美国国家公共电台 NPR Shutdown Makes Government Websites More Vulnerable To Hackers, Experts Say

 

LULU GARCIA-NAVARRO, HOST:

Hackers¹ love to try to breach² U.S. computer systems. This now may be easier than ever before. With so many IT and cybersecurity workers furloughed by the shutdown, security professionals say government websites are more vulnerable. NPR's Laura Sydell reports.

LAURA SYDELL, BYLINE³: The Trump⁴ administration may like to highlight American manufacturing, but try going to manufacturing.gov. The site has become unusable. You can't access any of the details offered about U.S. manufacturing. According to Netcraft, a British security firm, it's one of dozens of government sites that haven't renewed their security certificates. These certificates are a bit like a driver's license⁵ - they prove you are who you say you are. Dan Kaminsky, the chief scientist at the American security firm White Ops explains.

DAN KAMINSKY: You need to know you're really talking to your hospital or to something at the Air Force or wherever. And so there are certificates that make it so you know, OK, this is really the government resource that I'm trying to access and not some bad guy.

SYDELL: In some cases, the lack of a security certificate may just make a site unusable. But Kaminsky says the lack of a certificate also makes it easier for a bad actor to redirect you to a fake site.

KAMINSKY: People might get used to ignoring the browser⁶ warnings. Oh, well, you know, it's just the shutdown. And then you think, oh, you're really walking into this site. And you're really not.

SYDELL: Kaminsky offers up a worst case kind of scenario⁷. Imagine if the security certificate was down for the Social Security website, and a bad actor sets up a fake one. Someone could go to that site, enter their password and give the hackers access to personal information. The shutdown also means that there are fewer IT staff. For example, according to contingency⁸ plans on the White House Office of Management and Budget website, only around 2,000 employees out of more than 3,500 are working at the Cybersecurity and Infrastructure⁹ Security Agency. That's one of the agencies leading the nation's cyber defenses. Rob Ragan, a partner in the cybersecurity firm Bishop¹⁰ Fox, says there may be a lot of important tasks that aren't getting done, such as updating software with the latest security patches.

ROB RAGAN: You end up getting buried in a really big backlog¹¹ of issues that you may never dig yourself out of. And at that point, one of those issues may have been an indicator¹² of a compromise or a breach that may go unnoticed for months or years to come.

SYDELL: Security researchers worry that the shutdown is like putting a red blanket in front of a bull. Nations like Russia, China and Iran could see it as a signal to charge ahead. Ragan says think about the amount of information on government websites that's personal and even classified. And as the shutdown drags on, the likelihood of security lapses¹³ increases, says Vikram Thakur, a technical director at the security firm Symantec.

VIKRAM THAKUR: That risk is most definitely going to go up exponentially.

SYDELL: Ironically, Thakur says fewer personnel lowers at least one kind of security risk. One of the most popular hacking¹⁴ schemes is email phishing. That's when hackers send an email to an employee with a link that unleashes¹⁵ malware into the system.

THAKUR: If nobody's opening email and nobody's using the work network, the chances of the success rate for attackers who are using email as their primary mode of attack kind of falls all the way through.

SYDELL: NPR reached out to the cyber division at the Department of Homeland Security for comment but didn't hear back. Democratic aides in the House say they, too, are unable to get information right now about which IT workers are on the job. However, when the shutdown ends, they want to see details. In the event of a future shutdown, Democrats¹⁶ might move to keep IT workers on the job in the name of cybersecurity. Laura Sydell, NPR News.

1 hackers   

n.计算机迷( hacker的名词复数 )；私自存取或篡改电脑资料者，电脑“黑客”

参考例句：

• They think of viruses that infect an organization from the outside.They envision hackers breaking into their information vaults. 他们考虑来自外部的感染公司的病毒，他们设想黑客侵入到信息宝库中。 来自《简明英汉词典》
• Arranging a meeting with the hackers took weeks againoff-again email exchanges. 通过几星期电子邮件往来安排见面，他们最终同意了。 来自互联网

2 breach   

n.违反，不履行；破裂；vt.冲破，攻破

参考例句：

• We won't have any breach of discipline.我们不允许任何破坏纪律的现象。
• He was sued for breach of contract.他因不履行合同而被起诉。

3 byline   

n.署名；v.署名

参考例句：

• His byline was absent as well.他的署名也不见了。
• We wish to thank the author of this article which carries no byline.我们要感谢这篇文章的那位没有署名的作者。

4 trump   

n.王牌，法宝；v.打出王牌，吹喇叭

参考例句：

• He was never able to trump up the courage to have a showdown.他始终鼓不起勇气摊牌。
• The coach saved his star player for a trump card.教练保留他的明星选手，作为他的王牌。

5 license   

n.执照，许可证，特许；v.许可，特许

参考例句：

• The foreign guest has a license on the person.这个外国客人随身携带执照。
• The driver was arrested for having false license plates on his car.司机由于使用假车牌而被捕。

6 browser   

n.浏览者

参考例句：

• View edits in a web browser.在浏览器中看编辑的效果。
• I think my browser has a list of shareware links.我想在浏览器中会有一系列的共享软件链接。

7 scenario   

n.剧本，脚本；概要

参考例句：

• But the birth scenario is not completely accurate.然而分娩脚本并非完全准确的。
• This is a totally different scenario.这是完全不同的剧本。

8 contingency   

n.意外事件，可能性

参考例句：

• We should be prepared for any contingency.我们应该对任何应急情况有所准备。
• A fire in our warehouse was a contingency that we had not expected.库房的一场大火是我们始料未及的。

9 infrastructure   

n.下部构造，下部组织，基础结构，基础设施

参考例句：

• We should step up the development of infrastructure for research.加强科学基础设施建设。
• We should strengthen cultural infrastructure and boost various types of popular culture.加强文化基础设施建设，发展各类群众文化。

10 bishop   

n.主教，（国际象棋）象

参考例句：

• He was a bishop who was held in reverence by all.他是一位被大家都尊敬的主教。
• Two years after his death the bishop was canonised.主教逝世两年后被正式封为圣者。

11 backlog   

n.积压未办之事

参考例句：

• It will take a month to clear the backlog of work.要花一个月的时间才能清理完积压的工作。
• Investment is needed to reduce the backlog of repairs.需要投资来減轻积压的维修工作。

12 indicator   

n.指标；指示物，指示者；指示器

参考例句：

• Gold prices are often seen as an indicator of inflation.黃金价格常常被看作是通货膨胀的指标。
• His left-hand indicator is flashing.他左手边的转向灯正在闪亮。

13 lapses   

n.失误，过失( lapse的名词复数 )；小毛病；行为失检；偏离正道v.退步( lapse的第三人称单数 )；陷入；倒退；丧失

参考例句：

• He sometimes lapses from good behavior. 他有时行为失检。 来自辞典例句
• He could forgive attacks of nerves, panic, bad unexplainable actions, all sorts of lapses. 他可以宽恕突然发作的歇斯底里，惊慌失措，恶劣的莫名其妙的动作，各种各样的失误。 来自辞典例句

14 hacking   

n.非法访问计算机系统和数据库的活动

参考例句：

• The patient with emphysema is hacking all day. 这个肺气肿病人整天不断地干咳。
• We undertook the task of hacking our way through the jungle. 我们负责在丛林中开路。

15 unleashes   

v.把（感情、力量等）释放出来，发泄( unleash的第三人称单数 )

参考例句：

• These findings qualify the common view that economic growth unleashes myriad discontents. 这些发现，纠正了一个普遍观点，即经济发展使人们尽情宣泄不满。 来自互联网
• This caster unleashes a storm of electric discharge on the enemy. 法师向敌人释放出一片电火花的风暴。 来自互联网

16 democrats   

n.民主主义者，民主人士( democrat的名词复数 )

参考例句：

• The Democrats held a pep rally on Capitol Hill yesterday. 民主党昨天在国会山召开了竞选誓师大会。
• The democrats organize a filibuster in the senate. 民主党党员组织了阻挠议事。 来自《简明英汉词典》