US court system suffered 'incredibly significant attack' – sealed files at risk • Hacker News Board

Re: US court system suffered 'incredibly significant attack' – sealed files at risk

#21

Post by m3047 » Sat, Jul 30, 2022, 7:42 PM UTC

oliwarner wrote: post #6

But why are sealed files on the network?

True story...

These people (https://www.nisc.coop/) make (and operate) software which is used by lots of infrastructury / governmenty organizations. (I leave the osint to you.)

My cable company leases fiber from the city. The city built out the fiber because SCADA; they used to run the cable company.

The city utility department uses SSNs as a PIN for customer accounts. Wouldn't let me change it. I eventually complained to the State Attorney General. Then they relented and let me set a PIN.

It's not that they have good practices around any of this. The "app" they use to verify your PIN *shows them the PIN* or SSN. They justify this because their employees pass background checks.

I'm sorry, I imagine that seems like a digression. So, back to the cable company.

The cable company uses a version of NISC's software which *stores passwords in a retrievable format* and displays them for their customer service personnel. They justify this because their employees pass background checks.

Welcome to 2022.

Re: US court system suffered 'incredibly significant attack' – sealed files at risk

#22

Post by Wowfunhappy » Sat, Jul 30, 2022, 9:00 PM UTC

yellow_lead wrote: post #15

Wowfunhappy wrote: post #11

Earlier quoted context omitted.

I mean, it’s possible, but I see no reason to assume that. The article mentions files related to national security, so this isn’t your local school board. I’d expect they have at least decent security protocols in place.

> I’d expect they have at least decent security protocols in place. Don't expect too much from the government :)

There's a reason the most sophisticated attacks usually come from "state actors".

Re: US court system suffered 'incredibly significant attack' – sealed files at risk

#23

Post by heywoodlh » Sun, Jul 31, 2022, 7:20 AM UTC

yellow_lead wrote: post #15

Wowfunhappy wrote: post #11

Earlier quoted context omitted.

I mean, it’s possible, but I see no reason to assume that. The article mentions files related to national security, so this isn’t your local school board. I’d expect they have at least decent security protocols in place.

> I’d expect they have at least decent security protocols in place. Don't expect too much from the government :)

The U.S. government actually provides a lot of really awesome free security resources and I believe they implement a lot of security measures. One of my favorite security resource provided by the govt. is STIG[1]. If you take your time to implement the measures outlined in STIG in your network it would be EXTREMELY difficult (in my opinion) to break into your network/devices without a zero-day or other undiscovered exploit.

I have not worked for the govt, so I do not have a first-party understanding. And I doubt any entity is impervious to simple/well-known attack vectors (such as EternalBlue) but my experience with STIG as a security engineer has always left me really impressed with the level of research and suggestions the government provides to the public -- for free.

[1] https://public.cyber.mil/stigs/

Re: US court system suffered 'incredibly significant attack' – sealed files at risk

#24

Post by feet » Sun, Jul 31, 2022, 8:01 AM UTC

heywoodlh wrote: post #23

yellow_lead wrote: post #15

Earlier quoted context omitted.

> I’d expect they have at least decent security protocols in place. Don't expect too much from the government :)

The U.S. government actually provides a lot of really awesome free security resources and I believe they implement a lot of security measures. One of my favorite security resource provided by the govt. is STIG[1]. If you take your time to implement the measures outlined in STIG in your network it would be EXTREMELY difficult (in my opinion) to break into your network/devices without a zero-day or other undiscovered e…

They also do this while other parts of the government have their budgets gutted. How do they pay IT to implement security?

Re: US court system suffered 'incredibly significant attack' – sealed files at risk

#25

Post by heywoodlh » Sun, Jul 31, 2022, 3:11 PM UTC

feet wrote: post #24

heywoodlh wrote: post #23

Earlier quoted context omitted.

The U.S. government actually provides a lot of really awesome free security resources and I believe they implement a lot of security measures. One of my favorite security resource provided by the govt. is STIG[1]. If you take your time to implement the measures outlined in STIG in your network it would be EXTREMELY difficult (in my opinion) to break into your network/devices without a zero-day or other undiscovered e…

They also do this while other parts of the government have their budgets gutted. How do they pay IT to implement security?

Fair enough, I don't really have first-hand experience with government IT positions so I don't have much to add with how the government implements security.

Re: US court system suffered 'incredibly significant attack' – sealed files at risk

#26

Post by Wowfunhappy » Sun, Jul 31, 2022, 3:26 PM UTC

feet wrote: post #24

heywoodlh wrote: post #23

Earlier quoted context omitted.

The U.S. government actually provides a lot of really awesome free security resources and I believe they implement a lot of security measures. One of my favorite security resource provided by the govt. is STIG[1]. If you take your time to implement the measures outlined in STIG in your network it would be EXTREMELY difficult (in my opinion) to break into your network/devices without a zero-day or other undiscovered e…

They also do this while other parts of the government have their budgets gutted. How do they pay IT to implement security?

Parts of the government related to national security are pretty well funded.

Re: US court system suffered 'incredibly significant attack' – sealed files at risk

#27

Post by nijave » Mon, Aug 01, 2022, 1:58 AM UTC

oliwarner wrote: post #13

nijave wrote: post #8

Earlier quoted context omitted.

I imagine so people that should have access (like prosecutors) can get to them without visiting the court house (and potentially requesting copies of the original)

I would have expected that a strong, physical audit trail would be a highly desirable thing. That said, I have no idea what the transaction volume is like here. My experience of TV crime investigation tells me these are rare occurrences, under warrant.

Sealed files don't require warrants they are just court records that aren't publicly accessible. My understanding is motions (appeals or some other proceeding?) can be filed by a defendent (if that's the right term) and prosecution has a limited time frame to respond. Defense lawyers will just file bogus motions hoping a deadline is missed and they can move things further along. When that happens, it makes even more work for prosecutors which eats up time they could be spending building cases

Re: US court system suffered 'incredibly significant attack' – sealed files at risk

#28

Post by m3047 » Tue, Aug 02, 2022, 2:37 AM UTC

oliwarner wrote: post #14

djbusby wrote: post #9

Earlier quoted context omitted.

The "seal" is a Legal construct not a engineering/technical one.

And before it was a digital version, a sealed file would be removed from the general filing system, kept under lock and key. They seem to have forgotten basic security principles.

Have you personally inspected those facilities, or in other words: on what do you base this generalized conjecture?