back to article US intelligence blabs classified Linux VM to world via leaky S3 silo

A classified toolkit for potentially accessing US military intelligence networks was left exposed to the public internet, for anyone to find, according to security researchers today. A Linux-based virtual machine designed to safely receive and handle secret material, and connect to protected Pentagon computers, was discovered …

  1. Jeroen Braamhaar
    Black Helicopters

    CLOUD:

    Catastrophic

    Loss

    Of

    Uncontrollable

    Data

    1. Anonymous Coward
      Anonymous Coward

      C.LO.U.D.

      Careless Leak Of Unsecured Data

      1. Anonymous Coward
        Anonymous Coward

        Yep its about time CLOUD took a roasting

        Not bad, but S.M.A.R.T (as in IoT / TV) is still the best!

        Whoever came up with that one, pints on me. - Kudos!

        ...'Surveillance Marketed As Revolutionary Technology'...

        1. jake Silver badge

          Re: Yep its about time CLOUD took a roasting

          Cloud Laudanum Over-pumps Utopian Daydreams.

          1. 2+2=5 Silver badge

            Re: Yep its about time CLOUD took a roasting

            Costly Leasing Of Unsecured Devices

    2. Anonymous Coward
      Anonymous Coward

      For Uber / Equifax megaleaks etc

      CLOUD: Computer Leak Of Unknown Degree

      (Especially for leaks that tend to get re-stated)

    3. Anonymous Coward
      Anonymous Coward

      Continued

      Linux

      Obviously

      Unexplainably

      Dumb

      ?

      1. Anonymous Coward
        Anonymous Coward

        @AC:

        Cretin

        Leaves

        Obnoxious

        Undesired

        Detritus

  2. Anonymous Coward
    Anonymous Coward

    I can't believe it

    Tell me Evgeni and the Millions of Russian Hackers were involved somehow. Please. Pretty please. Can't we blame yet another stupidity resulting from abject incompetence on them somehow? No. Pity.

    In any case, this explains why Amazon now has to provide a "Secret Region". Frankly, that is the only way the agency files can be kept safe. Quite clearly, they themselves do not have the competence to do so.

    1. Yet Another Anonymous coward Silver badge

      Re: I can't believe it

      It's linux, which is from Finland, which is next door to Russia, so it's Kaspersky's fault - Q.E.D.

      1. Lars Silver badge
        Coat

        Re: I can't believe it

        No no it's clearly Sarah Palin, pal of the Trump who can see Russia through her window. As such interesting and very astonishing as it seems to imply Trump can't be totally stupid as he can detect even something even more so. So lets wait and see if Trump is a Russia or Linux user.

      2. ST Silver badge
        Mushroom

        Re: I can't believe it

        What does Kaspersky have to do with any of this?

        I admire your flawless logic: Kaspersky isn't involved in this security breach, therefore Kaspersky is, by definition, innocent of any security breach, known or unknown. Q.E.D.

        You should tell your employer to come up with better bullshit next time. You seem much too eager to bring up Kaspersky for no obvious reason. A.k.a. the lady doth protest too much.

        1. Voland's right hand Silver badge

          Re: I can't believe it

          What does Kaspersky have to do with any of this?

          Lighten up and look up the definition of sarcasm in the dictionary.

          1. ST Silver badge
            Stop

            Re: I can't believe it

            > Lighten up and look up the definition of sarcasm in the dictionary.

            Quit posting dumb shit, and I will.

    2. a_yank_lurker Silver badge

      Re: I can't believe it

      Unfortunately Evgeni and Ivan are not a fault. It is just feral incompetency at its finest.

  3. fnusnu

    ^^^^ "an intrusion that malicious actors will have attempted, when they found this bucket."

    No charge.

    1. Doctor Syntax Silver badge

      an intrusion that malicious actors will have attempted

      s/attempted/carried out/

      Still no charge.

  4. Anonymous Coward
    Anonymous Coward

    Ha ha ha... Haha.. Haha....

  5. bobajob12

    Not just AWS S3

    I have to wonder how much else is out there, not just on S3, which gets all the attention, but also all the other services where material is shareable via a web URL and access control is not baked into the client in the same way as it is on the server.

    - Google docs

    - Dropbox

    - SharePoint (not sure about this one, maybe AD auth makes it happen magically, but I never understood it)

    Dollars to donuts if someone went poking around the URL space for these servers they would find things they should not.

  6. Captain DaFt

    Oh dearie me!

    Yet another one.

    Despite the default being unable to do this, and Amazon even adding color coded flags to alert you when you change it.

    Who or whatever could be doing this?

    Once is an accident, twice is a coincidence, three times is stupidity, but constantly? Geez, who keeps pissing off the BOFH?

  7. Outer mongolian custard monster from outer space (honest)

    Forget for a moment it being on a unsecured bucket. Why is such material even in the cloud on a 3rd party hosting resource?

    The rules are, once its uploaded somewhere outside your ownership and direct control, you have lost control. Simple as.

    This fail cant be fixed by clickying a few flags on the container, only obscured a little.

  8. Adrian Montagu

    Any Military/Intelligence system (old CONFIDENTIAL, SECRET or TOP SECRET) must not be connected to a public network unless seriously encrypted. The working network environment of the same should be on physically separate media.

    Ignore this and you will pay.

    1. jake Silver badge

      Well, yes, Adrian.

      That's why we built 'em MILNET. Granted. it was never intended to carry classified data, but the bones were there to do just that. Squandered, as is most military spending.

      1. Fat-Boy-R-Dee

        Re: Shock news. US drivers actually use safety belts?

        So the USDoD built SIPRNET (as opposed to MILNET/NIPRNET) and various "high side"/TS networks with all kinds of bells and whistles. The problem with using these dedicated/hardened networks, and what these tools were trying to address, was how to get actionable intelligence quickly to/from the field. The more hoops to jump through, the older the intel gets, and the less useful/valuable it is. (insert misattributed Forrest quote "fustest with the mostest" here)

        Labeling the container "INSCOM" in the clear wasn't *quite* as stupid as labeling it SIPR or somesuch, but I can see a lot of scenarios where it would be nice to, while you're really forward deployed, be able to get to tools, and the only thing you need is the local dishwalla (or whatever the Iraqi/Afghan/ME equivalent is) and a suitably hardened IronKey or somesuch.

        Ah well, you (hopefully) learn something new every day, hopefully at somebody else's expense :-)

  9. PNGuinn
    Black Helicopters

    What about the GPL?

    So, TFA is not clear.

    This is a "classified" linux system. OK, so far so so good. It's private. No need to release the source code.

    But now it's been "published". Presumably GPL. So, where can we download it?

  10. Aodhhan Bronze badge

    Don't make too much of this

    First off... equipment/software used for encrypted communication isn't classified as long as the keys aren't valid. The keys are changed quite often or valid for one use, so the chance they are still valid isn't likely.

    It also doesn't make sense this is placed in a cloud, and not installed on a laptop.

    Don't rule out the chance this is a honeypot of sorts. Run the applications at your own risk.

  11. sloshnmosh

    Boots up rather quickly

    The VM in question boots up quicker than I had expected on VMWare Workstation.

  12. This post has been deleted by its author

  13. Ted's Toy

    An Oxymoran in the title

    US Military intelligence or any other countries military couple with the work Intelligence is an oxymoron

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Biting the hand that feeds IT © 1998–2019