A Department of Homeland Security mailing list that provides unclassified daily news reports on critical infrastructure information experienced a meltdown today when the list apparently got misconfigured and began routing any reply that someone sent to another person on the list to every subscriber on the list. The list was further configured to reveal the e-mail address of the senders so that the names and contact details of hundreds of list members -- including government workers in critical infrastructure positions -- were exposed. The mishap also revealed an interesting tidbit -- at least one member of the list works in some capacity with Iran's Ministry of Defense.
The problem began early this morning when a subscriber to the DHS Daily Open Source Infrastructure Report mail list sent an e-mail to the list address saying he was switching jobs and asking to have the daily report sent to his new e-mail address. Another list member replied to his message telling him that he'd inadvertently sent his request to the wrong address. That reply however also went to everyone on the DHS mail list as did every other reply from people on the list telling the first two posters that their messages had spammed the entire list. Subsequent e-mails pleading with members to "stop hitting the reply-to-all button" also were spammed to the entire list. By midday hundreds of such e-mails were clogging the list.
At one point someone suggested lightly that the mailing mix-up was a great way for list members to network and get to know one another which then resulted in a free-for-all internet party as members spammed the list with still more e-mail jokingly exchanging astrological signs and romantic details ("I like long walks on the beach and a nice chardonnay with my roasted duck," wrote one member) networking for jobs and in the case of at least campaigning for political office.
Subject: URGENT REQUEST FROM DOD RE: DHS_Daily_Report_2007-10-02
This is your COMBATING TERRORISM OFFICE for DOD asking you to kindlystop now please. We actually have work to do.
Not to be a buzz kill but this is NOT a networking tool. I will make alist of these responses to have all of you removed if it continues.
The Technical Support Working Group (TSWG) is the U. S. Government's national forum that identifies prioritizes and coordinates interagency and international research and development (R&D) requirements for combating terrorism. Through the Department of Defense's Combating Terrorism Technology Support Program and funding provided by other agencies the TSWG rapidly develops technologies and equipment to meet the high priority needs of the combating terrorism community and addresses joint international operational requirements through cooperative R&D with major allies. For information on TSWG technologyprojects transition opportunities and other user information please visit the TSWG web page at www tswg gov.
The list is run by a government contractor. List subscribers include government workers involved in security and counterterrorism efforts employees of government contractors and security companies as well as journalists and researchers. None of the information exchanged on the list is classified and can all be obtained from other sources. But many of the messages included signatures at the bottom of the e-mail disclosing the sender's government title and contact details which could potentially be of use to someone wanting to social engineer the government worker to obtain information or spoof the worker's e-mail address and pose as him.
The problem with the list continued for at least six hours before someone finally fixed it -- but not before more than 500 messages had been spammed to list members. [The
that the total number of e-mail messages generated from the server and clogging the 7,500-member list reached 2.2 million during the mishap.] One State Department worker complained that the mishap cost her agency money since she was working overseas and being billed for every message that arrived to her handheld device.
Some of the list members were surprised when the worker from Iran. Amir Ferdosi popped up with this message.
This is very distracting to my messages. I read English slowly. My main office is in Iran but I commute to Europe. I am a researcher for the defence ministry. Today I am just outside Marseille. France--it is very mild temperature.
My brother lives in Tustin. California. Is that near you. I visited several years ago.
Wow a reply from Iran!!!! Open source really does mean open source!!!!! For those of you that have responded to this email from an official computer with your snazzy little signature at the bottom especially those that have every piece of contact information listed including those of you that have disclosed sensitive phone numbers and classified email addresses have knowingly provided this information to people all over the world some of which I am sure are deemed "undesirables'. Folks wise up. This is an open report that anyone with an email address can subscribe to. Although some of you responses have been humorous to say the least (leave poor alex alone) you are opening doors to people that you do not want to. I notice some of you are in jobs that use this list as a way of staying informed although you have no true capacity in the world of infrastructure security and I applaud you for using this tool to stay abreast of all the information provided.
But those of you that are in the military or provide services through any official office you should know better than to advertise who you are and who you work for. The best tool that someone can use to gain access to information they should not have is to befriend you and what better way than through some harmless emails besides now they have all your information. This is trade craft 101 folks. Wise up and don't reply to something just because you can. I know that I now have access to hundreds of IP addresses email addresses phone numbers names of personnel in sensitive positions and locations. I am only a cover story and a fake letterhead away from trolling for intel.
I wrote Ferdosi asking him to elaborate on what he does for the Ministry of Defense. He replied that he doesn't actually work for the ministry but "for a company that creates products for security and other uses." He didn't respond to a follow-up question asking him the name of the company he works for but a Google search on Sazeman-e Sana'et-e Defa' turns up what appears to be the a state-owned subsidiary of Iran's Ministry of Defense.
Our tax dollars hard at work KEEPING THE IRANIANS UP TO DATE ON OUR HOMELAND SECURITY. I worked on military issues in the Senate and just because something isn't classified doesn't mean we want the IRANIANS to see it. How do we not screen subscribers to this thing?
Being on the list. I can assure Mr. Bridges that there really isn't anything the Iranians wouldn't already know if they had a few open source intelligence professionals working with them. Brian Ross on ABC News gets better FOUO scoops from loose-lipped DHS people.
What this daily report does is sum up all the events of the day. (often a few days late) through open source news reports into one 15+ page report so you really don't have to do it yourself.
P. S. If you want good leads on IT security look into a newsletter called "InfoSec News"
Just more proof that almost anyone will click/open/reply to almost anything without regards to their own (or company's) safety. All having fun yakking to whoever all the while sorting 1000+ spam/infected/phish emails from their inbox. (or clicking them)
Fergie my dear only an extremely incompetent analyst would exclusively trust the mainstream trade-press as a basis for their daily intelligence picture. However the DHS OSIR list is pretty dry when it comes to posting IT security news. I was only recommending another source (.. of many out there) to help fill that void.
What I find really alarming is that someone in Iran was able to subscribe to this list to start with.
How did that happen? Don't they have something set up which allows a moderator to accept/decline requests for access?
Your point about signature blocks is well taken-folks sometimes give their life histories in them. All this does is make data aggregation easier for the bad guys and opens you up for social engineering or exploitation by folks you'd rather not know-sheer foolishness all the way around.
i was pissed at DHS because i thought they were stealing my e-mails i made up the above e-mail address and got it i found out that it was the trojan virus that stole 3 of my e-mail accounts so far no one has stolen this one anonymous
Always comforting to realize that all these twittering pingbacking forward: you-just-gotta-see-this MySpaceBookers with the security sense of a mini-marshmallow are workin' for the G. Get out now podners they're warmin' up the boxcars.
Just like this blog the DHS public site is open to the public from which the daily public source report can be obtained. The email distro is a service to get it pushed to you each day.
The reparte on the list was cause for celebration from some and worry from others some of it quite funny...
The point is that nothing in the report is confidential but the exposure of the info about the people may have some repercussions along with the info available in the email headers that were flying about!
Love the federal employee geniuses equating "open source" with "open subscription." Like a battleship slowly dissolving in water even the greatest human achievements are eventually undermined by the basest human vanities.
SOMETHING SIMILAR : HAPPENED THE OTHER DAY WITH THE US GOV. [FIRST GOV] LIST SERVER; WAS GETTING ALL KINDS OF EMAIL HAD NO NEED! SO SENT ALL TO SPAM!. WAS THERE POSSIBLE ANOTHER CONSPIRACY THERE?WHO'S HOME LAND ARE WE PROTECTING; DOES ANYBODY REALLY KNOW?
I suggest this should be sent to all newspapers and tv stations in your area. They missed the significance of this completely. You are correct it seams Osama could subscribe to this list.
Now is the time to act. Get this story out of the blogisphere and into the mainstream press.
: Tech News. Gadget Reviews and Special Offers - all delivered to your mobile device.
Add to your favorite feed reader. Find more Wired com feeds including web-based news reader feeds.
Forex Groups - Tips on Trading
Related article:
http://blog.wired.com/27bstroke6/2007/10/dhs-mail-list-m.html
comments | Add comment | Report as Spam
|