Verizon Wants $1 Billion Discount After Yahoo Scandals, Still Fancies Itself The New Google

from the we're-innovative-if-we-say-we-are dept

With wireless and fixed-line broadband growth slowing, Verizon has been steadily expanding into new growth territories to try and please insatiable investors. So far, that apparently includes buying failed 90s internet brands like Yahoo and AOL in the belief that it can somehow become a Millennial advertising juggernaut. Except that hasn't been going particularly well, as the stodgy old telco realizes that it's kind of hard to innovate when you've spent the last thirty years bumbling about as a government-pampered telecom monopoly almost solely focused on turf protection.

And things have been going notably worse for Verizon over the last month, as the company has acknolwedged that Yahoo failed to reveal not only the 2014 hack of 500 million user accounts, but also its recently disclosed wholesale e-mail spying for the U.S. government during negotiations. That has prompted rumors that Verizon is looking for a billion-dollar discount off the original $4.8 billion Yahoo asking price:

"In the last day we’ve heard that [AOL boss] Tim [Armstong] is getting cold feet. He’s pretty upset about the lack of disclosure and he’s saying, ‘Can we get out of this or can we reduce the price?’” said a source familiar with Verizon’s thinking. That might just be tough talk to get Yahoo to roll back the price. Verizon had been planning to couple Yahoo with its AOL unit to give it enough scale to be a third force to compete with Google and Facebook for digital ad dollars.

Of course "scale" isn't enough to compete with Facebook and Google when you lack anything resembling disruptive or innovative DNA, though Verizon seems intent on learning this the hard way. Verizon CEO Lowell McAdam says the company has no intention of backing away from the deal, and continues to insist that despite Yahoo being a vicious shitshow, it's the missing link necessary to transform Verizon from stodgy old telco to innovative advertising juggernaut:

"I think, and we’ll see how AOL and Yahoo come together, but I think that entity can be easily one of the top three,” McAdam said at the conference. “I think we can provide the content and applications that will stand up with anything that goes up on the West Coast."

Right. But so far, there's absolutely zero indication that's going to be the case. One of the key cornerstones of Verizon's attack plan has been Go90, a new streaming video service tailored to Millennials. The problem? Those advertising and content partners McAdam claims are so excited about Verizon's entry into the market think the platform is a disaster of colossal proportions:

"Early on, we thought the platform had promise, but it was an absolute dud when it launched,” says one Go90 publishing partner. “We get the sense that unless you’re one of the premier folks they paid piles of money to [for original content], there isn’t much there from a traffic perspective,” said another. “Based on the plan they had originally laid out, it would have been a mid-tier platform for us — millions of views per month, at worst — but it’s turned out to be far, far worse than their projections,” says yet another."

Fancy! So not only did Verizon gobble up a number of underwhelming 90s internet brands in the hopes of striking it rich in content, its own foray into content has been painfully underwhelming (something that should have been apparent to anybody who remembers Verizon's first, brief attempt at original content, SugarString). Combine that with the money Verizon will have to dole out once the lawsuits over the Yahoo hack begin flooding in, and you've got the kind of pivot and metamorphosis that makes Jeff Goldblum's experience in The Fly look arguably pleasant.

Filed Under: hacking, mergers, security, surveillance
Companies: verizon, yahoo

Obama Promises 'Proportional' Response To Russian Hacking, Ignores That We Started The Fight

from the bogus-moral-high-ground dept

We've noted several times how launching cyberwar (or real war) on Russia over the recent spike in hack attacks is a notably idiotic idea. One, the United States effectively wrote the book on hacking other countries causing all manner of harm (hello, Stuxnet), making the narrative that we're somehow defending our honor from shady international operatives foundationally incorrect. And two, any hacker worth his or her salt either doesn't leave footprints advertising their presence, or may conduct false flag operations raising the risk of attacking the wrong party.

After significant pressure from intelligence industry saber rattlers and the cybersecurity firms that profit from cyber-hysteria, President Obama this week proudly proclaimed that the U.S. government would be launching a "proportional" response to Russia's recent slate of hacking attacks:

"We obviously will ensure that a U.S. response is proportional. It is unlikely that our response would be announced in advanced. It’s certainly possible that the president could choose response options that we never announce," Earnest told reporters aboard Air Force One. "The president has talked before about the significant capabilities that the U.S. government has to both defend our systems in the United States but also carry out offensive operations in other countries," he added. "There are a range of responses that are available to the president and he will consider a response that’s proportional."

Again though, the very idea that the United States would be "responding" is fundamentally incorrect. We've been engaged in nation state hacking and election fiddling for decades, happily hacking the planet for almost as long as the internet has existed. We use submarines as underwater hacking platforms, the U.S. government and its laundry list of contractors routinely hacking and fiddling with international elections and destroying reputations when and if it's convenient to our global business interests. Our behavior in 1970s South America giving tech support to Operation Condor is the dictionary definition of villainy.

Yet somehow, once countries began hacking us back, we responded with indignant and hypocritical pouting and hand-wringing. But the reality is we are not some unique, special snowflake on the moral high ground in this equation: we've historically been the bully, and nationalism all too often blinds us to this fact. Long a nation driven to war by the weakest of supporting evidence, hacking presents those in power with a wonderful, nebulous new enemy, useful in justifying awful legislation, increased domestic surveillance authority, and any other bad idea that can be shoe-horned into the "because... cybersecurity" narrative.

And as we're witnessing in great detail, hacking has played a starring role in this nightmarish election, with Donald Trump giving every indication he intends to only ramp up nation state hacking as a core tenet of his idiocracy, and Hillary Clinton lumping Russia, hackers, and WikiLeaks into one giant, amorphous and villainous amoeba to help distract us from what leaked information might actually say about the sorry state of the republic.

We're wandering into extremely dangerous territory here. As we saw with Stuxnet's impact on companies like Chevron, the United States' hacking behavior has had very real, negative repercussions for innocent third parties around the globe. Operating from the belief that we're somehow nobly defending ourselves is a falsehood the media consistently perpetuates, making this kind of dangerous digital saber rattling easier than ever for those in power. The U.S. press and public can no longer afford to be so viciously naive as 2016 stumbles drunkenly to its welcome conclusion and hacking becomes the bogeyman du jour for the next administration.

Filed Under: cybersecurity, escalation, hacking, obama, russia, white house

US Gov't Officially Accuses Russia Of Hacking... Question Is What Happens Next

from the this-is-unlikely-to-end-well dept

It's been quite a crazy Friday, and in the midst of it all, the US government finally came out with an official accusation that Russia is behind various hack attacks concerning the US election:

The U.S. Intelligence Community (USIC) is confident that the Russian Government directed the recent compromises of e-mails from US persons and institutions, including from US political organizations. The recent disclosures of alleged hacked e-mails on sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona are consistent with the methods and motivations of Russian-directed efforts. These thefts and disclosures are intended to interfere with the US election process. Such activity is not new to Moscow—the Russians have used similar tactics and techniques across Europe and Eurasia, for example, to influence public opinion there. We believe, based on the scope and sensitivity of these efforts, that only Russia's senior-most officials could have authorized these activities.

The same report says that they don't (yet) have enough information to also accuse Russia of the recent hacks on state election computers:

Some states have also recently seen scanning and probing of their election-related systems, which in most cases originated from servers operated by a Russian company. However, we are not now in a position to attribute this activity to the Russian Government.

But they also stick with the party line that actually hacking the election would be difficult:

The USIC and the Department of Homeland Security (DHS) assess that it would be extremely difficult for someone, including a nation-state actor, to alter actual ballot counts or election results by cyber attack or intrusion. This assessment is based on the decentralized nature of our election system in this country and the number of protections state and local election officials have in place. States ensure that voting machines are not connected to the Internet, and there are numerous checks and balances as well as extensive oversight at multiple levels built into our election process.

Of course, people have been pointing the finger at Russia over these hacks for a while, and according to various reports there's been widespread debate within the Obama administration about making a public accusation. There are two main issues here:

1. Attribution for computer attacks is really really difficult. No one knows for sure, and there are ways to spoof where attacks come from. There does appear to be quite a lot of evidence pointing back at Russia for these hacks, so it does seem like a safe bet. But that doesn't mean it's definitely them. It would be nice if people gave actual confidence values when they make statements like these, but no one in politics ever does that these days.
2. The much bigger question is what comes next. There are political benefits and costs to naming Russia. But the big thing here is that by naming Russia, it gives the US government more leeway to do something in response. And, as we warned many months ago, this is a horrifically bad idea. It will only escalate matters and make things worse overall.

As I noted just the other day, cybersecurity should be a defensive game. Going offensive is really, really dangerous, because things will get worse, and we really don't know what the capabilities of the other side(s) truly are. Focus on protecting critical infrastructure, not on some meaingless symbolic strike back.

But, of course, in this day and age, people seem to feel that every action requires some sort of reaction, and in a computer security realm, that's just stupid. But it seems to be where we're inevitably heading. The cybersecurity firms will get wonderfully rich off of this. But almost everyone will be less safe as a result.

Filed Under: cybersecurity, cyberwar, dhs, hacking, nsa, russia

Congressional Rep Mike Honda Sues Challenger Ro Khanna For CFAA Violation Over Access To His Donor List

from the oh-boy dept

So, the CFAA strikes again, and this time right in the heart of a Silicon Valley political fight. If you live in or around the Silicon Valley tech industry, you probably know who Ro Khanna is. He's often been described as the "candidate for Congress that Silicon Valley prefers." It feels like he's been running for Congress against incumbent Rep. Mike Honda forever, but it's really just in the past two elections. Here's a big Bloomberg profile of him from 2013 when he first challenged Honda, losing narrowly to him in the 2014 election, despite having support from many Silicon Valley tech industry stars. This year, he's running again, and in the primary, Khanna narrowly beat Honda, suggesting good things in the general election in November (the top two candidates in the open primary move on to the general election, regardless of party).

Khanna is known for his pro-internet views, while Honda has a reputation for not really understanding or caring very much about the internet.

And now... Honda has sued Khanna under one of the most hated laws on the internet, the CFAA (Computer Fraud & Abuse Act). As we've discussed for many years, the CFAA was supposed to be an "anti-hacking law" that was created by politicians who were (literally, no joke) scared by the fictional movie War Games into writing an anti-hacking law in the 1980s. The law has many, many, many problems, but the biggest one, which comes up again and again in cases, is that it has a vague standard of "unauthorized access" or "exceeding authorized access."

Not surprisingly, that's the issue in this case as well. In short, Brian Parvizshahi was (until Thursday night) Khanna's campaign manager. Way back in 2012, Parvizshahi had briefly (as in, for just a few weeks) worked at Arum Group, an organization that helped Mike Honda with fundraising. After he left Arum Group, apparently no one at the company thought to turn off his access to the Dropbox where they stored all their info about donors. Now, to most people, you'd think that the issue here would be Arum Group's bad policies. But, under the CFAA some can argue that continuing to access that file is a form of "unauthorized access."

And that's the central claim here in the lawsuit. Honda claims that Parvizshahi continued to access that Dropbox folder that he was given access to four years ago and which Arum Group never shut down -- and thus he, and the whole Khanna campaign -- violated the CFAA. You can see the full filing here.

Now, we can say that Parvizshahi continually accessing this info -- especially after starting to work for Khanna -- was really, really dumb. Especially since his actions were clearly viewable in Dropbox -- including cases where he supposedly "edited" the files. From the lawsuit, here's just one of many, many images: It is worth noting, though, that some of the screenshots merely show Parvizshahi "adding" the document to his desktop, which might have happened automatically if he was syncing his Dropbox account to his computer, which is the way many people set things up.

One other sketchy thing here is that someone sent a copy of Honda's donor list to San Jose Inside magazine in late 2015 -- and apparently the file they got matched a file in the Dropbox folder that Parvizshahi had accessed.

So while it may have been dumb for him to do so, the real fault here would seem to lie with Arum Group for (1) giving Parvizshahi access on what appears to be his personal Dropbox account, rather than adding a professional account that it controlled and (2) failing to revoke his access after Parvizshahi left, and not even noticing it for years. That seems to be the really negligent move here.

But, with the way courts have been interpreting the CFAA, it does seem entirely possible (if ridiculous) that a California court could interpret this to be a CFAA violation for Parvizshahi at the very least. If that also applies to Khanna, that would seem doubly ridiculous. Either way, as far as I can tell, while Khanna has taken a position on a number of issues related to tech policy, I don't see anything about the CFAA. Perhaps this particular episode will change that.

Filed Under: brian parvizshahi, campaigns, cfaa, donor lists, hacking, mike honda, ro khanna

UK Court Says Lauri Love Can Be Extradited To Face Hacking Charges In The US

from the big-brothers-gotta-stick-together dept

Lauri Love, the British hacker the DOJ has been dying to get its hands on, has just been handed over to the US by his own government. The decision issued today [PDF] basically states that honoring extradition agreements is more important than any concerns issued about Love's health and well-being once handed over to US federal agents.

Mr Love’s Article 8 rights are clearly engaged. In balancing the factors for and against extradition I am satisfied that the very strong counter-balancing factors required to find extradition would be disproportionate are not found in this case. Mr Love faces extremely serious charges for offences of computer hacking over a period of one year from October 2012 to October 2013. I accept Mr Love suffers from both physical and mental health issues but I have found the medical facilities in the United States prison estate on arrival and during any sentence if he is convicted available to him, are such that I can be satisfied his needs will be comprehensively met by the US authorities.

I am satisfied Mr Love’s extradition would be compatible with his Convention rights and I send this case to the Secretary of State for her decision as to whether or not Mr Love should be extradited.

Once in the US, authorities have promised to address Love's mental and physical health concerns by placing him in "segregated housing" while determining if he's capable of being housed in the general population. As anyone who's followed prosecutions of whistleblowers and hackers knows, "segregated housing" is just a colorful term for "solitary confinement" -- not generally known to improve the mental well-being of people who've already expressed suicidal thoughts.

On top of a trip to solitary, Love will be facing charges from three jurisdictions related to the alleged hacking of multiple government/government contractor websites and databases.

Mr Love is accused in three indictments in three districts as follows:

(i) Southern District of New York – Mr Love faces two counts on Indictment, one of computer hacking (maximum sentence of 10 years imprisonment) and one of aggravated identity theft (maximum sentence of 2 years imprisonment to be imposed consecutively to the sentence for count 1).

(ii) The New Jersey request details two counts on one indictment. One count is conspiracy to access a computer without authorisation and obtain information from a department or agency of the United States (maximum sentence of 5 years imprisonment) and one of accessing a computer without authorisation and obtaining information from a department or agency of the United States (maximum sentence of 5 years imprisonment).

(iii) The Eastern District of Virginia request contains nine counts on an Indictment, count 1 – conspiracy to cause damage to a protected computer and to commit access device fraud (maximum sentence of 5 years imprisonment); counts 2 -7 – causing damage to a protected computer and aiding and abetting (maximum sentence of 5 years imprisonment); count 8 – access device fraud and aiding and abetting (maximum sentence of 10 years imprisonment) and count 9 – aggravated identity theft and aiding and abetting (maximum sentence of 2 years imprisonment).

There's little to be gained by adding up the maximum possible jail sentence facing Love. Rest assured, if convicted, it will likely be over a decade. Consolidation of the cases and charges is likely, but more than one of the charges carry possible 10-year sentences.

Meanwhile, back in the UK, Love has managed to escape being jailed for refusing to turn over passwords and encryption keys to law enforcement. UK investigators fought hard to force Love -- who they've never formally charged -- to crack open multiple seized devices for them. This attempt was shot down in May by a judge who viewed this as an end run around protections built into RIPA, the laws governing law enforcement's investigatory powers.

The final decision on Love's extradition is in the hands of Elizabeth Truss, the recently-appointed Secretary of State for Justice. Truss' previous government work doesn't really provide much guidance on which side she'll come down on this, but her voting record tends to indicate she's more sympathetic to national security/law enforcement interests than those of her constituents. Considering the UK and US have a very cozy surveillance relationship, it stands to reason Truss will likely decide to appease the DOJ, rather than overturn the court's decision.

Filed Under: cfaa, extradition, hacking, lauri love, uk, us

Pressure Mounts to Punish Russia For Hacking Without Evidence And Before Investigations Are Concluded

from the evidence-is-for-sissies dept

While it's certainly possible Russia has been busy using hackers to meddle in (or at least stoke the idiot pyres burning beneath) the U.S. elections, we've noted how actual evidence of this is hard to come by. At the moment, most of this evidence consists of either comments by anonymous government officials, or murky proclamations from security firms that have everything to gain financially from stoking cybersecurity tensions. Of course, transparent evidence is hard to come by when talking about hackers capable of false flag operations while obfuscating their footprints completely.

Granted that hasn't stopped people from demanding a cyber or real world attack on Russia, both idiotic ideas for what should be obvious reasons. But with no hard evidence forthcoming, those looking for perceived justice are apparently getting a little punchy. The Washington Post notes that the government continues to conduct an investigation into the DNC hacks, but the whole "obtaining actual evidence before doing anything stupid" thing is clearly frustrating the 1980's action movie sect of the intelligence community:

"The White House’s and some Cabinet officials’ insistence on awaiting the probe’s results has frustrated some officials at the FBI, the Justice Department and within the intelligence community, who favor holding Moscow accountable. The White House’s continued requests for more evidence, said one official, is “to delay — purposely delay” a public attribution."

Again, it's not like you're going to find a goddamned memo linking Russia to the DNC hacks, and any hacker worth his or her salt isn't going to leave evidence of the hack or their ties to a nation state. There's also the ongoing reality that the leading country when it comes to nation state hacking has generally been the United States, making any vocal moral repudiation kind of laughable. Still, that doesn't seem to be stopping folks like Senator Ben Sasse, who insists that we should just skip the whole actual evidence thing and proceed to lambasting Russia for doing what the United States has done for decades:

"Sen. Ben Sasse (R-Neb.), a member of the Homeland Security committee, said President Obama should publicly name Russia and do so before the November election. A failure to do so will only encourage further cyber intrusions and meddling in the U.S. election, he said.

“If the Obama administration has a reason for not clearly attributing these hacks to Russia, it contradicts their own cyber strategy,” Sasse said. “If they’re silent because it would invite response, that suggests that we’re operating from a position of weakness — in other words, we know that we need to aggressively deter cyberattacks, but we are too vulnerable to do it. Neither scenario is reassuring."

But again, what good is publicly shaming Russia for hacking when you've spent decades doing the same thing -- or worse? The only net outcome is you wind up looking like a giant, blithering hypocrite to the global community. The entire article stumbles on like this, quoting various officials on and off the record demanding we do everything from impose sanctions to start leaking Putin's dirty laundry:

"The National Security Agency, for instance, could disrupt a Russian computer system in a way that leaves no doubt who did it and that warns the Russians “to knock it off,” one former intelligence official said. Or the CIA could leak documents that are embarrassing in some way to Russian President Vladi­mir Putin."

Attack! Attack! Who needs evidence? Who needs the moral high ground? Generally, the press-driven public dialogue on cybersecurity and intelligence is so far from what's actually happening in the wild (as intelligence whistleblowers illustrate every few years) that one really should treat press reports on the subject as creative fiction. Combine that with the way nationalism leads to hypocrisy and the fact that most of these "former intelligence officials" don't even know what a gigabyte is, and you've got a recipe for keystone-cops-esque high comedy.

Again, none of this is to suggest that Russia isn't hacking the United States. But to ignore that all nation states are hacking each other all the time is myopic, and suggesting the DNC attack constitutes some rare breach of international ethics is hysterically naive given what we know about the States' own hacking attacks. The real danger here remains the threat of false flag hacking attacks and misinformation campaigns designed to prompt countries to dramatic action without substantive proof. The smarter path is to focus this energy on securing, upgrading and patching government systems to protect against intrusion, even though that's certainly a lot less fun than starting a new world war just because you think hard evidence is for sissies.

Filed Under: cybersecurity, dod, doj, hacking, politics, response, russia, us government

FBI Arrests Two Suspects Involved With Hacking Of CIA Director's Personal Email Account

from the hack-the-CIA-and-FBI,-but-keep-chatlogs-and-use-Twitter-DMs-because-?? dept

The alleged hackers who social engineered their way into CIA director John Brennan's personal email account have been rounded up by the FBI. The so-called "Crackas With Attitude" collective lost two of its members to the federal court system late last week.

Andrew Otto Boggs, 22, who allegedly used the handle Incursio, or IncursioSubter, and Justin Gray Liverman, who is suspected of using the moniker D3f4ult, were arrested on Thursday, according to a press release by the US State’s Attorney’s Office in the Eastern District of Virginia.

The affidavit [PDF] in support of the arrest warrant is a hell of a read -- although possibly a very trying read for those with limited patience for txt spk and l33t h4x0r screen names. It's also a cautionary tale of hubris winning out over operational security, somewhat ironic for a group of hackers who took obvious glee in pointing out how terrible everyone else's security is.

The group made heavy use of social media, and in particular Twitter, to spread news of the dumps and mock victims. However, according to the affidavit, Boggs allegedly connected to one of the implicated Twitter accounts (@GenuinelySpooky) from an IP address registered to his father, with whom Boggs lived.

Much the same mistake led to Liverman’s identification: an IP address used to access the Twitter handle @_D3F4ULT and another account during the relevant time period was registered to an Edith Liverman. According to the affidavit, publicly available information revealed that Justin Liverman lived with Edith at the time.

The affidavit also includes several sets of Twitter direct messages between members of the group.

Also uncovered during the investigation were stored chat logs and screen recordings of the hackers in action.

Possibly of use in connecting the dots for the FBI was one of the accused's (supposed) participation in the Pentagon's bug bounty program -- something he would have had to sign up for using verifiable information.

Justin Liverman, who goes by the handle “D3F4ULT,” according to a press release by the US Attorneys Office for the Eastern District of Virginia, states on his LinkedIn page that he participated in the HackThePentagon program.

Or not...

HackerOne would not confirm or deny whether Liverman participated in its HackThePentagon program. However, requirements for gaining clearance to submit to the bounty were lax. To qualify, hackers had to be US persons and couldn’t appear on the US Treasury Department’s Specially Designated Nationals list of people and organizations engaged in terrorism, drug trafficking and other crimes, according to a Department of Defense press release.

Tough to verify when the person in question spent nearly as much time shit-posting as hacking. All in all, CWA seemed to be a fun, if not overly-cautious bunch that truly enjoyed worming their way into the inner computing spaces of high-ranking government officials.

However, this does not mean the group was mostly harmless. The affidavit shows the arrestees allegedly engaged in nastier activities as well.

Liverman also allegedly used a phone number linked to the @_D3F4ULT account to call one of the unnamed victims, and even recorded himself paying for a phone-bombing service to bombard the target’s device with calls.

The affidavit contains one of the hackers stating another sent a victim's phone "720 voicemail threats and like a thousand goatse sms image messages."

Also from the affidavit, a little IM action about calling in a bomb threat at a local law enforcement office.

Meanwhile, those remaining are claiming two things: that there are more hackers still on the loose. And that the FBI has the wrong guy… in all senses of the word.

Zoom claimed to have been raided earlier this year, but said he hasn't been arrested nor charged yet. The hacker also claimed that the FBI got the wrong person arresting Boggs because Incursio was actually a woman.

“Its not like this isn't the first time the FBI has been confused,“ Zoom said.

If nothing else, the CWA hackings proved government agencies like the DHS and FBI must not be able to hear themselves talk when they demand more data on Americans, despite not being able to secure the information they already have from 16-year-old hackers who go by the name of "penis" on Twitter. Their efforts also made it clear that most cell phone service providers' authentication processes have miles to go before they even approach "competent."

Filed Under: andrew boggs, cia, crackas with attitude, email, hacking, jon brennan, justin liverman

FBI Director: Our Electronic Voting System Is Such A Complete Mess, It Would Be Difficult To Hack

from the well,-then dept

There's been plenty of talking going around this election cycle about the terrible security problems with our current voting technology -- along with some conspiracy-theory level talk of foreign agents looking to "hack" the election. We haven't been very impressed with officials telling us all to calm down and it's difficult to see how FBI director James Comey did himself any favors by basically arguing that the voting system is secure... mainly because of what a complete and utter mess it is. The larger point he's making is somewhat valid, if clunky, in the fact that each state runs their own voting, so it's not like hackers can get into one central system and wreak havoc. The different systems definitely make it harder. But arguing that this is a sign of good security seems kind of ridiculous:

“The beauty of the American voting system is that it is dispersed among the 50 states, and it is clunky as heck,’’ said Mr. Comey. “A lot of people have found that challenging over the years, but the beauty of that is it’s not exactly a swift part of the internet of things, and so it is hard for an actor to reach our voting process.’’

Yeah, that's basically security through obscurity... at scale. Not exactly very reassuring, even if the underlying point may be true.

Wouldn't it be better if we just made sure the systems were actually secure (i.e., not computerized and connected to the internet) rather than just "clunky"?

Filed Under: e-voting, elections, fbi, hacking, james comey

OPM Hacking Report Says Agency Missed One Set Of Attacks, Spent Little On Cybersecurity

from the security:-always-worth-taking-seriously-AFTER-the-damage-is-done dept

The twice-hacked Office of Personnel Management has had little to offer but promises of "taking security seriously" and free identity theft protection for the thousands of government employees whose personal information was pried loose by hackers.

Twice-hacked, because there was one breach the OPM did discover, and one it didn't. While it spent time walling off the breach it had detected, another went unnoticed, leaking enough info on government employees that the CIA began worrying about the safety of agents located abroad.

A new report [PDF] by the Committee on Oversight and Government Reform (which AP refers to but, oddly, does not feel compelled to LINK to, despite it being a completely PUBLIC document) details where the OPM initially went wrong.

The government discovered the first hacking in March 2014. A Homeland Security Department team noticed suspicious streams of data leaving its network between 10 p.m. and 10 a.m. — the online equivalent of moving trucks hauling away filing cabinets containing confidential papers in the middle of the night. The government's Einstein intrusion warning system detected the theft.

[...]

For the next few months, the personnel office worked with the FBI, National Security Agency and others to monitor the hacker to better understand his movements. Officials developed a plan to expel the hacker in May 2014. That effort included resetting administrative accounts, building new accounts for users who had been compromised and taking offline compromised systems.

Good moves in the wake of a breach, although I'm sure the thousands affected would have preferred a more proactive approach -- like using available cybersecurity tools to help prevent breaches from occurring in the first place. Those tools are what detected the second, still-ongoing breach that the OPM failed to notice when patching up the first hole.

[F]our people familiar with the investigation said the breach was actually discovered during a mid-April sales demonstration at OPM by a Virginia company called CyTech Services, which has a networks forensics platform called CyFIR. CyTech, trying to show OPM how its cybersecurity product worked, ran a diagnostics study on OPM’s network and discovered malware was embedded on the network. Investigators believe the hackers had been in the network for a year or more.

Or, as the report puts it, the malicious code-detecting tool "lit up like a Christmas tree" when deployed. Despite this tool finding malicious code in about one out of every five OPM devices, the report notes the OPM didn't think it was worth paying for. It allowed the trial period to expire before deciding the toolset that found the second breach might be a valuable security asset.

Despite housing the personal information of thousands of government employees -- including those with high-level security clearances -- the OPM didn't take security quite as seriously as it claimed to while handing out free credit reporting, post-breach. Jenna McLaughlin of The Intercept points out that the OPM spent less money -- quite a bit less -- than many other government agencies on network security.

The personnel agency spent just $2 million in 2015 to prevent malicious cyber activity, while the Department of Agriculture doled out $39 million. The departments of Commerce, Education, and Labor also spent more in this area. Among the categories of cybersecurity spending delineated by the committee — preventing malicious cyber activity, detecting, analyzing, and mitigating intrusions, and shaping the cybersecurity environment — only the Small Business Administration spent as little as OPM (although Small Business Administration spent more overall on cybersecurity).

The OPM has responded to the report by stating it fails to account for the agency's, post-double-breach cybersecurity awesomeness. And one contributor to the Committee feels there's just not enough buck-passing in the report.

OPM responded by saying the report does not actively reflect the progress the agency has made since the hack, and Rep. Elijah Cummings, D-Md., the ranking Democrat on the House Oversight Committee, insisted the report was flawed, in part because it failed to place blame on or otherwise account for the contractors involved in the agency’s cybersecurity.

That the OPM would want the report to focus on its barn door-closing efforts, rather than its eminent hackability, is understandable. But it's also stupid to insist a report detailing past mistakes not spend more time speculating on the agency's presumably glowing cybersecurity future. The report's title is uncharacteristically (for a Congressional report) brutal and does nothing to spare the feelings of an agency that didn't appear to care until it was too late:

The OPM Data Breach: How the Government Jeopardized Our National Security for More than a Generation

But there's nothing to be gained by complaining that no one cares about the stuff you're doing correctly now -- not when it's been revealed that an agency that should have known it was, and will always be, a prime target for malicious hackers spent very little on cybersecurity and didn't deploy even the most basic security tools until well after the fact.

Filed Under: cybersecurity, hacking, opm

DOJ To Researchers: First Amendment Does Not Protect Violating Websites' Terms Of Services

from the SRO-only-in-the-court-and-not-much-here-to-grab-floor-space dept

The woefully out-of-date CFAA -- the product of panicked early-80s legislating in response to underdeveloped hacker fears -- continues to hold back research (both of the security and non-security kind) when not being wielded like the prehistoric weapon it is by the DOJ and multiple entities who prefer bludgeoning the messenger to fixing their broken systems.

Because of the ongoing misuse and abuse of a badly-written law (aided and abetted by some terrible court decisions), a group of academic researchers has decided to proactively sue the government over its terrible legislation, rather than wait around to get sued/indicted for attempting to determine if individual websites exhibit bias against certain users.

They've enlisted the help of the ACLU, which filed its suit against Attorney General Loretta Lynch back in June. The DOJ has responded with a motion to dismiss [PDF] that claims everything is wrong with the lawsuit, from the issue of standing to multiple failures to state a claim under the First and Fifth Amendments.

Plaintiffs fail to allege an injury in fact sufficient to meet the constitutional minimum of standing. Standing to assert pre-enforcement statutory challenges under the First and Fifth Amendments may exist where the statute in question regulates constitutionally protected conduct and a credible fear of prosecution exists. The challenged provision of the CFAA, however, does not facially regulate protected conduct, and the conduct in which plaintiffs intend to engage—deploying information-gathering software on the websites of non-consenting private entities—is not activity that the First Amendment protects. Moreover, plaintiffs fail to provide any facts indicating a credible threat that the challenged provision will be enforced against them: plaintiffs do not allege to have been investigated by law enforcement or threatened with an enforcement action; plaintiffs do not identify any cases in which the government has sought to enforce the CFAA for harmless terms of use violations that were not in furtherance another crime or tort; and the government has affirmatively stated that it has no intention to enforce the CFAA under the circumstances alleged here. Accordingly, plaintiffs are unable to assert an objectively credible threat of prosecution and, as a result, their complaint must be dismissed on standing grounds.

It is indeed difficult to sue to prevent things from happening, rather than suing to seek recourse after damage has been done. Speculating about future Constitutional violations is even less likely to succeed, as many courts tend to avoid tangling with any civil liberties questions not directly implicated by the case at hand. These two issues alone may find the court agreeing with the DOJ's assertions.

However, other assertions made by the government aren't as solid. While it is true the DOJ tends not to prosecute simple CFAA violations without a connection to other criminal activity, when it does choose to do so, it tends to respond with zealous, fear-based prosecution and incredibly severe sentence recommendations.

That the DOJ has magnanimously offered to not enforce the CFAA against the researchers at this point is heartening, as far as that promise goes. The DOJ may have no intention of doing so now, but if the researchers roll up on the wrong website and set some influential wheels to squeaking, that could change.

The DOJ is on less solid ground when it argues the CFAA does not create a chilling effect. It may be that the research effort (deploying bots to simulate job seekers, home buyers, etc.) is not a form of protected speech, but that doesn't mean speech -- and research efforts -- aren't being deterred by the badly-written and vaguely-interpreted law.

The government doesn't contend, however, that the results of the research won't be protected under the First Amendment -- just that the method of gathering the data isn't.

Here, plaintiffs allege that the challenged provision of the CFAA has chilled their desire to deploy software technology designed to gather information from the websites of private corporations without the permission of those corporations and in a manner that the relevant website terms of use expressly prohibit. The systemic collection of information from the websites of non-consenting private entities is not conduct the First Amendment protects, and thus plaintiffs are unable to assert a reasonable First Amendment chill with respect to that conduct.

[...]

Thus, just as there is no First Amendment right to gather information by personally travelling to a sanctioned country, and no First Amendment right to gather information by visiting a jail without the permission of the warden, and no First Amendment right to access information in electronic form rather than paper form, there is likewise no First Amendment right to gather information controlled by private entities by deploying a data-scraping computer program on the websites of those entities without their permission and in a manner that the entities explicitly prohibit.

And there's the chicken-egg problem with the First Amendment, which follows after the other chicken-egg dilemma of having to wait to be prosecuted (or threatened with prosecution) before being granted standing to challenge the government's enforcement efforts. To use the DOJ's cited equivalents, delivering the news is protected under the First Amendment. Gathering it, however, may not be.

What the DOJ doesn't spend any time explaining is why researchers might get the idea the government would come after them for performing this research. The DOJ has explicitly stated in the past that violating a website's terms of use violates the CFAA, making criminals of millions of pre-teens with Facebook or Twitter accounts. And the DOJ's own suggested rewriting of the CFAA looks to turn previous misdemeanors into felonies, including the sort of activity the researchers are proposing.

...knowingly and willfully traffics... in any password or similar information, or any other means of access, knowing or having reason to know that a protected computer would be accessed or damaged without authorization in a manner prohibited by this section…

The rewrite removes a key phrase: "with intent to defraud." This excision turns the researchers' plan to search for bias in websites into an admission of felonious intent.

That being said, there's a good chance this lawsuit will be tossed quickly. The route to CFAA reform still flows (slowly and sometimes, stupidly) through Congress. Unfortunately, the stakeholders with the loudest voices are those who prosecute under the law, rather than those punished by it. Because of that barrier to true reform, efforts to attack the law from oblique angles are likely to appear periodically until the law is overhauled… or replaced with something worse.

Filed Under: cfaa, chilling effects, doj, first amendment, hacking, research
Companies: aclu