Slashdot Mirror
DOD Overhauls Network to Thwart Crackers
Toddius Maximus
wrote in to send us a CNN story about the
Departent of Defense Overhauling
their network to prevent cracker attacks. How's that for
a feeling of warm fuzzies?
← Back to Stories (view on slashdot.org)
Hacker... Cracker... whatever. There's malicious groping going on in the DOD and it must stop!
(chuckle)
From someone behind that network, its a far bit more then a few more firewalls.
New regulations as to which protocols are allowed, and not allowed, who is able to connect to the network, and who is not. At current a audit is being conducted to determine what violations are out there. Networks that are non-compilant risk loosing their uplink.
Allready everything is having to be kerborized.
Lord save us, we may be even going to IpSec.
The problem for them has not been the protocols, per se, but the clear text logins.
It is quite easy to secure one area, however try securing a client's network to which you have no
administrative control, and within that client's
network there are multiple network of clients of theirs who they have no administrative controll. At the bootm of this, add univeristy networks connecting in to these networks, or other goverment agencies who are also connected to the internet proper. YOU can't secure those nets. What can you do.. Cut them off? But someone tells you you can't.
Its not a technical problem. Its a Political one.
...to leave a machine on running Carbon Copy or some such and blammo, what was previously thought to be an already secured location with free access to everything is not a jump off point for 37337 K1DDi3Z.
the niprnet redesign referenced is a mass upgrade
of select cisco routers on the niprnet backbone.
i suppose the filtering is somethin to do with some new version of cisco ios. *shrug*
Simple, see there's this thing called OPSEC...
Basically it states that an enemy can find out classified information by examining unclassified info and adding one and one together. If the rosters are saying that a lot of people are going on temporary duty, and the trans office systems have info for moving luggage and gear to some particular place, then that's a pretty good indication that something is going on.
A lot of this information is sent via niprnet because the secure network is used only for secure stuff, for obvious reasons. So this information can only be on the unsecured network.
Personally, I think it would really suck if we disconnected from the internet, since it's the only connection I have with the states, but it would stop the crackers. And keep in mind, not all of these people are teenagers... some are hired for that type of work. From other countries. That don't like us. Get the idea?
If the technical people and the professional soldiers made the decisions in life we would be a LOT safer and be involved in a lot fewer military conflicts. Technical people of course will say "Put in a firewall, close access to this, secure that.. we need to get this this and that and we can be 99% secure." The politicians on the other hand will say "How does this effect our ISO9000 policy? We'll need to form a commission and evaluate the differing products before we can choose one based on cost, efficiency, robustness, etc." Then 2 years later they finally implement it only to find it's such outdated technology they need to start all over again. Doing anything in the government is like trying to turn an oceanliner with a rowboat.
these changes.
"DISA's plans include the filtering of what DISA called "notorious" protocols routinely exploited by hackers... The protocols include the PostOffice Protocol (POP), which allows remote users to read e-mail stored on a central server; remote-access protocols, which allow users to read their e-mail from another system; and Packet Internet Groper (Ping).... The inability of NIPRNET to handle the loads imposed by Web traffic without lags or delays had resulted in numerous military commands installing Internet "backdoors" on their systems."
Unless they're not telling us the important stuff, what they're doing is pretty darn basic -- I'd do this kind of thing for a small business. It doesn't really surprise me that their security was so bad, but they ARE the DOD.
Posted by bSMfh (bastard ScoutMaster fro:
Doh!
someone groped my wife's packets!
ping origins
The military uses red and black, not red and green. Same principal. (I had help designing a firewall for them once, and have a interface labled red, and the other black was in the requirements. I don't remember which is which off hand.
BTW, this isn't ment to imply that all networks are connected, there are networks that are unconnected. The semi-secure but internet connected network is firewalled by this box, not the most highest security level networks, which not physical connection is allowed.
Translation:
A DOD spokesman has publicly stated that as soon as
their sys admins are tired of playing Quake, they
fully intend to install tcp_wrapper on most of
their systems, just as soon as they're done
sorting their bookmarks and reading Slashdot
they promised they would get right on it and
install that wrapper any day now, and if they
can have Friday off, they may even upgrade and patch
the old buggy daemons they left running, but
as one DOD sys admin stated "Phf! That's not my job!"
then he quickly returned his attentions to a
heated Phantom Menace debate on "Ain't It Coll News."
Read this.
It's basically the conscensus in the community that they're just adding a few firewalls. I think the DOD has more to worry about from internal threats than anything a bunch of adolescent l335 script kiddies could do.
--
I'd like to be able to grope via packets over the internet. Alas.
And Ping doesn't stand for anything. It's just Ping. Like the submarines do.
pooptruck
again the terms are confused...
a hacker is someone who hacks hardware and OSes
whereas a cracker is traditionally one who cracks
software copyright and helps in the distribution
of such warez.
see Hacker V Cracker on manos.com,
Cracker
The definition of a cracker is one who attempts to break into a system using techniques that he does not fully understand. Most of the crackers are young teenage punks who are very malicious and seek to get their kicks from destroying or alternating data on a system.
Hacker
The hacker on the other hand is an individual who yearns for knowledge. The hackers are very knowledgeable individuals. They often times know several programming languages, work extensively with the inwards and outwards of UNIX, have a firm understanding of all the TCP/IP implementations and protocols. They keep abreast on all the security related issues involving computers. Breaking into a system for a hacker is a thrill, it is a challenge that they take on. The hacker takes much delight in exploring the system from the outside/inside searching vigorously for misconfigurations, bugs, and holes in the operating system that would allow them to break into a machine. Once in the system the challenge has been completed and they have succeeded in breaking in. It is against hacker ethics to alter any data aside from the logs that are needed to clean their tracks. They have no need or desire to destroy data as the malicious crackers. They are there to explore the system and learn more. The hacker has a constant yearning and thirst for knowledge that increases in intensity as their journey progresses.
I'm afraid. I'm afraid, Dave. Dave, my mind is going. I can feel it. I can feel it. My mind is going.
So, starting sometime in July, they're going to filter some protocols, maybe POP, maybe telnet, but they haven't decided what to filter yet. Hmm...the first thing I did on my Linux boxen was to turn off any protocols that I didn't use and to set up ipchains to filter the rest. I also set Samba not to listen to the outside world, but only to my 192.168.0.* C network. And I'm new at this.
Typical government: A network that is several years old finally gets the consultant once-over and the committee decides to form a committee to look into what to do.
Mike
--
Mike
--
"Wi nøt trei a høliday in Sweden this yër?"
A 'good thing' if ever I saw it.
*COUGH*
Open Source. Closed Minds. We are Slashdot.
...stands for Fondle INternet Group Expecting Response.
:) */
/* We could keep this thread going all day with these
Save the whales. Feed the hungry. Free the mallocs.
ok. done. not bad for only 2 hrs. of sleep. now i gotta bang out this last project....
i want to live life, not just go through the motions
Groping going on in the US government? Naaaah. Can't be. -NG
+--
Given infinite time, 100 monkeys could type out the complete works of Shakespeare.
+-- (Score:-1, Moderator on Power Trip)
"and Packet Internet Groper (Ping), which hackers use to disable networks by overloading them with a
command."
'hackers'
When will they learn...sigh
censorship is a form of noise, which actively seeks to drown out content with silence - Crash Culligan
Or even better, somebody working from home can dial in on a idsn and have their Linux box just part on the LAN over there. Then maybe they make their root passwd something like: root, blank, their name, etc. and then the 3LiTe Haqrz!! can come in through the hole.
Hollow words will burn and hollow men will burn.