Slashdot Mirror
NSA Takes On West Point In Security Exercise
Wired is running a story about a recent security exercise in which the NSA attacked networks set up by various US military academies. The Army's network scored the highest, put together using Linux and FreeBSD by cadets at West Point. Quoting:
"Even with a solid network design and passable software choices, there was an element of intuitiveness required to defend against the NSA, especially once it became clear the agency was using minor, and perhaps somewhat obvious, attacks to screen for sneakier, more serious ones. 'One of the challenges was when they see a scan, deciding if this is it, or if it's a cover,' says [instructor Eric] Dean. Spotting 'cover' attacks meant thinking like the NSA -- something Dean says the cadets did quite well. 'I was surprised at their creativity.' Legal limitations were a surprising obstacle to a realistic exercise. Ideally, the teams would be allowed to attack other schools' networks while also defending their own. But only the NSA, with its arsenal of waivers, loopholes, special authorizations (and heaven knows what else) is allowed to take down a U.S. network."
Man, I love reading about stuff like this, but this article has some serious vagueness that really leaves unanswered questions. Perhaps a true security-fluent slashdotter can offer some insight if they are familiar with this particular game:
Why does this require "custom tools" with automatic monitoring? Really, I doubt the students know the details of asymmetric security theory / Ph.D. level mathematics, and were monitoring something like (if I get a port scan from IP x.x.x.x then tell "router guys" to block IP x.x.x.x).
It seems to me that this should be something that essentially should be done automatically, and with a very well-configured system would not cause that much of a problem.
Also, the article was written for somebody who doesn't understand computers to go "whoa." "Kernel-level rootkit"? How the hell did this "unwelcome executable file" get on the box to begin with, and why was it executing in kernelspace? I assume they were required to start with a compromised system, otherwise this is something that major corporations do all day (general traffic monitoring) and is actually kind of not exciting.
I wish that Wired and magazines would write at a technical level and describe accurately what is going on - IMHO more information is always better!
Slashdotter, ID #101. UIDs are in binary, right?
Purchasing Open Source Tools that could automatically thwart these types of attacks is to expensive. They cost at least as much as a toilet seat, and we know from the news, that they have not been purchasing any toilet seats.
Are you implying that previous generations do not have intelligence and creativity? Who do you think is teaching these cadets and running the exercise?
"It takes considerable knowledge just to realize the extent of your own ignorance." - Thomas Sowell
Dumbledore?
Nerd rage is the funniest rage.
No, the NSA IS NOT part of the DOD. DOD is Department of Defense. There are 3 to 4 branches, depending on how you count: Army, Navy(Marines), Air Force. Yes, technically "The Marines" are part of the Navy.
Over-the-top Response Guy! Giving "Over-the-Top Responses" since 1970.
Frankly, I was underwhelmed by the whole story. It was pretty clear the journo doesn't have a clue what was going on. Wired should be able to do better than that.
"I've got more toys than Teruhisa Kitahara."
According to wikipedia, "The National Security Agency/Central Security Service (NSA/CSS) is a cryptologic intelligence agency of the United States government, administered under the U.S. Department of Defense. " and "The Department includes the Army, Navy, Air Force, Marine Corps, as well as non-combat agencies such as the National Security Agency and the Defense Intelligence Agency."
Under Secretary of Defense for Intelligence
* Defense Intelligence Agency
* Defense Security Service
* Counterintelligence Field Activity
* National Geospatial-Intelligence Agency
* National Reconnaissance Office
* National Security Agency
I was actually part of the exercise, and I would agree that the article is very vague. The main purpose of the exercise was to help cadets learn best security practices of building a network. There were required services we had to run, such as exchange, a web server, DNS, active directory, and a jabber messaging server. The rootkit they speak of was on the box because the other part of the exercise was trying to secure untrusted computers. They riddled two Windows VMs and one Linux VM with as much stuff as they could, and the told us to secure them. Naturally we missed some things, which allowed the callback to go out.
As for the 'custom tools', I have no idea what they are talking about. We used native Windows logging and a few open source programs to pull logs to a log server, but that was about it for extra programs. I would agree that the article was written for the non-technical person, but those are the kinda of questions they were asking us when the reporter was here.
Yes, SysInternals was sucked up by the collective...err...Microsoft. From reading the article it is fairly obvious that the only serious security challenge came from a Windows box compromised by a rootkit. It seems the LAMP server they were running (I assume it was LAMP - they mentioned Fedora 8, MySQL and Apache... I assume it also had PHP, Perl and Python) easily handled the SQL injection attacks. I wonder if having a windows box in your network was part of the requirements insisted upon by the NSA when the cadets set up their network? NSA-Key, anyone?
Power does not corrupt - power attracts the corrupt.
Although SIGSAC was involved, this was done for the Information Assurance class that is taught by the CS department there. This was the culminating exercise. The course teaches security practices, and gives cadets a look into why it is important to program securely.
Read up on the "Millenium Challenge '02" war games. :-)
Opposing Force Commander, Gen. Paul van Ripen won.
He was not invited back
Cadets do not learn, they just get to press the "refloat" icon.
http://www.nytimes.com/2008/01/12/washington/12navy.html?ex=1357794000&en=a4dbb42d5ad2a700&ei=5088&partner=rssnyt&emc=rss
"The sheer numbers involved overloaded their ability, both mentally and electronically, to handle the attack,.. "
Domestic spying is now "Benign Information Gathering"
IF Asked AND IF Unclassified, the agency/party MAY provide a copy of the ENDEX.
Contact the Acadamies, NSA, even the Departments of Defense, Army, Air Force, Navy.
ENDEX's have event logs, referee notes, exercise build and teardown plans....
The only thing new in this world is the history that you don't know.[Harry Truman]
When you detect malware installed on your system, wipe and reinstall. Always! There is no "cleaning".
Probably wasn't possible given the parameters of the test, but they tried to clean a rootkit and got the predictable result.
Help stamp out iliturcy.
The tools we used were Nagios for service verification on an external computer (just to make sure we saw what the scorers saw, so we didn't lose points due to their slow network) and one box running Snort through a one way cable. We weren't allowed to let Snort block things, but it let us know who was doing what, allowing us to send up a request to the graders to block the IP. As for checking the untrusted boxes, we were able to run whatever we wanted on them. The root kit that we missed we simply didn't find in the mess of everything else.
My rights don't need management.
Those West Pointers usually make pretty good officers. Or, at least they do after a few SFCs drag the new looie behind the barracks and beat all the West Point hogwash out of them.
];)
Regards;
I invited NSA to run their red team against a classified intelligence network I ran back in the '90s. That's back when nearly every security tool was of your own creation. I was running SunOS 4.1.3, so at least I had a little help from OS security options.
They had to come on-site to break us and they identified only one finding for which we didn't already have fix planned or in work. We considered that a raging success!
The most embarrasing moment was when they broke the System Security Officer's password with an expanded dictionary attack. I got to kid her about that for months! "How's your password today?" "Strong, dammit!"
Invenio via vel creo
So the US government is creating a generation of black hat security experts: pros who define the cutting edge of hostile attacks on infosystems. That's all right and proper as part of the US military, the necessary maintenance of infiltration and coercive force that is required to operate as a last resort of public policy produced under the Constitution, like any military power.
Leaving aside the separate and important issue of Congressional and other oversight to ensure the military crackers operate always under proper law and in the formal national interest, what happens to these people when they leave government service? We'll have created dangerous people whose careers are dedicated to acts that are illegal, and threaten national (and private) security if they are used in attacks outside the proper military context. Sure they're like any other armed soldier, whose many other developed skills are valuable in many contexts not violence. But the fact is that many retired soldiers do find their skills and interests best fit a police or private security career, and even as paramilitary mercenaries - some of which private armies are emerging as serious threats to world stability in its balance of power. Military crackers are different, though: there is little or no role in non-military police, and virtually no legal role in private employ cracking anything.
We are creating an army of high-end crackers who will find themselves leaving the military, and available for hire by the legions of private employers whose use of them to crack systems is mostly illegal, or even acts of war.
We should consider how to track these people and their later activities. Working to secure and to test secure systems with permission of their owners is a valuable asset to keeping us all safe, whether as national service or in private employment. But leaving lots of them floating around loose practically guarantees that at least some of them will find jobs illegally cracking systems without the owners' permission, to do crimes, or perhaps even working for foreign militaries running attacks without coordination with proper US foreign policy, perhaps against our allies, perhaps against us, perhaps even just destabilizing some balance worked out among our enemies.
We are creating many serious potential threats, as part of our programme to reduce and eliminate threats. Part of that programme should be minimizing the increased threat we're creating with them. There's got to be a way to help these people continue their careers with the most freedom, which will overall increase security (and their personal benefit) that doesn't let some few people turn against their training (and likely oaths to "be good").
--
make install -not war
It all came down to the scenario. Built into the game was a notional 'cost' for different network items, making certain items prohibitively expensive. It mainly came down to the semantics of the rules, but the costs were going to be looked at for next year. The overall effect was eliminating the use of some best practices simply because of cost.
Exactly which trainees do you plan on registering, the students or the red team? I think you are missing the overall point of the exercise. There was no offensive side to the students networks, only setting up the services and try to protect them. The red team - those that the NSA already employs - were the only ones attempting to break in. The academies' jobs were to simply keep them out. I can see your point about keeping track of those who have been part of the NSA, but I would be willing to bet that is already taken care of.
- RG>
Hey pal, this isn't a pleasantforest, so don't waste my time with pleasantries!
Let me guess - did an Air Force recruiter tell you that?
"It takes considerable knowledge just to realize the extent of your own ignorance." - Thomas Sowell
The truth of the matter is that the Army generally has the least amount of fuckups when it comes to communications. This is because the Army curriculum is VERY methodical and almost reads like a checklist (in fact, we often use checklists and cut-sheets).
I'm not saying the Army is any more intelligent than any other branch. We have some really dumb people. The Army trains so that the dumbest kid on the block can do the job perfectly, every time.
...the right of the people to keep and bear arms, shall not be infringed.