Slashdot Mirror
Security Flaws Could Cripple Defense Network
userexec wrote to mention an FCW.com article about the uninspiring future for the Missile Defense System's software. The developers are apparently very worried about poor information security on the project. From the article: "The report said that neither MDA nor Boeing officials saw the need to install a system to conduct automated log audits on unencrypted communications and monitoring systems. Even though current DOD policies require such automated network monitoring, such a requirement 'was not in the contract.' The network, which was also developed to conform to more than 20-year-old DOD security policies rather than more recent guidelines, lacks a comprehensive user account management process, the report said. Neither MDA nor Boeing conducted required Information Assurance (IA) training for users before they were granted access to the network, the report stated. "
The subcontractor they hired to do the programming was called Diebold?
We'll no doubt see "All your missile base are belong to us" written on the system's password file.
Striking fear in the authors of godawful fanfiction, I am here, appearing in darkness, Tuxedo Jack!
Why not contract an Indian company to write it? Or make it a Sourceforge project. That always seem to generate high-calibre, error-free code.
Did you know my dad's dog died?
This does not suprise me at all, after all, we as Americans are quickly proving that we're becoming the bastion of incompetence. From NASA,
to the war in IRAQ,
irregularities in elections,
collapsing health care system,
cronyism in government,
out-sourcing out of hand,
the massive trade deficit,
the fact that communist China, Japan and the UK now help us with our balance of payments,
failing education system,
Katrina,....one wonders whether we as a nation can ever do anything right.
Question is: Is there eanything really?
Does this mean the big fat trackball might not respond? Who's going to defend those six cities?
This sig, aah-ah, is comin' like a ghost-sig...
The Missile Defense Agency (MDA) is George W. Bush's name for the Ballistic Missile Defense Organization (BMDO), which was Bill Clinton's name for the Strategic Defense Initiative Organization (SDIO), which was Ronald Reagan's "Star Wars."
How many more $500 USD toliet seats does the taxpayers have to buy before Boeing upgrades their network?
No matter what you do to design a system there will always be some hack who comes along to crap on your project. Just because you think you know better doesn't make it true. It certainly doesn't help that sites like this one jump on every little aberrant report like a pack of jackals.
"God fights on the side with the best artillery." - Napoleon, Marshal of France - speaking truth to power
Why is anyone going to care about a weapon system everyone knows is a dud anyway?
The system has never once demonstrated that it works, every single test has either failed outright or been rigged. The only reason the program exists at all is to hand out taxpayer money to campaign contributors.
Looking for an Information Security student project suggestion?
Try http://dotcrimeManifesto.com/
Somebody correct me if I am wrong about this, but a system like this should be run in an airgapped environment where external interfaces (radars, etc) are not ones which you can ssh over or anything like that. Most likely every interface into the system will do exactly what it is designed for and nothing else.
People who have access to workstations on the system should need to go through a significant amount of physical security before they are able to do anything. At least thats how similar systems I have seen are run.
http://michaelsmith.id.au
Their plans totally Bombed... I mean seriously, they Blew Up in their faces.
EpiAdv - if you like Pokey the Penguin, try this comic!
I'm sure this will be just as fixable as the Command Navigation Program. Trust the government.
In Soviet Russia, backwards is everything.
We'll just make talking about DOD security flaws illegal in Patriot Act 3 and then nobody will know.
It appears Ockham lost his razor and grew a beard.
Security Flaws Could Cripple Defense Network
Drunk Driving Could Be Dangerous
Microsoft Goes Head-to-Head With IBM
Mixing Household Chemicals Could Be Dangerous
notice a pattern? none of these headliness says or means anything. they border between "no $hit" and "duh".
instead of that say-nothing giberish how about "group passwords threaten MDA's communications network"? see, now the head line says something.
ps, not to be a jerk, just to point out an area where slashdot can be better than the rest.
--iggy_mon - www.ananonymouskiller.com - Die Trying -
I agree. I do C&A work for the government. Systems which have zero impact on national security have to conform to NIST guidelines. The fact that none of this was in the contract and not implemented is pretty bad...
A hole as big as this is simply unacceptable.
I doubt it. I mean, really, no level of failure or malfeasance in the missle shield project has dissuaded or concerned U.S. politicians one bit since it was first proposed. Why start now?
How about Global Thermonuclear war?
"We are all geniuses when we dream"
- E.M. Cioran
...You'd think after the Cylon's infiltration of the Caprica global network that someone would have taken this a little more seriously.
"...Well, there's egg and bacon; egg sausage and bacon; egg and spam; egg bacon and spam; egg bacon sausage and spam..."
I'm not surprised in the slightest by the "revelation" in this FA.
"Someone's head is going to roll over this one. The military has been really tight on network security lately, even with contractors. A hole as big as this is simply unacceptable."
You'd be surprised.
The only reason the program exists at all is to hand out taxpayer money to campaign contributors.
And the thousands of American scientists, engineers, technicians and support staff that design and work on these systems. Based on comments like this, you'd think that the government is stuffing shells full of cash and launching them at the enemy. Where do you think these "weapon systems" are designed and built?
Maybe my perspective is skewed. The only job offers (early career engineer) I was able to secure (in a timely manner) were from "big aerospace." If they were not "wasting taxpayer money" on large, risky (read: cutting-edge) R&D technologies, I'd be out of a really interesting, fulfilling job. And unfortunately, until some "other" interesting R&D area (energy would be a good one) is as big a target in the crosshairs of national/international interest, or until I have enough experience to start my own company, I am pretty happy working in the defense industry.
if its not in the contract, it is fraud for a government contractor to implement an extra feature or add-on to the system because the govt has to pay for the extra expenses (software developers' hours, testing, etc) incurred to make those improvements.
so if the security is bad, and it wasnt in the contract, the only people who can begin to address this are actually the purchasing organization, not the developers. the purchaser **needs** to add these stipulations in the contract or else the contractor legally is not allowed to work on fixing it.
Back in 1983, I saw this great documentary about a teenager hacking into a defense computer. Can't quite remember the name, though...
Why is anyone going to care about a weapon system everyone knows is a dud anyway? The system has never once demonstrated that it works, every single test has either failed outright or been rigged. The only reason the program exists at all is to hand out taxpayer money to campaign contributors.
Even if the system doesn't work, it's still bad to have unsecured access to it. It's certainly a concern that some terrorist might be able to infiltrate the system and use it to shoot down passenger planes or cause some other kind of damage. The system is designed to destroy things, incoming missles in this case, how hard would it be to redirect that destructive force to cause problems?
You just don't realise how picky they are about security. It dosn't matter if it actually works or not or if it's just for PR either. They don't care how importand things are, they are security nazis on everything they have a hand in. There are DOD websites where all they have is information that is easily available in other public places for anyone to look at. But because it's a military site, it's password protected and encrypted. What's going to be served at the chow hall today is more secure than this.
Someone save me from this sanity.
I must say this is astounding from a legal services point of view. I've seen defence contracts here in Australia, working at a law firm that works for Defence (and other government agencies). The usual practice is to start with a standard form contract which says something to the effect that the contractor must comply with the Defence Security [Directive / Policy / Determination / etc] dated []. And you always do a search before the final draft for "" and replace with appropriate information if it hasn't already been done. Alternatively a contract will say the latest Defence Security Directive issued from time to time - so the latest one always applies.
So I really find it amazing that this could sneak through... who's drafting this stuff?
Pessimism of the intellect, optimism of the will! - Antonio Gramsci.
If you read the history of the last days of the Roman Empire, it does not read a lot different than this. It was basically power struggles, greed and corruption from within. The foundational requirements of any society is conformance to some agreed minimal ethical and moral standards. When the foundation crumbles the building collapses.
My guess is the MDA was not reading the DOD guidelines on IA http://www.dtic.mil/whs/directives/corres/html/850 02.htm (among many other pubs) which is pretty clear. Being a classified mission critical system used for warfighting, they would fit into the MAC I, confidentiality=high baseline.
Lets hope their contract gets recompeted so my company can head over there!
Oh comon, everyone who watches "24" knows that you have to open a SOCKET before you talk to other defense-department computers! And it's really hard to do - all the CTU big-bosses always need to ask one of the geeks in the office to "open a socket to Division". The defense network is SECURE, I REST MY CASE!
Horns are really just a broken halo.
One weakness in many defense organizations is that so much of policy (IA) is a pain in the ass, but you learn to live with the pain as part of the job. If the people administering accounts, policy, and systems do not appreciate the reasons why the policies exit, they will not enforce them. If you are handed a 150 page procedure to read and sign that you have read it and you need the information access now, what are the chances you skipped the page that says you must do X to do Y? They are very high.
Also, we have loss of experienced cold war people (retirement, lay off, etc) means there is little continuity in the business process worsened by the tremendous growth in the programs and pressure to produce something now. Large programs require a large support staff.
Aerospace work is challenging and offers a low risk of being outsourced, or at least I hope it has a low chance of being outsourced.
Then, you have cases where companies "accidently" give advanced technology to foreign companies to gain some advantage. Examples are Iridium contractors giving advanced rocket technology to China and Toshiba improperly selling the machines and technology to make submarines quiet to the Soviets back when we were in cold war.
All this comes down to every engineer and manager enforcing policy.
Yeah, and monkeys might fly out of my behind. The acceleration due to gravity at the surface of the earth may be 9.8 m/s^2. Who's to say?
"None are more hopelessly enslaved than those who falsely believe they are free." -- Goethe
Depends.
If it was part of a Military Specification (or MilSpec), then the contractor had to follow it regardless of whether it was in the contract or not.
However, if it was Military Standard instead, then the contractor doesn't have to follow them, even if the Standard is referenced in the contract. Only if the applicable part of the Standard is put into the contract without reference, thereby making it a contract term, is the contracted entity required to follow it.
I realize that may be confusing, so I'll give an example.
If the contract references MilSpec 2020.1, then it is the contractor's job to look up that Spec and make sure they follow it.
If the contract references MilStandard 1043.7, then the contractor doesn't have to look it up or follow it, thought they can.
If the contract instead takes the text out of MilStandard 1043.7 and puts it into the contract, without reference to it as a MilStandard or with the copied text referring to another MilStandard, then the contracted entity has to follow it as it is a contract term.
And given the reliance on 20 year old legacy standards in this, it also sounds like the Contracting Officer and Program Officer (CO and PO respectively) didn't consider JTIC interoperability requirements as part of this.
Shit, that's twice in one week my Systems Acquisitions classes have been useful. Just not at work.
I like you, Stuart. You're not like everyone else, here, at Slashdot.
Not just GMD, but the whole system of systems including Aegis, THAAD, Airborne Lasers, advanced sensors and more. So in the long run I think MDA is following the right strategy - build stuff quick and refactor as needed. I believe this is far more efficient that spending 20 years on a monolithic waterfall development project.
And yes, overall I think national missile defense is a total waste of money compared to other places we could be spending it. But given its a real program (and pretty damn cool from an engineering perspective), they are doing the right thing.
Anyone realize that the report was pulled off the IG's website? It was 06-53 according to google. Now it's gone.
I do security
I assume the ones that failed were rigged to fail.
I do security
I interviewed iwth one of these groups last summer. Believe it or not, they tolde me that they do a lot of sourcing to american companies who foreign outsource (thus staying off the radar as far as foreign outsourcing concerns go)
More significantly, they use COTS software products, some of which are produced and maintained in countries that are likely to be on the receiving end of the target list. It should be fascinating to find out what happens if they ever try using it against one of those countries.
Incidently, I lost the interview for criticising some of their more glaring security holes. It was an technical architecture position, I thought that was a deliberate ommission to see if I knew what I was doing. It turns out that they are not simply too lazy to follow procedure, they are most clearly opposed to it.
Why, I cannot say, but it appeared to me at least that it was pressure from a few key people, rather than a general attitude, most of the low level techies seemed to appreciate teh need for more security and were quite frustrated by the lack of concern.
Missle system kills security leaks!
(Sorry, I'm really sorry. I can't stop.)
From the article: more than 20-year-old DOD security policies
So that would put it in the early 1980s... but in the 60s and 70s, the missile launch passwords were all "00000000" (also see here).
$nice = $webHosting + $domainNames + $sslCerts
Having been involved with the Air Force since 1985 and done my shair of IA traing, I can say it is basically worthless and more or less comes down to "Don't give out your password, or run software from home".
"Who are in control, they are not in control of anything - they don't even control themselves!" - Glen Beck
There are sourceforge projects that *maybe* two people on the planet earth have accessed, and one of them might be googlebot. It's the perfect place to hide in semi plain sight, just label it an MP3 metadata morpher skindesigned to be posix non compliant text console only alpha planning stage and only run on os2 beta or something,and it'll stay hid forever.
In the '06 and '08 elections, if a candidate for a federal-level race won't commit to ending this pointless, then don't vote for them.
If they do commit to ending the project, send them cash, since they won't be getting any from the defense contractors.
[o]_O
Our problems do not come from a "failure" to socialize medicine. When I was up in Canada, the news was that brain scanners were mostly going to places with powerful politicians. Quebec got an unfair share. Money was disappearing for political reasons. Over in the UK, people are being sent to France for surgery because they'd die on the waiting lists if they didn't go. Here in the USA we install brain scanners (lots of them too) where there will be patients and we don't die on waiting lists for anything other than an organ transplant -- and that only because we made it illegal to pay the dead person's estate.
Our real problems are:
Some of these problems are not really solvable. Economics is what it is, people like new technology, and nobody wants to see their little children die. The lawyers have some mighty lobbiests, but a change would at least be theoretically possible. The same goes for the co-pay insurance system, which could be replaced by a sliding scale or percentage system. (example insurance fix: the patient's payment must increase by at least 10 cents for every dollar of the treatment cost up to "$200 for $2000", then by 1 cent per dollar thereafter)
I used to work for a defense contractor on classified networks. When we stood up a new lab, there was a briefing for all employees with access (AKA need to know). They were told that the SA's (I was one) were the first line. In other words, if we said no, the answer was to be interpreted as "no way in hell". My group, however, was in the minority (we said no more often than we said yes). Every request was checked into using the NISPOM. Every software request was extensively checked. Unfortunately, this was the exception rather than the rule. In other areas, the mentality was "that which is not expressly prohibited is allowed", not the DOD/DSS standard of "that which is not allowed is expressly probibited". I spent 3+ years fighting management over this issue, despite the fact that any "unusual" request to DSS/DOD went through the 3 people (myself included) who had the respect and trust of the officials who were required to approve the request. I also quashed (on one occaision 3x) requests that violated the rules. The rules are there. They make sense. They only work when the people on the ground feel they make sense. I left the environment when the stress of meeting the regulations exceeded the stress of fighting with management. YMMV
And ye shall know the truth, and the truth shall make you free.
John 8:32(King James Version)
and to think we've only spent $10 trillion on the "war on poverty" since LBJ. That sure is working out well..
Any fool can criticise, condemn, and complain, and most fools do. - Benjamin Franklin