Slashdot Mirror
South Pole Research Station Hacked Twice
Marda writes "It's been known for a while that Romainian cyber extortionists cracked the computer network at the Amundsen-Scott South Pole Station last year. Now SecurityFocus is reporting that another computer intruder penetrated the station just two months before, and cracked the data acquisition system for the Degree Angular Scale Interferometer (DASI), a radiotelescope that measures properties of the cosmic microwave background. It turns out the station was insecure 'purposely, to allow for our scientists at this remotest of locations to exchange data under difficult circumstances,' according to internal reports."
insecure purposely? what about SSH? what about VPN? jesus, arent these scientist smart? cant they use some tools for that matter, cant someone creat a gui so the dont have to?
this is the most riddiculous thing I've ever heard.
"goodbye and hello, as always" ~Prince Corwin, from Zelazny's Amber series
Some people are just plain jerks. Sure, I want to know if my financial information is safe. But why should hackers take the time to bother scientific equipment?
I can just see it now. A buoy in the ocean with millions of dollars in scientific instruments and sensors, collecting data for good of all mankind. Then some hacker finds his way in through the radio connection and manages to burn out or blow up the equipment by playing with the settings. His excuse? "See! It should have been secure! Next time you'll know better!" Way to miss the point, jack.
Javascript + Nintendo DSi = DSiCade
Scientists are generally knowledgable, but only in their field of specialization. You don't expect a particle physicist to know about macro biology, and you don't expect an ornithologist to know about particle physics.
Computer security is another one of those fields that requires its own study time to be competent in, and most people aren't interested or don't want to spend the time.
tasks(723) drafts(105) languages(484) examples(29106)
Because if you had some brain you'd figure out that geosync orbit has to be straight above the equator.
FTA:
"Given the fact that no financial records or systems were compromised, no safety or loss of life was threatened, and no critical system corrupted, we need to balance legitimate security needs with the legitimate needs of our scientists at the Pole," the memo reads.
...Other documents show that less than two months earlier the NSF's security team was plunged into a similar fire drill when a computer intruder named "PoizonB0x" penetrated the primary and backup data acquisition servers for a radio telescope at the station called the Degree Angular Scale Interferometer (DASI), which measures properties of the cosmic microwave background radiation -- the afterglow of the Big Bang. The intruder, rated a prolific website defacer by tracking site Zone-H, used his moment of cosmic access to erect a webpage on the servers proclaiming, "I love my angel Laura."
Now, I'm not one for people snooping around in my stuff when they're not invited or anything, but consider this: The first hack modified a web page on a system that collects monitoring data (but most likely does not contain other meaningful data, like formulas), and the second intruder accessed no financial data, did not threaten safety, and did not corrupt any critical systems.
Isn't it possible that the systems that were compromised were actually left insecure, not necessarily "on purpose", but because they felt that there wasn't much of a need to secure them in the first place? They probably calculated the possible risks and decided that, if both systems did in fact only contain informational webpages or data collected from their equipment, that there wasn't much point in worrying a lot about securing them (after all, who would really care about the data besides them?).
I was in the park the other day wondering why frisbees get bigger and bigger the closer they get - and then it hit me.
...and expect to get net burgaled. Really is that simple. Regardless of the technical or budgetary constraints that's the way it is. The internet is a nice borderless place and even if everyone at your base station is nice and honest, that doesn't mean there aren't criminals within reach of your data.
The correct way to deal with this is to have a DMZ - a nice public facing internet machine that isn't as security critical as your primary experiment instrument. This may mean a compromise in terms of budget and/or data availability.
These posts express my own personal views, not those of my employer
Fix it yourself? Will you now?
Let's see. The hardware in the field is specialized ASICs chips driving custom built sensors. No linux distro will run on it. Even if you do write some custom ssh for the chips, you need to make sure they have enough power to do to prime exponentiation operations--expensive in terms of power. Likely, you're little offer to "fix it yourself" will be laughed at by the men who built the devices, under budgets, and tough enough to operate at 100 below zero.
Look, it's not your mother's E-machine. It's custom hardware that needs to talk to machines that have to be left insecure. Otherwise, the cost of doing science down there goes up, and some experiments just can't be run.
Heck, if they'll buy me the books
What? Do you think there's an OReilly book on the one-of-a-kind ASICS chips they have? Sounds more like they'd have to buy you an education. Come to think of it, I think they're better off sending down qualified scientists. As it is, I don't think you're even qualified to teach high school science. No offense.
The Amundsen-Scott station is very expensive to maintain. During the winter the entire base population can be as low as 17 individuals; this can increase significantly during a few months out of the summer, but with cuts in funding the total personnel at the station remains low.
The station is designed for one thing: scientific research. With that in mind, the people you send to the station are those capable of doing the research, or those that are capable of maintaining the station so that others can do their research. Most of the folks there are conversant in a half-dozen jobs - *because they have to be*. There isn't enough funding for critical positions, much less a position like 'computer network administrator' which is nothing more than dead weight 99% of the time. A person who, if they can't also fix tractor engines, maintain the fuel-based heating system, and help calibrate various pieces of astronomical equipment, is nothing more than a waste of space, food, and energy.
No doubt the Amundsen-Scott folks decided to do business 'as usual', e.g., in a not very secure manner, because a) who the hell would want to hack the system when there's nothing to gain?, and b) there isn't anyone there who's life work is system security.
(In fact, I'm willing to bet they *could* secure the system in a decent manner, but never saw the point of it since they couldn't conceive of why anyone would want to mess with it in the first place. Frankly, I can't either; it takes a real jack-off to do something like this.)
All those clueless gits out there who scream "they should have a network administrator!" might want to keep in mind that a network administrator isn't worth his weight in fuel to ship out there, much less keep around during the eight months of the year they're pretty much cut off from the outside world. And yes, that means *you*; if all you know is network administration/security then you're useless waste of good oxygen at Amundsen-Scott, and the people there neither want or need you cluttering up the cramped base, eating their food and using their heat.
Max
My god carries a hammer. Your god died nailed to a tree. Any questions?
Ease of use does not mean it has to be insecure!! Strong passwords and patched applications do not make usage difficult!!
has anyone here on /. considered that it might be a link which goes up and down alot ?
....
have you seen what happens when your encrypted link keeps dropping
Type unto others as you would have them type unto you.
Hmm, I haven't seen this documentary but there is a difference between sharing scientific knowledge (read access) and modifying that information with disreguard to authority (read/write access).
I don't think a researcher would appreciate it if another, even a scientist, updated the research without the approval of the researcher. Reading that same information and giving feedback however, is different.
You come home, someone's obviously been inside your house. Your door is open, they've gone through everything in the house.
After days of searching everything in the house, it's determined that they didn't actually take anything. What's the big deal?
steve
Oh, you're not stuck, you're just unable to let go of the onion rings.
It's easy to say the words "remote access", isn't it?
Call your local provider, ask them about getting a line to the South Pole. Keep calling until you find someone who can provide it. Once you do, ask them how much it will cost. Now, calculate how many slaves you'd have to keep working in full-time positions to be able to afford any decent amount of bandwidth.
steve
Oh, you're not stuck, you're just unable to let go of the onion rings.
With the risk of being OT here, the situation is rather simple. Think of the news as one giant magnifying glass. When a .ro cracker breaks and steals something news break and "Romanians did it again". There is no such thing as a cracking hype in my country but the news make the association between Romanians and cracking look so BIG, so strong, so people stop thinking that this might be just some poor smuck trying to get ahead in a country where people like my mom earn something like 100$ after 30 years of public service. This kind of crackers are present everywhere. Ok some of the .ro crackers were ingenious enough to crack some pretty tight servers but this doesn't justify generalizing.
People should STOP thinking that the world is black and white and START seeing the shades of gray. Good and Evil are in each and every one of us and the side the people see is often highly dependent on the angle of view.
Here is an example: Is Nicolae Paulescu EVIL or GOOD? If he is EVIL will you kill him if you have the chance to go back in time, if he is GOOD how come that he is such an anonymous considering what he has done for humanity?
If they are smart enough to use packet or satellite, then they can use BSD or Linux.
Many measurement devices don't have required software ported for [insert your *nix].
OOo doesn't have the same capabilities as Excel, essential in many enviroments.
And who is going to pay for porting that Excel/VBA/Access/MS SQL/etc stuff to BSD/Linux?
If the transmission time is what is vital, then have it go through a proxy system which is only unsecured on the one end. Then locally it goes through sanity checks and any unsafe or strange actions are flagged. If no computer speciallists are availible then a scientist can go through a predefined process to resolve the difficulty.
I know the scientists would rather work on their research but they are living in the 21st century just like the rest of us and security is a concern. If the hacking was important enough to involve the FBI then it is important enough to protect with at least the minimal amount of security.
What is the cost of replacing a trashed system?
RTFA. The system wasn't trashed. Very little was done to it.
How much does downtime cost you?
Considering that they only have communication access to the outside world for a few hours a day, very little.
What does it cost to get someone to your site to fix your system?
When the fuel could be used to ship needed equipment, food, or just used for heating, a whole hell of a lot.
What POTENTIAL expenses/risks do you face if someone uses your equipment to do damage to another site.
Considering the equipment on-base and the very limited daily access, this amounts to a big, fat zero. Or did you think they had cable?
People that have heard you rant about how "worthless" sys admins are start to wonder how credible the rest of your statements are.
A system administrator IS worthless at Amundsen-Scott, compared to a mechanic, a scientist, or an electrician. Do a bit of research on the subject before talking out of your ass.
Max
My god carries a hammer. Your god died nailed to a tree. Any questions?
Fine, have the unsecured link over the link, but have it secured at the northern end. The only way to access the link would be to use VPN or ssh to the machine at the uplink place.