We're Hacked...The Federal Government That Is

[RedHot25]

http://www.cbc.ca/politics/story/201...n-hacking.html

An unprecedented cyberattack on the Canadian government from China has given foreign hackers access to highly classified federal information, and forced at least two key departments off the internet, CBC News has learned.

....

But sources have confirmed the attackers successfully penetrated the computer systems at the federal government’s two main economic nerve centres, the Finance Department and Treasury Board.

The hackers apparently managed to take control of computers in the offices of senior government executives as part of a scheme to steal the key passwords that unlock entire government data systems.

It is unclear whether the attackers managed to compromise other departmental computer networks, including those that contain Canadians’ sensitive personal information such as tax and health records.

[Ozy_Flame]

Yikes. That is scary stuff. You usually hear about Chinese hackers trying to penetrate U.S. systems, but Canada is just as vulnerable I guess too.

[Devils'Advocate]

#1) The federal government is being asked to cut, cut, and cut some more out of the federal services. Asking for MORE security with LESS resources is virtually mission impossible.

#2) Statistics Canada, where I work, has TWO independent networks. Network A is completely detached from the internet and that is where we store all confidential information. Network B is used for internet connectivity. Due to budget cuts, we've been investigating merging the two networks, making us LESS secure (in my own personal opinion as a citizen; obviously the department's word is that every precaution will be taken to protect the public's data).

#3) I think completely severing yourself from the Internet is the only foolproof method. There is this constant "as soon as they build a better mousetrap, someone finds a smarter mouse". Hackers are more proficient than the people writing our firewall software. Most times security software patches are reacting to attacks that have already happened.

[TurnedTheCorner]

I always wonder when I hear about these attacks from China whether or not it is operating under the express consent of the Chinese government, operating under a "blind eye" from them, or operating as some kind of corporate endeavor. I don't know what's better or worse.

[Delthefunky]

I guess a third department (defense research) was hacked last summer

[Locke]

Originally Posted by Devils'Advocate

#1) The federal government is being asked to cut, cut, and cut some more out of the federal services. Asking for MORE security with LESS resources is virtually mission impossible.

#2) Statistics Canada, where I work, has TWO independent networks. Network A is completely detached from the internet and that is where we store all confidential information. Network B is used for internet connectivity. Due to budget cuts, we've been investigating merging the two networks, making us LESS secure (in my own personal opinion as a citizen; obviously the department's word is that every precaution will be taken to protect the public's data).

#3) I think completely severing yourself from the Internet is the only foolproof method. There is this constant "as soon as they build a better mousetrap, someone finds a smarter mouse". Hackers are more proficient than the people writing our firewall software. Most times security software patches are reacting to attacks that have already happened.

How do they totally seperate themselves from the internet? I've heard a few ways, but I'm actually a little curious.

Someone (I think it was photon) once mentioned a while ago something about a type of enclosure that disrupted all signals or something of that nature.

[Esoteric]

Anyone else hoping that we can read some more stuff on Wikileaks because of this?

[Dan02]

Originally Posted by Locke

How do they totally seperate themselves from the internet? I've heard a few ways, but I'm actually a little curious.

Someone (I think it was photon) once mentioned a while ago something about a type of enclosure that disrupted all signals or something of that nature.

simple, dont plug it in to the internet.

you're probably thinking of a faraday cage though.

[Bobblehead]

Ars technica has an interesting article about how a cracker organization hacked a security firm.

The second lesson, however, is that the standard advice isn't good enough. Even recognized security experts who should know better won't follow it. What hope does that leave for the rest of us?

http://arstechnica.com/tech-policy/n...bgary-hack.ars