[iwar] [fc:Key.U.S..Computer.Systems.Called.Vulnerable.To.Attack]

From: Fred Cohen (fc@all.net)
Date: 2001-09-27 06:46:47
Next message: Fred Cohen: "[iwar] [fc:CNN.should.be.renamed]"
Previous message: Fred Cohen: "[iwar] [fc:Taliban:.Portrait.of.a.Lunatic.Asylum.(egg.on.all.faces)]"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Message-Id: <200109271346.GAA12137@big.all.net>
To: iwar@onelist.com (Information Warfare Mailing List)
Organization: I'm not allowed to say
From: Fred Cohen <fc@all.net>
Mailing-List: list iwar@yahoogroups.com; contact iwar-owner@yahoogroups.com
Precedence: bulk
Date: Thu, 27 Sep 2001 06:46:47 -0700 (PDT)
Reply-To: iwar@yahoogroups.com
Subject: [iwar] [fc:Key.U.S..Computer.Systems.Called.Vulnerable.To.Attack]
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 8bit

Key U.S. Computer Systems Called Vulnerable To Attack 
By Robert O'Harrow Jr, Washington Post, 9/27/2001
<a href="http://www.newsbytes.com/news/01/170554.html">http://www.newsbytes.com/news/01/170554.html>

As the Bush administration prepares to fight terrorism abroad, it faces
a long-standing vulnerability at home: a persistent lack of security for
computer systems at the Defense Department, the Federal Aviation
Administration and other key government offices. 

Despite repeated warnings about the threat foreign governments,
terrorists and hackers pose, at least 24 federal agencies have failed to
adopt effective security to protect their computers and networks from
attacks over the Internet, according to government reports, computer
experts and former intelligence officials. 

Many agencies still do not use passwords properly, some cannot detect
intruders, and government systems overall are so porous, specialists
say, that hackers can use even an innocuous agency's network to breach
other, more sensitive systems via the Internet. 

Chinese hackers, angered by the death of a Chinese pilot in a collision
with an American spy plane, were able to deface several government Web
sites in April.  In a case last year, a computer virus breached Defense
Department security, damaging some computers and infecting some
classified systems. 

With the number and sophistication of computer attacks rising, "a clear
risk exists that terrorists or hostile foreign states could launch
computer-based attacks on systems supporting critical infrastructures to
severely damage or disrupt national defense or vital public operations
or steal sensitive data," the General Accounting Office concluded this
spring. 

Robert Dacey, director of information security issues at the GAO, told
Congress in April that major agencies' systems "are riddled with
weaknesses" that "place a broad array of federal operations and assets
at risk of fraud, misuse and disruptions."

The National Security Agency, the supersecret electronic spy agency that
also protects U.S.  codes, has warned that foreign governments have
already developed ways to attack U.S.  computer systems.  Officials
worry about attacks involving computer viruses that might disrupt
communications, destroy sensitive information or disable such sensitive
operations as the FAA flight control system or those that support
Pentagon war efforts. 

Bush administration officials said they recognize the exposure and plan
to issue an executive order in the next few weeks to create an office of
cyber-security in the National Security Council office in the White
House to deal with it.  Yesterday, an FBI official told a House
subcommittee that the bureau and other agencies are working on the
problem. 

The problem extends beyond the government.  Many businesses also have
failed to make security a priority in recent years and have suffered the
same sorts of disruptions.  Security specialists warn that power grids,
banking networks and other key private computer systems could be
targeted. 

Previous initiatives to defend government computers have foundered, in
some cases because of budget troubles or bureaucratic squabbling.  The
National Infrastructure Protection Center, set up at the FBI in 1998 to
detect and help prevent cyber-threats, didn't have enough specialists to
staff a 24-hour unit to monitor the Internet, in part because of FBI
budget restraints, another GAO report found.  And the CIA and National
Security Agency left key posts at the center vacant for more than a
year. 

A Defense Department plan to protect its sprawling global computer
systems, promised after audits found glaring security weaknesses, missed
its own deadlines because the agency didn't hire enough managers to run
the initiative, the GAO found. 

"It leaves us all very vulnerable, and nobody has been paying
attention," said Sallie McDonald, the assistant commissioner of the
Office of Information Assurance and Critical Infrastructure Protection
at the General Services Administration.  "It's not just hackers that we
have to be worried about.  It's nation states."

A senior FBI official said that "while government systems have
vulnerabilities which are being exploited, the agencies are working
extremely hard to formulate and implement policies to reduce those
risks."

The number of attacks has soared in recent years.  Three years ago, the
Federal Computer Incident Response Center counted 376 incidentsaffecting
2,732 federal systems and 86 military systems.  Last year, the number of
incidents reported was 586, involving 575,568 federal systems and 148
military systems. 

In July, for example, the "Code Red" computer worm infected thousands of
government computers.  The White House had to change its Web site
address to avoid the worm and the Pentagon temporarily blocked access to
some areas of its public Web site while it installed protective
software.  A few months earlier, the Chinese hackers invaded government
and business Web sites -- including those run by the Navy and the
departments of Labor and Health and Human Services.  Last year, an
attack program called "ILOVEYOU" penetrated systems at the Defense
Department, the CIA and at least a dozen other agencies, as well as an
array of private companies such as AT&amp;T and Ford. 

The vast majority of incidents are never reported, however, in part
because some agencies sometimes cannot detect when a hacker has gained
access to their files, officials said. 

Last year, Congress mandated better security procedures, including a
requirement that agencies give the Office of Management and Budget
reports detailing assessments of computer security, starting this fall. 
Frank Cilluffo, a senior policy analyst at the Center for Strategic and
International Studies,a policy think tank, said security will not
improve until the government better coordinates and funds its efforts. 
"There's been a whole lot of talk and not a lot of action.  .  .  . 
There's no accountability," he said, adding that policymakers have never
had to confront a security breach even close to the severity of the
attacks on Sept.  11.  "There's no one pulling all these pieces
together."

He added: "This is an issue that hasn't been in the mainstream.  Now
it's something that decision-makers, policymakers and others have to act
upon."

Among the 24 agencies cited by inspectors general and the GAO for
serious security gaps are the departments of Justice, State and the
Treasury and the Nuclear Regulatory Commission.  Problems include: o
U.S.  Army Corps of Engineers systems had "serious vulnerabilities" that
would allow both hackers and numerous legitimate users "to improperly
modify, inappropriately disclose and/or destroy sensitive and financial
data," according to a GAO report in October.  The weaknesses increase
the vulnerability of other Defense Department networks and systems to
which the Corps's network is linked, it added.  o The FAA has routinely
failed to secure physical access to its computer systems in recent
years, and in several cases it failed to conduct background checks on
auditors who have access to sensitive information.  "FAA's efforts to
prevent unauthorized access to data are inadequate in all critical areas
we reviewed -- personnel security, facility physical security, system
access security," the GAO reported last September.  "Until FAA addresses
the pervasive weaknesses in its computer security program, its critical
information systems will remain at increased risk of intrusion and
attack, and its aviation operations will remain at risk," Joel C. 
Willemssen of the GAO told the House Committee on Science. 

o The Environmental Protection Agency continues to have "pervasive
problems that essentially rendered EPA's agency-wide information
security program ineffective," according to a July 2000 GAO report. 
About the same time, hackers used an EPA site as a chat room to conduct
electronic conversations.  Officials said the EPA has been making
efforts to bolster security, but problems remain. 

o Auditors examining seven Commerce Department systems broke through
security using the Internet and were in a position to "read, copy,
modify, and delete sensitive economic, financial, personnel, and
confidential business data."

One of the problems, investigators said, was that network users could
gain extraordinary access to certain department databases simply by
logging on as a systems administrator.  No password was necessary. 

Reported by Washingtonpost.com, <a
href="http://www.washingtonpost.com">http://www.washingtonpost.com>
06:20 CST (20010927/WIRES TOP, ONLINE, PC, TELECOM, BUSINESS/) © 2001
The Washington Post Company

------------------------ Yahoo! Groups Sponsor ---------------------~-->
Pinpoint the right security solution for your company- Learn how to add 128- bit encryption and to authenticate your web site with VeriSign's FREE guide!
http://us.click.yahoo.com/yQix2C/33_CAA/yigFAA/kgFolB/TM
---------------------------------------------------------------------~->

------------------
http://all.net/ 

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/
Next message: Fred Cohen: "[iwar] [fc:CNN.should.be.renamed]"
Previous message: Fred Cohen: "[iwar] [fc:Taliban:.Portrait.of.a.Lunatic.Asylum.(egg.on.all.faces)]"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
This archive was generated by hypermail 2.1.2 : 2001-09-29 21:08:50 PDT