Slashdot Mirror
Mapping The CIA Nonclassified Network
jeffy124 writes "A security firm Matta Security in London has mapped the CIA non-classified network. Using only legal and open sources, the company mapped topology of machines and even found networks otherwise closed to the public. The company never port scanned or probed the network directly. Among items they found were emails and phone numbers of sys admins and other employees. Amazingly, they did all this in two days."
Last I checked, Portscanning was legal?
I wouldn't say that they mapped the CIA's network. Sure, they found some machine names that route mail. Big deal. I'll bet more that half of the slashdotters here could have gotten the same (or more) information. I don't see how knowing what machines route mail pose any security threat. Anyone outside the network could just look at their mail headers and see what internal machines were used to forward the mail.
If someone can get classified information from CIA via social engineering, I'd say someone needs to be retrained. These guys should be on the lookout for that at all times.
As for the email addresses and sysadmin names, I really don't think that's a big deal.
Guess we better stop posting our email addresses and names! And, god forbid, get rid of your business cards! And don't forget your whois information!!!!
If that's really an avenue to social engineering, then we're all in trouble.
nslookup -q=mx www.cia.gov
- m4tt4 s3cur1ty 1337 h4x0r
Social engineering is probably *the most* dangerous form of attack, as well as the most often overlooked from a defensive standpoint. Although the webmaster may not directly have details of russian agents, to use your example, he may have access to information that might compromise the security of the entire system. From my admittedly limited experience, the military and other "important" organisations are often little better prepared for attacks than the average web startup: even where great care and attention has been given to firewalls and the like, there will still exist employees who will disclose information, and there is still always the capacity for human error.
Besides, addressing this kind of issue "when someone breaks in" is too late. And it's important that the civilian be aware of and take an interest in problems in its government, police force, legal system, etc.
A link that has some good info on the legality of port scanning is: Journal of Technology Law and Policy
If you take the time to read it, there is a bunch of interesting stuff in it. Just do a page search for "port" and you'll get to the cool stuff.
Exactly. It is the typical information that any sysadmin from the outside. The graphic diagramming the networking layout shows nothing remarkable.
You can seen the original report in PDF format here, with _all_ of the juicy details.
Which is funny, because the link is not directly accessable from the main site.
talk about security.
"It is a greater offense to steal men's labor, than their clothes"
version 5.0.6a
Why you may ask?
Because Lotus Notes and Lotus Domino is the only mail product that gives email administrators zero access to information within mail files. Each Notes database has an access control list, and you can specify who's on it. The mail server can have "depositor" access, which means it can only place information inside the database. The database can also be encrypted so that only the server can read it -- meaning someone has to steal a copy of the database itself off of the file system, in order to have a chance at decryption.
First, anyone who answers the phone at the CIA is trained not to tell you anything. For that matter, they don't know anything. Everything os compartmentalized, computer systems, intelegence, even people. Social engineering on the scale you mention usually doesn't happen in the wild. Social engineer as a hacker technique is popular because of the low risk exposure. If you are a team hired by the AF to try and steal a plane you have zero risk no matter what you try, so you'll do some things no one would do in real life.
Second, do you really think the CIA uses username/password authentication for *anything*? Think smartcards, one time key generators, palm scanners, etc. I guarantee there isn't a single secure system you can get into without at least a token and a passphrase. The most secure systems require multiple authentications. Hello, we're are talking about the largest *inteligence* agency in world.
Si vis pacem, para bellum
The only thing more annoying than a Libertarian is an (un|mis)informed Libertarian