Homeland Insecurity?

Yeah, I kind of figured this would tickle some in alt.2600. I'm surprised, though, that the Linux guys haven't yet posted some deservably bent-out- of-shape comments about it.

I personally like this connect-the-dots BS between MS and those DHS dumbasses:

"One of the reasons I came to Microsoft is that I saw the critical role technology would play in achieving the goals of the National Response Plan," said Tom Richey, Microsoft's vice president for public sector since 2002.

Previously, Richey had been a career Coast Guard officer and commander who had worked under Adm. James Loy, who became deputy secretary of homeland security under former DHS Secretary Tom Ridge."

I was going to change the subject back to "Homeland," but..."Homoland" does seem to fit more tightly, so to speak....

-BC

While it looks as though the late 2004 patches have helped Outlook 2003:

Outlook still uses Internet Explorer for all HTML stuff and such, and that's the really big security hole these days: Not that Exchange Server 2003 also doesn't have a few things to worry about: If you read the article through thoroughy, there are just so many red flags about what they're thinking and why. Another concern is that MS might use it as proof to how secure their products are -- if they're good enough for the Dept. of Homeland Security, they're good enough for Joe Blow's Credit Card Processing Service and Aunti M's Remote Power Plant Access Service.

It seems that everything that Bush even breathes on....

-BC

Well, I myself have been suspicious about what became of the still mostly classified "Enhanced Carnivore" project:

I'm reasonably sure it didn't exactly go "away"....

-BC

I am no conspiracy buff; *but* there has to be a reason M$ got off with a slap on the wrist. I would say that M$ agreed to put subversive back doors and other well hidden such things into there os which the government has the

*keys* to open. There is also some talk however around the conspiracy sites about why the hardware is getting so cheap. True some of it is because of economics; but I also think some of it (hardware being cheaper then it ever has been) is to get consumers to get rid of their old hardware which doesn't have the government sponsored chips inside it for the new cheaper faster hardware. I know not a few old school hacks that are keeping some of the older *slower* hardware around and if nothing else putting them together to make a super computer using Beowulf and the likes.

"The Homeland Security Department soon will consolidate the e-mail systems of its 22 agencies, and it should surprise no one that Microsoft Corp.'s Outlook e-mail application is way ahead in the competition before it even begins."

BAWAHAHAHAHAHAHAHAHAHAHAHAHAHHAHAHAHAHHAHA!!!!!

The world's viri infect OS and application to lead the Department of Homoland Security!!

BAAAAAWAHAHAHAHAHAHAHAHAHAHAHAHAHHAHAHAHAHHAHA!!!!!

OMG A PROGRAM THAT CAN SEARCH FOR TEXT?!?! *shudder* Boy now THAT'S sca-er, wait a minute...

o_O

Sometimes, I think I might be the only person on the planet who isn't a FUCKING MORON!

Oh and that link you provided, yeah, how do you expect anyone to take them seriously when they can't even encode their images properly? They can reduce all those image sizes by about 50% just by switching to a 16 bit palette based PNG format.

--

Onideus Mad Hatter mhm ¹ x ¹

Not to imply anything, but you may want to look at the redaction pattern....

-BC

I'm not sure what to think when someone claims that they've been running Windows and Exchange and blah, blah, blah for ages without a problem when I personally know of companies and institutions with seemingly fortress-like protection (mostly because they are required to) still getting hacked and infected on a regular basis. And considering that IE cannot be made secure without making it unusably crippled, and that Outlook/Exchange systems tend to behave typically more like software Chernobyls, even in Redmond....

Not that I'm casting any aspersions.

-BC

Also, the "text search" part really mostly applied to the original Carnivore design. What little is known about what was called "Enhanced Canivore" is a bit more sneaky:

And for some more background stuff:

-BC

"As a department, we're pretty focused on Microsoft Outlook. "

"To respond to the security concerns, Microsoft has stepped up its patching activities. "

I don't know if this is still relevant:

Geo

There are no absolute set patterns in human behavior and communication...especially not in a world where you can never tell for certain who a person really is. Carnivore was a foolish, deficient, lacking design from the very beginning and no amount of "enhancement" is going to change that fact...ever. The government wasted tax payer dollars on a system that been proven time and time again to be grossly ineffective...but then what else is new? Has Carnivore stopped terrorism, of any kind? Well since we've been seeing a rise in terrorism, it stands to reason no. Zit lnlztd ol ql oftyytezoct ql ngxk qwosozn zg ktqr ziol ltfztfet. Teh crypto peeps might like that...of course I can extend that as far as I like, hell I can even take the encoded text and then reencode it in ROT13, base64, anything I like. Hell I could even reencode it as ROT13, then base64, then as ROT13 again and then base64 again and I could do that for an indeterminable number of times and unless you knew the precise number of reencodes you wouldn't have much luck figuring it out, now would you? ^_^

--

Onideus Mad Hatter mhm ¹ x ¹

Now, we're getting somewhere -- I have personally -- and very, very reluctantly -- set up pretty stable Outlook/Exchange (and Outlook/ Bynari) systems, but only by not exactly following MCSE guidelines.

Still, I would be very antsy about setting up such a system in very sensitive and problematic environments. I know of some large tech companies who treat an Outlook install -- which they would do only for customer support -- as they would a new virus they're studying: completely isolated from their working network and even the Internet if possible. (Part of it is also a suspicion somewhate related to the other main topic in this thread.)

IMAP email systems are far, far more robust, safer and more flexible, and calendaring is best done as a separate add-on. The only Outlook functions that seem to be currently and very temporarily tricky to replace is full Blackberry integration with a calendar and that email invite-to-calendar trick.

But there are a slew of products coming this summer and in the fall that look to more completely replace Outlook/Exchange systems. If the Blackberry stuff gets tied in as well, then expect the beginning of a mass exodus from that kludgey, house-of-cards proprietary mess beginning with the tech sector.

And good riddance.

-BC

"] |_| (_] _['' _['' ]-" /_\\ |/_ [. BC:

Er...

Seems that I had a conversation just last week regarding US DOD certified e-mail applications (there being but two: Lotus Notes and GroupWise)

My google skills are weak from not being online for a few days, but I did at least find the regs:

I guess if you're Homeland Security and most of your staff are already comfortable with using Outlook and Crackberries, too bad about those silly DoD information assurance regs. Different dept. anyway.

-BC

What people fail to see is that a Windows based workstation and server environment can easily be secured and used for daily work without much effort. We do it all the time, medical facilities, multi-office businesses, groups with people off-shore, etc.... More than 10 years with MS shops online and working without a single virus or compromise.

We did a utility company, setting up all security and services and were given the highest rating by HS for a secure setup.

There is more to security than many people understand or even think about, and it's not just something that people can fix by looking in one area. I personally love Exchange 2000 and 2003 for email as they offer more features to users than anything else I've used/installed on any platform, and it's simple to protect. Heck, even my linux workstations running Evolution can fully utilize Exchange connections.

Where the shops run into problems is letting users design/manage networks that really don't belong in the I.T. field.

*checks out some of the sites*

....um...they're not in English...

*crickets chirping*

Seriously if you want to try and have yourself a 'global cyber intarnet hax0r moms basement bananza Jihad special with fries'...probably it would be best to put the sites up in a language that's readable to more than...what, 2% of the entire world's population? I'm just sayin. o_O

--

Onideus Mad Hatter mhm ¹ x ¹

I do. They're either lying or ignorant.

However, the scales remain weighted in favour of global jihad, the first virtual terror organisation. For all the vaunted spying advances such as tracking mobile phones and isolating key phrases in telephone conversations, experts believe current technologies actually play into the hands of those who would harm us.

?Modern technology puts most of the advantages in the hands of the terrorists. That is the bottom line,? says Professor Michael Clarke, of King?s College London, who is director of the International Policy Institute.

Government-sponsored monitoring systems, such as Echelon, can track vast amounts of data but have so far proved of minimal benefit in preventing, or even warning, of attacks. And such systems are vulnerable to manipulation: low-ranking volunteers in terrorist organisations can create background chatter that ties up resources and maintains a threshold of anxiety. There are many tricks of the trade that give terrorists secure digital communication and leave no trace on the host computer.

Ironically, the most readily available sources of accurate online information on bomb-making are the websites of the radical American militia. ?I have not seen any Al-Qaeda manuals that look like genuine terrorist training,? claims Clarke.

However, the sobering message of many security experts is that the terrorists are unlikely ever to lose a war waged with technology.

PS:

The web site mentioned in the above article

appears to be a typo. I think they meant (which has some strange domain registry info, and appears to not be working). Archive.org seems to have archived something there a few years ago, which upon viewing seems to spawn a bunch of pop-ups.

There are many places that have MS shops that follow strict practices and remain safe. Not everyone uses IE and not everyone relies on MS methods to keep their networks safe. There are many firewalls the remove attachments by type from SMTP sessions, clean HTML sessions of malicious content, and limit users to proper sites.

If you look at the common methods for getting a virus or compromise, you can limit the exposure to almost nill if you understand them.