Critical Observer

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjDQHHHry4kCcLfJUr0dq6cY1Ce8cathmtZ_mAArzsf3IqgSapm_LehcpFO3qK86LNRtGuy9vbxXrCYC83kPCo9UxK_YzPCRaJd-4J3bMnBcrK3kvV6LPmT894BtzTxEoPU1-ap7sS8IwY/s1600/00000.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="330" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjDQHHHry4kCcLfJUr0dq6cY1Ce8cathmtZ_mAArzsf3IqgSapm_LehcpFO3qK86LNRtGuy9vbxXrCYC83kPCo9UxK_YzPCRaJd-4J3bMnBcrK3kvV6LPmT894BtzTxEoPU1-ap7sS8IwY/s640/00000.jpg" width="640" /></a></div>
<div style="background: 0px 0px rgb(255, 255, 255); border: 0px; font-family: arial, helvetica, sans-serif; font-size: 15px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;">
<br /></div>
<div style="background: 0px 0px rgb(255, 255, 255); border: 0px; font-family: arial, helvetica, sans-serif; font-size: 15px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;">
The US Department of Energy (DOE), which oversees the US power grid, nuclear arsenal and national science labs, is a prime target for cyberattackers who want to harm the United States.</div>
<div style="background: 0px 0px rgb(255, 255, 255); border: 0px; font-family: arial, helvetica, sans-serif; font-size: 15px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;">
Now we are beginning to glimpse the extent of the threat, thanks to unclassified records obtained through a Freedom of Information Act request by <span style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: 0px 0px; background-repeat: initial; background-size: initial; border-color: initial; border-style: initial;">USA Today</span>.</div>
<div style="background: 0px 0px rgb(255, 255, 255); border: 0px; font-family: arial, helvetica, sans-serif; font-size: 15px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;">
The <span style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: 0px 0px; background-repeat: initial; background-size: initial; border-color: initial; border-style: initial;">government records</span> show cyberattackers successfully compromised the DOE 159 times between October 2010 and October 2014, and attacked the agency a total of 1131 times during that period.</div>
<div style="background: 0px 0px rgb(255, 255, 255); border: 0px; font-family: arial, helvetica, sans-serif; font-size: 15px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;">
USA Today reports that 53 of the successful attacks were root compromises, meaning the attackers had administrator privileges on compromised DOE computer systems.</div>
<div style="background: 0px 0px rgb(255, 255, 255); border: 0px; font-family: arial, helvetica, sans-serif; font-size: 15px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;">
Of the 159 successful intrusions, 90 compromised the DOE Office of Science, which conducts energy research, and another 19 attacks compromised the National Nuclear Security Administration - the agency in charge of securing the nation's stockpile of nuclear weapons.</div>
<div style="background: 0px 0px rgb(255, 255, 255); border: 0px; font-family: arial, helvetica, sans-serif; font-size: 15px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;">
The <span style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: 0px 0px; background-repeat: initial; background-size: initial; border-color: initial; border-style: initial;">DOE disclosed</span> a breach in July 2013 that <span style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: 0px 0px; background-repeat: initial; background-size: initial; border-color: initial; border-style: initial;">compromised personal records</span> of 104,000 past and current federal workers, contractors and their dependents.</div>
<div style="background: 0px 0px rgb(255, 255, 255); border: 0px; font-family: arial, helvetica, sans-serif; font-size: 15px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;">
But the DOE isn't saying what data or systems may have been compromised in the other 158 breaches - that information has been redacted from the records.</div>
<div style="background: 0px 0px rgb(255, 255, 255); border: 0px; font-family: arial, helvetica, sans-serif; font-size: 15px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;">
A DOE spokesperson told USA Today that the agency can't comment on investigations into the compromises or who might have been behind them.</div>
<div style="background: 0px 0px rgb(255, 255, 255); border: 0px; font-family: arial, helvetica, sans-serif; font-size: 15px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;">
But it's quite possible that other nation states could be the culprits, as the US's top cybersecurity official alluded to in a speech in Washington, DC this week.</div>
<div style="background: 0px 0px rgb(255, 255, 255); border: 0px; font-family: arial, helvetica, sans-serif; font-size: 15px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;">
<span style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: 0px 0px; background-repeat: initial; background-size: initial; border-color: initial; border-style: initial;">Admiral Michael Rogers</span>, head of US Cyber Command and the National Security Agency, said nation states are spending a lot of time and effort to gain access to the US <span style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: 0px 0px; background-repeat: initial; background-size: initial; border-color: initial; border-style: initial;">power grid</span> and other <span style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: 0px 0px; background-repeat: initial; background-size: initial; border-color: initial; border-style: initial;">critical infrastructure</span>, according to the Wall Street Journal.</div>
<div style="background: 0px 0px rgb(255, 255, 255); border: 0px; font-family: arial, helvetica, sans-serif; font-size: 15px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;">
Those nation states want to have "options and capabilities" against the US, Rogers said:</div>
<blockquote style="background: 0px 0px rgb(255, 255, 255); border: 0px; font-family: arial, helvetica, sans-serif; font-size: 15.2px; line-height: 16px; margin: 1em 40px; padding: 0px; vertical-align: baseline;">
<div style="background: 0px 0px; border: 0px; font-size: 15px; line-height: normal; margin-bottom: 10px; padding: 0px; vertical-align: baseline;">
<tt style="background: 0px 0px; border: 0px; font-family: courier, monospace; font-size: 14px; margin: 0px; padding: 0px; vertical-align: baseline;">We have seen nation states spending a lot of time and a lot of effort to try to gain access to the power structure within the United States, to other critical infrastructure, and you have to ask yourself why. It's because in my mind they are doing this with a purpose, doing this as a way to generate options and capabilities for themselves should they decide that they want to potentially do something.</tt></div>
</blockquote>
<div style="background: 0px 0px rgb(255, 255, 255); border: 0px; font-family: arial, helvetica, sans-serif; font-size: 15px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;">
How the US can defend itself against these threats is an open question right now.</div>
<div style="background: 0px 0px rgb(255, 255, 255); border: 0px; font-family: arial, helvetica, sans-serif; font-size: 15px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;">
Should the US develop its own offensive cyber capabilities as a deterrent? Should it use <span style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: 0px 0px; background-repeat: initial; background-size: initial; border-color: initial; border-style: initial;">economic sanctions</span> against countries like <span style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: 0px 0px; background-repeat: initial; background-size: initial; border-color: initial; border-style: initial;">China</span> that have a history of <span style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: 0px 0px; background-repeat: initial; background-size: initial; border-color: initial; border-style: initial;">cyberattacks</span> on US interests?</div>
<div style="background: 0px 0px rgb(255, 255, 255); border: 0px; font-family: arial, helvetica, sans-serif; font-size: 15px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;">
Perhaps the US government should focus first on cleaning its own house.</div>
<div style="background: 0px 0px rgb(255, 255, 255); border: 0px; font-family: arial, helvetica, sans-serif; font-size: 15px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;">
USA Today reports that an audit last year found 41 DOE servers and 14 workstations used default or easily guessed <span style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: 0px 0px; background-repeat: initial; background-size: initial; border-color: initial; border-style: initial;">passwords</span>.</div>
<div style="background: 0px 0px rgb(255, 255, 255); border: 0px; font-family: arial, helvetica, sans-serif; font-size: 15px; margin-bottom: 10px; padding: 0px; vertical-align: baseline;">
That's making an attacker's job far too easy.</div>

US Department of Energy Hacked Repeatedly; Oversees Power Grid & Nuclear Arsenal

The US Department of Energy (DOE), which oversees the US power grid, nuclear arsenal and national science labs, is a prime target for c...

Read Article »