DoD and Net Attacks

Chernyakov writes "The Washington Post has an article about attacks on DoD systems. According to the article, the Pentagon's chief information officer said 'The Defense Department suffered more than 22,000 electronic attacks on its computer systems in 1999 and about 14,000 in the first seven months of this year.' " Those numbers apparently count port scans too, but the article is interest, talking about many things, including the fact that they don't run any commercial software on their most classified systems for fear of backdoors. I imagine the DoD's sysadmins are a scary bunch.

Comments

Looks like they use Solaris...

[Wee]

Well, nobody but them knows what they use for in-house servers/workstations/etc, but the DoD "homepage" uses Netscape Enterprise httpd on Solaris, according to Netcraft (the DoD's Defense Technical Information Center runs this combo as well).

What's really odd about the Netcraft link above is the history of the DoD website. As of 11 Oct 00, their OS was listed as "unknown" (and the DTIC's OS was unknown as of 12 Oct 00; looks like they all swicthed at the same time). Maybe that's what the article was referring to?

And if you want to see something really odd, try Netcrafting to the DTIC's IP addr. Their httpd/OS information was changed 9 Dec 00, which is tomorrow. And if you're not into conspiracy theories, then just tell yourself that it's because the run on GMT and they just made the switch to a new machine like ten minutes ago (it's currently 00:41 as I write this).

-B

Counter Attack

[PhiznTRG]

I imagine that the few "mission critical" systems the DoD has are written in house, by programmers with high security clearance, so that the Department knows the source very well. This of course does not preclude backdoors being put in the software but it most definitely lowers the chance.

Of more interest, to me, is how this also coincides with the DoD's interest in performing attacks of this nature on other countries. It looks like cyberwarfare is picking up, with the increased use in the Isreali-Palestine conflict going on and the inherent spillover to US domains.

I wonder how good the in house hackers are at intrusion of other systems?

Re:Port Scan's

[bellings]

I'm afraid I don't understand what people are calling a "port scan." If I type

$ telnet foo.bar.com 25

does it count as a port scan in your book? Because thats the exact equivilant of what anyone checking for mail relays is going to do -- there is no reason to check any port other than the mail port if you're looking for a mail relay. But, if you've got an MX record screwed up somewhere, you're going to get exactly the same thing if someone tries to send you mail. How do you distinguish between someone checking for mail relays, and someone trying to send you mail?

Another poster comments "how much of an "attack" is it to scan to see if FTP is open?" What kind of "scan" would anyone do to see if FTP is open? The user check to see if port 21 is open, and thats it.

I remember reading once on slashdot how an @Home nameserver was "port scanning" some guys machine, because it responded to his machine's DNS requests. Come on -- that's not a scan.

If checking one port is a "scan", then I'm afraid I probably scan hundreds, or even thousands, of machines a day. I'm such a 'leet hacker. Most of our webservers get tens of thousands of "scans" a day (generally, by people "scanning" port 80), from people all over the world. The mail servers get thousands of scans, too. What are you guys talking about?

Re:Open Source Software security

[jlg]

Keep in mind that OpenBSD isn't really very old. These classified sites have been around for a while and it seems unlikely that OpenBSD could become better than what they had before in a just a few years.

Fundumentally, OpenBSD is still UNIX. Remember the Orange Book codes? You don't see many UNIX systems past C2 because they really weren't designed for it. The A's and high B's belong to operating systems designed with security in mind from the start. Not insecure OSes that have been patched up.

Not to say OpenBSD isn't secure, it's just not at the right level of paranoia.

Re:Pointless Quote

[davecb]

It's a good tease, but it's not generally true.

The classified stuff is not on the unclassified nets, so you have to get inside the base to breach them.

Re:DoD computer systems.

[davecb]

It would be fairer if you said that they have some very secure networks which aren't attached to the Internet . The script kiddies are attacking the non-secure computers attached to the non-secure nets, and the foreign powers are trying to infiltrate the bases where the secure systems are. Consequently, the number of attacks on the public and unclassified DOS systems should be large, and the number of sucesses about the same as on other non-secure systems.

Re:Port Scan's

[mindstrm]

Okay. Attack may be the wrong word, but from a security point of view, someone who is only trying to use a service they already know you have isnt' scanning you; someone is scanning you to find something out they didn't already know, which is something you should be aware of. So yes, it could be considered an attack, from a security analysis point of view. From a legal 'let's sue them' point of view, it's certainly not enough.

They get attacked because they don't prosecute

[thogard]

They are quite spinelss when it comes to attacks. There is a new type of spaming attack using fast networks and adaptive guessing that can hit a server with hundred of thousands of messages in a very short time. Right now the writer is adjusting the code and when its released, it will nail a number of large computer system all over the world including the US goverments. I handed them all the data they need to prosecute this idiot but they choose to ignore it.

I used to for as a contractor for DISA (they run/own the computers for the US AF and other branches) and the only time we could get anyone excited about attempted hacks was by informally asking the OSI guys if they had time to drop by and hassle some kid. When that happened, it involved two guys in cheap suits dropping by some kids house and asking a few questions.

I like how they talk about the 1998 event. At that time hadn't learned their lession yet.

DOD's laziness

[Ektanoor]

Well it's good that DOD is doing something for its protection. Anyway, two years ago, defense in some sectors was near to miserable. The story they refer about the awakening is the example of this. As it was half told. The exploit was found in September and any well-learned sysadmin applied its patch on a month or two. However DOD's guys didn't handle a finger on it until they got these script kiddies harassing their systems. And the first thing they did was to go to the media and talk about "major attacks". What was the most stupid thing I heard about. In result they got a REAL DAMN attack that knocked down a few comps around. Great thing...

I believe that DOD learned the lesson. And learned to NOT TO TRUST the media. Since then I have less learned about Pentagon's generals crying over journalists shoulders and more real work on their defenses. Since then I saw even some real though stuff on security coming from the inners of DOD. My congratulations people to have learned the lesson.

If you kept that wave in 1998 then you could have got the third hackers counter-attack wave and this one could have been very heavy to hold. As people were getting really mad for seeing another Sundevil Operation coming up. Bashing hackers for the lass lazy security of your admins is not the way to operate. If you have a sleepy admin coming 8 o'clock to play minesweeper until 17:00 (time to go home!) is not our problem but yours. Fortunately it seems you got something out of what happened in 98.

From Russia with nukes... Just kiddin'...

Re:Port Scan's

[1337d00d]

Plus, logging portscans has some serious psycho-analytical value. If somebody is portscanning the first 1024 for standard services, they're a script kitty. However, if somebody is portscanning a small subset, or single one, in a high order 1025+, where they *are* running a service, then that calls for an immediate notification. Why? If somebody managed to 'hit gold' the first time, and find an accessible service, then they most likely had a contact, either from somebody inside or from somebody who used to be inside. The same holds true for an actual attack that is not preceded by a portscan. Knowing where to shoot for the first time is just asking to be watched.

Re:Port Scan's

[nebby]

..when most of the other houses on the street have their doors open and people walking in and out..

Re:Port Scan's

[bellings]

from a security point of view, someone who is only trying to use a service they already know you have isnt' scanning you; someone is scanning you to find something out they didn't already know, which is something you should be aware of

So... if I type http://www.monkey.com/ into the address bar of my web browser, just to see what comes up, I'm doing a "port scan" on that server? Should the administrator of www.monkey.com be aware that I'm trying to hack into the site?

If I decide I want to download the latest version of NetBSD, and I just randomly guess

$ ncftp ftp.netbsd.org

am I doing simething the administrator of the domain should be aware of? (In fact, last night I did exactly this. I had no idea where to download NetBSD -- that was just my first guess. I had no idea if there really was machine named ftp.netbsd.org, or what services it may provide. By trying to connect, I really was trying to discover something I didn't already know.)

The only thing I'd call a real "port scan" is the kind of thing you can do with a program like nmap -- scanning dozens or hundreds of ports at once, just to see which are open. It shouldn't be a suprise to anyone that those "port scans" are easy to log, but next to worthless to break into the machine.

Re:one high security net i saw

[multipartmixed]

You don't need to use fiber to implement one-way links; standard ethernet, with one pair cut, will do the trick.

--

DoD Computer Systems, OSs, and Commercial Software

[thewiz]

Understand that most attacks that are launched on DoD computer networks are against UNCLASSIFIED networks. They can contain sensitive information but the really CLASSIFIED stuff is housed on machines that aren't even connected to the Internet (think the original Mission Impossible movie). The sensitive machines that are connected to the Internet can't be found by any script kiddy or leet haxors. For those of you who think you're the hottest cracker around, think again. If the NSA or DoD hasn't approached you to join, you're not nearly as good as you think you are.

To address a few issues that others have brought up:
Attacking a military system with more than a port scan or mild probing WILL earn you a visit from some very terse (but polite) gentlemen.

At the facility I work at we use Solaris, AIX, Windows NT, Windows 98, OS/390, MVS, and even Linux on an S/390. I'm sure there is a project somewhere that uses OpenBSD.

Backdoors in commercial software are a VERY big issue, especially when the system is connected to the Internet. We DO use software like Emacs, and other Open Source software on our systems. Having the source code available for perusal by a programmer is EXACTLY the reason we use OSS. There is nothing hidden in OSS like there is in proprietary packages. Ever tried asking Microsoft for their code for any of their products so you could verify C2 compliance?

The DoD does NOT engage in monitoring the public on the Internet (that's the FBI's job ;) ). You will be monitored while accessing a DoD site (and we post BIG warning messages about that) or if you attempt to do anything that is deemed an attack against DoD systems (the same kind of acts that would get you monitored by a commercial site).

As for programmers putting backdoors into software that the DoD creates, that chance is nearly 0%. When a mission critical software package is written, it is done by more than one person, often by more than one team of people. The code is then subjected to multiple peer reviews. Everything that is done by the program is questioned and re-evaluated at each step of the development cycle. Why else do you think that the government is still using computers from the 70's and 80's? We haven't finished the code reviews yet! ;)

Trusting foreigners - Well, you can't even get a clearance if you were not born in the U.S. (at least that's the way they say it's supposed to work).

The DoD is NOT stupid or careless; unfortunately, there are times when people make mistakes and accidentally compromise classified information. This happens through laziness and cockiness on the part of users AND Admins; the same reasons that commercial sites get cracked.

And, yes, many of us are not in this job for the pay, rather out of a sense of duty toward our country.

How the DOD responds to port scans

[devphil]

The DoD uses the same techniques as any other organization who values privacy. If you're hitting a port for protocol foo on a machine that isn't dedicated to protocol foo, then that will earn you an IP block at the router level. The block lasts for quite a while (months, not minutes) and is then often dropped, unless you keep trying.

Another poster comments "how much of an "attack" is it to scan to see if FTP is open?"

If you're looking at the public FTP server, it isn't an attack; that's what the server is there for.

But if you're outside the firewalls, looking for FTP on a machine inside the firewalls that isn't advertised for FTP, that's what's called "recon," and will earn you an IP block, automatically.

Port Scan's

[holos]

Is it really fair to count port scans as an attack? I can see classing it if it comes from a 192/10/172/169 address but normal scans are part of life, or they are at least for my boxes and me. With portsentry on them I usually get 5 a week from sources all around the world, usually they just check for mail relay and script kiddy tools but sometimes I'll catch the same IP scanning many machines, then they get monitored.

Re:Port Scan's

[Falsch Freiheit]

Yes.

If you are intent on breaking into a machine to which you have no access, a port scan is the first step.

For any kind of attack (whether with guns or with computers), reconnaissance is the first step.

If you're not the DoD, though, I wouldn't worry about portscans. I don't count them as attacks just because they're so common. Besides, if I have a machine that runs several websites (some of which have files available for download), how much of an "attack" is it to scan to see if FTP is open? It could just be somebody who got a partial file download and wants to see if they can finish the download.

Also, with most of your machines, there is *some* kind of legitimate access the public has to it. The SMTP port or HTTP or something like that. For many DoD machines, there is *no* legitimate access for most of the public.

Only 5 a *week*? Wow. That's low. I think the main machine I do any admin for gets that many in an hour.

Open Source Software security

[m.o]

As a result, the official added, "we are not buying such off-the-shelf products in our most sensitive systems."

And for the rest, do they actually go through the code to make sure that there are no vulnerabilities, or do they just assume that if there were then they would have been already found?

Stupidity of attacking a DoD site

[scumm]

Man, it's one thing to be a prick and try a DoS attack or something on a commercial or public site, the repercussions are limited at best. It's not often you hear about people getting arrested (although it does happen).
But come on, attacking a Dept. of Defense site is just begging for some spookly looking heavily armed jerks to interrogate you under some hotlamps before hopping into the way-back machine and making it so you were never born!
Oy vey, just my cent or two.

Mike Thacker

Re:2000 Mission Critical Computers?

[slickwillie]

Are you kidding? Real defense weenies don't play solitaire, they play minesweeper.

slashdotting .mil servers

[Anonymous Coward]

is slashdot organizing a DoS attack on US .mil servers by posting a link on the front page?

Re:I can name at least 8 computers

[small_dick]

yes, there are probably computers on the internet containing classified material.

but there are also bad people around planning bank robberies. such is the nature of our planet.

note that you are legally obligated to share your knowedge of those 8 computers with your infosec POC.

in fact, anyone whith a clearance who reads your post is legally bound to report it.

DoD computer systems.

[Lazarus Short]

This isn't too surprising, considering that

• The DoD has quite possibly the most secure networks in the world (of those that are actually connected to the internet, of course). This makes them a target for anyone who wants a challenge.
• Lots of script kiddie type "hackers" have been indoctrinated with the mass media image of a "leet haxor" who discovers important confidential information while poking around the DoD, and they figure it could happen to them.
• Actual agents of foriegn powers are probably trying to gain access to secret information... Though traditional methods of gaining access are probably still effective.

Consequently, this sort of statistic shouldn't suprise anybody.

--

Using Off-the-Shelf Software

[Thalia]

People are nicer to the DoD than I had thought.

There was a report in 1996 that said that 65% of in-house testing hacks were successful. According to this more recent article, 3% of attempts caused damage, and only 1% managed to break into unclassified systems. That's a good sign, I think. Hacks are increasing at 10% a year, and security is increasing faster.

The Pentagon is trying to protect itself from future attacks by deciding to "to carefully consider the origin of all software used in developing or upgrading information technology or national security systems." It sounds like they're mostly worried about those "foreigners" trying to put in backdoors. I'm not sure why they trust Americans more. But by using commercial software, like Microsoft and Lotus Notes, they're not only making their task impossible (anyone want to parse Win2000 to figure out which parts were written where?), but are focusing on the wrong worries. They should use smaller software packages, that can actually be reviewed, instead of huge bloatware that permits backdoors to be hidden.

Thalia

Re:double standards

[Black Parrot]

> So when we grumble about possible backdoors in commercial software, it's paranoia. When the DOD does it, it's what? Justifiable, or just well-funded paranoia?

Yeah, that was my first thought, too.

I have a feeling that this article may have some substantial repercussions in the IT industry. If the DoD won't use closed-source software due to fear of backdoors, do you sleep well knowing that your workstation uses it?

Your bank?

Your voting machine?

OSS advocates might get some mileage out of showing this to The Man.

--

Quality of DoD sysadmins

[dkusters]

Working for a DoD contractor who supplies software to the DoD, I can attest to the general lack of quality among their sysadmins. There are some amazingly good admins out there, but they are few and far between.

The DoD has tens of thousands of computers at thousands of locations. They have over 10,000 different software applications that they have had written for them. I'm not exaggerating. Organizations as large as the DoD need a lot of admins. But, the admins are, for the most part, civil servants. They fit into the standard scale of civil servants jobs and wages. In other words, they don't get paid very well.

Let's say your a good admin. Would you work for $70K at a computer company or for $40K for the DoD and have a BGen. screaming at you for not allowing him to receive his granddaughter's cute annimation in the mail even though you've explained that the latest DoD mandate forbade ActiveX in emails? Simple choice. Industry pays better and has a better working environment.

So, what are you left with? One of the admins we deal with (let's call her Betty) was a typist in the secretarial pool (yes, the DoD still has those). She was promoted to an admin. Why? Because of her vast knowledge of networking? Because of her ability to troubleshoot hardware? No. Because she could type fast. This is a real story. Only the name has been changed.

There are good DoD admins out there. They do it not for the environment or the money, but for the sense of pride out of helping the country. On average, the quality of the DoD admins is very low.

Dave.

P.S., this post does not reflect the opinions of my employeer.

Re:What OS's do they use?

[superid]

Oh for crying out glayvin...."we" use everything that you do. Everything...NT, 2000, 98, 95, DOS, Linux, solaris, Irix, AIX, HP-UX and thats all within sight of my office!

What makes you think we're any different than a very large corporation? We are not one giant monolithic organization. We have well run firewalled networks...we have isolated networks...we have public webservers and database servers. Some I don't doubt will be defaced, others I have confidence that they are basically impenetrable.

We have smart users that can setup their own systems, and we have some of the stupidest users you've ever seen (I got 3 trouble calls from one person for the same printer in 10 minutes... out of paper, offline, and then he printed to a printer 10 feet away and couldn't find the printout)

the article is interest?

[divide_by_0]

Those numbers apparently count port scans too, but the article is interest, talking about many things....

what kind of interest does this article get? I would hope it would get at least 5% compound interest anually.

I feel more sorry for "Betty" than her managers

[cpeterso]

They chose to give her the sysadmin job, that's their fault. But she will feel their wrath (surprise!) when things don't work out.

:(

Last Post!!!

[dmatos]

Bwahahaha!

Must burn karma to make the whoring game fun again. Damn karma cap.

DoD sysadmins

[Art Tatum]

I imagine the DoD's sysadmins are a scary bunch.

Heh...probably neurotic, too. It's not a job I would want. I consume too much caffeine as it is.

I'll confess,

[Shoeboy]

I have been responsible for some of this. I can't help it - it's so rewarding.
You scan a DoD computer and several large men come over to talk to you.
They humiliate and scold you.
If you're lucky, you get a cavity search!
My favorite is a guy called Agent Wesley, he's got reaaaly long fingers.
Anyway, just wanted you guys to understand my script kiddie motivations.
--Shoeboy

Only 22,000?

[Michael Spencer Jr.]

Hmm...a port number is 16 bits...

65535 - 22,000...

My sources predict another 43,000 + attacks before the end of next year!

--Spence

Well.. YES.

[mindstrm]

Though I doubt the host 'www.monkey.com' will NOT have a web site on it, given the 'www' prefix...

I'm not saying there is anything whatsoever wrong with doing such a thing. I'm saying that, as part of an IDS, if I run a server that does NOT have an ftp server on it, then I would like to know about all the network traffic coming into my box, period. Even something as simple as an attempted FTP session, yes, is a concern.

Please understand I don't mean to say you should compain about it, or even assume that something bad is happening, only that it is something you should not simply ignore. YOu should record it, make note of it. I'm saying that it has relevance in overall tight network security analysis, period.

I'm not saying portscans are 'bad' to do either, I'm just saying that from a security point of view, as a sysadmin, you DO want to know about ANY non-prescribed network connection attempts or other traffic on your network, so you can properly make *informed* decisions as to what is a threat and what is not.

What OS's do they use?

[Mr. Flibble]

The article does not say what OS(s) they use, only that they dropped Solaris, and they dont use anything by Microsoft or Netscape (now AOL). (Heh, it would be rather funny if they used AOL to connect to the internet... But I digress.)

I wonder what the odds are that they use something like Open BSD? Its similar enough to Solaris (Only BSD init as opposed to sysV) and they have the source code. Still, the article says that they don't use any "commercial" products, does that mean that they code thier own, including the operating system? I doubt it, while they might have their own in house apps, I bet that the OS is open source and widely avalible, I am willing to bet that its Open BSD. It would have been great to ask Theo on the Ask Slashdot that was here recently, but then, I doubt if Theo would know if the DoD is using his little BSD system anyhow...

double standards

[gunner800]

So when we grumble about possible backdoors in commercial software, it's paranoia. When the DOD does it, it's what? Justifiable, or just well-funded paranoia?


My mom is not a Karma whore!

OpenBSD in the government

[Bryan Andersen]

I think both the Justice department and the NSA have both said they use OpenBSD. I'm a little less certin on the NSA having said so. I do remember a story about the Justice Department using OpenBSD for it's sensitive data.

Ultra Paranoid but they are usually nice about it

[OmegaDan]

I've had some (stupid) interludes with government agencies ... I sysadmin a small research lab, and one of the idiots in the lab tracerouted a State Department computer (it was a stupid thing to do in the first place )...

Got a letter a few days later asking me to confirm that the machine WASN'T compromised and please explain why we were tracrouteing them ... Being this paranoid makes sense actually ... by firing off a letter to machines acting suspisciously, they undoubtedly make life harder on their would be attackers by making compromised machines known to their owners.

The only complaint I have about the whole thing is it scared me shitless thinking we'd been compromised :-) The letter follows, although I removed the IP addressess ...

Gentlemen, Greetings, the U. S. State Department Computer Incident Response Team (CIRT) received a report from our Security staff that we were being touched from IP address ***.***.***.*** which translated to host name *******.***.*** Interestingly the packet ttl is 1 and source port of 60704 did not change. The events occurred on Sep Sep 23 20:51:17 (all times are local). All attempts appeared to originate from host name ******.***.*** We understand that this may be due to operational activity. Please examine your security logs during this time period and let us know if this was indeed authorized activity. Your assistance and cooperation are greatly appreciated. Susan L. Tanoe US Department of State - Bureau of Diplomatic Security Computer Incident Response Team 301-985-8347 Report computer security incidents to: CIRT@state.gov 301-985-8375 (24-hour contact number) For more information, visit us on the IntrAnet at: http://acd.ds.state.gov/high/cif/cifmain.htm CLASSIFICATION: UNCLASSIFIED This e-mail is unclassified based on the definitions provided in E.O. 12958

In reaction to the DOD not using open-source...

[marsalis]

Notice that a search for Air Force firewalls brings up Secure Computing's Sidewinder, a FreeBSD derivative.

one high security net i saw

[small_dick]

...was pretty cool. i've heard this trick is common in both mil and finance networks.

all you do is hook a basic box to the web for normal https processing, but on the back end you convert critical data to udp packets and broadcast those via a one-way phiber link to a transaction box.

the transaction box burns the transaction packets onto write-once cds.

note that although it is possible to lose *some* info from the insecure side, or to have *some* incoming data distorted by the wiliest of hacker, it is impossible, without inside help or truly clueless administration, to have anyone get/distort all the records.

the one-way link trick is pretty standard for sensitive data. truly hi-level secret stuff isn't connected to the web in any fashion. that would be idiocy.

Ah, it must be DoD budget time ...

[WillSeattle]

that's why we keep reading these stories about an "Electronic Pearl Harbor" and how hard they're working.

Face it, they just want an excuse to spend more money on eavesdropping on civilians on the Net, and this is just their way of making it sound like they're not looking for pr0n.