Slashdot Mirror
Obama Helicopter Security Breached By File Sharing
Hugh Pickens writes "A company that monitors peer-to-peer file-sharing networks has discovered a potentially serious security breach involving President Barack Obama's helicopter. 'We found a file containing entire blueprints and avionics package for Marine One, which is the president's helicopter,' says Bob Boback, CEO of Tiversa, a security company that specializes in peer-to-peer technology. Tiversa was able to track the file, discovered at an IP address in Tehran, Iran, back to its original source. 'What appears to be a defense contractor in Bethesda, Md., had a file-sharing program on one of their systems that also contained highly sensitive blueprints for Marine One,' says Boback, adding that someone from the company most likely downloaded a file-sharing program, typically used to exchange music, without realizing the potential problems. 'I'm sure that person is embarrassed and may even lose their job, but we know where it came from and we know where it went.' Iran is not the only country that appears to be accessing this type of information through file-sharing programs. 'We've noticed it out of Pakistan, Yemen, Qatar and China. They are actively searching for information that is disclosed in this fashion because it is a great source of intelligence.'"
So where's the torrent?
Tiversa was able to track the file, discovered at an IP address in Tehran, Iran, back to its original source.
.
.
'We've noticed it out of Pakistan, Yemen, Qatar and China. They are actively searching for information that is disclosed in this fashion because it is a great source of intelligence.'
If you use p2p file sharing software to steal music and TV shows - terrorists win.
Mit der Dummheit kämpfen Götter selbst vergebens
Torrent link, please?
Res publica non dominetur
I'm pretty sure that stupid/careless employees can leak sensitive information through P2P on any OS. I'm not aware that any of the OSX/nix installs search any less widely for shared folders than the Windows versions.
Stupidity is definitely OS-independent.
A lot of these P2P apps share your entire home or your entire computer by default when you first install them, it's up to you to go in and shut that stuff off, or at least define a specific folder to share from rather than the default.
Tagging this with "windows" isn't fair - it can affect any other system equally, this isn't a software problem, it's a user or developer issue. For example, I've worked on numerous macs with Limewire installed on them that are sharing all the user's music automatically by default.
I work for the Department of Redundancy Department.
Nope. Everyone is assuming this is a torrent because it is the most popular form of file sharing. Many of the old school peer to peer file sharing apps *by default* shared your documents folder. You could turn it off, but most people don't.
Many confidential files have been leaked this way. http://www.eweek.com/c/a/Security/Citigroup-Customer-Data-Leaked-on-LimeWire/
There used to even be guides to tell you what were common digital camera prefixes so you could do a search for CIM*.jpg or DSC*.jpg and browse people's private folders.
If you were a company or nation involved in espionage, getting on a p2p network and searching for files with obvious names would be a good place to start.
http://bizsecurity.about.com/b/2008/07/08/limewire-and-working-at-home.htm
It isn't just limewire of course, that's just the first one I could remember from years ago. There's also eMule and many others.
In addition to firing the person responsible, the entire IT staff should be reviewed if not fired. My guess though is that this is some ceo who specifically told IT that he was exempt from the security rules. C*Os are the biggest security risk because they tell people that the security rules don't apply to them. Remember that cdw? commercial about the boss who infects an entire office because he let's his kid use the company network?
Should be *banned* for security areas. If you need 'outside' for a valid reason you provide a dedicated machine for that purpose.
Its pretty simple. That company should be fired, not just the fool that caused the leak.
And i don't care what OS it runs, anything less then the above is plain reckless.
---- Booth was a patriot ----
None of these ideas are foolproof, someone dumb enough would eventually screw up anyway. But that is not the point, the point is that there are simple engineering steps that can be taken to reduce the amount of inadvertantly shared data.
Football Odds
... and this is why you have draconian policies in many companies about installing ANY unapproved software. I've seen people complain about "just let me do my job" and install anything they want, but the fact of the matter is that it only takes one dumb-ass like this to wreak major havoc.
Sometimes it's best to just let stupid people be stupid.
Uh, data like this shouldn't even be on a computer with a physical link to the internet at all. Classified data should stay on classified networks. Period.
I know a guy at a defense contractor. They isolate their networks containing classified data. If they need to remove a file from the room they reimage a desktop with a known safe image, copy the file onto that PC from a CD burned from a classified PC. They then scrub the files with software that does stuff like wipe unallocated space, check for word versions, PDF comments, etc. Then that desktop is used to burn a new CD with just the intended files. Then they securely wipe the desktop. That one CD that was created in this fashion is then allowed to leave the room. Note that this is the gist of how it works - some details may be less than accurate (obviously I'm not privy to the exact procedures, but this is the general level of rigor involved).
Even if somebody installed Kazaa or its like on one of the computers in that room it wouldn't be able to leak data - there are no network connections that are attached to the internet. If somebody needs to check email or browse the web they leave the room (carrying nothing with them) and go to another desk in a regular office area, which has a fairly secure network but something more akin to what you'd find in any decently secured corporate network. Of course, installing kazaa in the first place would be difficult since you're not supposed to carry anything into or out of the classified areas - I don't know if they get searched at the door but you would certainly be fired and potentially prosecuted if you were caught doing it intentionally.
Important datacenters like those found in stock exchanges / etc are similar. The datacenter is secured, network access is very carefully controlled, and to do anything important you need to have physical access to a room with cameras pointed everywhere and every task involves two people at the keyboard at all times.
There is no excuse for these kinds of breaches. Strong security isn't actually hard. It is certainly expensive, and it is certainly inconvenient. However, it really isn't hard - you just need to be methodical.
I don't think there's anything unfair about the summary. P2P applications are a security risk, and I know I don't allow my users to install them on their work computers.
Let me put it this way: Any time you're setting a computer up to be a server on the Internet, it's always a security risk. There are risks associated with bugs and things like that, but also (and perhaps more importantly) there are risks associated with misconfiguration. This is very relevant for P2P applications, which might come configured by default to share files that you don't want to share.
So yes, if people with high security clearances are installing Kazaa on their work computers and sharing out all their documents, then "OMG file sharers are breaching national security!"
Funny how this should happen so recently after Obama and McCain publically agreed that the plan to replace the aging Marine One fleet should be cancelled...
http://www.nytimes.com/2009/02/24/us/politics/24chopper.html
That's not even the real issue. They should be asking what a contractor is doing putting classified information on his "walking around" laptop. When I was in military intelligence, we had machines with classified information, but they were either dedicated hardened devices (for in the field) or they were fairly standard windows machines kept inside some sort of secure perimeter. The P2P aspect of this is really irrelevant, other than it gives both the "dastardly towelheads of Eastasia*" and the DoD an easy way to spot the information in the wild. This contractor likely already broke the rules enough to lose his job by having the files there in the first place.
* we've always been at war with Eastasia, right?
If a job's not worth doing, it's not worth doing right.
There's even more profit in REPLACING the now 'breached' current presidential helicopter fleet over these blueprints.
Don't even think that this has primary IT implications.
This is more about giving the polititians cover to continue the cost overruns.
Marine One Upgrade Plan Stirs Debate
A helicopter (one) that costs as much as (one) Boeing 747!
Wow...
God: When you do things right, people won't be sure you've done anything at all.
You know, I'm usually one to go with Hanlon's Razor (never attribute to malice what can adequately be explained by stupidity), but with the VH-71 Marine One replacement program getting the stinkeye for it's ridiculous cost overruns, for once the conspiracy thing has me suspicious. It's likely the plans being on P2P part is entirely coincidence, and the publicity of the incident is the conspiracy, but I can see it happening. The question now is, which Marine One plans are they? Are they the plans for the helicopters currently in service, and the conspiracy is trying to save the VH-71 program, or were they the VH-71 plans and the conspiracy is trying to kill the VH-71 program?
Really though, it's probably just unrelated coincidence. Most things like this are completely unplanned. Conspiracies require competence, and you just don't find that in government much.
If a job's not worth doing, it's not worth doing right.
.. but most importantly:
1. the idiots that believed the story. :rolleyes:
They should be asking what a contractor is doing putting classified information on his "walking around" laptop.
From the article:
"Clark told WPXI that he doesn't know how sensitive this information is, but he said other military information has been found on the Internet in the past and should be monitored more closely."
Nothing in the article said the information was classified, so it looks to me like it's kind of a "mountain out of a molehill" kind of thing - there's plenty of information about military hardware out there that looks scary to someone that doesn't know anything about the subject matter, but is strategically/tactically useless just the same. Similar information regarding the VC-25 fleet has been out there for some time, and I don't trust a reporter or employee of a peer-to-peer company to be able to evaluate whether something contains full documentation of "entire blueprints and avionics package for Marine One".
I worked for several years for a Navy contractor in their submarine combat systems department. Anything, *anything* that was classified was A.) kept in an area with physical access controls (often including unfriendly guys with guns), B.) if available electronically, was on a separate network physically inaccessible from outside that controlled area, and C.) if anything had to go outside that controlled area (software updates for the boats, for instance), there was a two-man protocol to be followed, with one of our guys and one of the Navy guys in custody 24x7 of whatever media had classified data on it. Even assuming the article is correct and there was truly useful information made available, the problem isn't that file-sharing is bad, or that Windows is insecure - the problem is that both the contractor and the agency they serve had lapses in their security protocol that would let such information anywhere near a non-secured network, and the appropriate security audits weren't taking place.
Please stand clear of the doors, por favor mantenganse alejado de las puertas
What sort of security depends on the secrecy of a helicopter's blueprints? Honestly.
Higher Logics: where programming meets science.
To use the claasic "car analogy" it's like driving around in a smashed-up pinto versus a brand-new Volvo. If you're worried about surviving an accident the choice of vehicles is obvious.
And people still die in Volvos. Yes, it may be harder to do so, but the uberidiot will always find a way.
The poster implied that that using something other than Windows would have been better. I posit that this particular user would have screwed the pooch no matter what OS they were on. This was not a built-in vulnerability of Windows (of which there are many). This was a built-in vulnerability of being an idiot user.
Hell....lose his/her job?
If they're lucky that will be all they lose. When you're doing DoD work for the Feds....you sign some pretty heavy forms about your responsibilities and the ramifications if you break them....accident or not.
If this asshole did this with what I would have to guess was secure information....putting these plans on a non-secure computer, that alone can get you some heavy legal problems, and possibly jail time.
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
Who Cares ????...... i don't...
If the Rebels have obtained a complete technical readout of this helicopter it is possible, however unlikely, that they might find a weakness, and exploit it.
Does the helicopter have a long trench leading up to a ventilation shaft?
Almost 200 comments, and not a single ROFLcopter...
You guys are slipping...
The difference between spam and poop is that you don't have to dig through septic tanks looking for real food. -- Me
It's a custom helicopter (just like air force 1 is a custom plane). You could for example get some sort of unique radar response from the plane, telling you the location of the helicopter, or worse, giving you something to program a sidewinder with.
Same goes for air force 1. If you had the specs of it's fof tranceiver you could wait until it's crossing the atlantic, then launch a rocket towards it which they have no chance to evade.
Basically it would reduce the problem of killing the president of the USA from successfully attacking a wide range of security forces, just to make sure you cover all angles, to the problem of making 1 tiny pinpoint strike. With the blueprints or a location indicator you'd could execute a pinpoint strike that would take involve almost no risk for the perpetrators and would sure as hell kill the prsident.
Except that Windows has such a cult following that it's likely the authorities will turn a blind eye to the incident. Take the case where Windows somehow got onto base computers in Afghanistan [usnews.com] and were subsequently owned by malware letting still more outsiders into the network. No one's been prosecuted publicly despite there certainly being a paper trail leading to the culprits.
You apparently have no clue how DOD classified networks work such as SIPRnet or JWICs. Anything classified has no connection to the unclassified internet. The SIPRnet and JWICS system passes though a KG-175, which in turns encrypts the traffic, to go though the normal network. If for example a windows SIPRnet, or JWICs system gets comprised with spyware. The only one who could touch these systems is people on the SIPRnet or JWICS. Just because the machine is comprised doesn't make the computer decide to send unencrypted data or open holes in the network, since any traffic leaving the network has to go though the KG-175. Now if some idiot user decides to connect a classified system to network, that's a much bigger issue that they call data spillage.
Any computer not classified is essentially on the NIPRnet (or unclassified network) for example, but the only data that is allowed on it is up to sensitive information such as SSNs, random forms, and TPS reports. Even flight schedules are not supposed to be NIPRnet.