The True Story: Two U.S. Nuclear Labs "Hacked"
December 8, 2007 5:49 PM
comment(s) - last by
Two labs of America's top scientists have fallen for the oldest trick in the hackers' book
featured a blog yesterday on how the media frequently reports on so called "hacks" with little understanding of what happened, participating in a
irresponsible brand of journalism that borders on alarmism
. The problem is exacerbated in that people really do fall victim to Internet scams, even rather smart ones, which reporters dubiously dub "hacks."
One such report
that two nuclear labs had been "hacked." The true story is a bit more entertaining and the reveals that there is no threat to the country's nuclear safety. Real threats such as concerted "hacks"
conducted by the Chinese against the U.S. government
are certainly a concern, but the only thing dangerous about the compromise at these labs is the stupidity of a few scientists and workers at the plants.
The Oak Ridge National Laboratory (ORNL) in Tennessee and Los Alamos National Lab in New Mexico have made a habit of
collecting the social security numbers, names, and birth dates
of scientists who visit the plants. The information is put into a database, which reads like a who's who of America's top scientists.
Unfortunately, nobody thought such a practice might be a bit insecure. Starting October 29, workers at the labs began receiving phishing emails, which followed a traditional attack pattern of containing malicious Trojan-containing attachments.
There is no evidence that the attacks were specifically geared at the lab. If the attacks were just a general Internet attack, those responsible might have been excited at the big fish they caught. The two labs both have reported that the phishing emails gained access to their system, which indicates at least two employees -- one at each plant -- were foolish enough to click the attachment and commence the damage. The result was that the database with the scientists' information was compromised.
The phishers gained access to the records of all visitors at the plant between 1999 and 2004.
Don't blame the news networks solely for sensationalizing the attack and making it sound like a sophisticated assault. Leaders at the labs have gone on record trying to fudge the facts in statements, making the attacks sound more complex than they really are and icing over that the attacks only succeeded due to employee failures.
For example, ORNL director Thom Mason stated that the attacks were, "coordinated attempt to gain access to computer networks at numerous laboratories and other institutions across the country," and continued, "Because of the sensitive nature of this event, the laboratory will be unable for some period to discuss further details until we better understand the full nature of this attack."
Los Alamos has been more silent about what appears to prove the old adage that the greatest hole in security on the average computer network is the network's users.
In 2006 Los Alamos fell victim to social engineering and phishing when its emails were stolen and ended up on the USB stick of a drug dealer found in a police raid. The emails contained data of simulated nuclear weapons tests considered sensitive.
At the time executive director of the Project On Government Oversight (POGO), Danielle Brian blasted Los Alamos for their lax security stating, "This appears to be a new low, even drug dealers can get classified information out of Los Alamos."
Expect more pressure for ORNL and LANL as the smoke of sensationalism begins to blow away, revealing atrocious security due to user stupidity. Looks like some of America's top minds have just fallen for the one of the oldest tricks in the hackers' book.
This article is over a month old, voting and posting comments is disabled
The irony is sadly laughable
12/9/2007 9:16:04 AM
I got one of those fraud alert letters from ORNL. The idea that my personal information was at risk of identity theft due to a hacked computer at "highly secure" government lab is both sad and funny at the same time.
On the other hand, I wouldn't make too much of how a place full of smart scientists should be any more capable of dealing with such an attack than another organization. The administration is in the hands of the same people you can find anywhere. Except for the security, the place is pretty much like a research oriented university. In fact, University Tennessee and Battelle share responsibility for its administration.
Anyone who has been to collge knows that the people running our places of higher learning are not exactly rocket scientists themselves.
RE: The irony is sadly laughable
12/10/2007 3:25:52 PM
I taught a training class at Los Alamos in one of their computer labs in the late 1990s, while I worked for a company that wrote electromagnetic analysis software. This was on UNIX, and they were so security sensitive that we had a security person sitting in the back of the room during the entire class and literally following us around, including stationing himself outside the bathroom when I or the other instructor (a female) took our potty breaks. They didn't trust one of the scientists taking the class to be our 'escort'. And we were given temporary, supposedly limited-access login accounts to that lab only because as instructors we had to demonstrate some of the software features on the projector for the class to follow along. They made a big deal about how they had to 'isolate' the lab from the rest of the intranet, etc since we uncleared (unwashed) heathens were visiting, and since this was supposedly a classified lab (or could be, on other days) there was supposedly no outside access, either.
The funny part is that the security person couldn't follow (and didn't try) the material in the class at all, and in fact read a magazine most of the time. But I remember on the second day we constructed an example waveguide interface problem that was giving us results that didn't seem physically correct, so we as the instructors wanted to get a copy of the model to send back to the developers for diagnosis and a possible code fix. Without even thinking about it we were able to open up a terminal window and FTP it to our company servers, and only later on did I ask the other instructor "um, if they were so security conscious we had to be followed, and were given "limited access" accounts...how did we so easily get a a toob to the Internets? <jokey l33t speak is obvious revisionist memory>. I was honestly worried that somehow they'd think we'd "intentionally" violated their security, but figured the best thing to do would be to come clean and bring it up, rather than wonder if they 'noticed' somehow later on and it looked more suspicious to have not mentioned it. Fortunately nothing came of it on our end - no idea if we cost someone an IT job, though....
Sad, really. There's some analogy about barn doors and cows one could insert there, somewhere....not that any of this applies, as obviously the typical user is the worst security threat per the article. But I find it amusing that even that closed lab had direct outside access. I don't even recall having to do anything special on the terminal window to FTP out through a firewall...
"Well, there may be a reason why they call them 'Mac' trucks! Windows machines will not be trucks." -- Microsoft CEO Steve Ballmer
Hack The Planet
December 7, 2007, 1:52 PM
Unisys Blamed for China-Connected Homeland Security Hacks
September 26, 2007, 10:08 AM
Dumb Twitter Controversy: Saudis Whine at Michelle Obama's Lack of Head Scarf
January 27, 2015, 4:57 PM
Google Fixes Homophobic "Bug" in its Translator
January 27, 2015, 2:31 PM
Chris Poole Retires From Role as 4Chan After a Decade of Success, Struggles
January 23, 2015, 1:45 PM
Study Shows People are Dumb as Ever With Passwords, Still Using "123456"
January 20, 2015, 3:19 PM
Site for "Glitter as a Service" Mail Pranks, ShipYourEnemiesGlitter, Launches
January 13, 2015, 2:22 PM
OS X Yosemite Compromises Security by Retrieving Embedded Email Images
January 13, 2015, 11:30 AM
Most Popular Articles
Under the Hood: How DirectX 11.3 and 12 Will Supercharge Windows 10 Gaming
January 23, 2015, 12:34 PM
Microsoft Shows Off Latest Windows 10 Build, Preps it for Next Week Release
January 21, 2015, 2:57 PM
BlackBerry CEO Claims Devs are Violating Net Neutrality by Not Supporting BB10
January 22, 2015, 4:37 PM
2016 Cadillac CTS-V Packs 640 hp Punch with 200 mph Reach
January 23, 2015, 3:25 PM
Will Google Become America's Fifth Major Carrier?
January 22, 2015, 12:42 PM
Latest Blog Posts
Sceptre Airs 27", 120 Hz. 1080p Monitor/HDTV w/ 5 ms Response Time for $220
Dec 3, 2014, 10:32 PM
Costco Gives Employees Thanksgiving Off; Wal-Mart Leads "Black Thursday" Charge
Oct 29, 2014, 9:57 PM
"Bear Selfies" Fad Could Turn Deadly, Warn Nevada Wildlife Officials
Oct 28, 2014, 12:00 PM
The Surface Mini That Was Never Released Gets "Hands On" Treatment
Sep 26, 2014, 8:22 AM
ISIS Imposes Ban on Teaching Evolution in Iraq
Sep 17, 2014, 5:22 PM
More Blog Posts
Copyright 2015 DailyTech LLC. -
Terms, Conditions & Privacy Information