Huge data breach prompts resignation of OPM director
bbc.co.uk
bbc.co.uk
Every time OPM says "it was only X" it comes out a few days later that they're lying.
My original statements have applied since day one: "Whoever took this data has all the relevant information on anyone (and their families and their friends) who has received a security clearance. Not some. Not parts. ALL."
and
"If someone just steals your identity, consider yourself lucky."
It was also uncovered that the so-called "hackers" had read/write access to the system so therefore EVERYTHING in it - whether good or bad - should be considered suspicious. People who shouldn't have gotten clearances, may have. People who should have been cleared, may have been blocked.
That's 1/15 of the entire population of the nation. There just are no words for the asininity of storing all of that data in a single database in the first place, IMO - let alone a database that is actually accessible through any number of network pivots from the internet.
Until you have a breach, essentially nobody would be willing to have that happen.
the "secure" Web gateway to OPM's background investigation systems is a
contractor-hosted website at an application service provider. That Web
gateway is reached through a Windows Web server running JRun 4.0, Adobe's
Java application server, as well as ColdFusion
[...]
In 2013, someone hacked into Adobe and stole the ColdFusion source code. And
Adobe dropped the JRun product line entirely in 2013—with extended "core"
support ending in December of 2014. There is no evidence that OPM or its
application provider had purchased expensive extended, dedicated support,
but JRun would hardly be the only unsupported platform still used by OPM.
The agency still has systems based on Windows XP (supported under a custom
support agreement with Microsoft), and many of the core systems run by the
agency are based on mainframe applications that haven't been updated since
their COBOL code was fixed for the Y2K bug in the late 1990s. [1]
[1] http://arstechnica.com/security/2015/06/epic-fail-how-opm-ha...
Stealing the information is bad enough, but that utterly shocks me. It should be a huge scandal - what if the Chinese has put sleeper agents in key positions?
Heck it almost makes sense to steal the data just to cover your tracks.
Why isn't this a bigger deal?
A slightly more charitable explanation is that it's very difficult to grasp the scope of a data breach initially. This is similar to most disasters, in that it takes time for a full awareness of what's transpired to sink in -- initial stages are almost always a period of increasing damage estimates as prevoiusly cut-off or not-heard-from locations file reports. I've written on how it took hours for Japan to realize the extent of damage in Hiroshima, and a full day to realize just what had happened. And that only because the United States told them.
https://www.reddit.com/r/dredmorbius/comments/1wf9yc/on_disa...
And that was an event which left highly tangible physical evidence.
For data loss, you're dealing with little by way of physical evidence, almost always an unknown attacker, and a case of forensic log analysis, trying to sort legitimate traffic from non. If you _can_ determine that specific accounts or IPs are known compromised or hostile, you may be able to make some guess as to what data were accessed, but that depends entirely on the level of logging and other design elements of your systems.
The evolving rule of thumb is that any data breach will be larger than first reported. But it's not appropriate to assume this is on account of intentional deception.
I suspect this will cost their ass.
I don't believe they have officially decided yet what sort of remedy they will offer either - I'm really hoping it'll be a lot more than the 18 months they offered for the first one. A period measured in decades would be more appropriate.
http://arstechnica.com/security/2015/06/epic-fail-how-opm-ha...
I am having an impossible time following this story. So vague. Thanks for the most descriptive link yet (although still totally lacking). I watched the cspan event and all I could derive was that inadequate logging meant they couldn't say how bad the event was. Totally unclear.
https://www.youtube.com/watch?v=pVPPTooB80E
And this is part 1:
Anything you can ask from me to authenticate myself: copy of a birth certificate, copy of my drivers license, social security number, information about where i grew up or my family... someone else has all of that now, which means they can now easily get original copies.
if this is correct, I guess that means passwords were stored in cleartext or reversibly encrypted. that is either epic stupidity, or someone wanted to keep passwords of potential employees so they could use them elsewhere
Ultimately in large organizations like this that are arguably well funded, the answer often lies in corruption (and not necessarily just the bureaucracy, but also the legislators who earmark crazy stuff like specific vendors and specifications that are handpicked for their favorite funders).
Why can it only be fulfilled by the authors?
Not a particularly valid assumption.
When Republicans let slogans like "we need smaller government" define governance, this is a big part of what happens.
The Democrats had a filibuster-proof majority in the Senate -- for four months. From September 24, 2009, to February 4, 2010.
Prior to then, the Deomocrats nominally had 60 seats in the Senate, but:
Edward Kennedy was ill from the night of Obama's inaguration.
Senator Al Franken's election was disputed for months.
Arlen Specter switched from Republican to Democrat, in order to hold his seat, but didn't support the Democrats for filibusters.
Senator Byrd was in hospital for much of 2009.
Absent a filibuster-proof majority, the GOP could and did effectively block any legislative action, at will, to the point of shutting down the Federal government of the United States for two and a half weeks.
http://cjonline.com/blog-post/lucinda/2012-10-15/obama-has-n...
No, the Democrats haven't been "running the show for the past 8 years."
The US spends more on domestic security theater than Germany or France spend on their entire military.
"Security" funding may not involve rewriting some employee database. The contractors running the system won't look at the system for flaws that need correction, they only operate.
The protected data generally contains people's deepest darkest secrets, and information on where to begin digging for more information that could be used to blackmail them into working for a foreign power. This information is collected in order to estimate how succeptable the applicant would be to blackmail, but is also the perfect starting point for starting a campaign to blackmail current security clearance holders into spying for a foreign power.
At least the way it worked in 2003 was that a security officer emailed you an old 16-color DOS application called EPSQ 2.2. As I remember, the application actually saved its data back into the binary, so people wouldn't be confused about what to email back to the security officer when they were done.
The EPSQ questionaire had two sections... one contained some basic data that your employer needed to see, and one contained drug use, alcohol abuse, mental health, financial problems, legal problems, etc. You picked two passwords that were used to encrypt the two sections, filled out the questionire, and emailed it back. You then gave the less sensitive password to the security officer. I don't remember if I sent the more sensitive password to the OPM or if EPSQ 2.2 contained public key crypto/obfuscation so that the OPM could recover the sensitive information encryption key. In any case, the human-picked password/encryption key most definitely could be used to decrypt the most sensitive data (blackmail information) in order to facilitate saving a partially completed questionaire and finishing it up at a later date.
These days, I really hope EPSQ is a web app that's accessed via a binary with a single TLS certificate authority hard-coded (and using perfect forward security), so copies of super-sensitive data aren't left in several mail queues protected only by (generally low-entropy) human-generated encryption keys.
The bad news is that almost your entire government is barely putting any effort into keeping your data secure.
To a large extent firings or layoffs in government amount to shuffling people around rather than what most would conclude from such a headline.
How many additional OPM's and Healtcare.gov's do we have to witness before people revolt and demand excellence out of government?
Today we seem to be content with the idea that government operates at precisely the opposite end of the scale, a place where a range of behaviors from sucking at your job to lying and criminal behavior seem to be considered virtues. And what's worst, there are no consequences for being utterly incompetent, lying or acting criminally?
The breach wasn't the problem. The problem is how fucked government is at nearly every level. That's what needs fixing.
Excellent.
Who cares is passwords are harder to brute force, once an attacker has walked away with everything in the OPM leak?
Don't get me wrong, I'm hugely in favour of hashed passwords. But with this sort of data it's a long way from making a complete database leak a nonissue.