Slashdot Mirror
NSA Wages Cyberwar Against US Armed Forces Teams
Hugh Pickens writes "A team of Army cadets spent four days at West Point last week struggling around the clock to keep a computer network operating while hackers from the National Security Agency tried to infiltrate it with methods that an enemy might use. The NSA made the cadets' task more difficult by planting viruses on some of the equipment, just as real-world hackers have done on millions of computers around the world. The competition was a final exam for computer science and information technology majors, who competed against teams from the Navy, Air Force, Coast Guard and Merchant Marine as well as the Naval Postgraduate Academy and the Air Force Institute of Technology. Ideally, the teams would be allowed to attack other schools' networks while also defending their own but only the NSA, with its arsenal of waivers, loopholes, and special authorizations is allowed to take down a US network. NSA tailored its attacks to be just 'a little too hard for the strongest undergraduate team to deal with, so that we could distinguish the strongest teams from the weaker ones.' The winning West Point team used Linux, instead of relying on proprietary products from big-name companies like Microsoft or Sun Microsystems."
Anyone surprised by the OS choice of the winner? It was going to be either that or BSD.
Looks a lot like the National Collegiate Cyber Defense Competition. Any college student team can participate in that one, however, and the NSA or Secret Service have participated in past events iirc.
The competition is a lot of fun, 64 teams last year.
"It is also much easier to secure because "you can tweak it for everything you need" and there are not as many known ways to attack it, he said."
I'm not sure I agree with this. There are plenty of ways to hack all OSs. Maybe a generic underhardened Windows install has more know ways...but how would one even quantify what is know and not know. Public is one thing, but given that Linux is open source and even compiled code can be broken down there is likely many known ways to hack products that are not public yet.
I'd be more interested in the permiter defenses they used. Like what kind of IDS/IPS did they use? Where they using email firewalls to prevent floods of emails or just blocking. I think you also have to harden your servers, but I'd rather have something protecting my email server and have more layers to dig thru..and to alert you.
NSA tailored its attacks to be just 'a little too hard for the strongest undergraduate team to deal with, so that we could distinguish the strongest teams from the weaker ones.'
Nobody wins, but lets see how long you hold out.
The year of the Linux... undergraduate military PC?
When it comes to stories like this, or the one about the Dali Lama's computers being compromised, etc., I'm always surprised that no one considers using OpenBSD as their operating system; it's the only one that I know of that is specifically, purposely built, for security. Because it's Unix, it can still run pretty much everything (though you want to use the OpenBSD version because it's been reviewed for security holes, etc.).
Seriously, if I wanted to keep my battle plans, aircraft designs, etc. out of the hands of the "enemy", I'd lock them up in an OpenBSD server, preferably on some less-common architecture like the Alpha, so that anyone trying to hack my system would have an enormously hard time.
Yes I understand this doesn't take into consideration social networking. So I'd take a page from the elevated privilege playbook and say that in my organization, no one trusts the person below him/her so as secrets can never flow downhill. Going back to the operating system, this would presumably be handled by ACLs.
Of course, no system is immune from the booze-n-hookers style of temptation, but that's someone else's job; I'm just here to install and configure software. :)
This appears like a modern day Kobayashi Maru exercise. And instead of it being designed and executed by a single Vulcan whom we all know, it was done by the best and brightest of our 'No Such Agency'. I say congratulations to both parties, the NSA and the winning West Point Team.
Man, do I ever long for the good old days of the Victorian era Kobayashi Maru.
Cadets trade trenches for firewalls
http://news.cnet.com/2100-7350_3-6249633.html
(if you don't have nor want a subscription to the NYT....)
This part probably is getting lots of attention here in /.:
Cadet Brian McCord, part of the team that installed the operating system, said he was chosen because his senior project was deeply reliant on Linux. The West Point team used this open-source operating system, freely available on the Internet, instead of relying on proprietary products from big-name companies like Microsoft or Sun Microsystems.
But this part probably says it all:
""It seems weird for the Army with its large contracts to be using Linux, but it's very cheap and very customizable," McCord said. It is also much easier to secure because "you can tweak it for everything you need" and there are not as many known ways to attack it, he said."
Previously: "Linux... Toward the Sunrise..." Now: "Linux... Toward the-- No, now, part of Every Sunrise"
That said, the assumption that the NSA are up to the off-the-reservation methods that true Black Hats would use may not be a correct assumption.
What we anticipate and plan for frequently is not what is used against us by someone who truly is our enemy.
-- Tigger warning: This post may contain tiggers! --
They weren't testing the operating systems, they were testing the cadets. A linux system is a sieve for the NSA-- I think this simply demonstrates that the team using the Linux boxes knew their system better than the teams on Windows or Solaris respectively. It's clear that a group of passionate linux admins can maintain an acceptably secure system at this level of expertise.
However, actually infiltrating the systems would have proven nothing. I guarantee the *level of difficulty* the NSA used in order to properly test the undergrads is beneath what the Chinese government would use if trying to infiltrate a U.S. site.
The reality is that none of these three systems are acceptably secure for government networks one their... if you're relying on just the Unix security model or Windows security model, you're basically wide opened to a dedicated and well-funded attack. It's situations like these where you need to keep your systems well behind a decent level of virtualization like secure separation kernels with more than competent internal security policies. The operating system like Windows, Linux, or Solaris, is really just the "interface" to the system for the users, so to speak.
Is that if your system is attached to a publicly-available network, you cannot be curtain of a secure system. Don't even try to tell me you can secure your network against all network-based attacks, current and future.
All you can do is raise the bar sufficiently to deter and defeat the lam0rs, and be able to focus your attention on detection, remediation, and retribution - if that's your style.
Having been rooted a few times, I would have loved to slip a little Ex-Lax into their Dew, but my boss said leave them alone. Just as well, they always come back for revenge. Our government may think differently.
But if it's hooked up to the Internet, count on it being compromised. Encrypt your data separately. Make backups and disaster recovery plans. Pray for this to happen on an otherwise quiet weekend, not the day before the quarterlies go out. And have an alternative. Anything is better than nothing.
In case you're wondering, I am a fatalist when it comes to network security. I see little hope.
deleting the extra space after periods so i can stay relevant, yeah.
I don't think the classified portion of the Executive Order that created them has been released. For all we know it contains a classified pardon.
I'd go on a Vegan diet but the delivery time from Vega is too long. --brownkitty
I was in the AF from 1977-1981 and worked directly for the NSA when they still had some scruples. In fact, my last posting was at Fort Meade after several years in the far east.
As a '202xxA'(Radio Communications Analyst), that focused on foreign military communications, I could have been reassigned at any time as a 202xxB (Radio Communications Security Specialist) with no retraining. The B job just meant we were testing our own weaknesses instead of exploiting those of our opponents. It is important to look inward, find your flaws, and fix them. Kind of like debugging open source code, huh?
That's what they were doing. Good job.
Up until 9/11, the nation's top computer security ppl were NSA. They had responsibility for it, which is why they created and pushed SEL. In addion, they insisted on running SECURED *NIX on all of their important systems. But then W and his staff created DHS and put them in charge of computer security. So far, that group has been a total set of f-ups. I used to work with several of those guys, and they were worthless back in 2000. Absolutely little to no real knowledge.
It is time to put the NSA back in charge of this.
I prefer the "u" in honour as it seems to be missing these days.