17 décembre 2018 | International, C4ISR

Audit finds cyber vulnerabilities in US missile defense system

By:

The Army, Navy and Missile Defense Agency are failing to take basic cybersecurity steps to ensure that information on America's ballistic missile defense system won't fall into nefarious hands, according to a Defense Department Inspector General audit released Friday.

Investigators visited five sites that manage ballistic missile defense elements and technical information, but the names of the commands were redacted in the publicly released report.

“The Army, Navy and MDA did not protect networks and systems that process, store, and transmit (missile defense) technical information from unauthorized access and use,” the declassified report states.

Such inadequacies “may allow U.S. adversaries to circumvent (missile defense) capabilities, leaving the United States vulnerable to missile attacks,” the report states.

They found officials failed to employ safeguards familiar to most people online in 2018, the latest development to raise questions about the U.S. military's cybersecurity vulnerabilities.

Among the shortcomings: Administrators for classified networks had no intrusion detection and prevention systems in place to watch for cyberattacks, much less stop them, according to the report.

At one site, officials said they had requested to purchase those cyber safeguards in December 2017 but nine months later it still hadn't been approved.

“Without intrusion detection and prevention capabilities, (the site) cannot detect malicious attempts to access its networks and prevent cyberattacks designed to obtain unauthorized access and exfiltrate sensitive (missile defense) technical information,” the report states.

Officials also failed to patch system flaws after receiving vulnerability alerts, one of which had first been identified in 1990 and had still not been fixed by April.

Another vulnerability that could be exploited by an attacker was first identified in 2013 but also was never pathced, according to the report.

“Countless cyber incident reports show that the overwhelming majority of incidents are preventable by implementing basic cyber hygiene and data safeguards, which include regularly patching known vulnerabilities,” the IG report states. “(Missile defense) technical information that is critical to national security could be compromised through cyberattacks that are designed to exploit these weaknesses.”

Some facilities failed to force employees to use common access cards, or CAC, when accessing the classified system, a basic cybersecurity practice known as multi-factor identification.

Instead, officials were able to access the sensitive information using just a username and password, the report states.

Hackers use phishing and other tactics to exploit passwords and gain access to such systems.

New hires are supposed to be allowed network access without a card for only their first two weeks on the job. But IG investigators found users on the systems without CAC cards for up to seven years.

At one site, a domain administrator never configured the network to allow only CAC holder access.

“Allowing users to access networks using single factor authentication increases the potential that cyber attackers could exploit passwords and gain access to sensitive (missile defense) technical information,” the report states.

Investigators also found unlocked server racks at some locations, another key vulnerability to insider snoopers.

“The insider threat risk necessitates that organizations implement controls...to reduce the risk of malicious personnel manipulating a server's ability to function as intended and compromising sensitive and classified data,” the report states.

External storage devices held unencrypted data and some sites failed to track who was accessing data, and why. Other administrators told investigators that they lacked the ability to record or monitor data downloaded from the network onto these devices.

Unless these officials enforce the encryption of such removed data and monitor its downloading and transferring, “they will be at increased risk of not protecting sensitive and classified (missile defense) technical information from malicious users,” the report states.

Investigators also found that some supposedly secure sites were failing to even lock their doors. One location had a security door that hadn't worked for years.

“Although security officials were aware of the problem, they did not take appropriate actions to prevent unauthorized personnel from gaining unauthorized access to the facility,” the report states.

Other sites featured no security cameras to monitor personnel movement and security officers failed to conduct badge checks.

While the report makes recommendations to fix the documented problems, officials for the inspected agencies offered no comments on the non-classified draft report of the audit.

Friday's scathing IG audit marked the latest in a string of reports detailing shoddy cybersecurity throughout the armed forces and defense contractors.

During the same week, the Wall St. Journal reported that Chinese hackers are targeting military systems and those of defense contractors working on Navy projects.

Beijing-linked cyber raids have attempted to steal everything from missile plans to ship-maintenance data in a series of hacks over the past 18 months, the Journal reports.

As a result, Navy Secretary Richard Spencer has ordered a “comprehensive cybersecurity review” to assess if the Navy's cyber efforts “are optimally focused, organized, and resourced to prevent serious breaches,” spokesman Capt. Greg Hicks said.

The review will also look at authorities, accountability and if the efforts reflect and incorporate government and industry best practices, he said.

“Secretary Spencer's decision to direct a review reflects the serious to which the DoN prioritizes cybersecurity in this era of renewed great power competition,” Hicks said.

https://www.navytimes.com/news/your-navy/2018/12/14/audit-finds-cyber-vulnerabilities-in-us-missile-defense-system

Sur le même sujet

  • Despite pressure from lawmakers and pandemic, French defense budget to remain unchanged

    6 octobre 2020 | International, Aérospatial, Naval, Terrestre, Sécurité

    Despite pressure from lawmakers and pandemic, French defense budget to remain unchanged

    Christina Mackenzie PARIS — Despite calls from French lawmakers for the nation's defense industry to receive extra financial support from the government to counter the negative effects of the coronavirus pandemic, the 2021 defense budget will remain unchanged. Armed Forces Minister Florence Parly said last week that the 2021 defense budget — planned before the pandemic as part of the 2019-2025 military program law — represents “the third year in a row that we have followed the military program law to the letter: This is an unprecedented effort, with an additional €1.7 billion [U.S. $2 billion] or so every year.” She added that the armed forces since 2019 have had €18 billion more to spend than in 2017, noting that between 2019 and 2023, the military investment budget will total €110 billion, which is more than the €100 billion national recovery plan announced by the French government last month to support a suffering economy. But Françoise Dumas, president of the National Assembly's National Defense and Armed Forces Committee, had called for “defense to be at the heart of the future recovery plan." And Cédric Perrin, vice president of the Senate Committee on Foreign Affairs, Defence and Armed Forces, argued “there is no specific component of this €100 billion plan for the defense industry sector.” The €49.7 billion French defense budget for 2021 includes payment appropriations of €39.2 billion, which is an increase from the previous year, as planned in the 2019-2025 military program law. Of this, a record €22.3 billion is earmarked for modernizing equipment and buildings; €12.3 billion will go toward wages; and €4.6 billion is appropriated for operating costs. The government's department focused on veterans' affairs is to receive €2 billion of the total defense budget, and the remaining €8.5 billion will go toward pensions. What about the recovery plan? In early June, the government revealed a series of recovery plans aimed at specific industries particularly hard hit by the pandemic. Though the defense sector was not the sole target of the €15 billion aeronautics recovery plan, it nevertheless benefits from the funds, given France's aeronautic giants — Airbus and Dassault Aviation — are active in both the civilian and military sectors, as are their two major suppliers, Safran and Thales. There are about 1,300 companies ranging from startups to major firms in the French aeronautics sector, and they employ approximately 300,000 people. The recovery plan is not aimed at the four major companies, but rather in helping their supply chain involved in specific projects, such as modernizing production tools, research and development efforts, and digital transformation. As a condition for receiving the government funds, the four large companies promised to “consider favorably” offers made by suppliers in France and within the European Union based on global cost, while also taking into account litigation risks, the reliability of after-sales services, the conformity of products and services, their societal and environmental responsibility, and their innovation. The Armed Forces Ministry is participating in the recovery plan by spending €832 million on five measures to ensure “an immediate workload for the whole sector.” The first measure was to anticipate an order for three A330 Phénix multirole tankers, a move enabling the Air and Space Force's two A340 aircraft to retire from service this year instead of in 2028, and its three A310 aircraft to retire in 2021 instead of 2023. The second measure is an order for a light surveillance and reconnaissance aircraft; the third is an early order for eight H225M Caracal helicopters for the Air and Space Force; and the fourth is for a naval airborne drone system (known by its French acronym SDAM) and an onboard mini-drone (SMDM). The fifth measure is for 12 helicopters (two EC-145s and 10 EC-160s) for the Gendarmerie and the civil security force. The ministry's contributions also include €300 million in subsidies for suppliers and subcontractors, as well as €1.5 billion spent over the next three years to support R&D and innovation. What are the defense funds going toward? Under the defense budget, the Army will procure: 12,000 HK416F assault rifles (and order another 12,000). Five Caiman helicopters (and order 21 light joint helicopters). 20 Jaguar armored vehicles; 157 Griffon armored vehicles; 80 renovated VBL light armored vehicles (and order another 120); and 1,000 VLTP light tactical multipurpose vehicles. 850 portable radios (and order 2,900); and 925 vehicle radios (and order 7,300). 200 MMP medium-range missiles and 75 firing posts. 10 SDT tactical drones. The Navy is procuring: A FREMM multimission frigate (and ordering an intervention and defense FDI frigate); and an upgraded light stealth frigate. A Caiman helicopter (and ordering eight HIL light joint helicopters). Three upgraded ATL2 patrol aircraft. Aster 30 missiles; F21 Artemis torpedoes; and four Exocet MM40 Block 3C anti-ship missiles (and ordering 45 Exocet kits). The Air & Space Force is acquiring: An Atlas A400M transport aircraft; three A330 Phénix multirole tankers; two upgraded C-130H transport aircraft; and 14 upgraded Mirage M2000D fighter aircraft. 14 Talios laser designation pods. 90 upgraded Scalp missiles. Six SCCOA 4 radars. Specifically for the space segment, a Musis/CSO satellite; 15 Syracuse IV ground stations; and one Ceres satellite system. The service is also ordering one HIL light joint helicopter; 367 MICA NG air-to-air missiles; 150 Mica NG training missiles; and 13 Syracuse IV ground stations. Two major programs for the service will also be launched in 2021: the Mentor training aircraft and the future combat air system demonstrator. https://www.defensenews.com/global/europe/2020/10/05/despite-pressure-from-lawmakers-and-pandemic-french-defense-budget-to-remain-unchanged/

  • Check Out This Stealth Target Drone: It Could Be a Warplane in Disguise

    23 janvier 2020 | International, Aérospatial

    Check Out This Stealth Target Drone: It Could Be a Warplane in Disguise

    The U.S. Air Force soon could deploy a radar-evading target drone. One that easily could evolve into a front-line warplane. California-based Sierra Technical revealed its prototype drone in photos the company released in mid-January 2020. The Fifth-Generation Aerial Target, or 5GAT, is roughly the size of a T-38 training jet and like the T-38 boasts two J85 engines. The prototype with its sharp angles bears a passing resemblance to an F-22 stealth fighter, albeit one without a cockpit. The company plans to fly the drone for the first time in early 2020. The Air Force wants the 5GAT drone for target practice in order to help fighter pilots prepare for dogfights with Russian and Chinese stealth fighters. The drone's development is part of a wider Air Force effort to provide realistic training to its pilots for doing battle with the latest radar-evading warplanes. The service also plans to organize some of its F-35 stealth fighters into an “adversary” squadron that would play the role of the enemy during realistic war games. https://nationalinterest.org/blog/buzz/check-out-stealth-target-drone-it-could-be-warplane-disguise-115936

  • Hackers Use Microsoft MSC Files to Deploy Obfuscated Backdoor in Pakistan Attacks

    17 décembre 2024 | International, C4ISR, Sécurité

    Hackers Use Microsoft MSC Files to Deploy Obfuscated Backdoor in Pakistan Attacks

    Tax-themed phishing targets Pakistan via MSC files, delivering stealthy backdoors with obfuscated malware.

Toutes les nouvelles