December 17, 2024 | International, C4ISR, Security
Bitter APT Targets Turkish Defense Sector with WmRAT and MiyaRAT Malware
South Asian APT group Bitter targets Turkish defense sector with WmRAT and MiyaRAT malware via NTFS ADS and scheduled tasks.
December 17, 2018 | International, C4ISR
Audit finds cyber vulnerabilities in US missile defense system
The Army, Navy and Missile Defense Agency are failing to take basic cybersecurity steps to ensure that information on America's ballistic missile defense system won't fall into nefarious hands, according to a Defense Department Inspector General audit released Friday.
Investigators visited five sites that manage ballistic missile defense elements and technical information, but the names of the commands were redacted in the publicly released report.
“The Army, Navy and MDA did not protect networks and systems that process, store, and transmit (missile defense) technical information from unauthorized access and use,” the declassified report states.
Such inadequacies “may allow U.S. adversaries to circumvent (missile defense) capabilities, leaving the United States vulnerable to missile attacks,” the report states.
They found officials failed to employ safeguards familiar to most people online in 2018, the latest development to raise questions about the U.S. military's cybersecurity vulnerabilities.
Among the shortcomings: Administrators for classified networks had no intrusion detection and prevention systems in place to watch for cyberattacks, much less stop them, according to the report.
At one site, officials said they had requested to purchase those cyber safeguards in December 2017 but nine months later it still hadn't been approved.
“Without intrusion detection and prevention capabilities, (the site) cannot detect malicious attempts to access its networks and prevent cyberattacks designed to obtain unauthorized access and exfiltrate sensitive (missile defense) technical information,” the report states.
Officials also failed to patch system flaws after receiving vulnerability alerts, one of which had first been identified in 1990 and had still not been fixed by April.
Another vulnerability that could be exploited by an attacker was first identified in 2013 but also was never pathced, according to the report.
“Countless cyber incident reports show that the overwhelming majority of incidents are preventable by implementing basic cyber hygiene and data safeguards, which include regularly patching known vulnerabilities,” the IG report states. “(Missile defense) technical information that is critical to national security could be compromised through cyberattacks that are designed to exploit these weaknesses.”
Some facilities failed to force employees to use common access cards, or CAC, when accessing the classified system, a basic cybersecurity practice known as multi-factor identification.
Instead, officials were able to access the sensitive information using just a username and password, the report states.
Hackers use phishing and other tactics to exploit passwords and gain access to such systems.
New hires are supposed to be allowed network access without a card for only their first two weeks on the job. But IG investigators found users on the systems without CAC cards for up to seven years.
At one site, a domain administrator never configured the network to allow only CAC holder access.
“Allowing users to access networks using single factor authentication increases the potential that cyber attackers could exploit passwords and gain access to sensitive (missile defense) technical information,” the report states.
Investigators also found unlocked server racks at some locations, another key vulnerability to insider snoopers.
“The insider threat risk necessitates that organizations implement controls...to reduce the risk of malicious personnel manipulating a server's ability to function as intended and compromising sensitive and classified data,” the report states.
External storage devices held unencrypted data and some sites failed to track who was accessing data, and why. Other administrators told investigators that they lacked the ability to record or monitor data downloaded from the network onto these devices.
Unless these officials enforce the encryption of such removed data and monitor its downloading and transferring, “they will be at increased risk of not protecting sensitive and classified (missile defense) technical information from malicious users,” the report states.
Investigators also found that some supposedly secure sites were failing to even lock their doors. One location had a security door that hadn't worked for years.
“Although security officials were aware of the problem, they did not take appropriate actions to prevent unauthorized personnel from gaining unauthorized access to the facility,” the report states.
Other sites featured no security cameras to monitor personnel movement and security officers failed to conduct badge checks.
While the report makes recommendations to fix the documented problems, officials for the inspected agencies offered no comments on the non-classified draft report of the audit.
Friday's scathing IG audit marked the latest in a string of reports detailing shoddy cybersecurity throughout the armed forces and defense contractors.
During the same week, the Wall St. Journal reported that Chinese hackers are targeting military systems and those of defense contractors working on Navy projects.
Beijing-linked cyber raids have attempted to steal everything from missile plans to ship-maintenance data in a series of hacks over the past 18 months, the Journal reports.
As a result, Navy Secretary Richard Spencer has ordered a “comprehensive cybersecurity review” to assess if the Navy's cyber efforts “are optimally focused, organized, and resourced to prevent serious breaches,” spokesman Capt. Greg Hicks said.
The review will also look at authorities, accountability and if the efforts reflect and incorporate government and industry best practices, he said.
“Secretary Spencer's decision to direct a review reflects the serious to which the DoN prioritizes cybersecurity in this era of renewed great power competition,” Hicks said.
On the same subject
-
-
August 26, 2024 | International, Aerospace
UK to build F-35-sized ‘silent hangar’ to test jamming, electronic war
The anechoic hangar is due to open in 2026 and will be one of the biggest in Europe, far bigger than existing facilities in Britain.
-
June 21, 2019 | International, Naval
Navy Looking for Better Ways to Share Data
By: Ben Werner WASHINGTON, D.C. – The Navy is grappling with how to securely share the vast amounts of data ship designers, operators and sustainers collect, a panel of engineers said Wednesday. Shipyards have the design systems they use to transmit plans from engineers to the shipbuilders. Once delivered, modern ships, submarines and even aircraft generate tremendous amounts of data gauging their performance. The Navy has more data than it knows what to do with, but Rear Adm. Lorin Selby wants to change this. “The problem we have is we don't do a great job of linking those together,” Selby said of the various data points. “That's what I'm driving for trying to link those together.” Selby, the chief engineer and deputy commander for ship design, integration and naval engineer at the Naval Sea Systems Command, was speaking as part of a panel discussing how the Navy and shipbuilding industry can use digital plans at the American Society of Naval Engineering's annual Technology, Systems & Ship symposium. Selby was joined by Rear Adm. Eric Ver Hage, the commander of the Naval Surface Warfare Center and Naval Undersea Warfare Center, and Zac Staples, a retired commander and current chief executive of Austin, Texas,-based maritime analytics firm FATHOM5. Staples' final tour in the Navy was the director of the Center for Cyber Warfare at the Naval Postgraduate School. “Today, we know the liability of many of our systems. We know the ship loadout. We know the type of baseline the ships have. We know the performance of tactical action officers and other key watchstanders when they're in the basic training cycle. We know the proficiency of the strike group when they go to sea,” Ver Hage said. “You have all this data; the problem is, we put missiles on ships, but the combat systems can't unlock all the capability that missile has in some instances,” he said, referring the possibility communications between ships and missiles could improve targeting. When quantum computing is developed, the ability to process this massive amount of data will become much easier, Selby said. Quantum computing is still being researched, with several nations trying to develop a way to tackle large data sets quickly, Selby explained. Within a year or two of mastering quantum computing, he predicts everyone will be able to use quantum computing. For the U.S. to have a decisive quantum computing edge, Selby said requires being ready now. “The key to being the one who can actually lever that technology and really take a huge leap forward in this century is going to be the nation that lays the foundation to be able to lever the capabilities of quantum with a software delivery mechanism,” Selby said. However, as the ability to analyze data speeds up, the importance of protecting this data also grows. “If we're going to build capabilities in the era of great power competition, we have to assume our adversaries are trying to steal them – because they're trying to steal them,” Staples said. “The exact copy Chinese joint strike fighter is a good indication that whatever our shipboard capabilities might go for will be equally targeted.” The current secure method of transferring data classified up to the secret level is over the Secret Internet Protocol Router Network (SIPRNet). However, SIPRNet has limitations, such as the expense of operating the network and creating secure terminals so everyone has access to a SIPRNet terminal to send and receive classified secret information. A cloud-based data vault could prove to be a good solution. Under such a program, access can be restricted, Staples said. Vault monitors will also know which adversaries are denied access to the valuable data being stored. “When you think about encrypting data, there's probably a more efficient way to do that than on SIPRNet,” Staples said. https://news.usni.org/2019/06/20/navy-looking-for-better-ways-to-share-data