« US government mines e… | Home | This is why discounti… »

Contractors do the dumbest things sometimes.

Thursday 12 July 2007 at 4:22 pm
Like putting classified material online where anyone can stumble across it it.

It has come to the attention of the news media that documents that really shouldn't be getting out (like blueprints of high-security military installations) are being stashed on publically accessible web and FTP servers around the net, sometimes on the networks of the subcontractors themselves where anybody with the time and patience to go digging has a chance at finding it. During research for this article, reporters working for the Associated Press found dozens of sensitive documents that weren't even protected with a basic password. Moreover, sometimes you could anonymously FTP into the same web servers and go poking around behind the scenes to look at the source code for dynamic content and find older things that were once hyperlinked (incidentally, this is how web developers get their work onto the servers in the first place; the standard FTP daemon is often a necessary evil, but there are still countermeasures that can be put into place). Even though the data is no longer online, nobody knows exactly what's still floating around out there, or what's likely to be accidentally posted in the future. I wonder how the security auditing teams that the US government hires to survey their systems missed this stuff..

More and more, it seems like the book Google Hacking for Penetration Testers (second edition) is required reading if you're going to be doing anything useful on the Net these days, if only so that you know what is possible and can plan to not do dumb things. I'd also recommend that all security auditors and penetration testers read it so that you can add some new tricks to the contents of your sleeves - just because it's not a Cisco router running the telnet daemon with a username and password of 'cisco' doesn't mean that it isn't important.

Used tags: , , , , , ,
AddThis Social Bookmark Button
Fight Spam! Click Here!

Trackback link:

Please enable javascript to generate a trackback url

two comments recorded.

The problem really isn’t with contractors – it’s more basic than that, and moreover more cultural than technological.

One major issue that there are truly a very limited number of SIPRNET terminals. Where I work some of the time, a location which is instrumental in developing new systems for the military, only has eight such terminals. Even though the building has hundreds of people and is currently a 3-star command (this means it is overseen by a 3-star general; very high rank). The net result is that the documents for creating new systems are unclassified. If they were set as Secret, as they should be, nobody would be able to do their work!

The root of the problem is that security costs money. When the money isn’t available, the choice is to either halt the project, or ignore security. Sadly, the third choice – getting the necessary money – is too often not available.

Hasufin - 12 07 07 - 16:50 - Reply to comment?

One would think that they’d have been trained in proper procedures by now. That’s usually the first thing that you have to go through and be signed off on when you get your authorization to use SIPRNET.

The lack of terminals seems to make sense – to meet minimum DoD security requirements (Orange Book), they have to be designed along very specific hardware guidelines (such as no floppy drive, certain file permissions all through the drives, mandatory labelling, stuff like that), and even though building such machines these days isn’t too hard for the companies contracted (if I recall correctly, it was Compaq at one time (now HP) and Dell’s moving into that market space). However, the teams that test and certify each and every device that’ll be connected to it are small and overworked as it is.

In my experience, it seems to be a 50-50 split between the first two options. I’ve never seen the third ever happen.

The Doctor (URL) - 13 07 07 - 10:52 - Reply to comment?


  
Remember personal info?

/ Textile
  (Register your username / Log in)

Notify:
Hide email:

Small print: All html tags except <b> and <i> will be removed from your comment. You can make links by just typing the url or mail-address.