Slashdot Mirror
NASA Vulnerable To Crippling Cyber Attacks
RedEaredSlider writes "The computer network NASA relies upon to carry out its billion dollar missions is just like your Mac or PC at home; vulnerable to cyber attacks. NASA's servers contain vulnerabilities that could enable a cyberattack to cripple the entire agency, according to a recent audit report from The Office of the Inspector General. The report was an unflattering look at NASA's internal computer security operations, as the Inspector General recommended the agency expedite the implementation of a new agency-wide program to oversee the network security problem."
Given how their website was so full of holes I'm sure they could have told NASA where to look.
yay for a goatse link...
"Ubuntu" -- an African word, meaning "Slackware is too hard for me". - stolen from Dan C alt.os.linux.slackware
NASA has always been lax about security. Every few years there's another story about them getting owned by a bored teen. And let's face it, their shoestring budget isn't going to pay for top dollar infosec support.
I thought there was a highly funded government agency that was charged with providing security for the nation's communications and information systems. Dang! Now what was that called... SAN? ANS? SNA?... Something like that. Anyways, why isn't NASA using them?
When our name is on the back of your car, we're behind you all the way!
IT is not rocket science!
I've abandoned my search for truth; now I'm just looking for some useful delusions.
You'd think after all the fuss made about Gary McKinnon accessing the system 10 years ago - they'd have done something about it by now
I highly doubt their servers run on IIS.
Why are these things connected to the internet? Does mission control watch Youtube while they're waiting for the countdown or what?
TFA is kind of sketchy on details though, so i'm wondering if anyone knows anything more about these "servers... that control spacecraft." Sounds like ignorant reporting to me.
enable a cyberattack to cripple the entire agency
What would that look like exactly? To the best of my knowledge NASA is kind of a management consultant group... They contract EVERYTHING out. All capital, all operations, all services. So its not like the space station will fall out of the sky, or space probe data will be lost, because thats all done by contractors, whom presumably do a better job, since its their money on the line not the taxpayers.
Most of their contractors are large, therefore politically well connected, which in a circular way explains why they are NASA contractors, duh. So if accounts payable takes a couple extra days to restore the backups and cut the checks for services rendered, eh, the contractors will be OK.
I'm envisioning a vast array of power points and TPS reports being lost... would that necessarily be all that bad?
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
Every agency is responsible for securing their own infrastructure. NIST only provides only guidance.
If you mod me down, I shall become more powerful than you could possibly imagine.
Their crack team of web developers can't even get nasa.com to work without the www. in front of it.
Computer networks can be accessed by computers. Film at eleven.
Yeah, like half, or 3.1%, same thing. I thought we were supposed to be bad at math.
How does it feel to be a liar with pants constantly on fire?
this is how the US government takes over and militarizes space...
A greater crippling obstacle appears to be (Con)gress, they can't even get their story straight on the budget let alone anything else.
Billions are dumped on our so-called "friends" and yet, everybody hates us. If 1/10th of the war budget went to NASA, we would be somewhere past the asteroid belt, let alone fiber optic networks for everyone.
The mind conceives, the body achieves, the spirit manifests.
You be good now Australian hackers!
I'm not going to give many details, it's not good business. I don't know much about the non-mission critical systems, but I do maintain mission critical ones and I will venture a mention they're not on the internet. The internet and the mission critical stuff are far separated. That's more specific than I probably should have gotten, things that communicate with the station, the shuttle and TDRS are isolated, often from one another.
The preceding post was not a Slashvertisement.
The internet and the mission critical stuff are far separated. That's more specific than I probably should have gotten,
Yeah, whatever you do, don't use the top secret phrase "air gap firewall".. Come on, enough security theater.
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
People can, and do, routinely sue the federal government (and state, and local). Hell, that's how Judicial Review was established in the first place. The FTCA establishes pretty clearly that sovereign immunity would not apply in that case.
Of course, it's more fun to just ignorantly spout bullshit.
Jeez, with IT like that, by this summer they probably won't even be able to launch a space shuttle!
...they've always had a problem with this, though. I was there years ago (at the beginning of the Internet boom) and we were one of the most hacked targets on the planet. Everyone seems to think that all the secret UFO data was in NASAs network -- and the pace of attacks was astounding. You had to have an RSA token to login to anything. It got so bad that we ended up having to put an optical tap (even as contractors, we fought that one) on the FDDI ring what was MAE-WEST so the FBI and other TLAs could try to track some of these idiots down.
Given that funding went down and many of the top IT / networking guys went into the booming private sector, I'm not surprised it's still a problem. All of the mission critical stuff is pretty well walled off -- but the rest of it has major issues. I don't think we'll loose a spaceship to it, but getting your email can be very annoying.
I don't understand the problem. McAffee's web check said their site was okay!!
Be seeing you...
"We found that computer servers on NASA's agency-wide mission network had high-risk vulnerabilities that were exploitable from the Internet. Specifically, six computer servers associated with IT assets that control spacecraft and contain critical data had vulnerabilities that would allow a remote attacker to take control of or render them unavailable" link
By any chance, would these 'computer servers' be running on Microsoft Windows?
"a recent audit report .. cited a 2009 incident in which cybercriminals .. caused the computer system to make 3,000 unauthorized connections to domestic and international IP addresses"
Wouldn't it be a good idea to put these 'computer systems' behind a firewall and only allow access through authenticated VPN connections?
They used to be hailed as the corner stone of undeniable precision, where they could lose contact with a shuttle, and plan its course and be able to tell with 100% accuracy where it would show up once it regained contact with them (apollo mission)....here, this makes them look like newbs....i dont know what happened, if some outsourced agency was hired to throw together their network configs, but i am surprised to say the least.