White House Conveniently Confirms 'Cyberattack' Story Just As Its Pushing Cybersecurity Exec Order
from the coincidence... dept
A "conservative" website apparently reported that Chinese hackers broke into a White House military office computer system with a "spear-phishing attack (like regular phishing, but directly targeted at a victim)". The White House has confirmed the story while saying that nothing sensitive was accessed:A White House official speaking on background late Sunday confirmed there was an attempted hack but said that it affected an unclassified network, was “isolated” and that there was no evidence that any data had been stolen.I'm not a huge fan of any sort of conspiracy theories, but it does seem questionable that this comes out just as the White House is circulating an executive order dealing with "cybersecurity," and so soon after the administration's preferred Cybersecurity Act got rejected by the Senate. The Free Beacon website that first broke the story seems to use it to suggest that the administration is "soft" on security -- though it was conservatives in the Senate who blocked the Cybersecurity Act from passing in the first place.
Either way, it seems likely that people are trying to hack into key networks all the time. This doesn't sound like much of a big deal, but the fact that the White House is confirming the news just as it's pushing this exec order (while still hoping to get legislation through in the lame duck session), at least makes you wonder if the whole thing isn't being "leaked" on purpose to get cybersecurity stories back into the press to push for the exec order or for a revival of the bill.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: china, cyberattack, cybersecurity, white house
Reader Comments
Subscribe: RSS
View by: Time | Thread
Fake?
[ link to this | view in chronology ]
Re: Fake?
Also, if it's true then first Govt personnel should be instructed into secure behaviors (ie: avoid opening those power point chains or unknown links) and second they should prevent connection to sensitive systems. Other than that the cybersecurity "exec orders" they want to implement are pretty much useless.
[ link to this | view in chronology ]
Re: Fake?
[ link to this | view in chronology ]
Re: Fake?
Watch and see this happen.More spying and more breaking of the 4TH Amendment and more abuse by our Government.
[ link to this | view in chronology ]
Re: Fake?
The glaring thing is...how would the bill have stopped this attack?
It sounds like they need a better IT manager to do better filtering of their email and educating their users.
[ link to this | view in chronology ]
Re: Fake?
Blogger Conveniently Confirms 'Cyberattack' Story Just As Its Pushing against Cybersecurity government plan
There. Makes more sense. Don't forget to take those calls Mike!
[ link to this | view in chronology ]
surely its standard practise?
[ link to this | view in chronology ]
Oh! The Humanity?
[ link to this | view in chronology ]
Re: Oh! The Humanity?
Now the other thing to mention is someone with access to the Nuclear Football and all kinds of secrets we have to protect, is one of those people who will answer an email from a deposed prince seeking help to move money out of his country.
It was a spearfishing attack, makes it sound dangerous. Almost as dangerous as getting an email from a friend seeking money in a foriegn country because they were mugged and robbed.
If you can't get your staff trained to avoid these attacks, what makes you think you can write a law and make it all better? Physician heal thy self.
[ link to this | view in chronology ]
As suspicious as...
The US Gov't has a huge amount of internet "real estate". The attack surface is massive, and the attempts are constant. In the weeks this executive order has been wending its way through the pipes, it's not surprising that this occurred. The fact that it's been reported so widely is a little ...smelly... but it's a pretty common occurrance.
IMO, this:
means the attack was not some super-sophisticated attempt to get at classified networks, probably more a "USA teh suk, Chinaz #1!!!" kinda thing.
[ link to this | view in chronology ]
huh what?
So we need a Cybersecurity Act to do what exactly? Make it illegal for the Chinese to hack? Stop phishing scams?
Did we run out of lobbyists for other shit?
[ link to this | view in chronology ]
Re: huh what?
[ link to this | view in chronology ]
Re: Re: huh what?
[ link to this | view in chronology ]
What about the Computer Hacking Law
[ link to this | view in chronology ]
Re: What about the Computer Hacking Law
[ link to this | view in chronology ]
--Highly convenient timing
--*Critical* information and infrastructure shouldn't be accessible online in the first place; even ordinary people know better
--The thing about this cyber-security bill is that it would effectively compromise the security and privacy of millions of people, under the guise of "protection"
[ link to this | view in chronology ]
Definitely odd that this particular attempt just happened to be newsworthy.
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Story Nailed It
Survey says: DING
[ link to this | view in chronology ]
I love TechDirt and really enjoy the articles that you write with ONE exception: Cybersecurity. This is what I do for a living, and I do happen to work for an unnamed government that you focus on quite a lot in regards to these things....
With that being said; Let me just say that the level of cyber attacks on national infrastructure is *NOT* being oversold. Most people simply couldn't comprehend the amount of attacks that are happening on a CONSTANT basis nor do most people understand the mitigation process and how it works within certain government organizations. In addition to that; there seems to be some serious misunderstanding in how data classification is approached at this level and why some controls (such as restricting government workers from accessing sites that are leaking classified data) exist.
Let's assume that YOU are responsible for a team of people that tries to protect a network. Those networks contain different classifications of data and you need to make sure that people are NOT accidentally moving classified data to unclassified systems. How would you deal with vetting every piece of classified data on an unclassified system and determining if it's actually been leaked? That process would be a nightmare.
Within government systems, the rule is that classified data is not allowed on unclassified networks. Period. That allows us to leverage data classification tools to help ensure that this data stays where it belongs. Having to make ad-hoc exceptions when something is "believed" to be leaked simply isn't practical.
These rules are not about CONTROLLING users from accessing this data on the net that's been leaked, they are in place to prevent this data from ending up on unclassified systems no matter what it's source.
There's a lot more to know about this process than simply what shows up in a news article somewhere....
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Re:
It is a known fact that the devil is in the detail.
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]
Re: Re: Re:
When I read articles like this that basically say the work I perform day in and day out is nothing more than a political conspiracy, it tends to irk me a bit.
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]
Re: Re:
Don't get me wrong.. I am NOT in favor of the Cybersecurity Act for a variety of reasons, most of which you already mentioned. I don't want to see the thing passed either.
My concern was more the approach to many of the cyber security articles that show up here. Many of them DO seem to question if these attacks are real, or just fabricated to justify poorly written laws. At least that's how I've been reading many of them.
[ link to this | view in chronology ]
Re: Re: Re:
There does appear to be an effort to transfer the paranoia of terrorists into the area of computer security, presumably in an attempt to get draconian laws passed.
From a security perspective, this is just as counterproductive as pretending that there is no threat at all.
[ link to this | view in chronology ]
Re:
1) See the reporting that the DHS was pleased that the myth of the Russian attack on a water station was being propagated.
2) There is a simple solution to the 'infrastructure attack' problem. Don't hook that stuff up to the internet.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Seems to be the M.O.
[ link to this | view in chronology ]
That's not hacking
[ link to this | view in chronology ]
[ link to this | view in chronology ]
[ link to this | view in chronology ]
There seems to be a connection here, at least as tenable as the one you are trying to make.
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Missed it by THAT much
In related news, Washington DC found to be the murder capital of the world. Congress urged to pass more laws against murder.
[ link to this | view in chronology ]
So what else is new?
[ link to this | view in chronology ]
So what is being done about cybersecurity?
[ link to this | view in chronology ]
And what about the attack on the banks?
You'd have to be an idiot to not think this is positioning by our "most trusted".
[ link to this | view in chronology ]
Re: And what about the attack on the banks?
Isn't that the point, though? Between governments and criminals, that which can be hacked will be hacked. What should we do? How do we, citizens of the world, protect ourselves? Or do we concede that we can't?
[ link to this | view in chronology ]