Dept of Defense employees can no longer visit eBay.com at work due to new vulnerabilities

jessewvu

Now, before you all start in on government employees using government computers to visit eBay, we all know how deplorable it is. Your comments to that end are completely unnecessary and should be considered bad form. I have an iphone so I don't use my gov computer to look at anything on ebay or other similar sites. With that said...

I got a base-wide email at work that we are no longer allowed to visit eBay sites while at work due to a new risk of viruses and spyware. Has anyone else heard of these new vulnerabilities?

AUandAG

No, not me. Sounds baseless in fact. You would think that someone here would
have said something prior to your notice. I hope it's wrong information.

bob

PS: retired and surf from home only!

dsessom

I work in IT at an Army base, and can still access it - for now. You never know from one day to the next. All photo sharing sites are blocked, like Photobucket, so when people post pictures from there, I just see red X's. But, like you I use my phone (Droid X) to surf the web and check email a lot.

jessewvu

I know you COULD access it. They are now shutting down ports to computers for accessing eBay. Something bad must have happened recently...

notwilight

I'd guess it is a productivity initiative. many companies are blocking selected websites as "non business related" and ebay if at the top of the list. Funny thing was, ebay is a site I used to access frequently for business purposes. We wouldn't buy off ebay but if you search for a widget on the internet, you'll often find links to ebay and the comments from the sellers were often useful--often including a scan of the product manual. Industrial supplier catalogs are always bland. --jerry

llafoe

I hope they don't shut down your port to access eBay... then you won't be able to access any website!

jessewvu

<< <i>I hope they don't shut down your port to access eBay... then you won't be able to access any website! >>



It's a security violation and it prevents you from logging into your computer. You essentially are at a work stoppage until the IT folks "clean" your computer which takes between two and three weeks. It's a pretty big deal when they shut your port down.

I seriously doubt it's a productivity issue. They did this to folks using google chat when it came out about two years ago because they viewed it as a security issue. I'll ask around the office on Monday and see what the deal is.

llafoe

I think I get it now... they shut down your port on the switch, not 8080? 2-3 weeks... you must have Army Signal doing your IT support?

As far as google chat, and any other IM for that matter... when Microsoft developed Windows they left three ports open which caused a major vulnerability for security when you use an IM, it's a catch-22; if you close them, you can't use chat... if you leave them open, you can be attacked.

As a sidenote, a common Army Signal vulnerability is... when they disable a website (IP or series of IP or DNS name) they leave the https domain open. If the website has a https domain, e.g., Facebook, you will still be able to use facebook if they only blocked http. I don't believe eBay has an https domain?

sinin1

I am not in IT,
but some eBay auctions have imbedded links


which could take you ????

dbcoin

I work on an Army base. The following is a list of prohibited sites:

ebay
Facebook
mail systems of any kind except your gov't Outlook email
chat of any kind (for some reason the PM function here is ok)
any known auction site
any cached web pages on google
LinkedIn

Also, no cell phone of any kind is allowed. No flash drive of any kind allowed

There are probably 100 other sites that I don't know about that are blocked

llafoe

<< <i>I work on an Army base. The following is a list of prohibited sites:

ebay
Facebook
mail systems of any kind except your gov't Outlook email
chat of any kind (for some reason the PM function here is ok)
any known auction site
any cached web pages on google
LinkedIn

Also, no cell phone of any kind is allowed. No flash drive of any kind allowed

There are probably 100 other sites that I don't know about that are blocked >>



Your base still allows porn?

SeaEagleCoins

you guys are behind the times... we got cut off from ebay back in 2002 here at the Dept. of VA... and rightfully so IMHO... we are supposed to be at work...

oops... and here I am on the forum...

...well... gosh darn it... I am entitled to a break now and then... aren't I? ...

goldbuffalo

Another reason to NOT have your ebay auctions end during the day.

SaorAlba

The biggest threats are the ones that are usually not anticipated. Let's say Russia or China decide they have had enough of the internet interference they can take down whole swaths of the grid - including the DoD. Just wait until the US bombs the Chinese embassy in some country again like they did in Belgrade back in '99 - and see what happens in retaliation.

dbcoin

Your base still allows porn?

Never tried it on the base.

LindeDad

Is this DOD policy or just one bases policy?
At what level of authority was this policy enacted at?

dbcoin

Just wait until the US bombs the Chinese embassy in some country again like they did in Belgrade back in '99 - and see what happens in retaliation.

That was a mistake wasn't it? They got their revenge when they bought all the pieces if the Stealth and reversed engineered it.

BTW - This whole WikiLeaks as the start of bringing down all the Middle Eastern countries I think was planted by us. Stuxnet, WikiLeaks, the face of the new Cold War. So yeah, these websites can have vulnerabilities that you don't realize. Maybe Stuxnet was downloaded from an Ebay site to begin with.

TrustNo1

I can understand it completely. It may be tough if you are just doing an occasional purchase but way too many people looking for a way in to gov lines.

crypto79

Ok Ok, there is some misinformation-I am an Army civilian Executive for the pentagon whose agency oversees the Pentagon's master network and my boss is the DAA/CIO for said network. We work closely with DISA, NSA, DTRA and the Army G6( insert your services HQ CIO if you are not army) who in that order are the ones that set guidance on IA or access to your (and everybody's else s) bases/building/FOB/outpost ect, those governing bodies can only be over ridden by the Joint Chiefs/ Sec Def governance panel . In normal fashion you can add to but not take away from your superiors rules so most likely you DOIM/NEC commander/DAA on his own or under orders of the base commander struck it down for work reasons and not a security IA push. There is no DoD Ebay policy and if a vulnerability had been accessed, I would have known about it 100%.

Bochiman

Dang it, Crypto, you're ruining a good rant.....is that also considered "bad form"?

crypto79

<< <i>I can understand it completely. It may be tough if you are just doing an occasional purchase but way too many people looking for a way in to gov lines. >>

Don't be silly or naive. Any DoD network worth protecting isn't even connected to the internet and the Government NIPR net that is connected is well protected. That being said, nothing that does touch the internet is 100% safe but one web site is as dangerous as the next if the person activates the various exploits out there.

MsMorrisine

then it sounds like too many surfers on the wave....


blast me for being liberal, but an occaissional look-see wouldn't be bad to me.
On the other hand, I've worked with people that seemingly had second jobs at work.

MsMorrisine

<< <i>Dang it, Crypto, you're ruining a good rant.....is that also considered "bad form"?
>>



Add it to the rules!

derryb

<< <i>Is this DOD policy or just one bases policy?
At what level of authority was this policy enacted at? >>


I retired from DoD three years ago. They have always had a policy of not visiting non-work related sites and I know people that received letters of caution for doing so. I also recall them outlawing the use of flash drives in DoD computers (even the flash drives they provided) after it was discovered that some flash drives were programmed to upload info off the hard drive to China. China doesn't need a strong military, they have a strong IT Department and a strong economic policy.

llafoe

Plug-n-Play, USB, Java, Cookies, TB removable storage, etc... great for the consumer, bad for the government!

USAFRETWI

I also work for the Army, Ebay has been blocked on our system for years......................

SaorAlba

<< <i>

<< <i>I can understand it completely. It may be tough if you are just doing an occasional purchase but way too many people looking for a way in to gov lines. >>

Don't be silly or naive. Any DoD network worth protecting isn't even connected to the internet and the Government NIPR net that is connected is well protected. That being said, nothing that does touch the internet is 100% safe but one web site is as dangerous as the next if the person activates the various exploits out there. >>



You are aware that tests have proven the vulnerabilities of the networks not even on the grid - am quite sure that they are being watched heartily in Beijing.

crypto79

<< <i>I also work for the Army, Ebay has been blocked on our system for years...................... >>



Local policy based off of work place efficiency, nothing more.

pitboss

If I am paying someone to work, I expect them to work, not play on the computer. If they want to play online then punch out and play or go home and do it.

llafoe

<< <i>If I am paying someone to work, I expect them to work, not play on the computer. If they want to play online then punch out and play or go home and do it. >>



Research has found that if workers are allowed to "play" at work; they're more productive. Research has also found that micromanagers never develop their employees.

ANACONDA

I think the comment about the Chinese having good IT might answer your question for the most part; I'm no computer guru but it seems planting executable programs in ebay offerings would be possible. Figure out what somone at the DOD might likely be interested in looking at, put an executable program into the offering and have it send back information over the internet to your computer.


"The trouble with the world is that the stupid are (overly confident) and the intelligent are full of doubt." Bertrand Russell

PerryHall

<< <i>If I am paying someone to work, I expect them to work, not play on the computer. If they want to play online then punch out and play or go home and do it. >>



Did your employees ever get a lunch break?

pitboss

<< <i>

<< <i>If I am paying someone to work, I expect them to work, not play on the computer. If they want to play online then punch out and play or go home and do it. >>



Did your employees ever get a lunch break? >>




Lunch break and breaks are fine, but not when you are supposed to be working. If you are wasting my time while you are supposed to be doing your job then maybe I need to replace you with someone who wants to work.

It has nothing to do with micro managing!

TrustNo1

<< <i>

<< <i>I can understand it completely. It may be tough if you are just doing an occasional purchase but way too many people looking for a way in to gov lines. >>

Don't be silly or naive. Any DoD network worth protecting isn't even connected to the internet and the Government NIPR net that is connected is well protected. That being said, nothing that does touch the internet is 100% safe but one web site is as dangerous as the next if the person activates the various exploits out there. >>

ok! lol

LindeDad

<< <i>

<< <i>

<< <i>If I am paying someone to work, I expect them to work, not play on the computer. If they want to play online then punch out and play or go home and do it. >>



Did your employees ever get a lunch break? >>




Lunch break and breaks are fine, but not when you are supposed to be working. If you are wasting my time while you are supposed to be doing your job then maybe I need to replace you with someone who wants to work.

It has nothing to do with micro managing! >>



You have to realize it almost takes a act of congress to fire a government employee that’s been in place for some time. Rules can force them to comply even if they don’t want to. Physical barriers make them comply. As for breaks that is about six hours a day any way in some cases.

derryb

<< <i>You have to realize it almost takes a act of congress to fire a government employee that’s been in place for some time. Rules can force them to comply even if they don’t want to. Physical barriers make them comply. As for breaks that is about six hours a day any way in some cases. >>


DoD employees are the exception to the rule. All you have to do is find reason to pull their required security clearance and they are gone. Have seen it happen all in one day.

pitboss

<< <i>

<< <i>

<< <i>

<< <i>If I am paying someone to work, I expect them to work, not play on the computer. If they want to play online then punch out and play or go home and do it. >>



Did your employees ever get a lunch break? >>




Lunch break and breaks are fine, but not when you are supposed to be working. If you are wasting my time while you are supposed to be doing your job then maybe I need to replace you with someone who wants to work.

It has nothing to do with micro managing! >>



You have to realize it almost takes a act of congress to fire a government employee that’s been in place for some time. Rules can force them to comply even if they don’t want to. Physical barriers make them comply. As for breaks that is about six hours a day any way in some cases. >>






Why are we hiring more govt workers if the ones we have are not working 8 hours a day. No wonder our country is so far in debt,

It is about time we put a stop to this B.S..

LindeDad

<< <i>

<< <i>You have to realize it almost takes a act of congress to fire a government employee that’s been in place for some time. Rules can force them to comply even if they don’t want to. Physical barriers make them comply. As for breaks that is about six hours a day any way in some cases. >>


DoD employees are the exception to the rule. All you have to do is find reason to pull their required security clearance and they are gone. Have seen it happen all in one day. >>



I know that can happen but this kind of rule is usually put in place for the one in a thousand or so that need it and not all jobs take a high level security clearance.