RELATED:
https:// archive.fo/CInHW (US Military Hired Amazon To Store Sensitive Data, Secrets Stolen By China)
https:// archive.fo/R7oOo (US Army Data Hacked In 2017, Stored On Amazon S3 Servers)
https:// archive.fo/FJWtH (NSA Files Left Exposed Online on Amazon S3 Server, Hacked)
https:// archive.fo/pC2Yd (Amazon S3 Servers NOT Secure!)
https:// archive.fo/FRrx8 (Wikileaks Begins To Leak Highly Confidential Internal Documents From Amazon)
THE FIRST STEP in solving any problem is admitting there is one. [Ouch!] But a new report from the US Government Accountability Office finds that the Department of Defense remains in denial about cybersecurity threats to its weapons systems. Specifically, the report concludes that almost all weapons that the DOD tested between 2012 and 2017 have “mission critical” cyber vulnerabilities. “Using relatively simple tools and techniques, testers were able to take control of systems and largely operate undetected, due in part to basic issues such as poor password management and unencrypted communications,” the report states. And yet, perhaps more alarmingly, the officials who oversee those systems appeared dismissive of the results.
The GAO released its report Tuesday, in response to a request from the Senate Armed Services Committee ahead of a planned $1.66 trillion in spending by the Defense Department to develop its current weapons systems. Subtitled "DOD Just Beginning to Grapple with Scale of Vulnerabilities," the report finds that the department "likely has an entire generation of systems that were designed and built without adequately considering cybersecurity." Neither Armed Services Committee chairman James Inhofe nor ranking member Jack Reed responded to requests for comment.
The GAO based its report on penetration tests the DOD itself undertook, as well as interviews with officials at various DOD offices. Its findings should be a wakeup call for the Defense Department, which the GAO describes as only now beginning to grapple with the importance of cybersecurity, and the scale of vulnerabilities in its weapons systems. “I will say that the GAO can be prone to cyber hyperbole, but unless their sampling or methodology were way off or deliberately misleading, DOD has a very grave problem on its hands,” says R. David Edelman, who served as special assistant to President Obama on cybersecurity and tech policy. “In the private sector, this is the sort of report that would put the CEO on death watch.”
DOD testers found significant vulnerabilities in the department’s weapon systems, some of which began with poor basic password security or lack of encryption. As previous hacks of government systems, like the breach at the Office of Personnel Management or the breach of the DOD’s unclassified email server, have taught us, poor basic security hygiene can be the downfall of otherwise complex systems. The GAO report says that one tester was able to guess an admin password on a weapons system in nine seconds. Other weapons used commercial or open source software but administers failed to change the default passwords. Yet another tester managed to partially shut down a weapons system by merely scanning it—a technique so basic, the GAO says, it “requires little knowledge or expertise.”
Testers were sometimes able to take full control of these weapons. “In one case, it took a two-person test team just one hour to gain initial access to a weapon system and one day to gain full control of the system they were testing,” the report states. The DOD also had a hard time detecting when testers were probing the weapons. In one case, testers were in the weapons system for weeks, according to the GAO, but the administrators never found them. This, despite the testers being intentionally “noisy.” In other cases, the report states that automated systems did detect the testers, but that the humans responsible for monitoring those systems didn’t understand what the intrusion technology was trying to tell them.'
The report contains a number of startling examples of how hackers are able to penetrate weapons systems. Testers were able to disrupt systems, change and download data. They also found that they could shut down parts of a system by simply scanning for cyber flaws. In one case, they were able to entirely take over a weapons system in just one day. One team of hackers was even able to send a message asking that users insert at least two quarters in order to continue using a system. But the report was most damning over the Pentagon's consideration of cybersecurity in the systems themselves, finding that the department was still "in the early stage of trying to understand how to apply cybersecurity to weapon systems.”
archive.is
archive.fo
wired.com
thehill.com
