sometimes to actual systems possibly. Also, the inherent trust insiders may have of their public presence could be leveraged for an attack on the actual systems.

...breached an agency website and gained access to government information.

That's a bit more than just defaced. And it looks like it was anon. They are bragging about it. But would government sponsored hackers (from say China) brag if they got in even deeper?

How do you know it was Anon? Anyone can claim to be Anon. It's not as though Anon is really even a thing, as opposed to an ad-hoc collection of factions.

American laws discouraging hacking will only leave more vulnerabilities open on American networks for foreign hackers to exploit. With one less exploit now open, we're lucky Anonymous hacked the Fed. How long had it been open? How many other entities may have hacked in and not published what they found?

Playing whack-a-mole with vulnerabilities doesn't help make anything more secure. Security vulnerabilities are, by and large, systemic issues; fixing individual issues will never make things better, they just reduce the appearance of risk. If you want to fix things, there are two things to keep in mind:

1) Attackers always have an advantage over defenders. Attackers have to find one bug, defenders have to fix them all.

2) Given #1 and the fact that we have such a systemic security fail on our hands, the correct approach is nuking whole classes of bugs. We did this with stack canaries and stack buffer reordering; we did this with CSRF tokens in popular web frameworks; we did this with safe, managed code negating the vast majority of memory corruption bugs.

We need to move past thinking of bugs as isolated incidents and figure out how to make everything better at once.

As computer technology becomes the toolset of the modern world, it becomes increasingly apparent that current leadership cannot effectively use or manage the toolset.

To some of us, this has been apparent for years. However, it can no longer be swept under the rug, even by the use of entrenched power.

And, if and as they can't use and manage the toolset, should they remain in their jobs?

My own personal history has been one of struggle against ignorant, moronic, and very risky mis-management. Decisions and actions -- or lack of action -- that decreased security and decreased competitiveness.

When I read such stories, I have little sympathy left. I'm sure there have been competent and well-meaning people telling them for years what they need to do. That is, until they were terminated for "rocking the boat" or left for greener pastures.

Pas, that's a bit like castigating a bank manager for his lack of locksmithing skills because thieves broke into the branch. I would have more sympathy with your argument if we were talking about poorly-formed economic models or so, but attacking the leadership of the federal reserve over a security breach on a website suggests a serious lack of perspective.

These are people who manage an organization that trades hundreds of millions of dollars per day, it's more akin to shaming them because they have a rusty screen door on the front door of their offices.

If the internal monitoring system was functioning and they knew about the breach then they're negligent in ignoring the problems, if it wasn't functioning/it wasn't implemented then they're negligent in not having the foresight to reduce their risk.

I think it's more like the bank manager kept installing low-security locks (edit: because their supplier gave a wowie presentation) when the locksmith advised upgrades. I'm neither a bank manager nor in government but I've worked on projects with the sort of terrible management decisions that could lead to this outcome.

Read more as criticizing the bank manager for ignoring or "forcing out" his employees who had repeatedly warned about the likelihood and ease of theft in his branch.

Anyway... who is insuring the the federal reserve networks?

AB, I take your point. And that did cross my mind somewhat as I made my comment.

However, there are... professionals, to use a word in line with your description, who refuse to respect and cooperate with other professionals in different domains.

Well... I guess I would argue that the more, or real professionals among them do. But, many don't.

I was part of a team responsible for some pretty critical infrastructure. And I was responsible for poking holes in it, before it was deployed and someone else did. Even within that context, I would sometimes have to go up a couple of layers of management and push in order to get a concern addressed. Something I could do by virtue of my reputation and personal connections up the chain of command.

In another position, I had the bully boss who would hold us back for the sake of his own opinion and sense of control. Combine that with some outside consulting, and I was emailing our entire customer database to said consultants each month with no encryption. I argued for better security, but I was summarily shot down. (Fortunately, I left that position not too long thereafter.)

Perhaps more pertinent, the Manning affair began in good part because State and other parties made a grand hash out of their intelligence systems including all-in (or out) security and apparently diddly-squat in terms of effective monitoring and auditing.

If this wasn't a serious concern, then why the hell are they making all this fuss after-the-fact?

And... even after this mistake, those responsible for the design and management of those systems were never publicly named and reprimanded, if they were at all.

At least in the case of Manning and Wikileaks, I'm not entirely opposed to the results. Too much has diverged too far from a critical level of transparency that I see as essential to effective democracy.

These people don't protect their resources. They don't respect the people they hire to do so. And they and/or other political operatives use the resulting fallout to foist a Big Brother monitoring mentality and technology upon the public at large.

Let them mind their own houses, first. And keep their noses out of mine.

Finally, I guess I am being somewhat hyperbolic, these days. Part of my desire is that sentiment rises to a level that public attention really comes to these issues along with greater clarity and understanding.

HN may not be the place for such expression.

OTOH, I don't think we want such ignorant people taking over our domain by law and force. Nor do most of us want to fear the government instead of being able to work with it.

I'm suddenly reminded of one boss I had, many years ago -- a fairly senior attorney at a very major corporation -- who refused to have a computer put in his office because he didn't want to deal with it and learn how to use it. (He was finally overruled; they gave him a Mac SE because it was physically smaller -- a compromise.)

He didn't need a computer; he had a secretary.

I also remember putting in an 80 hour week at the last moment to take care of paperwork for a many-million dollar acquisition that he should have been working on well in advance.

People who don't accept and manage the reality of their organizations, and change, are a problem. And I've seen too many people who are "too important" for such things; largely, they are a disaster.

Along the lines of this boss, I recall reading recently that Napolitano (head of Homeland Security), doesn't use email. Really? My confidence is not inspired.

http://www.slate.com/blogs/future_tense/2012/10/01/janet_nap...

One could argue that this is a risk reduction strategy. However, I'm skeptical. In my opinion, I've seen this attitude before. It leads to uninformed people making decisions about things they don't really understand.

People who are used to getting their way, and sometimes not too open to messages that contradict them or their opinions.

I hope my response to your point, AB, or the fact of my writing this here on HN, is not disrespectful. And I'll take some time to consider whether my current comments have been in the spirit and interest in HN -- seriously. Perhaps I'm straying; times have not been great for me, lately, and some of that frustration may be coming out sideways.

Regards

Its only a matter of time until they rape that place for everything.

Reply on news.ycombinator.com