Slashdot Mirror
NSA Wages Cyberwar Against US Armed Forces Teams
Hugh Pickens writes "A team of Army cadets spent four days at West Point last week struggling around the clock to keep a computer network operating while hackers from the National Security Agency tried to infiltrate it with methods that an enemy might use. The NSA made the cadets' task more difficult by planting viruses on some of the equipment, just as real-world hackers have done on millions of computers around the world. The competition was a final exam for computer science and information technology majors, who competed against teams from the Navy, Air Force, Coast Guard and Merchant Marine as well as the Naval Postgraduate Academy and the Air Force Institute of Technology. Ideally, the teams would be allowed to attack other schools' networks while also defending their own but only the NSA, with its arsenal of waivers, loopholes, and special authorizations is allowed to take down a US network. NSA tailored its attacks to be just 'a little too hard for the strongest undergraduate team to deal with, so that we could distinguish the strongest teams from the weaker ones.' The winning West Point team used Linux, instead of relying on proprietary products from big-name companies like Microsoft or Sun Microsystems."
Anyone surprised by the OS choice of the winner? It was going to be either that or BSD.
How bad-ass must one be to withstand concerted hack attempts by the NSA? I'd think that would look really, really impressive on a resume. Especially for someone applying for a .gov job!
NSA tailored its attacks to be just 'a little too hard for the strongest undergraduate team to deal with, so that we could distinguish the strongest teams from the weaker ones.'
Nobody wins, but lets see how long you hold out.
The programmers that contribute to OS projects are pretty adamant about good code, something Microsoft will learn one day.
And yet in practice this statement doesn't hold up because there is plenty of shit code floating around in open source projects.
The fact that the NSA was willing to participate at all strongly suggests to me that the NSA was just playing games, and was not in fact utilizing anywhere near their full capabilities in this exercise. Which says something pretty impressive about the NSA.
"It is possible to commit no errors and still lose. That is not a weakness. That is life." -Peak Performance
When it comes to stories like this, or the one about the Dali Lama's computers being compromised, etc., I'm always surprised that no one considers using OpenBSD as their operating system; it's the only one that I know of that is specifically, purposely built, for security. Because it's Unix, it can still run pretty much everything (though you want to use the OpenBSD version because it's been reviewed for security holes, etc.).
Seriously, if I wanted to keep my battle plans, aircraft designs, etc. out of the hands of the "enemy", I'd lock them up in an OpenBSD server, preferably on some less-common architecture like the Alpha, so that anyone trying to hack my system would have an enormously hard time.
Yes I understand this doesn't take into consideration social networking. So I'd take a page from the elevated privilege playbook and say that in my organization, no one trusts the person below him/her so as secrets can never flow downhill. Going back to the operating system, this would presumably be handled by ACLs.
Of course, no system is immune from the booze-n-hookers style of temptation, but that's someone else's job; I'm just here to install and configure software. :)
More than do the same with Windows
That said, the assumption that the NSA are up to the off-the-reservation methods that true Black Hats would use may not be a correct assumption.
What we anticipate and plan for frequently is not what is used against us by someone who truly is our enemy.
-- Tigger warning: This post may contain tiggers! --
They weren't testing the operating systems, they were testing the cadets. A linux system is a sieve for the NSA-- I think this simply demonstrates that the team using the Linux boxes knew their system better than the teams on Windows or Solaris respectively. It's clear that a group of passionate linux admins can maintain an acceptably secure system at this level of expertise.
However, actually infiltrating the systems would have proven nothing. I guarantee the *level of difficulty* the NSA used in order to properly test the undergrads is beneath what the Chinese government would use if trying to infiltrate a U.S. site.
The reality is that none of these three systems are acceptably secure for government networks one their... if you're relying on just the Unix security model or Windows security model, you're basically wide opened to a dedicated and well-funded attack. It's situations like these where you need to keep your systems well behind a decent level of virtualization like secure separation kernels with more than competent internal security policies. The operating system like Windows, Linux, or Solaris, is really just the "interface" to the system for the users, so to speak.
You're talking about bad drivers like its the OS's fault.
The trade-offs of having drivers in userspace outweigh the positives.
Did you forget "KEY" "NSAKEY" found when someone let windows slip with debug symbols and variable names on? This is the reason you don't trust black boxes known as proprietary software.
Artix
Your Linux, your init.
I don't think fault is relevant. The consequence of bad code in drivers that can trash the kernel is that the OS, which is all but useless without drivers, has bad code actively executing in kernel space on some deployed systems.
Obviously, a choice had to be made about how to provide drivers. I personally have no problem with the one that was made, and I suspect many security-conscious linux users would rather not accept the efficiency trade-offs for user-space drivers. The current situation does mean, though, that if you want to analyze or talk about the security of Linux you can't just dismiss drivers as "not part of the OS" - at least not the ones you're running on any systems you care about.
Additive identity, multiplicative cancellation, distributive multiplication over addition: pick any two (unless 1 = 0)