Slashdot Mirror
Mapping The CIA Nonclassified Network
jeffy124 writes "A security firm Matta Security in London has mapped the CIA non-classified network. Using only legal and open sources, the company mapped topology of machines and even found networks otherwise closed to the public. The company never port scanned or probed the network directly. Among items they found were emails and phone numbers of sys admins and other employees. Amazingly, they did all this in two days."
Last I checked, Portscanning was legal?
I wouldn't say that they mapped the CIA's network. Sure, they found some machine names that route mail. Big deal. I'll bet more that half of the slashdotters here could have gotten the same (or more) information. I don't see how knowing what machines route mail pose any security threat. Anyone outside the network could just look at their mail headers and see what internal machines were used to forward the mail.
If someone can get classified information from CIA via social engineering, I'd say someone needs to be retrained. These guys should be on the lookout for that at all times.
As for the email addresses and sysadmin names, I really don't think that's a big deal.
Guess we better stop posting our email addresses and names! And, god forbid, get rid of your business cards! And don't forget your whois information!!!!
If that's really an avenue to social engineering, then we're all in trouble.
Social engineering is probably *the most* dangerous form of attack, as well as the most often overlooked from a defensive standpoint. Although the webmaster may not directly have details of russian agents, to use your example, he may have access to information that might compromise the security of the entire system. From my admittedly limited experience, the military and other "important" organisations are often little better prepared for attacks than the average web startup: even where great care and attention has been given to firewalls and the like, there will still exist employees who will disclose information, and there is still always the capacity for human error.
Besides, addressing this kind of issue "when someone breaks in" is too late. And it's important that the civilian be aware of and take an interest in problems in its government, police force, legal system, etc.
Well, they're using Solaris 2.5.1, which initially came with SMI-8.6.
:: Imagine There's No Windows. It's Easy If You Try.
They have upgraded since that original version, however.
The latest Sendmail version for Solaris 2.5.1 was 8.8.8 plus a Sun patch, so hopefully they got rid of any and all potential problems.
MONOLINUX
Here's another funny thing:
Among items they found were emails and phone numbers of sys admins and other employees
This sounds really stupid of the CIA at the first glance, but if you think about it, the sys-admins were probably "email the webmaster!" links and the 'other employees' were probably officials that displayed their office numbers so the public could contact them. What a joke.
First, anyone who answers the phone at the CIA is trained not to tell you anything. For that matter, they don't know anything. Everything os compartmentalized, computer systems, intelegence, even people. Social engineering on the scale you mention usually doesn't happen in the wild. Social engineer as a hacker technique is popular because of the low risk exposure. If you are a team hired by the AF to try and steal a plane you have zero risk no matter what you try, so you'll do some things no one would do in real life.
Second, do you really think the CIA uses username/password authentication for *anything*? Think smartcards, one time key generators, palm scanners, etc. I guarantee there isn't a single secure system you can get into without at least a token and a passphrase. The most secure systems require multiple authentications. Hello, we're are talking about the largest *inteligence* agency in world.
Si vis pacem, para bellum
The only thing more annoying than a Libertarian is an (un|mis)informed Libertarian
The point is, that anyone in the USA should be allowed to discuss the merits of any social/political system. For a long time, that discussion was cut off, and people who held a particular viewpoint (however absurd it might seem to us rational people) were fired from their jobs, spied on, and even imprisoned.
Reality has a liberal bias
[100% ISO 646 Compliant]
SVM, ERGO MONSTRO.
The least they could do is have the outbound mailserver strip the internal mail headers from the message before sending it out. It's easy to do with postfix and that's what we do. Why give out anymore information than needed? I noticed that they were able to get what CIDR block they use for internal IP's from the mailserver.
Jesus I don't run a covert espionage agency and I at least do that at our company. Hell I even proxy requests to private servers from an apache server in the DMZ.
Isn't this just basic network security?
"Fighting the underpants gnomes since 1998!" "Bruce Schneier knows the state of schroedinger's cat"
Sooo.... What's new? Did someone expect public information not to be really public when it comes to the CIA? Secret stuff is probably already ran from sources that can't be easily found.
(Is there a site/whatever where people with ideas suggest what software is missing and people with time may choose to implement them?)
What I want is a kernel module to defeat port scanning. Whenever a remote tries to connect to a port that isn't bound, the module kicks in, accepts the connections, and doesn't do anything, or echos the incoming data, or sends random data, or behaves like a web/ftp/etc server, or a combination of the above.
If most computers used this, wouldn't port scanning become impractical?
Would there by any harm in it?
Version 5.0 of the client still can't handle Daylight Savings Time! If it crashes (and it does) you've got to manually kill the process nlhdeamon.exe to restart. You do not want your helpdesk handing out instructions like that...