Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror
×
Government Security IT Your Rights Online

Largest Simulated Cyber Attack To Date 71

Posted by CmdrTaco from the they-know-how-to-party dept.
Orome1 noted that the government will be running simulated cyber attacks as part of the Department of Homeland Security's Cyber Storm III exercise. It says "The exercise will be controlled from the Secret Service headquarters, where organizers from various agencies will be sending out 'exercise injects,' information that a player will receive that indicates that a certain event has taken place as part of the narrative set up by the organizers. This goes a bit beyond a paper narrative, including fake log data, drives that may contain fake malware, and fake event history, and is dynamic, meaning that it can change dependent on the actions the players take." ...which makes me wonder how effective this test would actually be.
This discussion has been archived. No new comments can be posted.

Largest Simulated Cyber Attack To Date More

Largest Simulated Cyber Attack To Date

Comments Filter:

  • Obligatory (Score:4, Funny)

    by Pojut ( 1027544 ) on Tuesday September 28, 2010 @10:27AM (#33722898) Homepage

    The only winning move is not to play. Now get me a WOPR with cheese!

  • Uh Oh (Score:3, Interesting)

    by AppleOSuX ( 1080499 ) on Tuesday September 28, 2010 @10:27AM (#33722912)

    Should we expect a real attack at the same time?

  • External & Internal attacks? (Score:1, Interesting)

    by Anonymous Coward

    I hope they're not just testing over the wire attacks, that new janitor with the thumb drive could do some damage...

    • Re: (Score:2, Interesting)

      by dragonhunter21 ( 1815102 )
      From the summary, it appears as though they're using drives with fake malware on them to keep operators on their toes. This should be fun.
      • what's fake malware? Is it a program that puts "you have been hacked" on windows desktops? Does it require similar permissions as regular malware? Will it trip virus scanners and automated lockdowns?
  • I wonder if a real attacker could subvert this simulation to hide a real attack. The "exercise injects" canals seems like a good way to inject malicious payload.

    • Um, shouldn't.

      In the real world there is a helpdesk code for 'only an exercise' that was created years ago.

      The only thing more dangerous about an exercise is distribution of security resources themselves, and it would be the same on exercise day as training day as Security Conference(Black Hat DC, FOSE) as $NationalHoliday.

    • Re: (Score:2)

      by jpapon ( 1877296 )
      On that note, you have just been added to a government watchlist. You're not supposed to wonder these things out loud!

    • From the article:

      However, the scenario won't use a virtual network. Instead, the exercise will be controlled from the Secret Service headquarters, where organizers from various agencies will be sending out "exercise injects," information that a player will receive that indicates that a certain event has taken place as part of the narrative set up by the organizers. This goes a bit beyond a paper narrative, including fake log data, drives that may contain fake malware, and fake event history, and is dynamic,

  • Now's the time (Score:3, Interesting)

    by Anonymous Coward on Tuesday September 28, 2010 @10:32AM (#33722978)

    Can anyone think of a good time to run a real cyber attack against DHS?

  • Let me guess the results in advance (Score:5, Informative)

    by vlm ( 69642 ) on Tuesday September 28, 2010 @10:36AM (#33723052)

    I can guess the results in advance of this pointless "test".

    We did well enough that none of us should be fired. Or we selected a fall guy months ago whom is not playing along, and I guess with "great shock" at the result its time for him to "spend more time with his family".

    We did poorly enough that we all need more money. Conveniently I happen to have a brother-in-law in sales at a contractor that provides a magic bullet that claims to do everything we need...

    There has never been a public "test" like this with any other result. Therefore its not even "news".

    I have participated in things like this (not in this situation or field) and the primary reason they occur is someone wants to send cash to a buddy at a contractor, and everyone else wants a day off eating catered food and enjoying some business travel.

    • best. summary. ever.

      Anyone care to bet against this being the approximate result?

    • You missed the part about: "we need more control of the Internet, cellphones, computers, etc."

    • Re: (Score:3, Interesting)

      by Jawnn ( 445279 )
      True words, sir. It's almost as if the new "cyber warriors" are nothing more than contractors being provided from new divisions of traditional "brick and mortar", or should I say "bombs and bullets" defense contractors.
      Oh..., wait.
    • These types of exercises are a lot of times done with oversight from the GAO. The GAO does not pull punches when it comes to letting people know how badly they screwed up or how screwed we all are.

      • Re: (Score:2)

        by vlm ( 69642 )

        Which is why these types of exercises are very carefully framed and preplanned to get the desired result.

        Don't forget, carefully planned and orchestrated failure, resulting in a live-fire FUD attack against the general public with the aid of some friendly journalists, might be the goal. Especially if the "ideal solution" happens to be taking away our rights, more laws, more regulation, etc.

        • Some of these agencies can't 'carefully plan or orchestrate' their way through a revolving door. You are giving these people way more credit/malice than you should.
    • Yes, I also predict it will either pass or fail! There has never been another result of a test.

    • Re: (Score:2)

      by tibman ( 623933 )

      The result of most army training exercises is OPFOR wrecking the home team. Then after lessons learned and experiences build up, the OPFOR can be beaten. I don't understand why a civilian organization would be different? It should really be a matter of reorganizing and retraining the assets they already have.. not purchasing new stuff. If their planning and expectations were so terrible that they need new equipment, then by all means they should buy it.

      Nobody should be fired because of a test, what a wa

      • Re: (Score:2)

        by ediron2 ( 246908 ) *

        Kudos. Wish you were modded 5 instead of parent. Per my too-long rant above, you're far more right about this stuff than parent is.

        Incidentally, the stuff that bit us on the ass last year tended to be much smaller than in our first such exercises. The most notable was a panicked boss overruling his techs and causing minor damage. But all in all, team members come away calmer, surer, more familiar with procedure (and more engaged when asked to edit procedure), and with relationships with CERT and peers at

  • The Government (Score:1, Offtopic)

    by alta ( 1263 )

    I'm going to go ahead and preempt all the non USians here...

    What government is "The Government"? Eh? The government of Moldova? Argentina? Kajikisitkishtanz? Tatooine?

    Why do you Imperialists pigs thing that only US people visit this site? How do you know that the government of Romulus doesn't have it's own Department of Homeland Security?

    Ok, sorry, had to get that out.
    Disclaimer, I'm not in the US. I live in Dixie.

    • Re: (Score:2)

      by chill ( 34294 )

      Disclaimer, I'm not in the US. I live in Dixie.

      Help me find that one on a map. Is that the place that got its ass kicked by the U.S. about 150 years ago? The place that has been totally pacified with NASCAR, pickled pigs feet, cheap alcohol and the SEC?

      • Re: (Score:2)

        by alta ( 1263 )

        http://lmgtfy.com/?q=dixie [lmgtfy.com]

        kicked by the U.S. about 150 years ago

        See what I mean? Imperialists pigs. I'm still living under their oppressive regime.

        Nascar... Never sat through a race.
        Pickled Pigs feet... That stereo type may have worked 149 years ago.
        SEC? Yeah, you got me, roll tide.

        I do have a Gadsden flag on my SUV. This one was almost lost to history but Obama has renewed our interest in it.

        • Re: (Score:2)

          by chill ( 34294 )

          Fine, pork rinds, then. :-)

          Tide? TIDE?!

          GO GATORS!

          • Re: (Score:2)

            by alta ( 1263 )

            Gators? Isn't that one of the teams we rolled over last year? Oh yeah, I forgot... The one where Teebow cried. (http://www.youtube.com/watch?v=qBO1LHUqD_0)

            I'll be watching for a replay (sans Teebow) this weekend in Mobile. Beautiful weather for the game this weekend. Think we may just move the big screen outside ;)

            You're welcome to join us. We're in Mobile. We're planning on having a house full.

            • Re: (Score:2)

              by chill ( 34294 )

              Thanks, and have fun. Honestly, I'm one of those people who believe college is for education, not sports. I'll also be in Chicago this weekend, listening to people try and explain how it isn't the Bears' weak opening schedule, they're just good. :-)

            • Re: (Score:2)

              by chill ( 34294 )

              Tide 31, Gators 6

              I bow before your superior college football program!

              Congrats.

      • Re: (Score:2)

        by alta ( 1263 )

        See my UID, it's really small. I've been around here for a while. It was a joke to preempt the whiners.

        As far as I'm concerned we can firewall off the rest of the world ;)

        Ok, not really.

    • Why do you Imperialists pigs [...]?

      Why is it always "[whatever]ist pigs"? Incidentally, I don't think the US has actively sought to colonize existing small countries for a very long time (ostensibly Iraq/the entire Middle East doesn't count since it is supposed to eventually "stabilize" at which point it will be freed, or whatever).

  • Dynamic != Static? (Score:3, Interesting)

    by Tekfactory ( 937086 ) on Tuesday September 28, 2010 @10:44AM (#33723194) Homepage

    "This goes a bit beyond a paper narrative, including fake log data, drives that may contain fake malware, and fake event history, and is dynamic, meaning that it can change dependent on the actions the players take." which makes me wonder how effective this test would actually be."

    Why shouldn't the test adapt to moves the player's make, do you think a hacker is going to keep running off the same script when he knows he's been noticed?

    Some of the worst botnets move their Command and controls nodes around and the people behind them release new code to adapt to what security researchers are doing to stop them. Including DoSing the researchers.

    What idiot thinks we can fight a changing landscape of threats with a static defense?

    No Really I can't tell from the context if that's Taco or the submitter, but paper narrative tests that the author mentions basically are just there to make sure you know your job or have memorized your DR plan, but they don't make you think.

    I'd be more worried if all facets of the scenario didn't get played out because nobody said "I image the hard drive" and so they skip that part of the test. In that case it would be up to the folks running the exercise to move the scenario along by saying someone at another agency imaged the drive, here is a copy, maybe you should look at it.

    It's a lot like preparing for a D&D game and having the players ignore half the story/encounters you wrote up.

    • Re: (Score:2)

      by vlm ( 69642 )

      It's a lot like preparing for a D&D game and having the players ignore half the story/encounters you wrote up.

      Oh, there's several ways around that, for sure:

      "Despite all agreeing not to open the trapdoor to the dungeon, you have an uncontrollable urge and open it anyway."

      "As you step away from my favorite trapdoor, you spy a giant, angry, immortal dragon heading your way. Care to reconsider that trapdoor?"

      etc etc. I suspect the whole thing has been scripted out. Basically "high school musical" for nerdy govt MBAs, probably with less dancing and music. I hope.

    • No Really I can't tell from the context if that's Taco or the submitter, but paper narrative tests that the author mentions basically are just there to make sure you know your job or have memorized your DR plan, but they don't make you think.

      I suspect you haven't ever taken part in a large scale simulation like this. I have. Short (and long) version: you're wrong.

      Not that there's anything wrong with ensuring that the participants know their jobs and/or have memorized their disaster recovery plan.

      • Of Man's reach exceeding his grasp...

        No big sims are multi-agency and have casts of thousands, even single agency drills can be enourmous and complicated. Just getting through the phone tree for a single angency is more complicated than running a "I call Iron Mountain to locate my backups" test or restoring the last good backup for real on one of the test boxes.

        But for the submitter who fails to see the value of a dynamic exercise, should I talk to him about planning a mini-D-Day invasion of Normandy? Becau

  • I don't get it really, what exactly is considered a cyber attack from the government's point of view? A DDoS at some sensitive service? And why would this sensitive service be accessible to the public internet anyway? Of course someone could compromise a workstation inside the network and stage his attacks from there, but then you should be really worried for other stuff (password policies, web filtering, firewalls etc). This sounds like another scare-tactic to gradually make people feel that the internet n
  • The original article is not quite right. The U.S. Department of Homeland security is sponsoring Cyber Storm. The United States, Australia, New Zealand, Canada, and the UK are participating. The focus is on response procedures for a significant event.
  • if(player.win())
    {
    player.loseAnyway();
    scaryPressRelease(REALLY_SCARY);
    Legislation* cyberRegulation = new Legislation;
    cyberRegulation->ramThroughCongress();
    Bureau bigBrother = cyberRegulation->biggerGovernment()
    }
  • Sorry to burst everyone's bubble, but I just simulated an attack of far greater proportions. First, I simulated having the resources to simulate an attack of far greater proportions, then I simulated executing my far greater attack. If anyone is interested, the results showed that while I was adequately prepared to defend against a simulation, I need to beef up some protocols and institute some new processes.

  • The World's Largest Simulated Cyber Attack is really growing up.

    Don't do anything that makes you feel uncomfortable.

  • Hmmm.... So exactly when does this stop being a simulation? :P

  • Taking a dev or similar production network and actually hiring the same people that would likely be used to attack your equipment to attack your honey pot and see what they actually do? I dunno i'm probably just being ignorant

  • Am I the only one hoping that Obama exercises his "internet kill switch" option?

    What happens then?

    "Good job Mr. President. Now our game is over. Way to ruin it for EVERYONE!"

Slashdot Top Deals

Never test for an error condition you don't know how to handle. -- Steinbach

Close