24,000 Pentagon Files Stolen in Cyberattack
mashable.com
mashable.com
Imagine if nuclear silos were built today and powered by Windows and attached to the internet - insane, right? Well at what level is anything else that would cause headlines if hacked, okay to be attached to the internet?
As Stuxnet shows, it doesn't really matter if the machines running Windows are connected to the internet or not. They'll be compromised one way or another if someone wants to badly enough.
Government spec motherboards shouldn't even have usb headers.
Sure it's possible to program a mouse or keyboard to inject code but way way way more difficult than a thumb drive or internet connected PC.
The first military to try to order such custom, extremely expensive (no alternative market for it!) gear will be flogged and quartered alive by the press. For spending 10 or 100 times as much as CotS hardware would cost.
Good luck finding a soldier brave enough to risk his career and family's income for mere USB ports.
The only hangup I see with that is that most boards don't have PS/2 anymore and you might need to connect a keyboard/mouse. To solve that you might need to epoxy a wireless transmitter into one of the ports and pair it with mice/keyboards as needed. But for situations where wireless devices are not allowable, I can't see any cheap solution short of soldering the USB wires to the motherboard. Damn USB for being so... universal.
Or just throw some software at it so that a very, very loud alarm goes off if a new drive is mounted or detected, search people for USB devices before they enter, and keep regular backups (if you make it impossible to get data out undetected, the only thing you could do with software on a USB drive is corrupt or delete data).
Easiest question under the Sun:
it's legal and considered perfectly OK because the software, network gear and configuration comes with the right documents. As long as the documents say the right procedures were applied during development and deployment, it's considered OK.
What do you expect, particular software and network gear being declared too vulnerable merely because everybody with relevant experience know and have experienced how vulnerable it is? Bureaucracies don't work that way; never did and probably never will.
We may want to have a way to counter such useless documents to make our countries' infrastructure safer, but that's not the easiest quest under the Sun anymore...
You are in for some surprises:
http://www.wired.com/science/discoveries/news/1998/07/13987
The US military-industrial complex isn't really there for national defense, or even for the conquest of weaker nations. Rather, it is a massive wealth transfer scheme. Microsoft fits right in.
Blighty's nuclear-missile-equipped submarines, now running MS Windows.
BSOD anybody?
I mean, obviously they don't want to draw specific attention to what methods were effective to sneak into the freakin' military, but I suspect it was something simple like that. It seems to always be the case these days.
It interests me though, because I just launched a startup to help mitigate broken-into email accounts: http://www.emailambush.com/ I wonder if it WAS a hacked email account, with someone just sitting there, slurping down emailed Word and Excel files. Further, I wonder how the heck I'd even begin to approach them about my service, should that turn out to be the case. I've never dealt with large-scale procurement-style folks before.