Slashdot Log In
NSA Takes On West Point In Security Exercise
Posted by
Soulskill
on Sun May 11, 2008 08:00 AM
from the with-friends-like-these dept.
from the with-friends-like-these dept.
Wired is running a story about a recent security exercise in which the NSA attacked networks set up by various US military academies. The Army's network scored the highest, put together using Linux and FreeBSD by cadets at West Point. Quoting:
"Even with a solid network design and passable software choices, there was an element of intuitiveness required to defend against the NSA, especially once it became clear the agency was using minor, and perhaps somewhat obvious, attacks to screen for sneakier, more serious ones. 'One of the challenges was when they see a scan, deciding if this is it, or if it's a cover,' says [instructor Eric] Dean. Spotting 'cover' attacks meant thinking like the NSA -- something Dean says the cadets did quite well. 'I was surprised at their creativity.' Legal limitations were a surprising obstacle to a realistic exercise. Ideally, the teams would be allowed to attack other schools' networks while also defending their own. But only the NSA, with its arsenal of waivers, loopholes, special authorizations (and heaven knows what else) is allowed to take down a U.S. network."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
More details, anybody? (Score:5, Interesting)
Why does this require "custom tools" with automatic monitoring? Really, I doubt the students know the details of asymmetric security theory / Ph.D. level mathematics, and were monitoring something like (if I get a port scan from IP x.x.x.x then tell "router guys" to block IP x.x.x.x).
It seems to me that this should be something that essentially should be done automatically, and with a very well-configured system would not cause that much of a problem.
Also, the article was written for somebody who doesn't understand computers to go "whoa." "Kernel-level rootkit"? How the hell did this "unwelcome executable file" get on the box to begin with, and why was it executing in kernelspace? I assume they were required to start with a compromised system, otherwise this is something that major corporations do all day (general traffic monitoring) and is actually kind of not exciting.
I wish that Wired and magazines would write at a technical level and describe accurately what is going on - IMHO more information is always better!
I was in the exercise... (Score:5, Informative)
As for the 'custom tools', I have no idea what they are talking about. We used native Windows logging and a few open source programs to pull logs to a log server, but that was about it for extra programs. I would agree that the article was written for the non-technical person, but those are the kinda of questions they were asking us when the reporter was here.
Parent
Curious (Score:2)
Sort of ignorant on their part, that they would expect you to keep security on one of the most critical networks in the world and not have proper tools.
Example: image the drive, make it read only, no execute and use tools like rkhunter, and many other programs to see what is running on the system under test.
To me, having a compromised machine on a military network would get it a instant pulled plug, and
Re:Curious (Score:4, Informative)
Parent
Re: (Score:3, Informative)
Re:I was in the exercise... (Score:5, Informative)
The network directive given out to the academies had stipulation they had to follow, and a scenario that reflected real world situations (the cadets were setting up a network that included VMs of computers they HAD to include in their network). The network directive also had costs associated with anything the cadets wanted to do. So if they wanted to park a cadet at a Snort terminal for the duration of the exercise, that had a cost associated with it, as did setting up VLANS, using IPSEC, other IDS sensors, firewalls, host/service monitors, etc. Each academy had to submit their network structure for review and approval prior to STARTEX. The scenario reflects real world situations that would come up in most operations that involve other allied nations.
The NSA was strictly there to attack the networks and document any exploits they succeeded with. I can't go into details as to what our Rules of Engagement were, but suffice to say that we met with success with every school that was actually scored (the two graduate schools that participated were not scored).
The whole goal of the exercise is to prepare the cadets for SECURING a network against information security threats. It is a DEFENSIVELY ORIENTED exercise. The cadets don't do any hacking (and I honestly think that unless a gifted or experienced cadet was at an academy with the skills to do a network penetration, they would not meet with much success).
Parent
Re: (Score:2, Interesting)
Re:More details, anybody? (Score:4, Insightful)
Parent
You have to understand (Score:3, Funny)
Re: (Score:2)
We send all our orders through the Requisitions Dept.
/In triplicate.
Re: (Score:3, Insightful)
Rootkit is payload... (Score:2)
Re: (Score:2)
TFA says they used Sysinternals RootkitRevealer to find it, which means it was a Windows exploit. The NSA guys probably just waved the rootkit in the general direction of kernel32...
Re: (Score:2)
Re: (Score:3, Informative)
But the kernel-level rootkit was much more dangerous. This stealthy operating-system hijacker can open unseen "back doors" into even highly protected networks. When they detected the rootkit's "calls home" the cadets launched Sysinternal's security software to find the hijacker, then they manually scoured the workstation to find the unwelcome executable file.
Since the article says the West Point team was running Linux/BSD, and specifically mentions that the cadets were running a "Fedora Core 8 Web server", I'm guessing the Windows system was being run by one of the other teams.
Frankly, I was underwhelmed by the whole story. It was pretty clear the journo doesn't have a clue what was going on. Wired should be able to do better than that.
Re: (Score:2)
Re:Rootkit is payload... (Score:4, Informative)
Parent
Re: (Score:2)
The point of that part of the exercise being how good you are at detecting threats from the inside (far more common due to users introducing viruses and trojans from web sites they stupidly vision, hijacked browsers, programs loaded from thumb drives, CDs burned at home, etc.
Sysinternals? Windows? (Score:2)
Re: (Score:2, Interesting)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Informative)
Opposing Force Commander, Gen. Paul van Ripen won.
He was not invited back
Cadets do not learn, they just get to press the "refloat" icon.
http://www.nytimes.com/2008/01/12/washington/12navy.html?ex=1357794000&en=a4dbb42d5ad2a700&ei=5088&partner=rssnyt&emc=rss [nytimes.com]
"The sheer numbers involved overloaded their ability, both mentally and electronically, to handle the attack,.. "
West Point Club (Score:2, Informative)
This isn't really an official extension of West Point, but rather a club at West Point known as SIGSAC.
The club's members every year get a chance to visit the NSA and see some rather interesting stuff, and so has a rather good relationship with the NSA in general.
The club itself operates out of West Point but has a network connection that isn't attached to West Point's network. It has actually participated in contests in the past as well with other schools/groups, so unless something's changed in the pas
Re:West Point Club (Score:5, Informative)
Parent
Pentagon hacker Gary McKinnon could do it... (Score:2)
http://arstechnica.com/news.ars/post/20060712-7249.html [arstechnica.com]
ENDEX (Score:2, Informative)
IF Asked AND IF Unclassified, the agency/party MAY provide a copy of the ENDEX.
Contact the Acadamies, NSA, even the Departments of Defense, Army, Air Force, Navy.
ENDEX's have event logs, referee notes, exercise build and teardown plans....
There is no cleaning a rootkit (Score:4, Insightful)
When you detect malware installed on your system, wipe and reinstall. Always! There is no "cleaning".
Probably wasn't possible given the parameters of the test, but they tried to clean a rootkit and got the predictable result.
Go Army (Score:3, Funny)
];)
Been There, Done That (Score:5, Interesting)
I invited NSA to run their red team against a classified intelligence network I ran back in the '90s. That's back when nearly every security tool was of your own creation. I was running SunOS 4.1.3, so at least I had a little help from OS security options.
They had to come on-site to break us and they identified only one finding for which we didn't already have fix planned or in work. We considered that a raging success!
The most embarrasing moment was when they broke the System Security Officer's password with an expanded dictionary attack. I got to kid her about that for months! "How's your password today?" "Strong, dammit!"
Register the Trainees (Score:5, Interesting)
Leaving aside the separate and important issue of Congressional and other oversight to ensure the military crackers operate always under proper law and in the formal national interest, what happens to these people when they leave government service? We'll have created dangerous people whose careers are dedicated to acts that are illegal, and threaten national (and private) security if they are used in attacks outside the proper military context. Sure they're like any other armed soldier, whose many other developed skills are valuable in many contexts not violence. But the fact is that many retired soldiers do find their skills and interests best fit a police or private security career, and even as paramilitary mercenaries - some of which private armies are emerging as serious threats to world stability in its balance of power. Military crackers are different, though: there is little or no role in non-military police, and virtually no legal role in private employ cracking anything.
We are creating an army of high-end crackers who will find themselves leaving the military, and available for hire by the legions of private employers whose use of them to crack systems is mostly illegal, or even acts of war.
We should consider how to track these people and their later activities. Working to secure and to test secure systems with permission of their owners is a valuable asset to keeping us all safe, whether as national service or in private employment. But leaving lots of them floating around loose practically guarantees that at least some of them will find jobs illegally cracking systems without the owners' permission, to do crimes, or perhaps even working for foreign militaries running attacks without coordination with proper US foreign policy, perhaps against our allies, perhaps against us, perhaps even just destabilizing some balance worked out among our enemies.
We are creating many serious potential threats, as part of our programme to reduce and eliminate threats. Part of that programme should be minimizing the increased threat we're creating with them. There's got to be a way to help these people continue their careers with the most freedom, which will overall increase security (and their personal benefit) that doesn't let some few people turn against their training (and likely oaths to "be good").
Which trainees? (Score:3, Insightful)
Re: (Score:3, Insightful)
The military has been graduating experts in the "black arts"* since the inception of organized militaries. Guys who know basic hand to hand combat, firearms skills. Advanced soldiers learn even more technical and lethal combat skills. I'm not saying that every soldier is a killing machine, but that is what they train for. Black hat network uber hacker on the "outside" a real threat? As veterans, aren't they already sort of registered? They've got their DNA on file. What more do you want from t
Re: (Score:3, Interesting)
Just registering "our" crackers' DNA isn't going to do anything to ensure they don't blow back on us. I'm talking about tracking these people's careers, probably combined with a referral program to help them get jobs assisting legitimate emp
Heaven forbidden (Score:5, Funny)
- RG>
Re:Fantastic (Score:5, Insightful)
Parent
Re:Fantastic (Score:4, Funny)
Parent
Re:Fantastic (Score:4, Insightful)
Parent
Re: (Score:2, Informative)
Re:What's with the fearmongering? (Score:5, Informative)
Under Secretary of Defense for Intelligence
* Defense Intelligence Agency
* Defense Security Service
* Counterintelligence Field Activity
* National Geospatial-Intelligence Agency
* National Reconnaissance Office
* National Security Agency
Parent
Re: (Score:2)
According to wikipedia [wikipedia.org]
I know this is a bit citation Nazi-ish, but please don't cite Wikipedia directly. Any random yahoo could have thrown that up 5 minutes ago... hell you could have made that edit 5 minutes ago!
That entire intro paragraph doesn't have one citation other than a passing reference to Title 10 USC
Just sayin'...I'd like to read the part of the USC that sets up the NSA but honestly that's a big law document to parse
Re: (Score:2)
No Such Agency? Whatever gave you the idea that enough information about NSA was put into the USC to make a big law document?
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
You mean those PhD mathematicians sit around all day hitting Control-C's?
Given the supercomputing clusters they no doubt have at their disposal, they could be generating a lot of SIGINT that way.
Re: (Score:2)
http://en.wikipedia.org/wiki/Social_promotion [wikipedia.org]
Re: (Score:3, Interesting)
Let me guess - did an Air Force recruiter tell you that?
Re:Academy academics (Score:5, Interesting)
I'm not saying the Army is any more intelligent than any other branch. We have some really dumb people. The Army trains so that the dumbest kid on the block can do the job perfectly, every time.
Parent