Slashdot Mirror
Mapping The CIA Nonclassified Network
jeffy124 writes "A security firm Matta Security in London has mapped the CIA non-classified network. Using only legal and open sources, the company mapped topology of machines and even found networks otherwise closed to the public. The company never port scanned or probed the network directly. Among items they found were emails and phone numbers of sys admins and other employees. Amazingly, they did all this in two days."
According to the Pentagon News Herald
TCD004
Last I checked, Portscanning was legal?
I would tend to think that the sites they mapped were in areas considered "DMZ" or De-Militarized-Zone. It's basic System's Administration... I think these Brits aren't giving our spooks enough credit.
Don't think that a small group of dedicated individuals can't change the world. It's the only thing that ever has.
Always nice to know if the spooks are checking up on me. (Not that I would give them any reason to)
Reality has a liberal bias
It don't claim to have found any private or restricted information. Everything they found was specifically put on the web to be found.
Simply knowing the names and e-mail addresses that Matta turned up would be enough for some social engineers to get the rest of the information necessary to mount an attack
Sorry, I don't buy that. "Hi, this is chuck, the webmaster. Can I have the names of our russian agents please?"
Post the article again when someone breaks in or actually finds classified info.
I wouldn't say that they mapped the CIA's network. Sure, they found some machine names that route mail. Big deal. I'll bet more that half of the slashdotters here could have gotten the same (or more) information. I don't see how knowing what machines route mail pose any security threat. Anyone outside the network could just look at their mail headers and see what internal machines were used to forward the mail.
If someone can get classified information from CIA via social engineering, I'd say someone needs to be retrained. These guys should be on the lookout for that at all times.
As for the email addresses and sysadmin names, I really don't think that's a big deal.
Guess we better stop posting our email addresses and names! And, god forbid, get rid of your business cards! And don't forget your whois information!!!!
If that's really an avenue to social engineering, then we're all in trouble.
If you submit a freedom of information act request to the CIA, you can probably get back pages and pages of blacked out text.
in the same page as the network map is
Related Stories: Report warns of al-Qaeda's potential cybercapabilities
don't you just love when we do half the terrorists jobs for them then wonder how they pull off elaborate attacks?
nslookup -q=mx www.cia.gov
- m4tt4 s3cur1ty 1337 h4x0r
A link that has some good info on the legality of port scanning is: Journal of Technology Law and Policy
If you take the time to read it, there is a bunch of interesting stuff in it. Just do a page search for "port" and you'll get to the cool stuff.
Exactly. It is the typical information that any sysadmin from the outside. The graphic diagramming the networking layout shows nothing remarkable.
You can seen the original report in PDF format here, with _all_ of the juicy details.
Which is funny, because the link is not directly accessable from the main site.
talk about security.
"It is a greater offense to steal men's labor, than their clothes"
A few weeks ago I was in an IRC-room when someone asked what sort of results people were getting for "traceroute (some IP I've forgotten)". whois said it was the CIA's IP-range, and the traceroute never reached that IP.
Taking the numbers from the diagram in the article, whois says:
Hewlett-Packard Company (NETBLK-HP19)
3000 Hanover Street
Palo Alto, CA 94304
US
Netname: HP19
Netblock: 192.81.0.0 - 192.81.255.255
Maintainer: HP
.
Hmm the CIA has 162.45.*.* assigned to them, I guess they aren't using it.
I hope the MiBs don't come knocking on my door now.
What time is it/will be over there? Check with my iPhone app!
One of their Sun boxes is running sendmail 8.8.8. Isn't that a bit out-of-date/insecure?
I hold it, that a little rebellion, now and then, is a good thing. -- Thomas Jefferson
governments are big, slow moving elephants. overworked bureaucrats grappling with small budgets and bosses who don't understand or care to understand what they do.
a constituency that howls about privacy one second and howls about security the next. how could the cia/ fbi have ever let september 11th happen! what a massive failure of intelligence. how dare the government propose a national id card/ that security guard frisk me/ have a shadow government in bunkers up and running. it's a conspiracy to rob us of our bill of rights i tell you!
plane hijacker mohammed atta getting his ins paperwork approved 6 months after september 11th. conflicting mission statements. layers and layers of legislation like legal sediment conflicting and overlapping and obfuscating the directives for an office. look at the org chart that tom ridge now oversees as part of the new homeland security office. it resembles a circuit board.
computer security is a flavor-of-the-month affair... savvy smurfing DoS exploits one month, code red worms the next... nimbleness, dexderity, and flexibility being the name of the game here.
so let's have a packet collision here between the nature of these two beasts. i think the government is screwed, basically. so how do you change the nature of big slow-moving government?
i'm not trying to be pessimistic. because i think after september 11th there is a lot of will to fix things. president bush said as much today when he commented that mohammed atta's paerwork coming through a few days ago is completely inexcuseable on the part of the ins.
i'm just wondering how you change the nature of this beast, because it will, it has to, change.
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
version 5.0.6a
Why you may ask?
Because Lotus Notes and Lotus Domino is the only mail product that gives email administrators zero access to information within mail files. Each Notes database has an access control list, and you can specify who's on it. The mail server can have "depositor" access, which means it can only place information inside the database. The database can also be encrypted so that only the server can read it -- meaning someone has to steal a copy of the database itself off of the file system, in order to have a chance at decryption.
I hope those guys like pr0n and are looking for a good mortgage rate.
You know what?
"Sorry, I don't buy that. "Hi, this is chuck, the webmaster. Can I have the names of our russian agents please?""
I always find it amusing when people try to make the CIA/FBI/NSA out to be bumbling idiots. They're not perfect, but they are really f'ing good.
In fact, if someone brought that weak 'social engineering' their way, it wouldn't surprise me if they were logged, traced, then given a visit by a couple really solemn-looking men in bad suits and dark sunglasses that smelled like pistachios.
I dare even one of the cynical know-it-all people that read this board to try it. Be sure to post your results so we can laugh at your cornholing.
Knunov
Why do users with IDs under 100,000 or over 700,000 usually have the most worthwhile comments?
Not a great example of detective work. I saw this on the politech list and it was made to seem like they got a lot more info. This was just basic network enumeration. Any kiddie could have done this after reading the first few chapters of Hacking Exposed
Douglas Calvert
They exist.
They work in buildings.
They have barbed wire around their compound.
Humans go in and out at various times during the day.
Using this valuable information and the logic of this silly article, I *could* mount a tactical strike against CIA headquarters!
Maybe I could run into a CIA employee at the butcher's and make friends and learn his home phone number. Shit! I've just *hacked in* to the CIA. Ph34r my skillz.
Ash OS durbatulk, ash OS gimbatul, ash OS thrakatulk, agh burzum-ishi krimpatul! Uzg-MS-ishi amal fauthut burgulli.
I'm sure they have systems that arn't connected to the internet in any way however remotely, but also seeing as the CIA snoops on the internet, they obviously have some machines connected to the internet that they would be upset if you hacked into (not that hacking into any of them would be very wise).
It's quite possible they've broken the law here; as unreasonable as it seems. As an example, if somebody gave you their telephone number, that's probably not classified. On the other hand, if someone hands you their telephone book, that's probably classified. So, reverse engineering their telephone book somehow would mean you have classified information; and that may be illegal. IANAL.
Whether their IP address list is classified, I cannot say... probably not, but I wouldn't like to bet.
-WolfWithoutAClause
"Gravity is only a theory, not a fact!"Do a google search.
;^)
Yes,
668: Neighbour of the Beast
Surely this top secret terrorism buster logo was meant to be classified; there is no way the CIA would be stupid enough to let this information out into the public arena, where it would expose them to ridicule!
As a sysadmin, it's important to know what information you make public or leak out. All of the information presented here are things that normally are known. If you don't know my DNS, web, and email servers why do I bother setting them up?
This sounds dangerous to people not in the know, and may make a good article to read but I don't see an issue here. Some of it is very questionable. How do you really know they are running Solaris? That wouldn't be hard to mask.
The point is, that anyone in the USA should be allowed to discuss the merits of any social/political system. For a long time, that discussion was cut off, and people who held a particular viewpoint (however absurd it might seem to us rational people) were fired from their jobs, spied on, and even imprisoned.
Reality has a liberal bias
[100% ISO 646 Compliant]
SVM, ERGO MONSTRO.
It happens all the time, idiots copy emails from the class net and then send it off to people on the unclass. "uh becouse they don't have a class email address..."
Also ILOVEYOU was found on the class system, that BTW runns MS lookout and exchange 5.5
hmm... for fun I enjoy launching DDoS attacks against 127.87.42.5
The least they could do is have the outbound mailserver strip the internal mail headers from the message before sending it out. It's easy to do with postfix and that's what we do. Why give out anymore information than needed? I noticed that they were able to get what CIDR block they use for internal IP's from the mailserver.
Jesus I don't run a covert espionage agency and I at least do that at our company. Hell I even proxy requests to private servers from an apache server in the DMZ.
Isn't this just basic network security?
"Fighting the underpants gnomes since 1998!" "Bruce Schneier knows the state of schroedinger's cat"
Here, get this CD/Video set, it's free! Learn how to secure Windows NT/UNIX to goverment standards! Order now!
http://iase.disa.mil/eta/index.html
hmm... for fun I enjoy launching DDoS attacks against 127.87.42.5
Not a whiff of Microsoft on their accessible networks, which makes me sleep easier at night, knowing their external Net presence has some semblance of stability and security.
I want to delete my account but Slashdot doesn't allow it.
I have a feeling this made news just because of it's affiliation with the CIA -- the all powerful super secret spy agency of the US government. I sure wish I could generate news stories by doing recursive whois reports and DNS queries.
What's next? I would think that if you were not able to map the CIA's unclassified public network than they must have some sort of major DNS problem.
There is absolutely no significane to this news story other than organizations who maintain a publically accessible web site with such services as e-mail and a web site must have a logical network structure to deliver said services. The CIA is no exception.
"I'll just chip in a bit for RedHat: I actually have that installed on my university machine." - Linus, '95
$ host -v -a -l cia.gov I think that about covers it.
(Is there a site/whatever where people with ideas suggest what software is missing and people with time may choose to implement them?)
What I want is a kernel module to defeat port scanning. Whenever a remote tries to connect to a port that isn't bound, the module kicks in, accepts the connections, and doesn't do anything, or echos the incoming data, or sends random data, or behaves like a web/ftp/etc server, or a combination of the above.
If most computers used this, wouldn't port scanning become impractical?
Would there by any harm in it?
The CIA's actual network defenses never even came
into play. Because of the CIA's reputation, the
security firm didn't dare portscan, or test the
numbers, names, and addresses they got.
Obviously the CIA are the ones who really employed
social engineering in this case.
Why is this significant? Well, as was recently pointed out the 4000 series line cards contain a class III led transmit/receive status indicator, which makes it possible to sniff traffic off of the interface optically from a distance. Hope the CIA has some extra black tape handy.
The Economics of Website Security
You can simply copy the database locally and use a freely distributed tool to edit the ACL to add yourself or modify -Default-. That will NOT get you past encrypted mail using Public keys tho'. On disk encrypted dBs will also not be effected by this. Doesn't appear in the ACL log either of course. If the person hasn't set User Types you can also create a Group with the user's name and put yourself in it.
;-)
On top of that at least two folks have created code that's supposed to unlock the ID file. One by substituting the hash that's compared by the password dialog in memory with one that's created by a seperate application. That code isn't distributed depsite promises to release. The second piece of code is a bit shakier but is supposed to be able to backdoor the ID. These two groups are speaking to one another but as of yet I've not seen any results. http://www.falling-dominos.com/ was one of the sites that was working this but refuses to release code for fear of the DMCA. I want this code if anyone has it..
Lastly, there's code out there to dictionary attack the ID file. Some work would no doubt yield brute force code but source hasn't been released for this tool. I might know how it works though
Overall though - Notes is damned secure compared to the MSFT crap that's out there. R6 is looking pretty good and the RC1 beta has been running on my server\workstation for several months now rock solid. Lotus came up witha workable PKI long before X509 seemed to have caught on. Port encryption and all sorts of nice goodies too. I happen to like the client and its dirt easy to build simple apps. Even workflow apps aren't hard to build and publishing to the WEB is no biggie unless you get really tricky. My home server is running Notes and except for the mile long URLs I find it pretty friendly...
Build it, Drive it, Improve it! Hybridz.org
It sure as hell isn't the CIA's running Exchange. They had a speaker at Lotusphere FROM the CIA who made it quite plain the Lotus Notes was what they were using. Very entertaining little guy too - loved it when the phone rang on the podium and he answered it. Wrong number(lol)!
Anyway, from what he said Exchange was NOT welcomed. Why would they bother to tell people that, present on it, run Notes on their Unclass server, and then run Exchange inside? You must be talking about another network....
Build it, Drive it, Improve it! Hybridz.org
They didn't just scarf info from Google - they also did reverse DNS lookups and a ZoneTransfer. At least one college kid has had his door kicked in for having done a ZoneTransfer to a domain that had recently been hacked. (sigh) Port scanning is no biggie IMO but it seems to me a ZoneTransfer might be a little more "aggressive". Still, if their country doesn't care.....
Build it, Drive it, Improve it! Hybridz.org
Before his company got attached to the net, they were using an address of '11.*' for their internal computers, which included a number of Sun workstations -- some doing double duty as routers. For those of you who don't know, RFC 1918 officially designates 3 network ranges for this sort of work -- 192.168.*, 10.* and 172.16.0/12. 11.0 obviously doesn't fit in that range.
When they got their network attached to the 'net, they had to do a good deal of work to renumber all of their computers to have 'proper' IP addresses (either in their assigned block, or in an RFC1918 non-routing block).
Within an hour of connecting their box to the 'net, they got a rather brusque call from an intelligence agency official demanding to know why they were stealing his packets. They had to disconnect from the network and root around their network until they found (and removed) the errant subnet stub. It turns out that they had managed to miss one SUN with a second ethernet card that was no longer attached to an active subnet (but still routing to the stub subnet). This was back at a time when any SUN with two ethernet cards routed by default, and every machine ran routed(8) as a matter of course (much easier than having to do manual routing all the time!). It turns out that the route to the stub network had leaked out to the larger internet and poisoned the routing for a huge pool of machines.
When I teach networking, I use it as an example of why you should always use the proper non-routing addresses for internal networks.
(I just did a whois, and 11.0/8 is actually owned by the Defence Intelligence Agency, not the CIA. Not like there's a big difference for us civies.)
Sometimes boldness is in fashion. Sometimes only the brave will be bold.
Simply modify the Server's ACL entry such that the User Type is "server" and this problem is solved. While you're at it set the option for "enforce consistant ACLs" and watch what happens when the Admin tries to get in. :-) You can set on-disk encryption to make things harder and for REAL fun have the User Record in the address book set so that all of th email is encrypted using the user's Public key. Whoops - the admin can't get in without the ID now huh?
;-)
Admin keeping copies of your ID? No problem, change your password and the ncreate a private encryption key. Encrypt that which you find too sensitive to share and smile. The admin is now locked out without breaking your IDs password or using a tool to circumvent the IDs password. Those tools aren't publicly available..
Done right it's quite possble to have privacy using Notes. Oh, use port encryption too
Build it, Drive it, Improve it! Hybridz.org