NSA to hackers: We’re not prepared for major attack

As an expert in the matter, I can only concur. The major reason is Microsoft.

"On a scale of one to 10, American readiness to deflect a major cyber-attack on its infrastructure is “around three,” head of the National Security Agency and the US Cyber Command said in a rare speech at a hacker conference."

Click here for source

No computer system is completely safe. Whatever system is the most popular in the world will be the one that hackers will know how to target.

Why would the NSA guy say this at a hacking conference? Its almost like hes trying to get people to start a major hacking attack. That would give the NSA good reason to clamp down on the internet and restrict all our freedoms.

Its clear what the plan is here.

Not just their choice of operating system. There are hundreds of other factors that affect their security, from design to procurement to implementation.
The NSA shouldn't be playing the network penetration and attack arena if they're not ready for it.

No computer system is completely safe. Whatever system is the most popular in the world will be the one that hackers will know how to target.

They're talking about networks. Huge networks.

Originally posted by XeroOne
Not just their choice of operating system. There are hundreds of other factors that affect their security, from design to procurement to implementation.
The NSA shouldn't be playing the network penetration and attack arena if they're not ready for it.

No computer system is completely safe. Whatever system is the most popular in the world will be the one that hackers will know how to target.

They're talking about networks. Huge networks.

edit on 28-7-2012 by XeroOne because: (no reason given)

I agree , but the OP seems to think its all Microsofts fault.

reply to post by PhoenixOD


I am not for or against Microsoft. I'm just saying it is the largest botnet on this planet and it is being controlled by a minority who knows the TCP/IP stack very well, not to mention a lot of application-level protocols.

Of course, no OS is invulnerable. But I'd rather have an OS that provides its source code and allows users to be the judge.

It's amazing what you see when you launch Wireshark or tcpdump when a Windows machine starts up.

I'm also a former employee of the government. What is shown on TV is completely bogus.

This is a US military server. Look at the amount of open ports:

Starting Nmap 5.21 ( nmap.org... ) at 2012-07-28 21:18 CEST
Nmap scan report for www.idss.ida.org (129.246.226.95)
Host is up (0.097s latency).
Not shown: 970 closed ports
PORT STATE SERVICE
23/tcp filtered telnet
25/tcp filtered smtp
37/tcp filtered time
53/tcp filtered domain
79/tcp open finger
80/tcp open http
135/tcp filtered msrpc
139/tcp filtered netbios-ssn
161/tcp filtered snmp
389/tcp filtered ldap
443/tcp open https
445/tcp filtered microsoft-ds
465/tcp open smtps
515/tcp filtered printer
593/tcp filtered http-rpc-epmap
995/tcp open pop3s
1039/tcp open unknown
1049/tcp open unknown
1051/tcp open optima-vnet
1055/tcp open ansyslmd
1080/tcp filtered socks
1433/tcp filtered ms-sql-s
1434/tcp filtered ms-sql-m
3128/tcp filtered squid-http
3389/tcp open ms-term-serv
4444/tcp filtered krb524
8080/tcp open http-proxy
10000/tcp filtered snet-sensor-mgmt
12345/tcp filtered netbus
31337/tcp filtered Elite

Nmap done: 1 IP address (1 host up) scanned in 5.70 seconds

Running: Microsoft Windows 2003
OS details: Microsoft Windows Server 2003 SP1 or SP2
Network Distance: 15 hops

reply to post by Stiglitz


But wont some of those port have to be set to open by an administrative user or by applications loaded onto the system by someone.?

Microsoft's firewall is stateful by default which means that traffic can not get in unless its a response to traffic going out.

reply to post by Stiglitz


The NSA is full of crap.

Cybercommand is FILLED with black hat hackers who they recruited before "cyber command" was suposedly shut down.

They WANT people to try and hack them. Probably so they can upload whatever version of STUXNET they are using to spy on folks.

OR:

Alexander advocated the passage of legislation, which would enable the NSA to set security standards for information infrastructure. The general expects “voluntary incentivized [sic] compliance” of those future standards. Earlier some civil rights croups expressed concerns about some of the cyber bills currently under consideration in the Congress over possible adverse effect on privacy they may cause.

To scare citizens into agreeing to legislation which controls, censors and limits internet freedom.

~Tenth

Originally posted by PhoenixOD
reply to post by Stiglitz

 

But wont some of those port have to be set to open by an administrative user or by applications loaded onto the system by someone.?

Microsoft's firewall is stateful by default which means that traffic can not get in unless its a response to traffic going out.

edit on 28-7-2012 by PhoenixOD because: (no reason given)

Something along those lines. You're confusing stateful blocking with Port Address Translation. Ports could be opened by anything running with admin privileges, including malware and compromised processes/programs.

I'm a bit skeptical about the idea of the NSA using badly-configured Windows systems. Back in (or around) 2006 they were instrumental in developing the Security Enhanced Linux (SELinux) components, which lock everything down at the kernel level, making it virtually too time-consuming for a hacker to get root access by exploiting processes.

The nmap output posted by Stiglitz suggests the network scanned had some kind of IDS/IPS system in place, and it's possible the IP address belonged to a decoy/honeynet.

reply to post by XeroOne


PAT is where multiple computers share a single gateway / public IP address through the allocation of port numbers.

but a stateful firewall like windows firewall is about packet inspection :

a stateful firewall (any firewall that performs stateful packet inspection (SPI) or stateful inspection) is a firewall that keeps track of the state of network connections (such as TCP streams, UDP communication) traveling across it. The firewall is programmed to distinguish legitimate packets for different types of connections. Only packets matching a known active connection will be allowed by the firewall; others will be rejected.

What im saying is that even with ports open someone would have a hard time just jumping in though an open port.

This is not directed at you XeroOne : but not all those ports are open by default so its not really a fault of windows so much as bad configuration by an administrator.

reply to post by PhoenixOD


I definitely agree. In fact, the problem of crap configuration can affect anything in the network - routers, switches, IPS - anything. Even the entire network could be designed badly with an unsuitable architecture. Trusting the Windows firewall on its own is a huge gamble.

Originally posted by tothetenthpower
reply to post by Stiglitz

 

The NSA is full of crap.

Cybercommand is FILLED with black hat hackers who they recruited before "cyber command" was suposedly shut down.

They WANT people to try and hack them. Probably so they can upload whatever version of STUXNET they are using to spy on folks.

OR:

Alexander advocated the passage of legislation, which would enable the NSA to set security standards for information infrastructure. The general expects “voluntary incentivized [sic] compliance” of those future standards. Earlier some civil rights croups expressed concerns about some of the cyber bills currently under consideration in the Congress over possible adverse effect on privacy they may cause.

To scare citizens into agreeing to legislation which controls, censors and limits internet freedom.

~Tenth

Damn right, I personally think they are trying to bait some american hackers so they can recruit the good ones.

Load 5 felony's on you most will opt to work for them. They got the best working for them now, trying to hack

their own systems in case of a real attack 9xs out of 10 after the hack is analyzed they find the hole it

got through.. The NSA has the best they KNOW OF NOW, we can call this a recruiting shout out

reply to post by XeroOne


I agree relying on a single firewall is asking for trouble. I think one of the biggest problems with windows firewall is that it can be disabled from the OS. But this is not really Microsoft's fault i can absolutely guarantee if they had it their way they would have the firewall on all the time with no off switch. Its the users that insist on having an option to switch it off.

reply to post by Stiglitz


not sure you should be posting that, mr government employee.

reply to post by Agit8dChop

he said he used to be a gvt employee

I'm also a former employee of the government

reply to post by Agit8dChop


Not sure that the government should be doing what it's doing. Pretty sure actually. The world's consciousness is shifting...
I'm keeping the best for last.


Also, I do not feel threatened or scared. Hollywood movies are made to make people think a certain way. A "Jedi" mind trick.

reply to post by tothetenthpower


Stuxnet does not affect Linux. That is exactly the point I was making.
Hackers do not use windows. They also use encrypted tunnels and other techniques to obfuscate their communications.

Logs are extremely detailed in Linux. You can trace any traffic leaving and entering your network.

"Please note the stuxnet hits windows operating systems. Linux and Mac which is linux based do not seem to be affected. "

Source

reply to post by XeroOne


The address does not belong to a "honeypot". It is a portal to an unclassified network for security assistance personnel and military sales.

www.idss.ida.org...

Originally posted by PhoenixOD

Originally posted by XeroOne
Not just their choice of operating system. There are hundreds of other factors that affect their security, from design to procurement to implementation.
The NSA shouldn't be playing the network penetration and attack arena if they're not ready for it.

No computer system is completely safe. Whatever system is the most popular in the world will be the one that hackers will know how to target.

They're talking about networks. Huge networks.

edit on 28-7-2012 by XeroOne because: (no reason given)

I agree , but the OP seems to think its all Microsofts fault.

Well its not directly Microsoft fault but lets not kid ourselves here... You were right in your first post that no OS is perfectly secure however when it comes to security Microsoft is down the list somewhere between two tectonic plates...

And Window is being used pretty much universally in gov agencies...

Originally posted by Stiglitz
reply to post by XeroOne

 

The address does not belong to a "honeypot". It is a portal to an unclassified network for security assistance personnel and military sales.

www.idss.ida.org...

Then if its unclassified who gives a damn about securing something that's already public property... Even though the network belong to a three letter agency or what the heck it doesn't mean its hooked up to their inner network... Its probably some off net cheap server they use for this kind of crap...