11:02 AM
Connect Directly

Web Probes On Defense Contractors Rising

Rapidly increasing rates of industrial espionage against the U.S. defense industry puts military technology at risk, report says.

Internet-based attempts to steal U.S. military technology via defense contractors are on the rise, according to an annual Department of Defense analysis of data supplied by the defense industry.

Not only are network probes and intrusions on the increase, the Department of Defense said in the report, which it released late last month, but so are "bold and overt" requests for information made via e-mail and even social networks.

Information systems are the most-heavily targeted of military technologies, according to the report, closely followed by aeronautics. Efforts to get details on unmanned aerial vehicle technology are becoming so widespread that the report broke out a separate section about UAVs, finding that, there, too, foreign elements are looking for information on UAV IT systems.

The report was written by the Defense Security Service (DSS), a branch of the DoD that, among other things, works with the defense industry to protect military technology. The DSS draws on individual reports of suspicious contacts that it collects from the defense industry and analyzes that data in annual reports.

"The United States' technical lead, competitive edge, and strategic military advantage are at risk; and our national security interests could be compromised," DSS director Kathleen Watson wrote in the report's introduction. "The attack is pervasive, relentless, and unfortunately, at times, successful."

Last year, for example, reports emerged that hackers had breached sensitive data on the next-generation U.S. Joint Strike Fighter program. That attack was said to have come from China. A top executive at another government contractor that does business with the DoD recently told InformationWeek that attacks are indeed on the rise, and that his company is spending an increasing amount of time on cybersecurity issues.

In addition to the DSS, several other government efforts, among them the Department of Homeland Security's National Infrastructure Protection Plan and the military's Defense Industrial Base Information Assurance Task Force, aim to help ensure sensitive military data held by defense contractors remains secure.

According to the DSS report, while foreign governments still pose a huge risk, probes by commercial entities are growing at nearly double the rate at which those by governments are growing. The report attributed this to likely purposeful attempts to make overt contacts "seem more innocuous."

Most attempts to exploit U.S. military technology appear to be coming from East Asia and the Pacific (including China, the Koreas and Japan), which represented 29% of the total suspicious contact data. These areas were followed by the Near East (including the Middle East), and Europe and Eurasia (including Russia and Eastern European countries known for hacking).

The report suggests that the only reason Europe and Eurasia aren't higher on the list is that they may be more successful at covert espionage that goes unnoticed.

Overall, direct requests for information, whether by e-mail, phone calls, or marketing surveys looking for things like price quotes and system information, are the preferred method of operation, the report finds.

The report attributes this to ever-increasing Web connectivity and the ease of e-mail and online requests for information. Suspicious Internet activity, including intrusions and spam, represent the second most popular avenue of attack.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Current Issue
Dark Reading Tech Digest September 7, 2015
Some security flaws go beyond simple app vulnerabilities. Have you checked for these?
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-08
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Published: 2015-10-08
Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 mishandles authentication requests, which allows remote authenticated users to conduct LDAP injection attacks, and consequently bypass intended login restrictions or obtain sensitive information, by leveraging certain group-administration privile...

Published: 2015-10-08
The REST interface in Cisco Unified Communications Manager IM and Presence Service 11.5(1) allows remote attackers to cause a denial of service (SIP proxy service restart) via a crafted HTTP request, aka Bug ID CSCuw31632.

Published: 2015-10-08
Cisco Wireless LAN Controller (WLC) devices with software 7.0(240.0), 7.3(101.0), and 7.4(1.19) allow remote attackers to cause a denial of service (device outage) by sending malformed 802.11i management data to a managed access point, aka Bug ID CSCub65236.

Published: 2015-10-06
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 21335999.

Dark Reading Radio
Archived Dark Reading Radio
What can the information security industry do to solve the IoT security problem? Learn more and join the conversation on the next episode of Dark Reading Radio.