‘The
Govt’s move to delink computers used by civil servants from direct access to
the Internet is “absolutely necessary” to keep govt data and public services
secure.’ Hsien Loong.
When
this policy takes effect in May next year, civil servants can only access the
Internet through dedicated computers or through their personal computers. Hsien
Loong has disclosed that there have been very determined attacks on the Govt’s
IT systems and the threats are getting more severe and sophisticated. Just
relying on the system’s defensive measures is looking like a losing proposition
and it is best to cut the connection to the minimum. Hsien Loong quoted the
possibility of personal data like NRIC numbers, addresses and income tax
returns being hacked and put up for sale in the Internet. It is all about being
safe and secure and the safety of citizens.
Given
the same kind of logic and thinking, would the govt clamp down on immigration
if more Singaporeans are being beaten by foreigners here or if the threats of
terrorism increase, or if actual terrorist acts occurred? Or would it be too
late by then? Data security cannot be more serious that personal security and
safety and the threats of terrorism on our soil or in the heartland? How badly
exposed are Singaporeans to terrorism with so many foreigners here?
The
preventive and proactive policies and measures taken to safeguard the data and
information safety and security of our citizens should be extended to make sure
citizens’ personal safety is protected and not compromised by the hoards of
foreigners with unknown backgrounds. Tiok boh? Important or not? No attack does
mean we are safe. Terrorists planning to hit their home country from here does
not mean we will be safe.
What
are the govt going to do about these threats? Should we cut down the human
connections as well or at least reduce the numbers here? Terrorists can also
wear suit and ties among the professional ranks.
Do the Aristocrats knew about downloading and thumb drives and external drives. ????
ReplyDeleteIf a person wants to pass data they can always downloaded and save. Later pass to the other parties. Why send the info now and get caught if unaware.
Think they better use the Skills Fund to study about computers skills and do not post the monkey showing the middle finger.
"The preventive and proactive policies and measures taken to safeguard the data and information safety and security of our citizens should be extended to make sure citizens’ personal safety is protected and not compromised by the hoards of foreigners with unknown backgrounds."
ReplyDeleteRB
Hahahahahaha. Hoards of foreigners with unknown backgrounds? This is better than having no foreigners.
So it is still a choice between the lesser of 2 evils, even though citizens’ personal safety is at risk of being compromised.
Just like the 70 % who voted for the PAP, even though PAP is damn screw up like what RB mentioned many times in his blog. Because to vote for the opposition will be even worse.
If you study risk management, you will learn how to manage risks.
ReplyDeleteFirst thing is that you try to eliminate the risk, failing which, you try to reduce the risk. If still fail, learn to accept and live with the risk.
In the case of no Internet on civil servants' computers, PAP is eliminating the risk of IT security being compromised. This they can do, being just a technical issue.
But in the case of hoards of foreigners with unknown backgrounds posing a risk to Sinkies, I think PAP cannot do much if they need those foreigners. So by keeping quiet or seem to be doing nothing as observed by RB, PAP is indirectly telling Sinkies to accept and live with the risk.
After all, PAP has a recent 70% mandate to decide and do all these. So kpkb no use, except for fun on a weekend.
Do you think Singaporeans know very little about the national reserves?
ReplyDeleteIf yes, then maybe the physical threats to Singaporeans is not very important?
But maybe the government computers know a lot about our national reserves?
So maybe it's more important to secure our government computers than Singaporeans?
True or not?
What do you think?
Do you think Singaporeans know very little about the national reserves?
ReplyDeleteAnon 10:20 am
Why would Singaporeans care about national reserves, as long as they have lots of reserves in their bank account?
What has national reserves, even if they are a lot, got to do with Singaporeans with money no enough?
The challenges of this separation: (1) social engineering on the rise (2) tortoise-slow network workstation, especially if shared by group (3) snapping of sensitive data on personal mobile phone (4) blah blah blah . Hands-On Green Matters
ReplyDeleteWhat has national reserves, even if they are a lot, got to do with Singaporeans with money no enough?
ReplyDeleteJune 11, 2016 10:28 am
Because the national reserves belong to all Singaporeans?
Just like Singapore belongs to everyone living here.
Now ah Loong can sleep peacefully..all civil servants can only read approved materials..msm gg to provide free newspapers to boost circulation n direct the news..this has taken censorship to a whole new level...
ReplyDeleteCivil servants will operate inside an aquarium.
ReplyDeleteNo use one Lah..even the G us infiltrated with Aliens aka Foreign Trash..G or goons isolate the Internet & personal workstation could only help little Lah..look at the Upcoming movie directed by German already telling Sinkies that they will be destroyed by Aliens in the future ( watch the Independence Day Resurgence)...
ReplyDeleteBG PM Lee is spot on this issue. However he doesn't go far enough. Air-gapping the public servants computers has to occur NOW.
ReplyDeleteAlso, all cellphones should be BANNED from offices, to be surrendered and stored at security checkpoints at the entrances. Govt employess can remain in contact with the outside world while at work the "old fashioned way"---LANDLINES. Also, all USB ports and optical drives in all govt computers need to be locked out.
Cybercrime is now very big business---estimated at USD 2 trillion per year or around 15-20% of global GDP. Every system is hackable---even your car can be "commandeered" by hackers to turn off your brakes and go full throttle if they pull up close to you whilst driving.
IMO govt computers are already compromised thru 0-day (zero day) exploits. The time between INFECTION and DISCOVERY of the infection is usually in the order of several months. Air-gapping the computers will prevent any malware from communicating with the hackers, which could make it more difficult for them to access the govt systems and plant more malware, open backdoors and plant rootkits. Anti virus programs WILL NOT DETECT most of the more sophisticated malware. With around 50,000 new malware agents being created EVERYDAY, good luck with trying to detect them on your own computers, smartphones and tablets (the most easily hackable devices ever).
Add to that Singapore the "smart nation" is full of "stupid people" all waiting to be socially engineered. Everyone is on their smartphones playing (malware infected) games and using apps like WeChat (full of malware) and using suspiciously CHEAP "Made in China" phones which come with malware preinstalled (I was one of them. I bought a "cheap" 5.5" Android at Sim Lim, preinstalled with "bloatware"---games. The motherfucker was stealing $10-20 per day by PREMIUM SMS malware)
There is no "patch" for human stupidity and gullibility. Humans are the ultimate 0-day exploit. I can say with certainty that there is going to be more malicious hacking on the SG.GOV computers. Some of it, they won't tell you about.
As for your smartphones, if you're on social networks, chances are you are infected already and some the more sophisticated malware is invisible to your anti-virus detectors. In fact, some of your anti-virus maybe DISGUISED as malware.
If you're not at least afraid, you should be.
Here's a question for all those "xenophobes" complaining about "foreigners" working in Singapore:
ReplyDeleteHow do you know at least some of them are not AGENTS of foreign governments or cybercriminal organisations?. If some of them have been caught with fake creds, how many of them with real creds are actually hackers who have access to govt. computers and thus able to plant malware or to exploit 0-days on the national IT infrastructure?
Answer: You don't know. No one does. I say again: the time between infection and detection is in the order of several months. Or even years.
Scared yet?
"... the time between infection and detection is in the order of several months. Or even years. "
ReplyDeleteJune 11, 2016 11:56 am
What about the time between the death of LKY and the discovery that PAP is incompetent without LKY?
Is it in the order of several months or several years?
Scared yet?
@ anon 1230:
ReplyDelete>> What about the time between the death of LKY and the discovery that PAP is incompetent without LKY? <<
70% of the population disagree with you. So are they right? Or are you right? If you think you're are "right", what is your next play? More anonymous comments on a blog?
>> Scared yet? <<
Of the PAP? Nah. If you know how the "game" their systems, you can do very well. ;-)
Got your "game face" on yet?
For us, we really don't give a shit about civil servants can not access the Internet. In fact it may be better as some may be surfing undesirable sites during working hours then exposed the system to malware.
ReplyDeleteFor us, it's more important that the government lift the restriction on some sites as many sites have interesting riding videos that were blocked hence affected our members enjoyment.
Yew Kuang
Chairman
Kuda Riding Club
Singapore Chapter
This comment has been removed by the author.
ReplyDelete@ "Kuda bravery" anon 252:
ReplyDelete>> For us, we really don't give a shit about civil servants can not access the Internet <<
Good for you. One day when the hospitals get hit and you as a patient get prescribed the wrong drugs---injected directly into your IV tube, with lethal or permanent brain damaging consequences)---because the database was hacked, and records corrupted; I wish your surviving family "good luck" in their attempts to sue the govt. for "justice".
Me? I'll be fucking laughing at the consequences of your silly attitude. ;-)
@ Redbean:
ReplyDeleteI think it is time to rethink this national idea of "smart nation". Having the whole city state wired up and controlled by computers is not such a good idea because of the hacking threats----there are just TOO MANY THREATS and NOT ENOUGH countermeasures or contingencies in place.
In the last few weeks, some offices in Singapore were hit with malware known as "Locky". The Locky virus is known as "ransomeware". It encrypts your files (so you can never open them) and then sends you a ransom note demanding payment for unlocking your files.
I suspect some govt. agencies were hit with Locky or similar crypto-ransomeware, but the govt. isn't about to make this announcement public. They probably had to settle 6 or 7 figure amounts to pay the ransoms. Announcing it to the public would be downright embarrassing.
How to be a "Smart Nation" when we have stupid PAP Ministers?
ReplyDeleteDunno how to operate a train system in Singapore;
one of the smallest countries in the world.
Dunno how to keep our IT infrastructure safe from hackers.
Everything also dunno.
Only know how to get the highest salaries in the world for Ministers.
We also have stupid voters.
ReplyDeleteKeep voting for the same people with the same old tired ideas.
Ideas you can get for free by reading LKY books.... No need to pay million dollar salaries to listen to the same rubbish.
Did someone get cancer?
ReplyDeleteDid someone get stroke?
Did someone get heart bypass?
What type of cock succession plan Yew call this?
Do you think Singaporeans better vote Opposition to prepare ourselves for an alternative succession plan without PAP?
I agree, need to rethink this smart nation thing. Maybe it is safer to go manual. When everything is wired up, just a little virus would wipe out everything. Just a little virus.
ReplyDeleteSee how clever those people thinking of wiring up everything now want to disconnect everything?
See how they hooked up all the computers into the stock market and the market is dying but no one got the guts to say so, praying that it would go away or would not kaput.
Those in the exchange pretend everything is just fine, just as they want it to be. The MAS also did not know what to do. So also pretend all is fine. What about the ministers, all turn to look away. Not my problem. No one is complaining, so no problem.
All computers must be stand alone system like in the 70s and 80s. Like that very safe.
Locky virus? Were they developed by people who had been working in our govt system and thus could find all the loopholes and all the right information/knowing the value to attack and locked up and demand for a ransom?
ReplyDelete
ReplyDeleteIs Microsoft to be blame for their oh so popular software ?
holes everywhere. exploits after exploits even Microsoft don't know about. what so good about Microsoft!
up till now there is still no alternative to Microsoft except for Linux flavours which doesn't have enough support from the masses. but than there are still exploits within Linux.
there should be a new operating system being built which can hopefully deter these attacks. so much money to make but all these business people with fat money don't want to invest in it.
lets go back to Ms DOS OS. haha.
the next thing will be only 2g phones will be allowed in the gov.
smartphones are so easy to hack into.
IBM could revive it's OS/2 operating system. or bring back Steves Next OS and kick Microsoft to Hel?.
when you develop a operating system the company has to be responsible be it Microsoft , Cisco or who ever builds the OS.
What do you think ?
"Those in the exchange pretend everything is just fine, just as they want it to be. The MAS also did not know what to do."
ReplyDeleteRB 8:25 pm
Why would that matter, when PAP can now even win a by election with a minority candidate in a Chinese majority SMC?
/// Maybe it is safer to go manual. When everything is wired up, just a little virus would wipe out everything. Just a little virus. ///
ReplyDeleteI have no objections if we go back to the physical scrip system for shares just like 20 years ago.
- high frequency trading would be very difficult
1/2
ReplyDelete@ 1021:
Yes, there are many "bugs" in MS OS. In fact, it is so buggy that they've stopped supporting (updates and patches) XP, which was probably their "best" OS, next to NT.
However, there are still millions of computers running XP---especially legacy systems, all with unpatched bugs open for exploitation.
The "back of the envelope" estimates are around 10-20 bugs in every 1 million lines of code. So Windows 8 has probably 50 million or so lines of code. Do the math ;-)
In 1969, NASA's Apollo 11 put Neil Armstrong and Buzz Aldrin on the moon. The number of lines of code on Apollo's computers was in the thousands, perhaps tens of thousands. Today your top-end Galaxy 7 or iPhone 6 has, by several orders of magnitude more lines of code than what THE WHOLE OF NASA had for its Apollo moon landing mission in 1969.
More lines of code means more bugs and thus potential for exploit. Now you know why there are such frequent updates to your software---they are patching potential weaknesses.
However there is no patch for human stupidity....and we know that has been exploited since the time people lived in caves and hunted woolly mammoths. :-))
Linux is of course a much better choice. Being "open source", it is scrutinized by millions of knowledgeable individuals who try to break systems and find out the weaknesses which are fixed immediately. The result: an extremely robust and efficient OS with a much smaller footprint which can be configured to run on a variety of modern tech gadgets. Android OS is essentially SE Linux with a Java-like "virtual machine" called "Davlik" running on top.
I use Linux almost extensively. I have Ubuntu on most machines, Raspbian for Raspberry Pi's, Arch linux (simple and elegant) on my android phones and tablets, and Kali Linux 2 on one tab and phone, and of course on a couple of computers. Kali Linux, IMO is the best OS and suite of tools for HACKING.
I even have Kali Linux 2 fully weaponised on my MacBook Pro---my daily portable---and am in the process of weaponising the Kali installation on my everyday smartphone. (i.e. I can hack networks from my smartphone...if I wanted to...but only with permission from the legitimate owners ;-) )
2/2
ReplyDeleteIf a 60-year old botak short-arse harmless uncle with only mediocre Linux skills can be walking around with fully weaponized hacking gear in today's world, what about the "young guns" who are fully adept in hacking and have a malicious streak or a penchant to "make fast big money"?
The cute specky nerd chick on the train next to you is giving you "sexy eyes" but she's packing an RFID scanner which is stealing your credit card numbers without even touching you. How the fuck would you know? Before you get off the train, she's off and uploading your CC and debit card or simply using it immediately to buy BitCoin.
Meanwhile, you are still on the train. When you get off and go to the pharmacy to re-supply your Viagra prescription, you find that your debit card doesn't have any money left on it to pay. The elderly woman at the checkout gives you a disgusted look: "Kani nah uncle, want to screw mei mei no money ah? Chow kah hum sup uncle! Pui Pui!"
In China, there is a group identified as "Hidden Lynx". There are about 50-100 of them, many of them are officers in China's govt intelligence and cybersecurity community. These people are some of the most gifted hackers on the planet, and they are for hire. They are not 17 yr olds who act impulsively and lack self control. Hidden Lynx operators are patient, innovative and HIGHLY skilled---better on average than the other top hackers in the world. (Google it!)
If Hidden Lynx hasn't alread embedded itself in Singapore's IT infrastructure, it's only a matter of time before they do. Singapore, being the most "PRC friendly" cuntry in the world might even have Hidden Lynx members already in play, on the island, in jobs where they can directly access Singapore's IT.
This is the shit which keeps me awake at night. Everyone should be worried. Put the good old Singapore "kiasu kiasi" attitude to good use, for once.
Good. We can all start talking about the No internet of things. What a ducking joke. A smart nation wannabe cannot even reduce its security risk without going back to the 80s. This kind of kiasi mentality already 'su' liao lor..cyber simi lan jiao ?
ReplyDelete@ 600:
ReplyDeleteThe internet of things is unstoppable. Already many people are wearing smart watches and fitness trackers---many with GPS. Most people don't give a shit about cybersecurity risks as they prefer the convenience and "entertainment" their digital lifestyle devices bring them.
In Singapore, people are gadget-crazy and will always flock to buy the latest and greatest stuff. Observe the situations everytime when Apple, Samsung or Xiomei release their new phones: queues in the real world, and sold out in minutes in the online websites.
Another human trait which has been benefiting criminals for thousands of years is the fact that most people, most of the time think "it won't happen to me", and just like the proverbial ostrich with its head in the sand simply carry on "enjoying life" oblivious to the rel chance that their devices could already have or be part of APTs (Advanced Persistent Threats---unauthorised entry and placement on device which can remain there for months or years undetected). No one gives a shit about crime until they become victims---can be any type of crime.
The fucking SG.Gov should play down the "Smart Nation" thing. Don't make such a big deal, just to show uncles and aunties how "great" Singapore is and to win their "love" for the PAP govt.
What I'm suggesting is a RETHINK in policy, and a stronger concentration on security issues, maybe some form of public awareness.
Singapore is---at the moment---one of the least infected cuntries in the world as far as malware infections go. Estimated to be around 25% of all computers, say 1 in 4. However China and India are over 50% infected, and high rates of infection are recorded in Taiwan, Thailand, S Korea, Philippines and Indonesia. We have lots of visitors and immigrants from these cuntries crossing our borders everyday with their laptop computers, phones and tablets, and soon when the "internet of things" kicks in, their wearables and personal devices---all connected to the net.
No one is going to stop tech progress. Technology brings tremendous benefits...going back to 1970's is not an option.
Like I said, I'm just throwing out ideas here. I have no crystal ball....I don't know what is going to happen. I'm only suggesting that certain things can happen.
Here are the prices for various "hacking services"
**Disclaimer: for educational and informational purposes only. Don't be a "bad guy"!!**
Singapore can’t be a Smart Nation if systems are vulnerable: CSA chief
ReplyDeleteThere is this THING called the INTRANET.
ReplyDeleteYou don't have to curtail the use of Internet.
If you are not a miser and your company is big and
wants big businesses and be connected to the Whole
Wide World, you need the Internet.
You can set up an INTRANET to safeguard your sensitive
and confidential and top secret information.
Before Internet arrived, MINDEF and other Key Ministries
were using INTRANET.
What has happened to this Network now?
There are many intranets still in existence. However they are even easier to infect. Many employees don't practice good "digital hygiene" and will just insert their own USB drives or DVDs into the office hardware connected to the intranet.
ReplyDeleteMany ICS SCADA (Industrial Control Systems Supervisory Control and Data Acquisition) installations are connected by intranet. These systems are used to supply and control utilities like gas, electricity and water. They are also notoriously under-protected.
In Sept this year, there will be a Cybertech conference/ exhibition in Singapore. They have a few talks on SCADA which might interest you.
Meanwhile heed the warning from the Singapore Police
Be safe!