Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How hackers made minced meat of Department of Energy networks

arstechnica.com

Post reply on HN
Print view View original

11–20 of 21 posts

Re: How hackers made minced meat of Department of Energy networks

#11

Post by jtchang »

jrochkind1 wrote: post #10

> Chief among them is the fact that none of the 354 database tables containing social security numbers were encrypted. Using strong cryptography to protect such "at rest" PII has long been considered a best practice in government and corporate data security. Really? Although I don't work in that field ('government and corporate data security', or generally anything where we have to deal with SSN's and such) -- that d…

In the payment industry there is the concept of PCI-DSS. It is basically a set of requirements regarding the handling of sensitive data. While a lot of it is just common sense some of it should be applied to any sensitive data that you are working with.

Encrypted database tables are not that common. More common is encryption of the whole disk or database using Oracle or some other software/hardware.

If you are storing full credit card #s it better be encrypted while the data is at rest.

Re: How hackers made minced meat of Department of Energy networks

#12

Post by 6d0debc071 »

jrochkind1 wrote: post #10

> Chief among them is the fact that none of the 354 database tables containing social security numbers were encrypted. Using strong cryptography to protect such "at rest" PII has long been considered a best practice in government and corporate data security. Really? Although I don't work in that field ('government and corporate data security', or generally anything where we have to deal with SSN's and such) -- that d…

Don't work in that area but

- http://en.wikipedia.org/wiki/Transparent_Data_Encryption

Apparently widely used enough to have support existing for it.

Re: How hackers made minced meat of Department of Energy networks

#13

Post by kevinchen »

reginaldjcooper wrote: post #8
ChuckMcM wrote: post #3

TL;DR version - if you don't apply security patches, or take basic precautions, you will get compromised. It is sad that our government IT organizations are so poor, I would consider that a National Security threat much more than having the FBI help some whack job build a fake bomb so they can publicly "break up" a terror plot.

One significant reason I don't want the government collecting all of my data is because they seem totally incapable of creating a secure system or even a system that operates properly.

The NSA seems technically capable, though. (They seem to get the best of the best software engineers / IT people.) Not that it's good they have it, but at least they can keep it safe from outside attackers.

Re: How hackers made minced meat of Department of Energy networks

#14

Post by growupkids »

kevinchen wrote: post #13
reginaldjcooper wrote: post #8

Earlier quoted context omitted.

One significant reason I don't want the government collecting all of my data is because they seem totally incapable of creating a secure system or even a system that operates properly.

The NSA seems technically capable, though. (They seem to get the best of the best software engineers / IT people.) Not that it's good they have it, but at least they can keep it safe from outside attackers.

Their IA clearly sucks though.

Re: How hackers made minced meat of Department of Energy networks

#15

Post by rdl »

ChuckMcM wrote: post #3

TL;DR version - if you don't apply security patches, or take basic precautions, you will get compromised. It is sad that our government IT organizations are so poor, I would consider that a National Security threat much more than having the FBI help some whack job build a fake bomb so they can publicly "break up" a terror plot.

The problem has actually gotten worse -- by acting like asshats and spying on US citizens (as well as a whole litany of other stupidity, like racist drug laws, ...), it's presumably a lot harder to recruit and retain great people for the less-sexy roles like IT/IA.

Re: How hackers made minced meat of Department of Energy networks

#17

Post by eli »

droidist2 wrote: post #5
ChuckMcM wrote: post #3

TL;DR version - if you don't apply security patches, or take basic precautions, you will get compromised. It is sad that our government IT organizations are so poor, I would consider that a National Security threat much more than having the FBI help some whack job build a fake bomb so they can publicly "break up" a terror plot.

Did the fake bomb scenario actually happen? I'd be interested in reading about that.

You can listen to a podcast about one instance http://www.thisamericanlife.org/radio-archives/episode/471/t...

Re: How hackers made minced meat of Department of Energy networks

#18

Post by jerf »

jrochkind1 wrote: post #10

> Chief among them is the fact that none of the 354 database tables containing social security numbers were encrypted. Using strong cryptography to protect such "at rest" PII has long been considered a best practice in government and corporate data security. Really? Although I don't work in that field ('government and corporate data security', or generally anything where we have to deal with SSN's and such) -- that d…

It's possible to end up with access to a database via some mechanism without having access to the code that can decrypt the values. Perhaps you've stolen a backup, or exploited an SQL injection to get access to one of these tables, but without the decryption code it's useless (if the encryption itself is done correctly).

It's weak protection, because obtaining the database and obtaining the code are pretty highly correlated, but it can make sense in some situations. Obviously, the easier it is to obtain the unencrypted values, the less likely an attacker is to get stranded between the encrypted values and the decryption code. (i.e., an "encrypted partition" doesn't do much to defend against any remote attack because they'll all be using the readable mounted partition, a pervasive API layer that automatically decrypts things for user code is that much easier to accidentally use by the attacker as well, etc. In a weird way you want these fields to be as hard to use as possible, violating normal software engineering rules; every normal ease-of-use consideration is a hole.)

Re: How hackers made minced meat of Department of Energy networks

#19

Post by pstuart »

droidist2 wrote: post #5
ChuckMcM wrote: post #3

TL;DR version - if you don't apply security patches, or take basic precautions, you will get compromised. It is sad that our government IT organizations are so poor, I would consider that a National Security threat much more than having the FBI help some whack job build a fake bomb so they can publicly "break up" a terror plot.

Did the fake bomb scenario actually happen? I'd be interested in reading about that.

A good read: http://www.rollingstone.com/politics/blogs/national-affairs/...

Re: How hackers made minced meat of Department of Energy networks

#20

Post by wiredfool »

jrochkind1 wrote: post #10

> Chief among them is the fact that none of the 354 database tables containing social security numbers were encrypted. Using strong cryptography to protect such "at rest" PII has long been considered a best practice in government and corporate data security. Really? Although I don't work in that field ('government and corporate data security', or generally anything where we have to deal with SSN's and such) -- that d…

Encrypting database tables is easy.

Key management so that you can do anything with the data is significantly harder, depending on your threat model.

Post reply on HN