Risk
3/1/2012
12:49 PM
50%
50%

NASA Breaches Leak ISS Control Code

A laptop computer--one of 48 devices that went missing from the space agency between 2009 and 2011--contained algorithms to command the space station.

Top 10 Open Government Websites
Top 10 Open Government Websites
(click image for larger view and for slideshow)
A laptop computer stolen from NASA in March 2011 contained algorithms used to command and control the International Space Station (ISS), one of a number of breaches that raise new concerns about the agency's ability to protect sensitive data, an agency watchdog official told Congress.

NASA reported the loss or theft of 48 computing devices between April 2009 and April 2011, resulting in the unauthorized release of private data, including ISS control codes, NASA Inspector General Paul Martin said in his written testimony submitted to the House Committee on Science, Space, and Technology.

Martin testified before the committee about NASA's IT security, which apparently is lacking when it comes to protecting data. Although NASA also has leaked sensitive data through lost hardware and other ways over the last several years, the agency continues to lag behind others in encrypting its data, he said.

In addition to the ISS codes, the laptops that went missing also contained personally identifiable information, third-party intellectual property, social security numbers, and sensitive data on NASA's Constellation and Orion programs, according to Martin.

[ See our complete RSA 2012 Security Conference coverage, live from San Francisco. ]

What's more, the agency has no way to accurately gauge the amount of data that could be released when laptops are lost or stolen because it does not review backup files to determine what was stored on them. Instead, it relies on employees to report on the lost data, according to Martin's testimony.

Laptop theft or loss is not the only threat to NASA data. The agency is increasingly the target of specialized attacks called "advanced persistent threats" (APTs) that are "particularly well-resourced and committed to steal or modify information from computer systems and networks without detection," said Martin in his testimony.

The APT hacker groups are highly organized and well-funded and may lurk inside NASA's network even after the agency has fixed the vulnerability, he added.

In fiscal year 2011, NASA reported 47 APT attacks, 13 of which compromised agency computers. Moreover, Martin reported that credentials for more than 150 NASA employees were stolen during those attacks.

The problem may lie because NASA historically has been slow to adopt full-disk encryption on notebook and other mobile computing devices, even as its counterparts in other agencies are doing so. The Office of Management and Budget reported that government-wide encryption for these devices is at 54%, but as of Feb. 1, 2012, only 1% of NASA devices were encrypted, according to Martin.

"Until NASA fully implements an agency-wide data encryption solution, sensitive data on its mobile computing and portable data storage devices will remain at high risk for loss or theft," he said.

InformationWeek and InformationWeek Government are conducting a survey on IT security and cybersecurity in U.S. federal government agencies. Upon completion of our survey, you will be eligible to enter a drawing to receive an Apple 16-GB iPad 2. Take our Federal Government Cybersecurity Survey now. Survey ends March 9.

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Fill
50%
50%
Fill,
User Rank: Apprentice
3/1/2012 | 7:30:21 PM
re: NASA Breaches Leak ISS Control Code
It is surprising that NASA, of all agencies, doesn't use encryption more. Encryption is built into some OSs these days and otherwise is pretty simple to use with third party apps (free and commercial).
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3407
Published: 2014-11-27
The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 9.3(.2) and earlier does not properly allocate memory blocks during HTTP packet handling, which allows remote attackers to cause a denial of service (memory consumption) via crafted packets, aka Bug ID CSCuq68888.

CVE-2014-4829
Published: 2014-11-27
Cross-site request forgery (CSRF) vulnerability in IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, allows remote attackers to hijack the authentication of arbitrary users for requests tha...

CVE-2014-4831
Published: 2014-11-27
IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, allow remote attackers to hijack sessions via unspecified vectors.

CVE-2014-4832
Published: 2014-11-27
IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, allow remote attackers to obtain sensitive cookie information by sniffing the network during an HTTP session.

CVE-2014-4883
Published: 2014-11-27
resolv.c in the DNS resolver in uIP, and dns.c in the DNS resolver in lwIP 1.4.1 and earlier, does not use random values for ID fields and source ports of DNS query packets, which makes it easier for man-in-the-middle attackers to conduct cache-poisoning attacks via spoofed reply packets.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?