Hackers Breached US Army Servers 209
An anonymous reader writes "A Turkish hacking ring has broken into 2 sensitive US Army servers, according to a new investigation uncovered by InformationWeek. The hackers, who go by the name 'm0sted' and are based in Turkey, penetrated servers at the Army's McAlester Ammunition Plant in Oklahoma in January. Users attempting to access the site were redirected to a page featuring a climate-change protest. In Sept, 2007, the hackers breached Army Corps of Engineers servers. That hack sent users to a page containing anti-American and anti-Israeli rhetoric. The hackers used simple SQL Server injection techniques to gain access. That's troubling because it shows a major Army security lapse, and also the ability to bypass supposedly sophisticated Defense Department tools and procedures designed to prevent such breaches."
In other words ... (Score:5, Funny)
as usual, military contracting companies provided over-hyped shoddy work to the military, who either didn't know better or didn't care.
Of course, I thought it was going to be as simple as knowing that the password was "Joshua".
Comment removed (Score:5, Funny)
Re: (Score:2)
Now they sell their skills back at 3X the price as contractors and do not get treated like trash.
Small tip, US mil, treat your men and woman right.
Re: (Score:2)
Well said. If GP was correct, the US wouldn't have much to show for the trillions it spends. Since they have the capability to destroy the planet several times over, obviously the money was well spent.
Re: (Score:2)
How about this then: In 1965, we had the capability to destroy the planet several times over in a matter of a few hours. In 2005, we had the capability to destroy the planet several times over in a matter of a few hours. What exactly did we gain for our trillions of dollars spent between 1965 and 2005?
Re: (Score:2)
Re: (Score:2, Funny)
See I too can just over simplify stuff till my point seems reasonable.
Re: (Score:3, Insightful)
You're making an entirely different point from the one you think you're making.
Re: (Score:2)
weapons age and must be refreshed, much like computers.
target acquisition systems get better and should be upgraded/replaced (now we can destroy the world several times over to a precision of < 1m Vs ~1Km)
enemies get better defenses requiring an increasingly better offense to stay at parity.
Re: (Score:2)
How about this then: In 1965, we had the capability to destroy the planet several times over in a matter of a few hours. In 2005, we had the capability to destroy the planet several times over in a matter of a few hours. What exactly did we gain for our trillions of dollars spent between 1965 and 2005?
Perhaps the ability to win a war without destroying the planet?
Re: (Score:2)
You lost Vietnam war and haven't captured Osama yet.
Besides, how do you know the US has the capability to destroy the planet several times over? The army can't be trusted to be unbiased on their reporting, because they have an obvious incentive to make it seem that funding was well-spent rather than wasted, e
I know this is old but, (Score:5, Funny)
All your base are belong to us
Re: (Score:2)
Take off every 'Information Aggressor Squadron'!!
No it isn't (Score:2)
That's troubling because it shows a major Army security lapse, and also the ability to bypass supposedly sophisticated Defense Department tools and procedures designed to prevent such breaches.
Who know where these outward facing servers reside? Having outward websites vandalized says nothing about the security of an organizations networks.
Re: (Score:2)
Amateurs (Score:5, Funny)
If they want to prove a point they have to stop targeting US Defense facilities. Hack a serious portal like Slashdot if you can! Ha!
Re: (Score:2)
Re:Amateurs (Score:4, Informative)
Actually, if someone did a show-stopper like that it would be a bad thing for everyone. It would provide the impetus for the Internet to be split up into separate non-connected networks and walled gardens. These wouldn't be "mere" firewalls, these would be networks that would be either running a new (or old) network protocol (IPX is an example) or a non routable protocol such as NetBEUI (Don't confuse NetBEUI with NetBIOS... NetBEUI is the transportation and is obsolete, as TCP/IP has completely taken over that communication layer function over) or Appletalk.
Right now, a black hat can sit at his/her computer, and connect on the same network to virtually anything. Should people get too upset and knee-jerkish about a War Games scenario, he or she would have to spend a lot of time and effort trying to get gateways working to networks that have completely different protocols (IPX, VINES) in the effort to try to attack machines.
Compared to the past, a dedicated cracker just needs to focus on a relative small part of an OS or a service like Apache, IIS, or SQL Server for great gains. In the past, one had to jump from DECNet to BITNET to NSFNet, perhaps doing through multiple UUCP hops if the boxes were moving mail via store and forward and mdoems. Almost no host or network was the same as another, so a generic "script kiddy" who could run a prepackaged toolkit against a random company didn't exist back then.
Re: (Score:2)
Um....no
If the networks are not supposed to interoperate, you just don't connect them in the first place. You don't do something as dumb as relying on an old protocol to prevent access.
Amazing. (Score:5, Interesting)
Pardon the rant, but can anyone tell me why we're still having people write code that is subject to SQL injection attacks?
I mean, sometimes potential buffer overflows in C/C++ programs can be tricky to notice. Writing threading code that's not subject to deadlock or starvation can often be a challenge.
But isn't code that's subject to SQL injection attacks just blindingly, amazingly obvious at first glance?
Re: (Score:2, Informative)
Yes and No. If I want to have a program that I pass SQL queries to and it returns either safe or unsafe that is not a computable problem. There is no way to tell if a query is good or bad without context. That being said there are things like prepared statements that give the statements context, that is explicitly stating which parts of the query are control statements and which are data.
In a simple system you are correct but in a system of even moderate complexity telling if code is vulnerable to SQL in
Re: (Score:2)
Yes and No. If I want to have a program that I pass SQL queries to and it returns either safe or unsafe that is not a computable problem.
Are you sure? Your statement would only be obviously true if a single SQL statement can be a Turing-complete language.
Re: (Score:2)
Yes and No. If I want to have a program that I pass SQL queries to and it returns either safe or unsafe that is not a computable problem. There is no way to tell if a query is good or bad without context. That being said there are things like prepared statements that give the statements context, that is explicitly stating which parts of the query are control statements and which are data.
In a simple system you are correct but in a system of even moderate complexity telling if code is vulnerable to SQL injection becomes non-trivial. When you have to dig through 5 levels of inheritance several times to hunt down all the places where the query is actually formed it's not all that simple.
Perl taint mode. Sure, it it conservative, but if taint is complex enough that it does work, then I wouldn't trust a person to get it right with 100% accuracy.
Re:Amazing. (Score:5, Insightful)
How do you know the code was recently written? More likely, the app was written years ago, before the phrase "sql injection" was even coined.
Re: (Score:2)
Well, before they started calling it SQL injection, it was just invalid input. Since I was programming for an audience of millions, if even 0.1% of them were script kiddies, and 0.01% of them were good, my servers would have a life expectancy of days at most.
What's the big difference between:
SELECT user FROM auth WHERE username = 'foo';DROP TABLE auth;
and
(please forgive me for how wrong this is)
$result = `grep %in{sea
Re: (Score:2)
The way to protect against sql injection is not to "validate external input." It is to pass the external input to the database after telling the database what that external input should be representing (sql parameterization). Let the database decide if it is valid or not.
If you try and reinvent the wheel in every app, you will certainly make a mistake at some point. The guys who wrote the DB know more about this than you do; let them handle it.
Re: (Score:2)
Why would anyone let the website run with DROP TABLE or any other high level permissions? Shouldn't the website be using credentials with read only permissions. Maybe after the user logs in they can update their one record. Not anyone other record.
(Here is where I will be flamed to oblivion)
Or is this another case where the web dev says that they need full god rights on the DB server?
You should always run with just the permissions you need to get the job at hand done. Nothing more ever.
Re: (Score:2)
Ok, how about...
; update users set password = password('') ;
It was just a freakin' example, not a dictation of how to break things. {sigh}
Re: (Score:2, Funny)
I'd like you to stop by my work and bludgeon a few developers of mine over the head, if you would. Seems they're all too busy posting on a site called "BackSlash" or something to check their code.
Re: (Score:2)
As mentioned by other posters, since we don't know how old the system is, we can't really measure it against "modern" perceptions.
In addition, they could be a victim of this kind of thing:
Contractor: We'd like to make a prototype for a web site that will do XYZ.
Govt: K, here's some cash.
Contractor: Here's a prototype, now can we have some cash to convert it from a prototype into a real system?
Govt: Nah. I'd have to fill out a lot of paperwork for that. We'll just use the prototype.
Re: (Score:2)
Re: (Score:2)
Like everything else this system was built by the lowest bidder.
Re: (Score:2)
I thought Information Week was sensible. (Score:5, Insightful)
"Equally troubling is the fact that the hacks appear to have originated outside the United States. Turkey is known to harbor significant elements of the al-Qaida network. It was not clear if "m0sted" has links to the terrorist group."
Hooray for sensationalism!
Re: (Score:3, Funny)
Shhhh!!
And remember to bow to the cookie pushing overlords...
Their tactic of having two or more 6-7 year old girls say in perfect unison "Would you like to buy some girl scout cookies" is diabolical. This overloads one with their cuteness causing loss of some higher brain function. Which compels one to buy these cookies.
Re: (Score:2, Funny)
Front end compromise... (Score:5, Interesting)
I'm just playing devil's advocate but who puts their public website inside their defences?
I know it is an extremely common practice in this country to actually put sites like these on standard third party hosting services (e.g. Rackspace).
They set them up to be as secure as other e-commerce sites, so fairly secure, but without having to poke holes in a nice heavy firewall.
Re: (Score:2)
Who says it's behind their real defenses?
Look, it's a web server on the Internet. It's gonna need at least a firewall. Just like if they used Rackspace to host it and you were behind Rackspace's firewall. But there's also gonna be additional defenses for other systems.
And, btw, anything that's on the server is gonna be unclassified or somebody's goin' to jail regardless of the breach.
Re: (Score:2)
Re: (Score:2)
My point was less about the severity of the compromise and more about the nature of it being on "US Army Servers." I was just trying to show the distinction between the public facing kind of "US Army Servers" and the behind the scenes equipment that one might hope was secure.
SQL injections are fairly common, as have been buffer overflows. But while companies have responded to buffer overflows by making better compilers, better frameworks, and even new CPUs there has only been a slow crawl to a better way to
Re: (Score:2)
Are you seriously that clueless? Most relational database APIs have had parameterized query support since before what I'd think is the majority of slashdot had god damn computers. The only mainstream programming language that has lagged in its adoption (they were there, just not as visible as they could until the later versions) is PHP
Hyperbole? (Score:5, Insightful)
I didn't bother to RTFA, but summary is inflamatory at best.
A public-facing, high-profile (perception) server gets compromised? That's not news.
Let's say it is news for a minute. What was the budget for this public-facing project? This is not a "major Army security lapse" by any stretch of the imagination.
Of course, my line of thinking wouldn't be widely accepted because it ignores the emotional response that the summary probably provokes in most people.
Honeynet (Score:2)
Yeah. If you read about all of the shit the military keeps secret for decades, something tells me that information week wasn't able to pull something the military didn't want to give.
So, what would you do if you wanted to learn the technical capabilities of the enemy? Try to hack into their location, or set up some seemingly vulnerable services and watch what they do? Double bonus: "leak" the break-in (wink wink) to Information Week and see what kind of celebration activity you can see on the lines. Hell, I
Re: (Score:2)
Seems we don't have to know much about the situation to know one thing... a "major Army security lapse" is more like, say, strategic radio comm in the clear, close enough to be intercepted by the enemy, and results in casualties.
A public facing website that gets script-kiddied by some asshat from Turkey that thinks exploiting a site by SQL injection is Uber-L33t is not a major lapse. I'm pretty sure this is not weighing heavily on some 5-star's mind.
any good military has (Score:2)
1. good tactics
2. the ability to adapt new tactics as previously good tactics become irrelevant
one way a tactic becomes irrelevant is changing battlefield conditions. you don't fight in a swamp the way you fight in a desert, for instance
well, the internet is valid battlefield. and you fight on it with new tactics. it remains to be seen now if the us military understands that
1. it needs to take this battlefield seriously
2. it can develop good tactics to fight on this battlefield
but as it stands now, a bunch
Re:any good military has (Score:4, Interesting)
The US military is pretty much incapable of fighting a guerrilla war where the combatents are intermixed with civilians and civilian casualties are forbidden. It made Vietnam very difficult and it has made Iraq difficult as well.
What we have is a guerrilla war against hackers where they are effectiely shielded in most cases by the ISP and their own country's law enforcement. The end result is almost an unwinnable war.
We are winning in Iraq by ending the use of civilians as shields. We won in Vietnam by separating the combatants from the civilians. It is going to take that sort of effort to win against hackers, crackers and identity thieves. Unfortunately, right now the effort required to do this is intense enough that it is many, many times the losses so far. So I don't think they are going to do anything until the losses mount up a lot more.
What makes this worse is in order to effectively combat these people it is going to take either the cooperation of foreign law enforcement or just going around them. Neither one is going to make these other countries want to be our friends, but they seem to be happy with the hackers running around doing whatever.
goalposts. deliverables. (Score:2)
the goals in iraq and vietnam are different than that on the web. in irag and vietnam you have to go out there and police the countryside. on the web, you just have to hunker down and prevent intrusions. its the difference between riding out into the countryside and battening down the hatches on the castle. its a lot easier to secure a castle than police the entire countryside
Re: (Score:2)
Your analogy is flawed... Although you are right, that "policing the countryside" is difficult, securing the castle is very hard too, when you aren't allowed to pursue the repelled attackers. And, as far as I know, most of the military's tactics and doctrines rely on retaliating (or a threat thereof) as a deterrent.
And yet, retaliati
wrong (Score:2)
http://www.nytimes.com/2009/05/29/us/politics/29cyber.html [nytimes.com]
Re: (Score:2)
What you have is a few teenagers writing graffiti on the army bulletin board located outside the base. And yes, the War on Vandals is likely unwinnable. However, you might try declaring War on Exaggeration.
You didn't win in Vietnam, you lost and fled.
Re: (Score:2)
Wait... we won Vietnam?
Re: (Score:2)
We are winning in Iraq by ending the use of civilians as shields. We won in Vietnam by separating the combatants from the civilians. It is going to take that sort of effort to win against hackers, crackers and identity thieves. Unfortunately, right now the effort required to do this is intense enough that it is many, many times the losses so far. So I don't think they are going to do an
Excuse me? The US did not win the Vietnam War, unless the US was aiming to make Vietnam a communist country and have lots of casualties.
Wrong words - there is no war there (Score:2)
Re: (Score:2, Insightful)
That's doubtful at the best of times, but for the sake of argument entertain you.
No you haven't. There hasn't been any noticeable decrease in violence, just less reporting of it. Just because the US army has the media on a tight leash doesn't mean that you're winning, in fact this is about the only lesson the US armed forces learned in Vietnam and in my opinion the most useless one taught.
Ahh yes, we've all seen the famou
Re: (Score:2)
Continuing the military analogy... What great battles have been won purely by defense? Denying yourself he ability to "reach out and touch someone", will always give the advantage to those who seek to blow you up -- or to bring your server down.
Re: (Score:2)
Not really. Do you have any idea just how many computers have .mil addresses? If somebody screwed up on the configuration for an infinitesimally small percentage of them, that's still a lot of systems open to attack. And the script kiddies will get lucky.
But the US military also doesn't talk about their own "cyber" offensive and defensive capabilities for obvious reasons. Which leads to the erroneous presum
a different war has different goals (Score:3, Interesting)
the battle on the web is one of image and a communication capability and integrity. if the enemy can thoroughly trounce the image and capability of the military on the web, then that is a battlefield which is a valid battlefield and which has been won by the enemy. you thoroughly reject the validity of this battlefield. you are thoroughly wrong and woefully behind the times
your allegory of spraypainting graffiti on fences is inaccurate. it would be more accurate to say every flag in every corridor were turn
Re: (Score:2)
> if the enemy can thoroughly trounce the image and capability of the military on the web,
Another variant on this "lawfare", where you use the laws of a country against them. Boumediene v. Bush [wikipedia.org] is prime fodder for this.
Along the lines of what you were saying, Robert Coram's book about Medal of Honor recipient Colonel Bud Day [militarypr...glists.com] talks about how the North Vietnamese would show the POWs videos from back home to show that resistance was hopeless - e.g., John Kerry's testimony before the Senate. Same kind of t
right (Score:2)
you consider the battlefield invalid and low-priority
strange how people are so hard at work on this unimportant nonbattlefield, eh?
pfffft (Score:2)
SQL Injection? *Yawn* (Score:5, Funny)
Re: (Score:2)
Meh. Locking your doors only means paying to replace a broken window along with your missing stuff. If the thief is determined, that is.
Re: (Score:2)
Re: (Score:3, Funny)
Sensitive? (Score:2)
It appears the servers in question were used for serving up web sites. Probably publicly-facing web sites. So, what sensitive information was at risk? There are already regulations about what content can be approved to sit on a DoD server with a publicly-facing web site.
Again????? (Score:4, Insightful)
Again?
Slashdot requires you to wait longer between hitting 'reply' and submitting a comment.
It's been 17 seconds since you hit 'reply'.
Chances are, you're behind a firewall or proxy, or clicked the Back button to accidentally reuse a form. Please try again. If the problem persists, and all other options have been tried, contact the site administrator.
So, what do I need to do, type really really slow?
Re: (Score:2)
So, what do I need to do, type really really slow?
Maybe you can package your comment as the payload of an SQL injection?
Cyber Security Cadence (Score:4, Funny)
I don't know what I've been told
But Army server's are quickly pwned
You don't need some high-tech decryption machine
Just a string with a semi-colon in between
I don't know what I will find
When good Army hacker's have resigned
We'll have a good laugh when some bored kid in China
Posts photos of Gen. Petraeus with a vagina
Big Deal (Score:3, Insightful)
In other words just because the front end website for the Army got defaced that means nothing. It is like defacing the IRS website. It means nothing till you have peoples tax returns being rerouted to your personal bank account.
Mass Defacement Contest (Score:2)
Turkish hackers are well known to compete on mass defacement contests.
When preparing a contest, they scan all IPs to locate vulnerable sites.
When the contest starts, they deface the maximum number of sites in a given amount of time (probably one hour in this case).
They always go for the quickest way to hack a site, and so, they are not really hackers but script-kiddies.
TFA is completely bullshit, since the hackers don't care about the content of the sites.
BTW, why does the army still keeps vulnerable Window
Ho hum (Score:5, Insightful)
"Oh...but the breach reveals the military's vulnerability."
Does it? To what?
Answer: To webserver page redirection.
Might there be greater risk here? Perhaps. But no evidence was presented to indicate that. Get back to me when you've identified a MATERIAL RISK, not merely a TECHNICAL VULNERABILITY.
As for those of you who have hopes and expectations that ALL THINGS MILITARY will be secure...WTF?
Re: (Score:3, Insightful)
Re: (Score:2)
"Oh...but the breach reveals the military's vulnerability."
Does it? To what?
Answer: To webserver page redirection.
Might there be greater risk here? Perhaps. But no evidence was presented to indicate that. Get back to me when you've identified a MATERIAL RISK, not merely a TECHNICAL VULNERABILITY.
The military has to look at an opponent and asses capabilities.
Not actual abilities, but possible capabilities.
So while you say "technical vulnerability," a security oriented person says "everyone who visited that web page could have been thoroughly pwned with trojans". If that doesn't qualify as a material risk, what does?
As for those of you who have hopes and expectations that ALL THINGS MILITARY will be secure...WTF?
Even the lowliest of web security scanners checks for SQL injections.
ONOES! (Score:2)
Users attempting to access the site were redirected to a page featuring a climate-change protest.
OHNOES! They breached the admin net!
There's a reason why the protected A/B network is accessible to the intarwebs and the L2 or higher networks are not. This may be interesting from a hacktivism standpoint... but it's not terribly newsworthy... or, at least, it's not got nearly as much shock value as the summary purports it to have.
whoa (Score:2)
SQL Injection? (Score:5, Insightful)
I'm hardly one to defend MS products, but come on.
SQL injection is hardly "a security vulnerability in Microsoft's SQL Server database." SQL injection is a result of badly written code. Nothing more. There is never an excuse for that to occur, even in environments where security isn't the top priority.
The whole article feels a bit off to me. I get the sense it was written by somebody with little technical cluefulness. I particularly like the line about "sophisticated Defense Department tools and procedures designed to prevent such breaches" followed by a sentence identifying AV software. Written by a dummy, for similarly intelligent people, perhaps?
I don't speak turkish (Score:2)
Re:wood for the trees (Score:5, Insightful)
Why aren't classified information on a separate network, not connected to the Net? Please: this is not 1980 anymore - protect critical information seriously.
Re: (Score:3, Insightful)
How do you know that classified intelligence was even obtained? Why are you even assuming that the security of these servers, an ammunition plant and the Army Corps of Engineers no less, will have the same security as that of the Pentagon? Did it ever occur to you that perhaps the Army would appropriate security based on how vital their assets are?
Re:wood for the trees (Score:5, Insightful)
Re:wood for the trees (Score:5, Insightful)
Why aren't classified information on a separate network, not connected to the Net
It is, in fact there are multiple, separate networks.
Other than the author repeating the word "sensitive" over and over again, there wasn't anything concrete in the article about whether the information was actually classified. I suspect it wasn't.
Re:wood for the trees (Score:5, Informative)
Re: (Score:2)
The important part was "Beyond the redirects, it's not clear whether the group was able to obtain sensitive information from the Army's servers. "
They didn't get any "sensitive" information. Sure as heck they didn't get any classified information. They breached a public web site, hosted on a public network. I seriously doubt the server was even physically close to any classified information, much less attached to a network with any, or contained any itself.
The
Re: (Score:2)
Unless the hackers got fake "classified" information only on display so they stop trying to get the real stuff, what the public knows probably doesn't matter much.
Re:wood for the trees (Score:5, Informative)
Re: (Score:2, Insightful)
That is not true. When you work for a military contractor you would be amazed at the amount of classified information which is available on the shared drives.
No--it is not directly available to the internet, but how many exploits does it take to hijack a browser and gain a command prompt or a vector to the injection of bytecode? How about hijack a browser and progressively insert holes in the compromised system until a backdoor can be opened? Sure, going to www.military-contractor.com and trying to force
Re: (Score:3, Interesting)
Re: (Score:2, Insightful)
The folks that take care of the important stuff aren't stupid and are highly paranoid.
Not sure where you're getting your facts from, but from my years in the military I'd venture to say that you're a bit overconfident. There are plenty of ways for sensitive data [salon.com] to find its way into the hands of outsiders.
Re:wood for the trees (Score:4, Informative)
Re: (Score:2, Informative)
Re: (Score:3)
Classified+ information isn't available off a webserver on the Internet. If it is, someone would be being headed to the military prison at Leavenworth for a very long time.
Re: (Score:2)
Re: (Score:2)
Classified Info Is On Separate Servers (Score:3, Interesting)
Re: (Score:2)
Re: (Score:2, Funny)
I too can provide vague, uninteresting and falsified anecdotal evidence, look at me go!
Re:Wait... (Score:4, Interesting)
This isn't too hard to find out. Look for GS military IT jobs, and see what they're hiring for. Lots of Windows crap. They still do have *nix positions, just not as many.
Of course, a 1 admin to 10 windows machine ratio is acceptable, as a 1 admin to 50 Linux machine ratio is acceptable. They have a LOT of workstations out there that need tending to.
Re: (Score:2)
It's sad the the Microsoft sales people are better.
People bitch about the MS tax, and go pirate Windows and Office for their home computers, but that doesn't even make a dent in their income. They make HUGE money off government and corporate contracts.
Re: (Score:2)
Re:Wait... (Score:5, Funny)
Don't you mean "Windows For Warcraft"?