Pentagon confirms 2008 hack was ‘most significant breach of U.S. military computers ever’

Apple Online Store“A ‘significant compromise’ of U.S. military networks has been acknowledged by the Pentagon two years after the breach was reported in the press,” John P. Mello Jr. reports for TechNewsWorld. “‘In 2008, the U.S. Department of Defense suffered a significant compromise of its classified military computer networks,’ Deputy Secretary of Defense William S. Lynn III wrote in an article in the September/October issue of Foreign Affairs.

Advertisement: Save up to $100 on a new Mac and printer at Apple Store online. Free shipping.

Mello Jr. reports, “‘It began when an infected flash drive was inserted into a U.S. military laptop at a base in the Middle East,’ he explained. ‘The flash drive’s malicious computer code, placed there by a foreign intelligence agency, uploaded itself onto a network run by the U.S. Central Command. That code spread undetected on both classified and unclassified systems, establishing what amounted to a digital beachhead, from which data could be transferred to servers under foreign control. This previously classified incident was the most significant breach of U.S. military computers ever, and it served as an important wake-up call.'”

MacDailyNews Take: Looks like they’ve finally begun to answer that call: Apple’s Mac shipments to government grew 200%, sixteen times faster than the overall PC market’s 12.1%, in Q2 2010 – August 23, 2010

Mello Jr. reports, “The malware originating from the infected USB drive was dubbed ‘Agent.btz.’ It’s a variation of the SillyFDC worm.”

Full article here.

MacDailyNews Take: According to Symantec, the SillyFDC worm affected Windows 98, Windows 95, Windows XP, Windows Me, Windows Vista, Windows NT, Windows Server 2003, Windows 2000.

Macintosh unaffected.

46 Comments

  1. @acid,

    The reason DOD chose to bet the farm on Windows is because regulations require competitive purchases and buying from the lowest bidder. They see a computer as hardware, with the software as an afterthought. So if 20 vendors sells PCs, they think they’re running a competition between 20 vendors–never mind that they’re all stuck with the same damn OS! Fools.

  2. I can’t believe they would put so many systems of the same OS on both classified and unclassified networks. What happened to military grade unix systems? Either this report stinks or the military network security team needs to be tossed in he brig.

  3. @ Ged

    In the interest of MDN regularity, please leave the titillating innuendoes to Tower Tone. ” width=”19″ height=”19″ alt=”wink” style=”border:0;” />

    … and no, “innuendo” is not Italian for a suppository! … and a “bigamist” is not Italian for a large fog.

  4. Huh? You idiot Mac Heads. Common Sense says. If you give them a Inch they will take a mile. Let’s see Jim’s remarks were that if there were more Mac’s than Pc’s Macs would be targets more than Windows.. And how is that not true? If I am a hacker and want to gain controlnof as many computers I can to create a zombie army and most of the PC’s were Macs then would it not make sense for mento target Macs? Just because Mac’s might have a longer learning curve dies not mean they can’t be hacked. Once hacks start flowing on the Mac’s the Hacker community will start sharing thebinfo among each other . Software is written by humans and so has mistakes.. Unless the there are androids writing the software at Apple (which I doubt). So try to argue against that bit of common sense unless you are scared to use any.

  5. @Jacob

    1. Common sense? Did you read your own post? The “sense” it gives is incoherence. Read it again. If you truly believe you wrote a well structured argument, your issues go way beyond ignorance of technology.

    2. If you had any knowledge of os security, you would realize what a weak argument you are making. The “you’ll rue the day mac got hackzored” has been posited by Win-bois for nigh on ten years to no avail. And it makes no sense to say that macs might get hacked someday is an excuse for windows to be hacked every microsecond. Why are you even bothering to defend that?

  6. To Jim and Jacob (and other defenders of the security through obscurity myth):

    Of course Windows is the target, but obscurity of the Mac isn’t the reason. The proliferation of Windows machines that are readily vulnerable through a lack of updates IS the reason why, to be sure.

    The most your typical botnet includes is a few hundred thousand machines. The largest was in the low single digit millions, and was notable for that large number.

    The Mac is acknowledged to have over thirty-five million installed machines now, and they are known to have a higher percentage of patched machines than Windows ever dreamed of.

    I think that, if one was looking for money, the generally better off and well to do Mac user base would be a bigger target – since that is where the money is – but such is not the case.

    The target is the vulnerable Windows machines, because that is what the ready-made malware libraries have lots of – malware targeted at Windows. Why bother to write your own malware, requiring months of R&D, when somebody already has stuff you can buy and use within days if not hours?

    THAT is the secret of the Windows vulnerability to malware, and why Macs are not targeted, Windows is just easier to target, due to known unpatched vulnerabilities on millions of PCs.

    Market share has nothing to do with it, not does installed user base. Both platforms have sufficient numbers to fuel botnets.

    Vulnerabilities do.

  7. Sorry but too good to pass up on a friday. ” width=”19″ height=”19″ alt=”grin” style=”border:0;” />

    @Jim,
    “Hackers simply write virus to get get the biggest bang for the buck”

    HELLO….. I AM JIM………. I AM A TROLL…………
    processing,,,,, processing…..
    MY GOAL IS TO SPREAD MS FUD………… I AM JIM…..
    processing….. processing…… p r o c e s s i n g……….
    MACS ARE BAD…….. PCS ARE GOOD……. I AM JI…..
    …………….. process…..i…..n……..g…….

    ERROR….. ERROR………. DOES NOT COMPUTE……
    Ballmer…….. father.!!……… where are you when i need you……..

    ERROR…………———————- EOL.

    ———- Blue…… Screen………..of………death……….. 🙁

    Just a thought here on this fine friday…..

    en

  8. “Macs are virtually invisible on the internet right out of the box.”
    There are any number of websites you can go to that will display your IP address, browser and OS- including Macs. Kinda kills that posit, doesn’t it.

  9. it would be better if the mac community were to work on security before the walls fall. i would be the first to agree that there are 100k+ viruses for windows and i will also agree there are no known mac viri in the wild.

    but that doesn’t mean macs are invulnerable. this gets proven every time there’s the pawn to own contest each year. the attack vectors used have moved away from a simple virus attack to a memory injection scenarios. and lets not forget how fast iphones fall to a malformed pdf. (i know, i know, different OS).

    if the mac was perfect, how do you explain all the security updates apple puts out? it’s because the apps are a key source to get access to memory. and if you read the original article, it was a flash drive that infected the pc. are you going to try and say that mac’s don’t read a flash drive when it’s inserted? bs, that’s the first thing it does is look for a load executable, just like a CD.

    the attacks on jim are more of an example of how little you really know, the best attack vector is through the human interface which you’ve all proven with your posts.

  10. FACT: There are only Trojan horses for Mac OS X, requiring LUSER behavior in order to be installed. There are no viruses for Mac OS X. There are no worms for Mac OS X. That is all.

    FACT: On a Per User basis, where the number of users of Mac and Windows are equal, there are over 1000x more malware for Windows. This of course makes the ‘Security by Obscurity’ myth an outrageous joke, pointing out shockingly poor security in Windows, including 7ista.

    FACT: All US government computers hacked via the Internet, by such scum as Red China’s Red Hacker Alliance, run on Windows. No government Mac computers have ever been hacked via the Internet. Not one.

    FACT: There is no such thing as perfect programming or a perfect operating system. The only people who have ever said ‘Macs are impenetrable’ or other such garbage have been trolls spreading the usual lies, or newbies who don’t know any better. Expect Mac security vulnerabilities. Keep up-to-date with Apple Security Updates.

  11. @Shadow
    “are you going to try and say that mac’s don’t read a flash drive when it’s inserted?”

    Dude, can you really not know the difference between reading a flash drive and running the code on it? OS X will detect the drive, but will require administrator permission to execute any code on it that would modify the OS or apps in any way.

    Also, comparing pawn-to-own with self-replicating attacks is ridiculous. The odds of a hacker turning his attention on my specific Mac are negligible. The threat from a self-replicating virus that can automatically and without human intervention attack millions of PCs at once is exponential orders of magnitude greater.

    The fact remains that the actual danger to Mac users from undetectable threats (i.e. not social engineering) has been next to nil throughout the entire 10-year life of OS X and will likely remain so thanks to sandboxing and enforcement of admin privileges.

  12. Did anyone notice how the hackers used an “off-the-shelf” worm (SillyFDC)? They didn’t even care to write their own code; they went for the existing malware, which theoretically should have been detectable by whatever antivirus software was installed on that target laptop. Once it did infect a computer, it was easy for it to spread itself around, and it of course immediately launched its malicious “phone home” payload.

    It is simply mind boggling how many different pieces of malicious code are available out there for anyone to use as they please, and how neither MS, nor antivirus companies, nor IT departments can do much to eliminate them.

  13. @ Hillshire

    Dude are you ignorant yourself.

    1st of all I did not say I was a winbois… Where in my argument did I say I was a Windows user only??? (I have mutiple apple devices knucklehead). And when you argue against my spelling instead of the basis of my argument than you have already lost. Debate “101”

    2nd. The argument is valid and you are only showing your ignorance as Mac’s are computers as well and can be hacked. There are arguments on this page listing how they can be hacked so pay attention MacHead.

    3rd. You AppleFanbois need to stop and acknowledge that Mac’s as well as Window Pc’s are vurnarable to viruses and need to stop acting like they don’t. Mac’s are less in the wild than Windows and plus their are alot of windows “Haters” out there who are viruses writers so malice is also why Windows Machines are hacked. But keep it up Mac Fanbois maybe you will “rue the day” as you say Hillshire that you acted like you are God among the Computers.

    Please don’t pound me with articles written by other Mac’ Heads. Go to an Impartial place where there are people who are Windows Lovers and well as haters and see if your flawed arguments that Mac’s are impervious to viruses hold up to the test.

  14. troll sez: “and see if your flawed arguments that Mac’s are impervious to viruses hold up to the test.”

    The usual bullshite ‘you will “rue the day”‘ FUD. I guess this troll can’t read very well, seeing as I posted this earlier today:

    FACT: There is no such thing as perfect programming or a perfect operating system. The only people who have ever said ‘Macs are impenetrable’ or other such garbage have been trolls spreading the usual lies, or newbies who don’t know any better. Expect Mac security vulnerabilities. Keep up-to-date with Apple Security Updates.

    Darn. Trolls just can’t stand it when you put facts in your face. They just drone on and on with the troll-talking-points because that’s what they’re paid to do.

    Here’s something else I posted earlier today:

    FACT: On a Per User basis, where the number of users of Mac and Windows are equal, there are over 1000x more malware for Windows. This of course makes the ‘Security by Obscurity’ myth an outrageous joke, pointing out shockingly poor security in Windows, including 7ista.

    I enjoy flaming trolls and eating them alive. They taste like tandoori chicken.

  15. FACT: The first anti-Apple security FUD, ‘you will rue the day’ etc., was perpetrated in March of 2005 by Symantec in an attempt to prop up their Norton Anti-Virus software, which at the time had the reputation of being the most unstable software one could install onto a Mac.

    A deluge of malware for Mac OS X was coming! RUN FOR YOUR LIVES!

    I’m still waiting…

    FACT: Over 5 years later, Mac OS X has 23 Trojan horses, no viruses, no worms.

  16. @Jacob

    Lame.

    Debate 101? Wouldn’t that include understanding the issues, preparing carefully, and then presenting a well reasoned argument? None of which you have done. So the question is, why do you persist on hammering hollow arguments that were disproved years ago? What is the point? Why do embarrass yourself?

    MDN Magic Word. “kept”. As in: The troll kept posting even though he knew his points were invalid.

    Go ahead and rail away again. I may or may not answer, depends on whether or not it amuses me or not.

  17. OMG…

    Fucking idiots over at pentagon!!!
    DONT connect machines to THE INTERNET if they contain sensible data!!!

    This is amazing…
    It may be more inconvenient but IT IS SECURITY!!!

    I know alot oc corporations that don’t connect computers to the net just because of this very reason. What’s so hard about it? ITS THEIR OWN FAUlT!

    Pentagon is someone should be a step ahead and think security FIRST! And that means NOT connection to the net!!!!

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.