Slashdot Mirror
NSA Wages Cyberwar Against US Armed Forces Teams
Hugh Pickens writes "A team of Army cadets spent four days at West Point last week struggling around the clock to keep a computer network operating while hackers from the National Security Agency tried to infiltrate it with methods that an enemy might use. The NSA made the cadets' task more difficult by planting viruses on some of the equipment, just as real-world hackers have done on millions of computers around the world. The competition was a final exam for computer science and information technology majors, who competed against teams from the Navy, Air Force, Coast Guard and Merchant Marine as well as the Naval Postgraduate Academy and the Air Force Institute of Technology. Ideally, the teams would be allowed to attack other schools' networks while also defending their own but only the NSA, with its arsenal of waivers, loopholes, and special authorizations is allowed to take down a US network. NSA tailored its attacks to be just 'a little too hard for the strongest undergraduate team to deal with, so that we could distinguish the strongest teams from the weaker ones.' The winning West Point team used Linux, instead of relying on proprietary products from big-name companies like Microsoft or Sun Microsystems."
Anyone surprised by the OS choice of the winner? It was going to be either that or BSD.
Looks a lot like the National Collegiate Cyber Defense Competition. Any college student team can participate in that one, however, and the NSA or Secret Service have participated in past events iirc.
The competition is a lot of fun, 64 teams last year.
I'd feel a lot more positive about the NSA's capabilities, if they didn't have a track record of illegal wiretaps.
"It is also much easier to secure because "you can tweak it for everything you need" and there are not as many known ways to attack it, he said."
I'm not sure I agree with this. There are plenty of ways to hack all OSs. Maybe a generic underhardened Windows install has more know ways...but how would one even quantify what is know and not know. Public is one thing, but given that Linux is open source and even compiled code can be broken down there is likely many known ways to hack products that are not public yet.
I'd be more interested in the permiter defenses they used. Like what kind of IDS/IPS did they use? Where they using email firewalls to prevent floods of emails or just blocking. I think you also have to harden your servers, but I'd rather have something protecting my email server and have more layers to dig thru..and to alert you.
NSA tailored its attacks to be just 'a little too hard for the strongest undergraduate team to deal with, so that we could distinguish the strongest teams from the weaker ones.'
Nobody wins, but lets see how long you hold out.
This appears like a modern day Kobayashi Maru exercise. And instead of it being designed and executed by a single Vulcan whom we all know, it was done by the best and brightest of our 'No Such Agency'. I say congratulations to both parties, the NSA and the winning West Point Team.
The year of the Linux... undergraduate military PC?
As soon as i read "[..] used an SQL Injection to [..]" in TFA, I stopped and realized they already failed. How amazing? The NSA calls SQL injection sophisticated? I can't wait to tell what would happen if someone took down a few root backbones.
When it comes to stories like this, or the one about the Dali Lama's computers being compromised, etc., I'm always surprised that no one considers using OpenBSD as their operating system; it's the only one that I know of that is specifically, purposely built, for security. Because it's Unix, it can still run pretty much everything (though you want to use the OpenBSD version because it's been reviewed for security holes, etc.).
Seriously, if I wanted to keep my battle plans, aircraft designs, etc. out of the hands of the "enemy", I'd lock them up in an OpenBSD server, preferably on some less-common architecture like the Alpha, so that anyone trying to hack my system would have an enormously hard time.
Yes I understand this doesn't take into consideration social networking. So I'd take a page from the elevated privilege playbook and say that in my organization, no one trusts the person below him/her so as secrets can never flow downhill. Going back to the operating system, this would presumably be handled by ACLs.
Of course, no system is immune from the booze-n-hookers style of temptation, but that's someone else's job; I'm just here to install and configure software. :)
So either Linux is more secure than other operating systems or Linux users are smarter than other computer users.
This is good practice for those NSA hacker teams who will be executing the upcoming "cyber-warfare" false flags against various US targets in the coming year. This will be blamed on China/N.Korea/Iran/"Axis-of-Evil"member.
Where's the site that sells tickets?
I never went to summer camp, help me live my childhood dreams!
I'm in my early thirties and am therefore becoming ineligible for some branches of the military, but I know I still have a coupe of years left to think about joining the army. It'd be interesting to hear from people with any experience doing tech work (especially security or software engineering) in the Army.
Cadets trade trenches for firewalls
http://news.cnet.com/2100-7350_3-6249633.html
(if you don't have nor want a subscription to the NYT....)
This part probably is getting lots of attention here in /.:
Cadet Brian McCord, part of the team that installed the operating system, said he was chosen because his senior project was deeply reliant on Linux. The West Point team used this open-source operating system, freely available on the Internet, instead of relying on proprietary products from big-name companies like Microsoft or Sun Microsystems.
But this part probably says it all:
""It seems weird for the Army with its large contracts to be using Linux, but it's very cheap and very customizable," McCord said. It is also much easier to secure because "you can tweak it for everything you need" and there are not as many known ways to attack it, he said."
Previously: "Linux... Toward the Sunrise..." Now: "Linux... Toward the-- No, now, part of Every Sunrise"
There is no "Naval Postgraduate Academy," it's the "Naval Postgraduate School". If the authors of the article couldn't be bothered to take 15 seconds to confirm that with Google, it makes me wonder what else is incorrect in their writeup.
That said, the assumption that the NSA are up to the off-the-reservation methods that true Black Hats would use may not be a correct assumption.
What we anticipate and plan for frequently is not what is used against us by someone who truly is our enemy.
-- Tigger warning: This post may contain tiggers! --
They weren't testing the operating systems, they were testing the cadets. A linux system is a sieve for the NSA-- I think this simply demonstrates that the team using the Linux boxes knew their system better than the teams on Windows or Solaris respectively. It's clear that a group of passionate linux admins can maintain an acceptably secure system at this level of expertise.
However, actually infiltrating the systems would have proven nothing. I guarantee the *level of difficulty* the NSA used in order to properly test the undergrads is beneath what the Chinese government would use if trying to infiltrate a U.S. site.
The reality is that none of these three systems are acceptably secure for government networks one their... if you're relying on just the Unix security model or Windows security model, you're basically wide opened to a dedicated and well-funded attack. It's situations like these where you need to keep your systems well behind a decent level of virtualization like secure separation kernels with more than competent internal security policies. The operating system like Windows, Linux, or Solaris, is really just the "interface" to the system for the users, so to speak.
...that in about one week's time there will be a report in the mainstream media about how multiple US Armed Forces' networks underwent a thorough attack by unknown sources that were probably of Russian or Chinese origin, not realizing that it was this training exercise?
Motorcycles, Robots, Space Gossip and More!
Totally off-topic but it's good to see the number of comments back on the front page summary
Is that if your system is attached to a publicly-available network, you cannot be curtain of a secure system. Don't even try to tell me you can secure your network against all network-based attacks, current and future.
All you can do is raise the bar sufficiently to deter and defeat the lam0rs, and be able to focus your attention on detection, remediation, and retribution - if that's your style.
Having been rooted a few times, I would have loved to slip a little Ex-Lax into their Dew, but my boss said leave them alone. Just as well, they always come back for revenge. Our government may think differently.
But if it's hooked up to the Internet, count on it being compromised. Encrypt your data separately. Make backups and disaster recovery plans. Pray for this to happen on an otherwise quiet weekend, not the day before the quarterlies go out. And have an alternative. Anything is better than nothing.
In case you're wondering, I am a fatalist when it comes to network security. I see little hope.
deleting the extra space after periods so i can stay relevant, yeah.
In other words, grasshopper, nice work -- but the NSA is capable of much craftier network take-downs.
Thank you Mario! But our princess is in another castle!
There is no -1 Disagree mod. Slashdot.org/faq defines mod options. USE IT.
2009 will be the Year of the Linux MBT!
Ezekiel 23:20
I was in the AF from 1977-1981 and worked directly for the NSA when they still had some scruples. In fact, my last posting was at Fort Meade after several years in the far east.
As a '202xxA'(Radio Communications Analyst), that focused on foreign military communications, I could have been reassigned at any time as a 202xxB (Radio Communications Security Specialist) with no retraining. The B job just meant we were testing our own weaknesses instead of exploiting those of our opponents. It is important to look inward, find your flaws, and fix them. Kind of like debugging open source code, huh?
That's what they were doing. Good job.
Why would talented hackers want to expose themselves like this to NSA? That's what I don't get. It's like submitting freaking fingerprints to the police before you rob a store.
What did the losing teams use? If they all used Linux then the fact that the winning team did so is uninteresting. I assume that the teams were required to provide some set of services as well otherwise a winning strategy would be to simply pull the network connections.
Squirrel!
When will I be able to watch an event as this live somewhere with play-by-play?
Well, #1: They want their degree.
#2: They already work for the government, since these are service academies
#3: Working for the NSA pays nicely, and you don't have to worry about jail cells or bullets in the head.
Very interesting! It's good to see a completely positive story about DoD activities.
Ideally, the teams would be allowed to attack other schools' networks while also defending their own but only the NSA, with its arsenal of waivers, loopholes, special authorizations is allowed to take down a US network.
How about inverting the competition? Presumably this "arsenal of waivers" could be used as a letter of marque to protect the various academy teams when attacking an NSA prepared target. It could be even more revealing to see "No Such Agency" playing defense.
A lot of malware assumes that if it can get on the system, even if it's just a stub program, it can then open a connection and download the rest of it. Since most malware assumes an x86 architecture, the program is downloaded already compiled for said architecture.
By introducing a less-common processor, first, any pre-compiled code simply won't work. Plus you'd have to now figure out what type of processor your target is using, which is not necessarily easy (if I was maintaining such a machine, I'd make sure no program, like Apache, identified the architecture by stripping out any mention of it on the 404 pages, etc.).
Even assuming you figure out the architecture, the machine would never ever ever have any kind of compiler on it so even if you got into it, you wouldn't be able to build anything, you'd have to get ahold of another machine of a similar chipset and build it separately.
All of this can be done, and sure, you could pick up an Alpha if you want from ebay, but for 99.99% of attacks, no one wants to. If you are a foreign government trying to get at my aircraft blueprints, it might be worth it to try, though I'd argue the booze-n-hookers approach would be easier.
Up until 9/11, the nation's top computer security ppl were NSA. They had responsibility for it, which is why they created and pushed SEL. In addion, they insisted on running SECURED *NIX on all of their important systems. But then W and his staff created DHS and put them in charge of computer security. So far, that group has been a total set of f-ups. I used to work with several of those guys, and they were worthless back in 2000. Absolutely little to no real knowledge.
It is time to put the NSA back in charge of this.
I prefer the "u" in honour as it seems to be missing these days.
If you wanted a Linux computer, you should have bought one. You're not going to ever get what you want if you keep encouraging them to use the crap chips and subsystems with secret interfaces.
If you want a Linux laptop, buy a freaking Linux laptop. It's not like they're not all over the place. Here, for example.
If you quit paying them to jerk you around, they'll quit doing it. Capiche?
Help stamp out iliturcy.
Maybe it is good for interests of the democracy worldwide in perspective, but it surely makes forums uninterstiong and suffocates a free discussion. When State Department announced couple of years back a creation of the Information Special Forces I could not imagine that it will be so massive and omnipresent.
I mean will not Internet die if rich political entities flood it with the political spam? And now this - attacks are being polished again by political forces. Will it grow the same ugly way as the Information Special Forces?
... SELinux simply gets Linux to the point that it's technically as secure as Windows ... Microsoft has enough control over Windows to theoretically improve on this, but I don't believe it's possible for Linux to exceed the security level it's at without scrapping the kernel ...
You've just brought up an interesting discussion:
Can a poorly-funded open source software become as secure as a well-funded proprietary software?
Woah! I've just became flamebait! Goodbye, mod points, I'll miss you.
...were running a ZX80. The NSA didn't expect THAT now did they?
NSA Agent: "How can we possibly run a virus in 1k of RAM?"
The MoD use it and demand it. Your DoD purchase it for their warships as do we.
If using windows is such a handicap to security, why are they being used?
As such it is a valid inclusion in the test.
If Windows with all the propriatory security software in the world to choose from cannot hold its own, it shouldn't have been used anywhere in the DoD.
Leaving it out of the test would have unfairly crippled the test since MS and vendors would have been able to say "Well, we are more secure than any of them, if used correctly".
Now they can't.
But the way the cadets designed their network was a big factor in their victory, too. The NSA dictated some terms: All networks had to be capable of e-mail, chat and other services and had to be up and running at all times despite any attacks or defensive measures. Beyond that, the teams were free to come up with their own designs.
West Point's took three weeks to build. The cadets settled on a fairly standard Linux and FreeBSD-based network with advanced routing techniques for steering incoming traffic in directions of the IT team's choosing.
Does OpenBSD have any of the SELinux type security features?
systrace is a different kind of tool. It does allow you to set access policies, but for the system calls. Also, SE Linux is an add-on for the Linux kernels only. Systrace is available for Linux and the BSDs, which would include systrace for OpenBSD, You'll have to check if OS X is still covered.
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
Richard Bejtlich from the TaoSecurity Blog was invited by NSA's Tony Sager to visit the CDX in person:
http://taosecurity.blogspot.com/2009/05/thoughts-on-2009-cdx.html
Bejtlich mentions that CDX participants were given a budget for the exercise. This means it cost them "marks" (in exercise language) to replace the Windows images NSA provided with alternative systems like FreeBSD or Linux. That decision caused the team to have less resources for other tasks.
The Army didn't win just because they used Linux. Bejtlich posts reasons why they won here:
http://taosecurity.blogspot.com/2009/05/lessons-from-cdx.html
Are there any remote exploits for classic OS? I am not aware of any if file sharing is turned off. That might have been an interesting wildcard to throw at NSA as a defense.
I thought that is how they got around "domestic spying" alleged illegalities. They have a gentleman's spook agreement to share info. Their spooks spy on your citizens and vice versa, circumventing the rules while not actually breaking them. They then share intel gathered.
goddamn link that leads to a login page instead of the described articles.
I've said it before, I'll say it again - if you cant find a link to a news story that goes directly to the story instead of a login page, DON'T FUCKING POST IT!
editors: It would be nice, if when you get links like these, you could take ten seconds once to use google to find the same story hosted by a site thats not run by ASSHOLES, and potentially save thousands of people from having to waste ten seconds each (thus resulting in tens of thousands of wasted seconds)
The article only mentions "flooding an email server" and "installing viruses." This couldn't have been just a glorified DoS from the NSA, could it?
"Upon attaching the waterblock to my penis, I began to notice that I know nothing about computers." -- JRockway