Federal Computers Fail Hacker Test

Nintendork writes: "An article by the Associated Press, published on CNN tells of the latest network security report cards earned by Federal agencies. The Department of Defense along with several others failed. I hope terrorists that pose physical threats don't have any script kiddies in their arsenal."

Comments

I don't buy it...

[Mustang Matt]

I wish they would have gone into more detail about what tests were ran and how they were failed. It's easy to criticize the government but where are the facts?

I can't believe that they could have scored at F on any security test. Am I naive?

Is it physical security or through the internet or what?

Does anyone have any links that show what tests were done and how they scored on each one?

Re:I don't buy it...

[Nick Number]

I can't believe that they could have scored at F on any security test. Am I naive?

Well the following paragraph of the article gives some blatant examples of poor practices that were found:

The GAO routinely hacks into federal computers to test security and rarely fails. At the Commerce Department, for example, the GAO in August found some computers didn't require any passwords; some used "password" as the password; and entire lists of passwords were stored in plain view on the computers themselves. When one Commerce employee detected investigators trying to hack the agency's computers during their testing, he launched an illegal, electronic counterattack against the GAO.

This isn't all that hard to believe. These networks are huge, and there will always be some people who value convenience over security. The question is whether the admins are understaffed, inexperienced, or simply lax in enforcing policies.

Re:I don't buy it...

[Col. Panic]

One way to score an immediate 'F' is *not* to secure the default configurations for many systems. If that is not done, default passwords can be used by any shmo with a manual. I am guessing that too many administrators just install devices and leave them alone when they have ensured that they work. That is not going to cut it in any environment that requires secure configurations.

Re:I don't buy it...

[BlueboyX]

At the school I volunteer at I talked to a woman who will be setting up a new lan. She was discussing how complicated setting up secure networks is with the librarian. She seemed pretty happy with herself that she knew how to prevent people from getting onto the computers by just clicking the 'X' button on the login menu. Her face looked pretty impressive when I told her that another trick lets people get in a system by loging in as 'Default'

Heh, I used that trick once to get in a hospital computer system where my father worked (he forgot his new password). The X trick didnt work, but Default sure did.

Let's just face it, we are dealing with normal people here. Not nerds. Most of us here could set up a more secure network than you will find on average. And I include alot of us who have never actually set up a network in that statement. Alot of things that are common sense to us are magical or totally unknown to normal people.

The only way the gov and various businesses are going to get more secure is if they train their people in computers (unlikely) or hire more nerds (also unlikely, for the gov at least. They cant/dont compete with businesses very well).

In other words, alot of basic things in the beurocratic and commercial worlds are going to have to change if they are going to seriously make their systems secure.

Homemade Unix

[Ashcrow]

A boss of mine a few years back was an ex-administrator on a private mil network. I picked his brain about some of the stuff and he explained that they use NT on the public networks (IE: for email to friends and family and other trivial things) and a hommade UNIX version for their private/secure networks. Of course this was just for his area of the military.

As for the DOJ, I met a guy who was arested for cracking into it when he was 19. He explained that it is a lot easier than people think and he cracked it about 11 times before he was caught. He now works for a large security consulting group.

Typical useless gov't reports

[baptiste]

Note this from teh article:

The grades are based on information the departments gave to the Office of Management and Budget (OMB). Under a new federal law, agencies must report regularly to OMB on their efforts to keep computers safe.

Please - this was just an audit of what agencies SAID they did. Can you imagine the grade they'd get if they actually scanned the systems and networks for vulnerabilities? A monumental task no doubtm but still scary to contemplate.

Of course the flip side is that the security may be much better than this report leads you to believe. I'd imagine many gov't sysadmins have secured systems beyond what the paper pushers have speced out for them.

Re:Typical useless gov't reports

[DahGhostfacedFiddlah]

Yep - no "glory" cracking into a D- system.

Re:Typical useless gov't reports

[vanguard]

Please - this was just an audit of what agencies SAID they did. Can you imagine the grade they'd get if they actually scanned the systems and networks for vulnerabilities?

Actually, I think you need to read the article more closely.

The GAO routinely hacks into federal computers to test security and rarely fails. At the Commerce Department, for example, the GAO in August found some computers didn't require any passwords; some used "password" as the password; and entire lists of passwords were stored in plain view on the computers themselves. When one Commerce employee detected investigators trying to hack the agency's computers during their testing, he launched an illegal, electronic counterattack against the GAO.

I'm pretty sure they didn't gather the "we keep passwords taped to our monitors" information through a form that the DOD filled out.

Re:Typical useless gov't reports

[kir]

Of course the flip side is that the security may be much better than this report leads you to believe. I'd imagine many gov't sysadmins have secured systems beyond what the paper pushers have speced out for them.

I've worked for or with the DoD for the past 10 years (both as active duty AF and now as a government contractor) - the last 5 working in security. Unfortunately, it has been my experience that your statement is exactly what you said - imagined. (I can really only speak on DoD - The AF and some nameless joint commands in particular.)

So many security problems exist at so many different levels, it's amazing no major infiltration has occured (that we know about anyway). Sure, IIS web servers all over the DoD are being defaced, but this is small potatos (and on par with the civilian sector). So many "mission critical" systems exist on the NIPRNET (Non-secure Internet Protocol Router NETwork - the DoD's chunk of the internet) with very very few competent administrators... it actually scares me. Patient tracking, Command and Control, Supply, Personnel, and etc. systems ride the NIPRNET. Glean enough information from these systems and you have the equivalent of classified information.

I said so many problems at so many different levels - What am I talking about? Example: The basics are not being followed. User education is horrendous. I know I could walk into most any secretary's office and find his/her password in minutes. How? Look under the keyboard, inside the monitor's control panel door, under the coffee cup on the desk, inside the top drawer, etc. etc. "Who cares? It's just a secretary. She/He couldn't possibly have access to important information." Well, they don't give secretaries to just any grunt. She's probably the secretary to at least a Colonel (O-6) and she probably has access to his email. What's more littered with sensitive information than a Colonel's or General's email.

Grab a phone book from any military facility (just look in the trash), get some names, call up the help desk. "This is Sgt Such-and-such... I've just locked myself out. I guess I've forgotten my password. Could you please reset it." "SURE. Your password is now P@ssW0rd. You'll be forced to change it when you next login." (YES, it really is this easy! - I know, I've done it during exercises.) Etc. etc. etc. Pick a basic security best practice and I can guaruntee it is not being followed at most DoD installations.

I've said this in many previous posts on /. and I'll say it again - MOST DOD ADMINISTRATORS ARE INCOMPETENT! The DoD isn't exactly paying top dollar for their personnel (that's why I'm a governement CONTRACTOR not an EMPLOYEE); Training for the grunts is next to SHITE; and a complete misunderstanding of information security bleeds throughout the top brass in the DoD.

It's pretty sad, but I keep banging away to make my little chunk of the DoD network(s) more secure. Wish me luck. I think I'll need it!

Re:Typical useless gov't reports

[Syberghost]

And furthermore, when their people come in and audit these practices, and report them as "unacceptable", there's often tremendous pressure (up to and including "change that to passing and sign it, or you're fired") to simply ignore it, report it cryptically or just plain lie, and go on with your business. Especially in the military, but even in the "civilian" agencies that should know better, such as NSA.

This is pointless

[haruharaharu]

I hope terrorists that pose physical threats don't have any script kiddies in their arsenal

So, Al Queda is going to deface the DOD's webpage? Who cares? The article mentioned the ever present password list taped to a computer, which would imply physical access. I doubt the average script kiddie has the social skills to get that.

Re:nArf?!

[Evro]

Read this: http://www.zdnet.com/zdnn/stories/news/0,4586,5094 508,00.html

Are international hackers the greatest threat?

[Tim_F]

I'm not sure I agree that international hackers re the greatest threat here. If I were the US government, I'd be more concerned about the American script kiddies (for example when the CIA site was defaced).

It also doesn't tell WHICH computers.

[Ieshan]

Personally, I don't buy the article because it doesn't tell which computers failed the tests. Somehow, I doubt there's any sensitive, highly classified information stored on 95% of government computers - most government workers simply don't have access to that type of data or knowledge.

I'm scared at the fact that someone could report on this with so little attention to detail. It's an article simply designed to scare people into thinking that the US government isn't more prepared than they are.

Re:It also doesn't tell WHICH computers.

[Col. Panic]

I doubt there's any sensitive, highly classified information stored on 95% of government computers

Maybe not, but if there is a trust relationship among computers on the network and one is compromised, you have access to all of them. That changes your odds a bit.

What do the grades mean?

[recursiv]

Without a specification of what these letter grades mean, this is all fairly meaningless and subjective. A 'C' could mean anything.
An 'F' is the worst possible grade, so does this mean that there is no possible way for those agencies to have done worse?

I found the results from last year here. It's interesting that it was released on September 11 2000.

Vulnerabilities

[Rebulator]

It's been known for quite some time that government agencies are quite an easy target. The fact is, most agencies are not centrally controlled as to what software they need to run, much less what service packs/security patches that need to be installed.

I was on an independant team to go over several different agencies policies and security models concerning the Internet, and this is what we found.

1) Most of the time we could find a vulnerable host on a network to exploit from the Internet with an off the shelf exploit.

2) The hosts and their networks usually tend to not have much information worth a terrorists time. I'm not saying that this is an excuse, merely pointing out the fact that if they're running a default install of IIS4, most of the time there isn't much on the network worth the time invested.

3) Most networks with something worth looking for, have some levels of security in place.

All of that said, I can assure you that most skript kiddies (the ones that posted to attrition.net, etc) don't have the knowledge to gain access to anything more than a default install on a jpl or nasa.gov host.

Reb

scoring system?

[BigBir3d]

Does 'F' imply no password protection?
Does 'D' imply posted password?
Does 'C' imply password?
Does 'B' imply encryption?
Does 'A' imply near perfection?

I presume an 'A+' is un-obtainable. If it has a way in, then, can't it be cracked?

Lets just hope it doesn't go down like this

[redhotchil]

::strong arabian accent::

Hello, sir, um, secretary, sir, um, could you, um, read the words taped onto your screen?

"k5jd930d03DfA"

Praise Allah!

*click*

Re:Lets just hope it doesn't go down like this

[srvivn21]

From reading the article, it looks like this might be more accurate:

::strong arabian accent::

Hello, sir, um, secretary, sir, um, could you, um, read the words taped onto your screen?

"P-A-S-S-W-O-R-D"

Praise Allah!

*click*

It must be a mess

[Quizme2000]

When one Commerce employee detected investigators trying to hack the agency's computers during their testing, he launched an illegal, electronic counterattack against the GAO.

This makes it apparent that the IT department is extremly mismanged. Standards and procedures for dealing with hacker attacks, critical loss, and computer abuse are the core requirements of ant IT support. I'm guessing that alot of gov't computers have access to the internet that do not require access for its job function. Every terminal thats connected is a security risk that must be addressed. Probably setup by very underpaid gov't worker that was "trained" in a day.

I work at a school

[BlueboyX]

I do volunteer work at a local elementary school. I have been helping them repair computers that got damaged due to renovations during the summer and weird things the teachers do.

Now, teachers are somewhat educated people. You can't just instantly become a teacher (as you could get some other bureaucratic positions) yet they are technophobic or just plain computer illiterate. Heck, I have to help them set up their vcrs! The extent of computer security that they can handle is putting a password on the Accelerated Reader program so that kids don't change their grades.

These people are not stupid or ignorant in general. They just know jack about computers. If these teachers, being more educated than your standard bureaucrat might be, can't deal with computer security then how could a standard bureaucrat be expected to?

Government systems administrators? School networks don't have system admins. They have librarians that know a little bit about computers. That is who will be maintaining the network at the school I volunteer at when I eventually leave. As far as I can tell, they never have had a dedicated computer person in the entire school district who maintains these systems. I know there is a woman in the district who is going to be working on installing more computer equipment, but fixing things doesn't seem to be a normal part of her job.

Just putting things in perspective.

Re:I work at a school

[Heem]

I do volunteer work at a local elementary school. I have been helping them repair computers that got damaged due to
renovations during the summer and weird things the teachers do.

Now, teachers are somewhat educated people.

I work for a large bio-tech company. Most of the company has at least one PHD. But yet I still have to make sure that their computer is plugged in. Some even send their passwords in plain text email to me if they have a problem. That doesnt mean that they are not smart, They are each VERY smart in their own field, the nation's leaders. I can't expect them to be even the slight bit knowledgeable in MY field, or else, lets face it, there would be no need for an IT department at all, they could do it themselves, and we'd all be out of a job.

If a security audit came through on the day that Person A sent me their password in an email, and person B managed run and install a program that offers up a backdoor, no matter how good OUR security and policies are, we would just have failed.

But the important stuff is well protected...

[imrdkl]

Kept in deep caves, as I understand.

Once in awhile we have to upgrade the older versions, in which case the older stuff is simply destroyed and replaced with newer operating systems, and operators.

Microsoft should be so pragmatic.

What kind of counterattack?

[kindbud]

When one Commerce employee detected investigators trying to hack the agency's computers during their testing, he launched an illegal, electronic counterattack against the GAO.

I wish they had defined "illegal, electronic counterattack." What exactly did he do? I bet he did just what any one of you would have done, he performed portscan to see if there were any open ports suggesting a compromised system.

Re:What kind of counterattack?

[rockwood]

I would assume 'illegal' to mean "...against agency policy..." The employee most likely took personal responsibilty of counter-attacking a supposed hacker instead of reporting to the proper departmental channels. In which case (if it were a real hacker and not an internal test hack) the employee could have compromised more of the system or tipped off the hacker that they were noticed causing them to leave and the security department having to deal with the remains of a hack rather then monitoring and tracing a live/current hack. Or causing the hacker to freak and cover his found tracks radically by taking down entire systems.

I too would have been interested in knowing the guidlines for these grades. Prior to 9/11/01 it is possible that the systems were looked at in a much less crucial manner, whereas after 9/11/01 those reviewing the systems may have been much more critical. This causing the grades to drop when the systems actually remained at the same level of security. - Henry Smith

Re:Not really

[haruharaharu]

Let's hope they don't run IIS on computers with classified data, or at least don't connect it to the public net.

Be careful

[Kiro]

The FBI and CIA have been known to do turnabouts on hackers. Just ask Max Vision. The gov't fought long and hard to demonize and criminalize even the whitest hats of hacking, and Ashcroft's pushing to get them labeled as terrorist acts on top of that.
The DoD's had it's fair share of smudged histories. Be Alert. Keep your pistol handy.
Yes, you can be useful in combatting terrorism. Just make sure you know where the line is getting drawn and be on the correct side of it.
And realize that some of combatting terrorism may go against projects you've been supporting, like anonymous remailers, strong crypto for everyone, anti-censorship protections, and the elusive set of projects working to enable dissidents in countries such as China to safely communicate with the outside world. These and other tools can also be used by the bad guys, and will no doubt become targets

.

Re:Be careful

[BrookHarty]

Good example, the CIA armed, and gave billions to Afghanistan to fight Russia. Now some of those Afghanistan rebels/terrorists are armed and well funded by the USA.

Good intentions can turn around and bite you on the ass.

Management style...

[GISboy]

anyone old enough to remember various management styles, would probably refer to this as the "Open Door Policy".

In my brief stint at a Panasonic refurbishing depot, the management there also had the same policy.

"My door is always open, as long as you never walk in, it will remain so."

"First rule of management; EVERYTHING is your fault" --Hopper, A Bug's Life.

(note: misfiring neurons due to my son startling me awake at 5am. sigh.)

Doesn't surpise me but...

[Mashiki]

A few things come to mind, they need to be more worried about dumb ass script kiddies, even an idiot can run a program and do something, crackers would be their next likely problem. If they want some help, I'm sure there are many hackers that would jump at the chance to work for them. It is a tough time in the technology field right? Besides, who is more likely to know about all the exploits, crackers for sure, but a very good chance that it is the hackers who were the people that originaly found the exploit.

We don't have our noses's burried in books and reading the "latest and greatest" security information for no reason.

Iraqi Geekettes

[Baldrson]

After operation desert storm, where Iraq basically just took a big chunk of their young male population out for incineration, there are probably a number of Iraqi women looking for husbands. This means many of them will end up being geekettes.

Now, we all know that geeks don't like girls except for the electronic kind so there is no danger of Iraqi geekettes showing their favors to Western geeks thereby offering them a better deal than they have gotten in the West -- particularly not when the likes of Jon Katz are granting the Western geeks the favor of writing stuff about the wonders of globalization of the West at which geeks are allowed to gawk for simulated exhilaration.

Re:Iraqi Geekettes

[Baldrson]

I said: After operation desert storm, where Iraq basically just took a big chunk of their young male population out for incineration, there are probably a number of Iraqi women looking for husbands. This means many of them will end up being geekettes.

Something replied: Wrong. They would have to teach women how to read, let alone teach them computing.

Oh, but of course -- how could I have overlooked the fact that the Iraqis have no biological weapons programs... and even if they did, Western geeks are, as we all know, so demanding in the standards they apply to females they would deign to touch that they would insist not only on literate girls fawning over them as they program Perl or play Quake III -- but on girls who look like Laura Croft and can whip out a buffer-overflow exploit after hot sex and show it to him for his approval before the geek falls asleep.

F is for Federal

[Alien54]

I can't believe that they could have scored at F on any security test. Am I naive?

F is for Fedral

It is also for fixed ideas, fubar, etc. very simply, if you think you have the answers, you will not look in the right places.

which is why you get situations like that.

Fotunately, or maybe not so fortunately, a lot of terrorist are not so interested in computer stuff as tools for their actions. they are more into things that go boom.

The SSA

[RageMachine]

I did a small job working for Compaq installing NT4 boxen for the local SSAs (Social Security Agency)(s). They used a Centralized NT 4 server with SP3 (Yes, service pack 3) and the administrator password was... get this... "password1". The client machines loged in to the PDC on a TokenRing network which took minutes just to download a 50k profile. The man who was in charge of all of this was being overpaid, since I could tell that some of these older machines still had virii on them. :\ and the server crashed twice because of a tokenring bug in service pack 3, and they din't know what it was, nor did they know that SP6a was available. The assistant din't even know what Windows2000 was, much less BSD/Linux.

Yes, the governement does have very terrible security. I thought our taxdollars were paying for more than this? Im not bashing, or trying to be a troll, but wouln't some form of UNIX like BSD, or Linux reduce our tax rates, providing the admins know how to use it? I know they are paying thousands just for that ONE NT4 server running on a Pentium Pro 200, with 128mb ram.

Systemic Problems

[Marcus Erroneous]

Having worked for the government for awhile, both in and out of the military, there are several insights for that part of the network. For awhile, the official architecture was Windows NT. Regardless of it's strengths or weaknesses. We were using Novell at the time and under constant pressure from on high to get with the official architecture. Fortunately, my boss was more concerned with costs and effectiveness than official position. However, security wasn't an issue. Even in '98 we didn't have a firewall and the director didn't see the need for one. And since he didn't see the need for one, there wasn't going to be one. Only secure networks were using firewalls, and they weren't using NT for that. You might say, "I thought you just said the official architecture was to use NT?" and you would be correct. But even MS couldn't overcome the obligation for classified networks to look at security and stability first and evangelism second. The firewalls were manned by *nix boxen or other platforms and people that knew how to configure them.
Another problem is the civil service. You can have someone rise from a computer background to head a major department responsible for all IT and Telecomm issues that can barely use an e-mail client and can't explain one difference between ISDN and POTS. Then, they hire based on longevity. If you show up with the qualifications for a gs-9/10/11 position but haven't been in civil service, don't even think about it. Come in as a 4 or 5 and work your way up. Those inside the system feel that the higher position should be their's by virtue of having "put in their time". Promotions should be based on how long you've been in the system, not whether or not you can do it. My wife, who was in the civil service was once warned not to even think about applying for a specific position. Despite have a degree in the field and current certifications (medical field where those things frequently mean something) she hadn't been there long enough to deserve to apply for it. The woman who warned her used to have current qualifications, but had stopped bothering to stay current over 10 years ago. Nor attend any sort of training or classes to at least stay up on developing techniques. Not smart in any field. This sort of personnel system doesn't encourage people to stay or even to try to hire on. At this particular installation, those of us that could move on, did. Oh, did I mention that the pay isn't one of the more enticing features? I started at a large corporation making more than the director of that organization. Not that I make that much, they make that little.
Let's see, forced system architectures from the top down. A system that rewards longevity at the expense of competence. No central policies to control and/or coordinate at the command level, let alone service level, let alone within the civilian side of the house. And an incredibly low pay scale. I can't imagine why there would there would be any deficiencies. The good news is that there still exist some competent, dedicated people within this structure. Which is why any of the networks and/or machines passed at all.

Waddaya mean password is a bad password?

[raumdass]

Anyone who has put in a few years doing IT or security at a big organization (University, large corporation, whatever) can attest to the fact that the people who are ultimately in charge of the Big Security Decisions (i.e. the ones that can write the checks or sign-off on policy) are often the ones that have the least clue about it. They don't see the "Bad Guys" parked outside with their tools and getaway cars, waiting to break in while your not looking, so they think worrying about security and user education is either a waste of time and that you're too paranoid for always talking about "security", or they've bought whatever line they were sold by whomever sold them the promise of "security" and delivers instead a world of Macro Viruses and Code Red worms.

While I have to believe the "really important super-secret stuff" is kept safely locked away by geeks wiser and smarter than us, it cannot come as a surprise that the state of government computer security is about the same as security on the internet at large... it mostly sucks. Why? We can blame the software companies that release easily exploited code, and maybe we should start making them more accountable, but as long as people keep picking dumb passwords, administrators keep letting them, and they in turn keep following poor practices (fricken clear-text password lists!?!), then this what happens.

The reality check

[Anonymous Coward]

I am currently a sysad for a small military unit that has 3 WinNT servers (one PDC and 2 BDCs) using MS Exchange 5.5. I have done all I can to lock/patch these monsters down, but it seems like every damn day I am patching this, reinstalling SP-whatever on that. As long as they rely on MS software, it is always going to fail. I have been screaming about getting a firewall for months and months now, but they just look at me and tell me "We don't have the money yet." DON'T HAVE THE MONEY YET!?!?!?! THIS IS THE FRICKIN' DoD WE ARE TALKING ABOUT! I have seen them waste more money on building electro-conference rooms and overhead projectors for useless cheese slides! My nets get scanned by outsiders at least 3 or 4 times a day, and that is only because I HAVEN'T had them registered in the .mil DNS system. If I did, the number would go up.
The Emperor has no clothes, gentlemen, and I have no sympathy for ANY Government network that gets hacked, when it could have been prevented.

The report itself

[jamie]

Here's the presentation by Robert Dacey (Director of IS Issues at the GAO), which the AP story references. Always more enlightening to go to the source:

http://www.gao.gov/new.items/d02231t.pdf

Federal courts

[dillon_rinker]

This doesn't surprise me a bit. I work for a law firm who does a fair bit of work dealing Federal courts who REQUIRE electronic filings. You can't submit a brief or pleading on paper; you have to submit a .PDF file of the document to the court through their web site.

Guess what systems have been widely infected by Code Red. And Code Red II. And NIMDA. These are organizations who are expected to serve a public trust, and who are DEPENDENT on their web servers to stay up. Not only do they fail to keep up with security patches (Code Red), they fail to apply patches when it becomes obvious they've failed to do so (Code Red II). They don't even apply patches or take servers offline when they've been rooted (NIMDA).

I couldn't figure out where all the Code Red etc. worms were still coming from until I discovered this while working with an attorney to file a brief with an infected court system. Your tax dollars at work.

F is for ...

[blang]

Freedom of Information. For once, the feds have chosen the most efficient way to implement something.

Really!?

[AMuse]

Holy crap, man! How insecure federal government computers, along with AOL and other huge companies, have shown to be! It almost makes me think that it's *difficult* to completely secure an entire /8 subnet when you have tens of thousands of employees responsible for different pieces of it.

My guess is, they may have hacked into a few desktops running winders, but getting into shell.int.us.mil is still relatively difficult.

This is surprising why?

[phillymjs]

Likely the most sensitive sites are built on some custom UNIX stuff, but isn't a good portion of the U.S. government simply standardized on Microsoft products?

Well, when you're tapdancing through a minefield, you shouldn't be surprised when you wind up legless.

~Philly

timothy, timothy

[SecretAsianMan]

I quote the article's title:

Federal Computers Fail Hacker Test

Don't you mean 'cracker test'?

(Woot, now my /. purity value will go down even more, since I've now explained the difference between 'hacker' and 'cracker' to a member of the press!)