Hackers crack Defence Department

[Slim]

Hackers crack Defence Department


By JIM BRONSKILL
Canadian Press


http://www.globeandmail.com/servlet/story/RTGAM.20040713.wfedhack0713/BNStory/Technology/

Ottawa â ” Determined computer hackers broke through federal firewalls several times last year, gaining access to Defence Department networks.

A newly obtained report on security breaches at the department in 2003 also reveals dozens of internal lapses.

Computer security has become a high-profile concern in federal circles in light of cyber-terrorism, operations mounted by foreign intelligence services and, more often, the sloppy practices of employees.

The Defence Department's Computer Incident Response Team tracked a total of 160 events â ” from digital break-ins to dodgy e-mail procedures â ” last year.

Located in Ottawa at the Canadian Forces network operations centre, the team defends department computers by monitoring intrusion detection systems, zeroing in on threats and issuing alerts.

A declassified version of the team's report was released to The Canadian Press under the Access to Information Act.

It provides an indication of the difficulties faced by federal agencies such as the Defence Department in keeping their sprawling information holdings secure from interlopers.

The Canadian Security Intelligence Service has warned that it is almost impossible to eliminate network vulnerabilities entirely because computer systems and attack tools are in a constant state of evolution.

Other documents released by Defence underscore the high degree of confidentiality attached to such issues. Many of the records are classified top secret, with much of the information withheld from release due to its perceived sensitivity.

The response team's report notes five instances of â Å“unauthorized privileged accessâ ? to Defence networks, considered the most serious of seven categories of breaches.

They also logged five cases of â Å“unauthorized limited accessâ ? and 35 instances of â Å“malicious logicâ ? â ” the attempted introduction of viruses, worms or other unwanted programs into a computer system.

There were 110 cases of â Å“poor security practiceâ ? on the part of employees, by far the most common problem last year. Of these, the majority involved concerns about the security of e-mail transmissions.

Others stemmed from use of Internet Relay Chat messaging and the popular KaZaa file-sharing service, inappropriate storage of materials, and unauthorized Web postings. Another case involved improper access to a network.

No one from the Defence Department was available Tuesday to discuss the security cases.

Several of the documents released by Defence were prepared by the Communications Security Establishment, the highly secretive federal agency with the dual role of electronic spy service and protector of federal computer systems.

The records indicate CSE focused on issues including the potential exploitation of wireless communication networks, suspicious probes of systems and the general methods employed by hackers.

It appears CSE also undertook an analysis of the so-called Blaster worm that infected computers last August.

 

[Pieman]

35 instances of â Å“malicious logicâ ? â ” the attempted introduction of viruses, worms or other unwanted programs into a computer system.

Let me guess, they are using MSOutlook for their mailing system? Using outlook these days is about as safe as...say...drinking oven cleaner. Honestly, most of these worms and viruses are designed for specific programs and operating systems. Solution? Don't use Outlook. Get some other less used program or hire some guy to come in a tailor one specific for your office. You eliminate 99% of email attacks right away, and things like the Blaster worm don't work. I tossed my Outlook program years ago and oddly enough, I have never ever gotten a virus on my windoze platform through email. I did get the blaster worm in an email from someone, it is harmlessly sitting on my linux platform as we speak. Just taking some simple steps like that can save people a lot of trouble.

  The records indicate CSE focused on issues including the potential exploitation of wireless communication networks,

Two way radio anyone? Man, they had better be very careful about using that at all.   A little work at it and any fool cab bust into a wireless network. Even encrypted 'secure' networks are highly vunerable to some decoding scripts and issuing fake MAC addresses. This security is improving on these kind of things, but it has a long way to go.

Maybe there are some computer security gurus on this forum that know a little more than me about this stuff, but I think that if you wanted to be almost 100% effective against preventing hacks, wouldn't the best way to do that is use your own uniqe operating system? Say a spin off of the Fedora core, and use your own unique programs. It elminates many of the threats and you would only really   have to worry about direct attacks, brute force password cracking, and internal security. Trying to bust an operating system that you do not know or understand would be a difficult task to say the least.

The open source operating systems have become user freindly enough now that even the people who have trouble using windoze would be able to learn fast enough.
Just a thought, and a word to the wise: Ditch Outlook folks. You won't miss it at all.

 

[Goober]

...but I think that if you wanted to be almost 100% effective against preventing hacks, wouldn't the best way to do that is use your own uniqe operating system? Say a spin off of the Fedora core, and use your own unique programs. It elminates many of the threats and you would only really   have to worry about direct attacks, brute force password cracking, and internal security. Trying to bust an operating system that you do not know or understand would be a difficult task to say the least.

The open source operating systems have become user freindly enough now that even the people who have trouble using windoze would be able to learn fast enough.
Just a thought, and a word to the wise: Ditch Outlook folks. You won't miss it at all.

Nothing will ever be close to 100% effective against preventing hacks. Developing a unique OS for the DnD computers is not cost effective. You have to spend the millions developing, then training the end user (money and time) training the support, help desk costs, the cost of NOT having access to widespread and free troubleshooting, and knowledgebases the likes Windows and Unix has. Fedora is still *nix, the bugs/holes are still there, and will be found.

I remember a few months back the open source OS's (Linux distros) had more holes found in them than MS Windows in a 2 or 3 month span. Why? They are more popular now, so the hackers turn thier attention towards them. *nix is not bug free, far from it, with all these distros out, lines of code in the millions, and human error a fact of life, you have one swiss cheeze of an OS. But it is a fact that *nix OS's carry less of a risk for sure. But the cost factor comes in again. Re-training end users, training support staff, having to pay support staff more because of the *nix knowledge they hold etc...

 

[Gunnar]

They had more holes listed by one or two comparisons....how many of these were deal-breakers tho....How many were exploits that could only be used by someone who had access to the system in the first place?

Open source is inherently more secure, because there are more eyes looking at it.  Unix is inherently more secure because not everyone has root access, nor is every little app made part of the OS, so that if something breaks EVERYTHING breaks.

 

[casing]

Using Linux (not UNIX, which was already implemented in Iris) would have been a far better choice.   I'm not privy to why of course, but there are several likely reasons that the Army chose to go with Windows platforms.   A very likely and possibly the big decision tree choice is that the Windows platforms make inter-operability with our allies much more feasible.   (Not only the US and UK (Bowman), but also countries like the Netherlands, Germany, and quite a few others.)  At least that's what DND consultants likely would have told them.  I have a colleague who has since proven the interoperability of Linux with the existing systems, so it definitely would have been a good choice.  

If the Army had employed the right contractors (easier said than done and that is a very common problem in the IT world) from the start, Linux would have been implemented instead.  Choosing Linux would have made the costs of developing the systems exceedingly lower than for Windows--just because of the licensing fees (which are absolutely outrageous for Microsoft products, and I'm not talking about just the OS).

Sure, Linux has security holes as well, but with knowledgeable worker bees they can be fixed without needing to rely on the mother company (ie: Microsoft), which typically doesn't do the job properly anyway.

 

[Goober]

... But it is a fact that *nix OS's carry less of a risk for sure. ...

I do agree with you both, the DnD chose to go with windows way back when, like most of the world, Linux was probably unheard of, and Unix OS's like SCO and Solaris were server only. But now the cost will be huge to switch. However once they do switch, costs will go down. But they need that initial lump sum of cash to do the switch.

 

[bossdog]

I want my Banyan back

 

[The_Solecist]

...   A very likely and possibly the big decision tree choice is that the Windows platforms make inter-operability with our allies much more feasible.

 

My experience in Bosnia with SFOR HQ's computer support cell was that given the number of national forces present, and the requirement to share data, that using multiple OSes would have made it much more difficult.

Most DND computer users have a Windows based OS at home, so retraining is less of a requirement.  The logistics of implementing, supporting and training personnel for a new OS would be too high given the roll-over rate of OSes these days.  It all comes down to cost when making decisions.

~~~

The DND network is remarkably secrue when compared to corporate and educational networks throughout Canada.  Many corporations do not employ a team of computer network professionals whwhoseob it is to specifically test, and shore up the security of the network.  Often the person(s) responsible for security are the same ones responsible for e-mail, user problems, and general maintenance of the equipment itself.  Too many hats and not enough direct expertise makes for a weak system.

 

[bossdog]

I have to agree, the DND network is extremely secure compared to other corporations (having managed networks in Bosnia, the NWT, DND and for Bell Canada). Back in the mid 90's there was never access to the outside but as time goes on our requirements change hence, creating minor vulnerabilities.

 

[Goober]

The physical security of the networks are pretty impressive aswell. For about a year I did contract work on the PCs at Stadacona, and every time I came in, I had to have an escort who watched me like a hawk, right from the front gate. The replacement parts I was installing were also examined.

On a side note, I found it kinda ironic and funny that all the "Secret Lan" computers all had large bright orange stickers that said "Secret Lan" on the sides of the cases.