L-3 Communications, Grumman: Hack Attack

I'd like to think that most folks running major technology companies in America are a trifle less clueless than Dilbert's manager:



Unhappily, it doesn't take a pointy-haired manager, or executives who think "password1" is a strong password, to have security troubles.

A system like this sounds fairly safe, I think:

"...SecurID adds an extra layer of protection to a login process by requiring users to enter a secret code number displayed on a keyfob, or in software, in addition to their password. The number is cryptographically generated and changes every 30 seconds...."
(Wired)

The SecurID service probably worked pretty well. Until someone hacked into their system. We still don't know exactly what data was stolen, and how it's been used, but whats been happening to American defense contractors suggests that the encryption seeds for SecurID tokens is available to someone with Internet access.

And an interest in classified data about United States weapons systems.

This is not, in my considered opinion, good news. At all.

I've put excerpts from the last two days' news at the end of this post.¹

There's probably going to be quite a bit of finger-pointing, as word of this these hack attacks spreads. One of the more sensible points to look into, I think, is why more clients of SecurID didn't change their systems after the original hack?!

Oh, Come On: How Bad Could It Be?

Someone speculated that the control system for Predator drones might be hacked with data that's quite possibly been taken from someone's network. About the best outcome of that might be that the drones wouldn't work at all. Someone with a little piloting skill and the right software might decide to hijack a Predator drone and send it on a new mission.

That, I think, would be bad news. But then, I'm one of those people who don't think that the military-industrial complex and Yankee imperialism is the greatest threat to world peace and spotted owls.

Looking beyond strictly military data, America - and a fair number of other countries - depends on a complex power grid and a telecommunications system for most of what we do every day. Which, for quite a few months each year here in Minnesota, includes keeping the temperature inside above freezing.

Back when the Y2K bug was being dealt with, I evaluated my household's resources. Happily, we didn't get a chance to test this: but I'm pretty sure we would have been okay for at least a few weeks, if the power had failed at midnight, December 31, 1999.²

Then there are nightmare scenarios, like someone getting clever with a pharmacy chain's prescription software. Think Colossus: The Forbin Project meets Dr. Giggles.

Maybe the power grid and phone system crashing in mid-winter wouldn't be so bad, after all.

Related posts:

• Hack Attacks
  • "Pentagon's New(ish) Policy About Hack Attacks"
    (May 31, 2011)
  • "Lockheed Martin, Oak Ridge, Spear Phishing, and Common Sense"
    (May 29, 2011)
  • "Lockheed Martin Corp, SecureIDs, EMC, and All That"
    (May 28, 2011)
  • "China, Paper on How to Bring Down USA Power Grid: All a Big Misunderstanding?"
    (March 20, 2010)
  • "World Bank Group Network Hacked; Chinese IPs Used: Just What We Need"
    (October 10, 2008)
• Passwords, security, and common sense
  • "Cloud Computing, Dropbox, and the Postcard Principle"
    Apathetic Lemming of the North (May 13, 2011)
  • "Lemming Tracks: Bad News From Sony; and Getting a Grip"
    Apathetic Lemming of the North (May 3, 2011)
  • "Lemming Tracks: Epsilon Breach, Spam, and Getting a Grip"
    Apathetic Lemming of the North (April 6, 2011)
  • "Strong Passwords: It Can be Done"
    Apathetic Lemming of the North (January 1, 2011)
  • "International Cyber Crime Ring Busted: 'By Jove, I Think They've GOT It!' "
    Apathetic Lemming of the North (October 3, 2010)

In the news:

• "EXCLUSIVE: Northrop Grumman May Have Been Hit by Cyberattack, Source Says"
  Jeremy A. Kaplan, FoxNews.com (June 1, 2011)
• "Second Defense Contractor L-3 'Actively Targeted' With RSA SecurID Hacks"
  Kevin Poulsen, Threat Level, Wired (May 31, 2011)

---

¹ Excerpts from the news:

"Top military contractor Northrop Grumman Corp. may have been hit by a cyber assault, the latest in a string of alarming attacks against military suppliers...."

"...Lockheed Martin said its network had been compromised last week, and defense contractor L-3 Communications was targeted recently, as well. Both intrusions involved the use of remote-access security tokens, experts say.

"On May 26, Northrop Grumman shut down remote access to its network without warning -- catching even senior managers by surprise and leading to speculation that a similar breach had occurred...."

"...Charles Dodd, an information warfare consultant with Nisrad Cyber Research Institute, raised a scary possibility: Unmanned aerial vehicles such as the Predator can be controlled by computers. If hackers access those computers, can they operate those deadly drones?

" 'If adversaries get that technology, we may not be the one that controls those weapons,' he told Fox News.

"The network attacks spiral from a security breach in March, when hackers stole information related to RSA's SecurID access keys...."
(FoxNews.com)

---

"An executive at defense giant L-3 Communications warned employees last month that hackers were targeting the company using inside information on the SecurID keyfob system freshly stolen from an acknowledged breach at RSA Security.

"The L-3 attack makes the company the second hacker target linked to the RSA breach - both defense contractors. Reuters reported Friday that Lockheed Martin had suffered an intrusion.

" 'L-3 Communications has been actively targeted with penetration attacks leveraging the compromised information,' read an April 6 e-mail from an executive at L-3's Stratus Group to the group's 5,000 workers, one of whom shared the contents with Wired.com on condition of anonymity...."

"...Together, the attacks suggest the RSA intruders obtained crucial information - possibly the encryption seeds for SecurID tokens - that they're using in targeted intelligence-gathering missions against sensitive U.S. targets....

"...SecurID adds an extra layer of protection to a login process by requiring users to enter a secret code number displayed on a keyfob, or in software, in addition to their password. The number is cryptographically generated and changes every 30 seconds...."
(Wired)

² No 'survivalist' stuff: the water heater holds a pretty good supply of water, and the basement could be sealed off. It would have been cold and dark, though.