Personal data for more than 130K U.S. Navy sailors hacked

If you're a state actor (Russia, China etc.) that has a sufficient funding / motivation to take a dataset like this and systematically blackmail people in it for information, it seems naïve to think that those states haven't had this sort of information for decades already through traditional espionage methods.

our government doesn't give a shit because we "hack" foreign nationals/governments so regularly that 130k accts doesn't register as an issue.

it really is child's play

You have just described the spy-vs-spy-vs-countrer-spy-vs-??? intelligence and counterintelligence dance that has been happening for at least 100 years. The situation is the same, just the modus operandi has changed.

'Sovereign Invidual'[0] makes a good case of how all the hacks and leaks across the board will eventually drive the adoption of encryption, which in turn will lead to the gradual transition of power away from nation states (mostly in the economic sense).

[0] https://www.amazon.com/Sovereign-Individual-Mastering-Transi...

I hypothesize this is not so much about influencing US policy and action directly, or even about spying on assets, but more about mutually assured destruction for when a cyber war breaks out.

The state actors responsible for this want the US to know that they have these records. That they can attack/disturb/flood the personal computers, social networks, and family of these soldiers / military assets.

Also note the apparent warning in the Shadow Brokers auction:

> You see what cryptolockers and stuxnet can do. You see free files we give for free. You see attacks on banks and SWIFT in news. Maybe there is Equation Group version of cryptolocker+stuxnet for banks and financial systems? If Equation Group lose control of cyber weapons, who else lose or find cyber weapons? If electronic data go bye bye where leave Wealthy Elites? Maybe with dumb cattle?

> Can you as the CIO be trusted with highly personal, highly sensitive data on millions of Americans?

Perhaps a better question is: can anyone be expected to properly secure data on that scale, against well-resourced malicious actors?

Take the violated trust in the CIO top of the Navy releasing this news on the day before Thanksgiving.

I bet quite a big number of those federal CIOs got their "education" from:

"Center of Information Assurance and Cybersecurity at the University of Washington, designated by the NSA/DHS as a Center for Academic Excellence in Information Assurance Education and Research"

http://www.washington.edu/research/centers/126

http://www.uwb.edu/ciac

https://www.pce.uw.edu/certificates/information-security-and...

Taught by a ~70 year old woman with lit major, MBA, fake IT Phd and zero real IT knowledge https://www.coursera.org/instructor/~115

I took three classes wasting my time listening to >50 year old industry veterans(LAX airport CISO boasting how he doesnt know _anything_ about computers etc) tell me CIO role is to get a piece of paper stating you delegated responsibility and obey all the federal/industry pat on the back standards (PCI, HIPAA, SOX).

So you think that laptop is sitting on cinderblocks somewhere or what?

Agreed,how long is the investigation? It's only been a month. Isn't saying it hasn't been used at this stage kind of absurd?

Why even mention that part at all, just makes them sound dumber. Should have just said "there's an active investigation, we will release the full scope in a report later"

I don't think the laptop was specifically targeted. People generally don't follow the rules and walk around with too much information that isn't secure. They're bamboozled with phishing and like to click on rar files that have their FEDEX shipping documents for a package they never sent.

Or they have a developer image on their laptop that isn't locked down and download Warez or Torrent and visit Porno sites.

Until there are consequences when this kind of thing happens, like people getting fired or severe penalties, I'm afraid it will just continue. It's either some 15 year old kid in Eastern Europe or the Chinese and Russians have some more info to build dossiers on the American Armed Forces.

That's the problem, but on the other hand, "move fast and break things" doesn't work very well in military. Some middle ground solution is needed here.

Because private industry clearly has managed to avoid any security breaches?

For the last ~5 years the only credit card that hasn't been reissued before the expiration date because of some large corporate data breach is the one I never use.

"its contractors", "its long"

The answer is don't outsource things like this to Booze Muhkidney

Hard-wired terminals in secure rooms, airgapped from the internet and no external/portable devices allowed, enforced by there being no sockets, and if that fails, by Marines with rifles. It really is not difficult to make a system 100x securer than that one...

You probably have no idea the degree to which the IT people in and around the military maximize their belief that those simpleton sailors not in the IT circle of trust are sheeple, and that they, the IT gods are, each and every one, the grand saviors of the Republic.

That sort of arrogance begets an unprecedented sense of entitlement. Coupled with a severe dependence on Microsoft Tuesday updates, and a general inability to recognize an SQL query (not making that up), and you have a real problem.

I would not doubt, for a second, that 134k SSNs were on some contractor's laptop.

HP does government consulting, it's quite likely they were working on an application that needed access to that data. When I was a civilian working in Navy medicine (building apps), that was often the case.

I can imagine this happening very easily. Let's say a contractor is helping add a module to some web application...

"It worked on test, but not in production. It's supposed to be live already, what's the holdup? Fine, I'm not supposed to do this but I'll give him access to the live-server, read only, of course, since you have security clearance anyway. Plus, the data is in the DB, not on the application server. Ok, so now you have the whole /deploy folder, find the issue..."

"What do you mean you lost you laptop on the metro this morning? Fuck! Ok, well you only had access to the /deploy folder, but now I'm required to audit your laptop's backup to see if you had anything important, what a pain in the ass. Wait, what's this? There are all these XML files with personnel data in them in /deploy/api/xml/!!!!! Those files are supposed to be processed and removed from the web server, not stored! Shit!"

It was probably the MS Access database from BUPERS. It gets mailed to every command (or downloaded nowadays) on a monthly basis. It has everything on everyone. SSN, names, addresses, ranks, birthdays, etc. At least 50 fields of personnel info for almost everyone in the Navy. And it's not classified, otherwise they wouldn't be able to distribute it so widely (although they could at least make it Secret since most admin have Secret clearance, but most admin also work on unclas machines, so I guess not).

Source - I was a Yeoman in the Navy and had access to this. I already didn't think much of the Navy's PII procedures, but seeing this thing for the first time blew me away. It shouldn't exist.

It's pretty common for the government to do this sort of thing --

http://www.cnn.com/2009/POLITICS/01/27/va.data.theft/ 600+

http://thehill.com/policy/technology/97817-va-loses-another-... 26.5 million veterans/active

The funniest part of all of this is that the non veterans here seem to be surprised by this.

The real question is why not? Its not like HP will be fined to the tune of tens of millions for the breach, at best they will get stern reprimand letter.

Let's set up some predictions: more or less than the OPM hack?

The general public sees members of the armed services as people who, for one, are contractually obligated to be guinea pigs. I doubt there will be a huge reaction outside e.g. opsec circles, for better or worse.