NSA Wages Cyberwar Against US Armed Forces Teams

Hugh Pickens writes "A team of Army cadets spent four days at West Point last week struggling around the clock to keep a computer network operating while hackers from the National Security Agency tried to infiltrate it with methods that an enemy might use. The NSA made the cadets' task more difficult by planting viruses on some of the equipment, just as real-world hackers have done on millions of computers around the world. The competition was a final exam for computer science and information technology majors, who competed against teams from the Navy, Air Force, Coast Guard and Merchant Marine as well as the Naval Postgraduate Academy and the Air Force Institute of Technology. Ideally, the teams would be allowed to attack other schools' networks while also defending their own but only the NSA, with its arsenal of waivers, loopholes, and special authorizations is allowed to take down a US network. NSA tailored its attacks to be just 'a little too hard for the strongest undergraduate team to deal with, so that we could distinguish the strongest teams from the weaker ones.' The winning West Point team used Linux, instead of relying on proprietary products from big-name companies like Microsoft or Sun Microsystems."

Comments

Linux

[sleekware]

Anyone surprised by the OS choice of the winner? It was going to be either that or BSD.

Re:Linux

[ArcherB]

Great security comes by keeping yourself off the grid of would be attackers. Even the most secure systems can be tapped if somebody wants to bad enough and knows where to find it.

For a Soldier/Marine/Sailor/Airman, the ability to communicate is just as important as the ability to shoot. The greatest marksman in the world is worthless when he is cut off from his unit and surrounded by enemies that are in constant contact with each other.

So to unplug the network cable from these machines kinda makes them worthless.

Re:Linux

[EEDAm]

You were surprised how confident and competent the NSA seems here? Honestly that got me scratching my head hugely. Not because I have some god given insight into the strength of the NSA but simply because this was an *under-grad* evaluation where they pitched the task as slightly too hard for the best under-grad team. Nuff respect to under-grads who study hard, but being an under-grad is just part of the journey and you have so much more you can develop when you finish that phase of your life. You really think it's surprising the NSA (or for that any fact any corporation / organisation / entity) is fairly or in fact let's make that *hugely* more advanced than the undergrads entering it? For every genius entrepreneur who comes out of college with a hot idea, there's a million who are just beginning their development. The world would be f$cked if we stoppped at that point...

Re:Linux

[Daniel Dvorkin]

If the other teams were "forced to run Windows" (which it doesn't say anywhere in the story) then it would have been because of service policy ... in which case hopefully the Army's relatively favorable attitude Linux will get the other services' attention.

Re:Linux

[Software Geek]

The competence of the NSA or the cadets has nothing to do with it. At the moment, the attacker simply has a huge advantage over the defender, no matter who the attacker and defender are. The defender must deploy a host of applications whose primary development goal was time to market, and security is still somewhere near the bottom of the todo list. The defender must rely on the discipline of end users with no interest or understanding of network security. The attacker can download all kinds of prepackaged exploits from the internet. The attacker only needs for a handful of those exploits to succeed. The defender can not afford to lose even once.
Government networks get hacked because they are defending. I would venture to guess that the NSA can hack into Chinese and Russian government networks just as easily as they can hack into ours.

Re:NCCDC

[nametaken]

How bad-ass must one be to withstand concerted hack attempts by the NSA? I'd think that would look really, really impressive on a resume. Especially for someone applying for a .gov job!

Kobayashi Maru?

[HaeMaker]

NSA tailored its attacks to be just 'a little too hard for the strongest undergraduate team to deal with, so that we could distinguish the strongest teams from the weaker ones.'

Nobody wins, but lets see how long you hold out.

Re:Kobayashi Maru?

[Johnny Mnemonic]

Also, note that the NSA isn't saying that they used the full force of their power and creativity. This is probably for several reasons:

-it's not worthwhile to simply crater all of the teams. You want to see who's the best graduates and the most receptive to a couple of years of schooling, even if they need 25 years worth of real world experience to stand up to a real world exercise.

-You don't want to reveal your whole strategy just for a graduation exam.

-Even if you do reveal your whole strategy, you don't want your opposition to know that you did.

I would be tempted to use something pretty rare, and mask the id strings--I would think that it would take so long to understand what OS I was really using to serve, and to research and characterize it's failures, that I would win. Like use BeOS and make it look like OS X as much as possible.

Re:Not as many?

[Burkin]

The programmers that contribute to OS projects are pretty adamant about good code, something Microsoft will learn one day.

And yet in practice this statement doesn't hold up because there is plenty of shit code floating around in open source projects.

Re:NCCDC

[Atlantis-Rising]

The fact that the NSA was willing to participate at all strongly suggests to me that the NSA was just playing games, and was not in fact utilizing anywhere near their full capabilities in this exercise. Which says something pretty impressive about the NSA.

OpenBSD?

[wandazulu]

When it comes to stories like this, or the one about the Dali Lama's computers being compromised, etc., I'm always surprised that no one considers using OpenBSD as their operating system; it's the only one that I know of that is specifically, purposely built, for security. Because it's Unix, it can still run pretty much everything (though you want to use the OpenBSD version because it's been reviewed for security holes, etc.).

Seriously, if I wanted to keep my battle plans, aircraft designs, etc. out of the hands of the "enemy", I'd lock them up in an OpenBSD server, preferably on some less-common architecture like the Alpha, so that anyone trying to hack my system would have an enormously hard time.

Yes I understand this doesn't take into consideration social networking. So I'd take a page from the elevated privilege playbook and say that in my organization, no one trusts the person below him/her so as secrets can never flow downhill. Going back to the operating system, this would presumably be handled by ACLs.

Of course, no system is immune from the booze-n-hookers style of temptation, but that's someone else's job; I'm just here to install and configure software. :)

Re:Not as many?

[Anonymous Coward]

More than do the same with Windows

Re:Not as many?

[socceroos]

You're talking about bad drivers like its the OS's fault.

The trade-offs of having drivers in userspace outweigh the positives.

Re:You're looking at it backwards...

[mikek2]

They weren't testing the operating systems, they were testing the cadets.

Agreed 100%. While supposedly the country's best & brightest, Cadets truly aren't more than horny 21 year-olds (I was a cadet... trust me I know! ;).

Yes, the NSA could've SMASHED them in minutes. But the bigger concept here is to get the cadets to wrap their brains around the idea of a Pearl Harbor on the US' IT infrastructure & how to protect against it.

Assuming this exercise started this year (it didn't... just saying), we'll start to benefit in ~5 yrs, as these horn-dogs assume senior roles.