Come for the politics, stay for the snark.

Wow, you are pre-disappointed. How surprising.

Battle won, war still ongoing.

Proof that we need a blogger ethics panel.

Fuck these fucking interesting times.

If you are still in the GOP, you are an extremist.

I’d like to think you all would remain faithful to me if i ever tried to have some of you killed.

The willow is too close to the house.

Teach a man to fish, and he’ll sit in a boat all day drinking beer.

We are aware of all internet traditions.

You cannot shame the shameless.

Impressively dumb. Congratulations.

The cruelty is the point; the law be damned.

They fucked up the fucking up of the fuckup!

Not all heroes wear capes.

That’s my take and I am available for criticism at this time.

Make the republican party small enough to drown in a bathtub.

People are complicated. Love is not.

A thin legal pretext to veneer over their personal religious and political desires

The worst democrat is better than the best republican.

This fight is for everything.

Is it irresponsible to speculate? It is irresponsible not to.

So it was an October Surprise A Day, like an Advent calendar but for crime.

Too often we confuse noise with substance. too often we confuse setbacks with defeat.

Schmidt just says fuck it, opens a tea shop.

You are here: Home / Politics / America / Operations Security Failure! Cyber Security Edition

Operations Security Failure! Cyber Security Edition

by | 92 Comments

This post is in: , , , , , , , , , , , ,

Operations Security is defined as:

Operations Security, or OPSEC, is the process by which we protect unclassified information that can be used against us.  OPSEC challenges us to look at ourselves through the eyes of an adversary (individuals, groups, countries, organizations). Essentially, anyone who can harm people, resources, or mission is an adversary.

OPSEC should be used to protect information, and thereby deny the adversary the ability to act.  Nearly 90% of the information collected comes from “Open Sources”. Any information that can be obtained freely, without breaking the law, is Open Source.  .  It is social network sites, tweets, text messages, blogs, videos, photos, GPS mapping, newsletters, magazine or newspaper articles, your college thesis, or anything else that is publicly available.

Our OPSEC objective is to ensure a safe and secure environment. OPSEC is best employed daily when making choices about what communications to use, what is written in emails or said on the phone, postings  on social networking sites and blogs.  Any information you put in the public domain is also available to your adversaries.

The bottom line is that we can be are our own worst enemy.  Google yourself or your organization and see how much you can find out.

Someone needs to do their annual training right quick!

Боже мой!

 

Reader Interactions

92Comments

  1. 1.

    Miss Bianca

    So, when is Jason Chaffetz going to convene hearings on this grave, grave breach of national security?

  2. 2.

    PPCLI

    There will be hell to pay when Jason Chaffetz finds out about this. That man is a fanatic on the subject of cyber-security. I expect hearings to start up right away.

    /s

  10. 10.

    sherparick

    Please tell James Comey he needs to expand his “e-mail” management investigation. Also, tell Dean Baquet at the NY Times that questions must be raised.

  11. 11.

    The Moar You Know

    If any of our employees here at Moar Security was forwarding to a Gmail account, never mind using it as a primary, I could and would fire them on the spot. I’d have to, actually. Google/Alphabet will happily hand over everything on an account with nothing more than a subpoena, which in several states doesn’t require a judge to issue, only a lawyer.

  13. 13.

    sharl

    Sorry, but I’ll wait for the authoritative NYT story on this that ties it to Hillary’s campaign. Gotta avoid fake news these days…

  17. 17.

    Gin & Tonic

    Haven’t heard much from Giuliani Security lately. Doesn’t look like they’ve been very busy, though.

  18. 18.

    dmsilev

    @The Moar You Know:

    Google/Alphabet will happily hand over everything on an account with nothing more than a subpoena, which in several states doesn’t require a judge to issue, only a lawyer.

    Well now. This suggests an opportunity re: Big Orange.

  19. 19.

    Xenos

    Per TPM, a top FSB official in Moscow has been arrested for treason, apparently due to being a mole for the US. It appears that someone in the Trump administration may have tipped off Putin about this.

    Seems to be worth a bit of investigating, right?

  23. 23.

    trollhattan

    @Xenos: If Trump actually burned an agent of ours…. Suppose it could also be a Vlad-directed warning to moles unknown; Cripes, where’s le Carre when we need him?

  24. 24.

    PPCLI

    @Gin & Tonic: Or perhaps the recent arrests of Russian FSB agents/possible US intelligence assets indicate that Rudy and co. have been very busy indeed.

  25. 25.

    Immanentize

    Immanentize says:
    January 25, 2017 at 1:39 pm
    @rikyrah: I saw your link on Casperscy (intentionally misspelled) in the earlier thread — my first thought is: “Are Trump people already burning our agents abroad?” I know its tinhatty, but inquiring minds want to know…

    With US assets being rounded up in Russia, I am afraid we have truly entered the frightening zone. Really scary zone.

  27. 27.

    Roger Moore

    @schrodingers_cat:

    So far a regular person what is the safest email account to have?

    It depends on your threat model. If you aren’t worried about being subpoenaed and your main worry is hackers stealing your password, Google is probably fine, especially because they offer two factor authentication*. If you’re worried about subpoenas or warrants, you should probably pick a provider like HushMail that lets you send encrypted mail**. IIRC, it’s also a good idea to download your mail to your own computer and delete it off the server so anyone who wants to look at your old mail has to physically seize your computer rather than just asking for the mail from your provider.

    *i.e. just getting your password isn’t enough to get into your account. You need to add a second passcode that changes based on the time. That code can either be texted to your phone or generated using an app.
    **ETA: The point is to encrypt the mail on your computer and send it encrypted the whole way, so it can only be opened by somebody who has the decryption key. That protects it against snooping, either by somebody hacking the connection or getting access (legal or otherwise) to the server.

  28. 28.

    JPL

    @Immanentize: The repubs will pay attention once they rid us of social security, medicare, medicaid, the ACA and get cut the taxes for millionaires and billionaires. I hope it’s not to late. By that time, our experiment in democracy could be over.

    At this point, I assume that the EU intelligence operations will no longer be sharing intel with us.

  29. 29.

    Immanentize

    @JPL: I am certain that is their plan, but this stuff seems to be moving much faster than they could have imagined. And they get Pence anyway. Unless Pence was fully in the know about impeachable stuff. At some point, the massive structural screw ups and political distractions will slow down their ability to push through their agenda.

  30. 30.

    p.a.

    Someone posted-earlier thread ?- that PootyPoot was a) disciplining his sneaks for leaving fingerprints, b) setting up deniability: rogue element of GRU KGB CHEKA whatever the f#*& they’re called now did it but has been neutralized.

  31. 31.

    Gin & Tonic

    @Gelfling 545: When he was announced a couple of weeks ago, infosec people had a blast dissecting his company’s public-facing server. Long story short – it was a total embarrassment.

  32. 32.

    Xenos

    OK,. CIA assets abroad are getting burned, the senior staff at State have been fired, and all the ambassadors have been fired with no replacement in sight.

    Can it be considered a coup if the president is wiping out the executive branch? Either way, the country is going to be unable to manage its affairs at all pretty soon.

  33. 33.

    Major Major Major Major

    Open thread?

    My friend got interviewed in New York Magazine!

    In Trump’s America, Even Puppy Twitter Is Getting Political
    By Madison Malone Kircher

    Twitter’s @EmergencyPuppy has more than half a million followers. The account, as you might have guessed from its name, is devoted to all things cute and canine, with the occasional guest appearance from a particularly tiny kitten or fuzzy ducklings. At least, that was its intention[…] back in 2011[…]

    […]

    The responses to @EmergencyPuppy’s new brand of tweets have been “overwhelmingly positive.” “Add @EmergencyPuppy to the list of freedom fighters with @TeenVogue and rogue scientists,” wrote one Twitter user, describing several other unexpected groups that have risen to become the face of the resistance. Still, Truebe says he’s also experienced some flak. “The extremely negative responses seem to come from privilege — almost exclusively white men — who feel as if I have violated some contract by switching the content up,” he said. “As if they were entitled to cute puppies and only cute puppies and that it is their right to complain about a free service I’m providing.” Truebe says for these users, his response is often to just tweet back using one particular picture of a dog with its tongue out, “it’s a good dog.”

  37. 37.

    p.a.

    @Immanentize: IF we had a fully functioning Democratic Party and a responsible media (or, let’s shoot the moon, a Dem version of FuxNews), we could tar them all together, Lord tRumpleroy, Dence, Ruin, Yertle, and take at least the Senate in ’18.

    (Don’t know the Senate race breakdown for ’18. Probably bad for Dems, of course.)

  39. 39.

    Another Scott

    So I was having a discussion with J about whether there were people (as opposed to corporations) who actually supported the TPP. I mentioned Farmers. There was lots of good information on the TPP at the USDA, but of course it was taken off-line. Much/most of it is at the Wayback Machine (but not some of the graphics I’m looking for).

    I did some more searching and it seems that the USDA has a policy of archiving stuff and a page with those TPP links is here.

    But, guess what? Clicking on those links gives different pages, or 403 errors (access denied).

    Maybe it’s just a reconfiguration issue or something, but we need to keep an eye on things like this. This was work done by the US government and the people have a right to see it.

    Cheers,
    Scott.

  40. 40.

    Gin & Tonic

    @Barney: Kinda OT, but doesn’t that guy Evan O’Connell look like the guy you’d like to kick the barstool out from under?

  42. 42.

    pseudonymous in nc

    There is an argument that having an account tied to a Gmail account is better in some ways than one tied to a personal domain: you don’t run the risk of having it compromised if the domain lapses or is hijacked. That doesn’t apply when you have access to government domain email, or if you’re working at an private org with its own professional tech security people and policies.

    2FA, though. With an OTP authenticator app or a USB key, not a text message.

  43. 43.

    Major Major Major Major

    Didn’t our last Republican administration burn an asset just for fun/spite/because they could?

    ETA: @Another Scott: To be fair, normal person websites have trouble with things like this. I can only imagine the clusterfuck that is the Trump administration trying to deal with it. This is the first time we’ve had the transfer of such a large volume of web assets from one administration to the other, so it wouldn’t surprise me if there were busted links and archival issues for some time to come in a non-malicious manner.

    This is not to say that there aren’t also malicious things happening, which of course there are; but we shouldn’t necessarily be freaked out by every broken link.

  46. 46.

    sharl

    @schrodingers_cat:

    So far a regular person what is the safest email account to have? My main account has been a gmail since forever.

    I’ve been looking into this issue as well. I suspect my existing 2-factor authentication setup for g-mail is adequate for my present needs, along with broader browser (Chrome) and Win10 protections – running both Windows Defender for standard antivirus and Malwarebytes for more newly released malware that is lurking out there.

    One thing relatively new is a new 2-step authorization technology known as a U2F, which requires some hardware (FIDO U2F Security Key) that fits into a USB slot – explanation here and here (Google’s page on it). Both of those sites have links to Amazon sites where you can buy the hardware (I couldn’t find it in a local Micro Center, and the guy I talked to there knew nothing about it).

    I saw some infosec pros strongly urging this a while back for those with compatible systems, though since I don’t travel into the dangerous parts of the internet that infosec folks wade into as part of their jobs, I don’t know if their advice is relevant to me. The problem is that malware always becomes more innovative and easier to use with time, so while there’s no bulls-eye on me today, there may be tomorrow.

    The infosec escalation: it never ends, and it is a pain in the ass.

  48. 48.

    tobie

    Did the senior management at State resign or were they fired? I’m having trouble making sense of the reports. Thanks in advance for any clarifying info.

  49. 49.

    Shakti

    The only thing which surprises me is that these accounts weren’t somehow connected to a Yahoo account with security questions.

  50. 50.

    mai naem mobile

    Lumpy better watch it. The 400lb hacker sitting on his bed in NJ may be hacking into his Gmail account right now. Also too, bbbuttt Hillary had a private email server….screeeeechhh!!!

  51. 51.

    Mnemosyne

    @tobie:

    Given that the Trump administration lies about everything, I think it’s going to be hard to say for sure. They’re already lying about which side canceled the President of Mexico’s visit here.

  53. 53.

    Major Major Major Major

    @sharl: Everybody should always use two-factor authentication where it’s available.

    Gmail should be fine, but in general email itself should be considered highly non-private as a determined (particularly government) agent can often find a way in. Encryption will be your friend there, but that can always be broken by shoe-leather type stuff.

    Edit: Malware doesn’t have much to do with any of this except if you get something that will log your password keystrokes or something like that, in which case nothing password-protected without two-factor is safe. And even then you can get malware on your secondary device too. Etc.

  55. 55.

    ? Martin

    @schrodingers_cat: I’ll reiterate the above. Turn on 2FA on your Gmail account and you’re almost certain to be fine. The Ubikey is cool. I have one, but it is a bit of a PITA, and overkill for most people.

    Unfortunately, it’s near impossible to make email secure. Just assume that it’ll be read. The key is to ensure that nobody can hijack your account by getting your l/p.

  56. 56.

    Major Major Major Major

    @MazeDancer: Oh, yes, everybody should opt out of that, but the damage was done long ago. A dossier like that is easy as pie to set up for somebody. I used to do it, sort of, but as one of the good guys. Can’t go into a large amount of detail.

  57. 57.

    sharl

    @Major Major Major Major: Yep. I haven’t been doing anything nefarious that would irk a government agency (famous last words, I know), but hackers looking to capture keystrokes, passwords, etc. to gain personal information to hijack accounts and whatnot are my big personal concern.

    And for Facebook users, hot off the press so to speak:

    Well, today, a HUGE thumbs up has happened — Facebook has upgraded the login security for its 1.8 billion users by integrating the unphishable protection of the FIDO U2F Security Key into its social platform.

  58. 58.

    Sloane Ranger

    @JPL: The BBC has just reported that, in an interview given on the flight over there, Teresa May said that the UK might end its intelligence sharing agreement with the US if Trump legalises torture.

  59. 59.

    Gin & Tonic

    @sharl:

    The infosec escalation: it never ends, and it is a pain in the ass thus pays the mortgage.

    ETA: I guess the

  60. 60.

    Roger Moore

    @sharl:

    One thing relatively new is a new 2-step authorization technology known as a U2F, which requires some hardware

    This is great for the authentication side of the problem, but it doesn’t guarantee anything else. So it makes it hard for somebody to hijack your account but doesn’t necessarily protect you against somebody subpoenaing your emails from the provider or intercepting your emails in transmission.

  62. 62.

    J R in WV

    @schrodingers_cat:

    My neighbor/systems admin has identified protonmail.com as the most secure email service available. I intend to convert to that service asap. Encrypted end-to-end, all servers located in Switzerland, so not in the EU, not in the USA. Probably as protected from Trump-fomented penetration as possible.

    Designed by CERN and MIT scientists, free with additional support available for a low price. 5,000,000 users so far.

  65. 65.

    Roger Moore

    @MazeDancer:

    There is a site called FamilyTreeNow . com that has a terror inducing amount of info about people.

    Some of it is even accurate! I have the advantage of a relatively common name, so the information they have about me beyond my addresses is wildly incorrect. This could be either a good thing or a bad thing. On the one hand, it shows that they don’t actually know everything about me. On the other hand, it means I could potentially get in trouble for something that’s incorrectly associated with me.

  68. 68.

    Roger Moore

    @Major Major Major Major:

    Oh, yes, everybody should opt out of that

    It won’t help. You’re opting out of that site, but they’ve mined their data from elsewhere. I occasionally get mail for the people who they list as possible relatives/associates, which I can only assume is because somebody else made that association and they’ve copied the incorrect information from there. Once that kind of information- correct or not- is out there, it’s almost impossible to eradicate.

  70. 70.

    Keith P.

    @Shakti: It be hilarious if they were those kinds of accounts where you can lock them out by just failing logon a few times. That “security measure” (at least as most commonly-implemented) cracks me up.

  73. 73.

    cosima

    @Another Scott: I read that Alaska fishermen were upset because their primary buyers for Pollock (spelling?) is Japan, and TPP would have benefitted them. Going to go out on a limb here and say that the shitgibbon/Hillary votes were probably split in that crowd, there would have been at least some of them who would not have voted to shoot themselves in the foot. I was born/raised in AK, and my ex & I had a Bristol Bay fishing permit (he still has & uses), so I know a wee bit about that crowd.

  75. 75.

    Another Scott

    @J R in WV: As long as you can still access Swiss servers from inside the USA…

    :-/

    Seriously, there are no guarantees that any of this stuff can’t be broken or forbidden given a determined enough government. Great Firewalls, breaking DNS, etc., etc., can all be done. I don’t expect them anytime soon, and I’m a fan of people taking reasonable precautions, but don’t fool yourself and don’t be unnecessarily paranoid.

    Cheers,
    Scott.

  77. 77.

    Immanentize

    @Another Scott: I can’t remember — are you a lawyer? I am considering an information protection concept that is based on legal confidentiality rules….

  80. 80.

    Roger Moore

    @Another Scott:

    As long as you can still access Swiss servers from inside the USA…

    If you can’t, you have bigger problems than unavailability of your email. Also, too, if you’re planning for the worst, it’s probably better for the failure mode to be making your email inaccessible to anyone rather than making it accessible to everyone.

  81. 81.

    Another Scott

    @Immanentize: Nope, I’m not a lawyer (though I do opinionateify about legal things sometime). I’m not an IT person either – just a very long-time Internet user.

    Cheers,
    Scott.

  82. 82.

    Immanentize

    @Gin & Tonic: I think I got it, but I was avoiding because hate both Nazis and dentists…. The latter probably scare me more than the former. Put them together? Hoffman!

  83. 83.

    Captain C

    @O. Felix Culpa: I suspect a lot of Republicans are worried that if Trump actually starts a full-on investigation of vote fraud, they’ll get caught up in the dragnet, one way or another.

  84. 84.

    Captain C

    Serious question: If the arrested Russians were in fact moles, and were burned by Trump people, and given that Trump is already basically openly at war with the entire IC, at what point to Trump people start having really nasty personal info leaked, accidents, or vaguely plausible natural deaths, if at all?

    ETA: Or would they just be arrested?

  85. 85.

    Roger Moore

    @Captain C:

    at what point to Trump people start having really nasty personal info leaked, accidents, or vaguely plausible natural deaths, if at all?

    I’m going to go with “not at all”. The classic response to suspect mole is a canary trap: give the mole misinformation and see if the enemy starts acting on it. The response to a known mole is twofold: strategically feed it misinformation and try to turn it into a double-agent. Harming a mole is a last resort when the other options don’t work. If the IC actually gets actionable intelligence proving that Trump is a mole and they can’t make use of him, the correct response would be to reveal it to the Congressional oversight committees. That has the advantage of being A) the legally correct thing to do and B) getting the information to people who have the power to do something with it; you can bet the Democrats on those committees would act on it.

  86. 86.

    Ian

    @Xenos:
    It seems worthy of quite a bit more than investigation, if merited. Now imagine the reaction of a democratic president ousting a mole.

  87. 87.

    droog

    Congress and SCOTUS need to waive the nepotism rules. National Security demands that Barron Trump is appointed as Special Chief Protector of the Cyber.

  89. 89.

    Cheryl Rofer

    @Captain C and @Roger Moore: We don’t know much about the Russian arrests, but there is a lively speculative game going. The arrests were in December and just revealed this week. That makes it less likely that it was Trumpies who outed them, but not impossible. Another possibility is that the intelligence report on the DNC hack gave Russian counterintelligence enough information to out these guys. Or that it started an investigation that turned them up. Or that they are an easy target to make a point. I’m trying to stick to available facts and have worked through what I’ve got here.

  90. 90.

    Sloane Ranger

    @cosima: Thread is probably dead but just in case it’s not here is nothing I would like more than for us to get [email protected]!ked but at this point there is 0 chance of this happening. We are in what can’t be cured must be endured territory.

    As for May’s comment “might” in this case is diplomatese for will. If our Intelligence people have even the slightest cause to believe the Russian arrests were the result of a leak from the Trumpeters it’s probably happening. And not just us. Expect Canada and New Zealand to do the same. Australia I’m not so sure of.

  91. 91.

    Central Texas

    That OPSEC definition is interesting. I suspect that it is only one tiny step from that to considering anyone who would read the information revealed as an enemy from who everything should be concealed. Unfortunately, that “everyone” means “us”, the citizens and voters who might be interesting is what is being done our name if not on our behalf. It is not a good attitude for public officials or public servants to cultivate but is all too common and becoming more so.

Comments are closed.