NASA hacking?

A post on allegations of NASA being hacked from Del Brazil of Advent IM

There have been allegations of numerous hacks into the systems controlled or operated by NASA. These have ranged from secret UFO files being accessed, through to drones being infiltrated and subsequently controlled by unauthorised persons.

This raises the questions about how secure the NASA websites, servers and systems are.  There are a whole host of individuals who claim to have hacked NASA including a 15 year old who is alleged to have caused a 21 day shutdown of NASA computers, through to an individual who claims to have found evidence that NASA has or is in the process of building ‘space warships’ and finding lists of ‘non-terrestrial military officers.’

The latest alleged hack involves the release of various videos, flight logs and personal data related to NASA employees.  This hack is believed to originally to have started over 2 years ago with a hacker paying for initial access; although it is not yet confirmed, it is fair to assume that this purchase would be associated with a NASA employee.  The hacker then carried out a ‘brute force’ attack against an administers SSH password, resulting in a successful compromise within 0.32 seconds as the password is alleged to have been still set to the default credentials.  Having infiltrated the system with an administrator’s password the hacker was then pretty much free to navigate his/her way around various NASA systems collecting information as they went.  It’s not unusual to find CCTV systems and/or other Base Management Systems Administrator settings being still set on their default setting, what is unusual is to find that NASA has systems are potentially falling foul of this too.  There were also claims that one of NASA’s unmanned drones used for high altitude and long duration data collections had been partially taken control of during the hacking with a view to potentially crashing it in the Pacific Ocean.

The information claimed to have been obtained includes 631 videos of weather radar readings and other in-flight footage from manned and unmanned aircraft between 2012 and 2013 along with personal information related to NASA employees.  It is widely

image courtesey digitalart on freedigitalphotos.net

 

reported on the internet that the personal information obtained relating to the NASA employees has been verified by another media client, as they have allegedly attempted to contact those individuals by telephone; although it is further reported that no actual conversations took place and that verification was obtained from answerphone machines pertaining to those NASA employees.   There is no reports that the same media client has received any return calls from the alleged NASA employees nor is there any documented communication from NASA’s IT Security Division, the Glenn Research Center, the Goddard Space Flight Center, the Dryden Flight Research Center, the NASA Media Room or the FBI.

This is certainly not the first and won’t be the last alleged hack of NASA.  It is well known that there are a whole host of individuals who are continuously attempting to attack large organisations; whether their motive be criminal or just inquisitive you can be assured that any alleged successful hack will make headline news. Hackers are widely regarded as kudos- seekers; reputation and status hungry within their own fields and targets like this are very highly sought after.

Let’s consider the sensitivity of the alleged data?  Any sensitive or ‘secret’ information is likely to be securely stored in a manner to prevent or at least deter any potential hacker; however no system is 100% secure and so there is, albeit very small a possibility that a hacker maybe successful.

NASA have responded by stating that ‘Control of our Global Hawk aircraft was not compromised. NASA has no evidence to indicate the alleged hacked data are anything other than already publicly available data. NASA takes cybersecurity very seriously and will continue to fully investigate all of these allegations.’  So the old ‘he said, she said’ playground argument continues with neither party being proved or dis-proved but what we do know is that hackers will continue to attack high profile organisations for ‘Kudos’ status or bragging rights.

Got a Drone for Christmas? Don’t forget Registration and Regulation

Whilst trying to contain my disappointment at not getting Millennium Falcon drone in my stocking, I asked Advent IM Security Consultant, Del Brazil, what the implications are for those of us who do have drones, Star Wars based or not…

Civil Aviation Authority (CAA)

Image courtesy of Salvatore Vuono at FreeDigitalPhotos.net

As Christmas has been and gone many of us will now be the proud owner of a drone in some form or another.  The excitement and thrill of being in control of your own flying machine coupled with maybe a camera of some description is only matched by the recent hype related around the new Star Wars movie.  Some people including the author may disagree including; however some people may view the freedom of flying a drone quite a fun hobby but we all have our own vices.

The CAA defines a drone as an unmanned aircraft which unlike traditional remote controlled model aircraft, which have been used by enthusiasts for many years, have the potential to pose a greater risk to the general public and other aircraft.   Unlike manned or model aircraft there are currently no established operating guidelines so operators may not be aware of the potential dangers or indeed the responsibility they have towards avoiding collisions.  Anyone flying a drone either recreationally or commercially has to take responsibility for doing so safely.

The CAA’s focus is purely safety. For the criminal use of drones, including harassment, anti-social behaviour or damage to property, it is a police matter. If people have concerns about a drone being flown in public they should call the police, a CAA spokesman says. “Local police can assess the situation in real time and, if there is any evidence of breaching the air navigation order, they will pass on any information on to us.”

It has been reported that the CAA has prosecuted two Unmanned Aerial Vehicle (UAV) operators relating to safety breaches with another four investigations pending. The Association of Chief Police Officers was unable to say how many prosecutions the police have made over drones but there have been a few; although during the ongoing House of Lords select committee inquiry on remotely piloted aircraft systems, Chief Inspector Nick Aldworth of the Metropolitan Police said: “We do not have a criminal privacy law in this country, so it is not the concern of the police to try to develop or enforce it.”

Is there any other legislation that drone operators may fall foul of?  Well according to Chief Inspector Aldworth “The most obvious example to date is the Sexual Offences Act 2003 and the specific offence of voyeurism.”

The number and frequency of incidents being report around the world is on the increase which include a Euro 2016 qualifier in Belgrade being stopped after a drone trailing an Albanian flag was flown over the stadium whilst in France a number of nuclear power stations were buzzed by drones in a number of mysterious incidents.

A number of associations affiliated with flying and/or airspace The British Airline Pilots Association (BALPA) is campaigning for drones to be programmed not to enter certain airspace – known as geo-fencing. The Phantom series of drones, sold by manufacturer DJI, already includes geo-fencing. The GPS of the drone is programmed with the co-ordinates of thousands of airports around the world. It cannot enter these areas. If it tries to it will be forced to land. And within a 2km radius of a major airport its height will be capped at just 10m.

Another step that BALPA is calling for is that, just like with a car or television, people purchasing a drone would have to give their personal information to the retailer and that this information should be logged or that there is a requirement for users to register their drones with the relevant authority.  This has a twofold effect in that if a drone is apprehended the owner can be traced to ensure that it is returned to its rightful owner and that it may also assist in any investigation relating to illegal activity that may have been undertaken by the operator.

Another possible solution would be to build in strict height limitations just like the Phantom 2 which is limited to a height of 400 feet; although this is likely to be easily circumvented with software.

Regulations have just come into play in the United States which requires hobbyists to register drones as small unmanned aircraft systems on the Federal Aviation Administration website.  The online registration service is active but it is unclear as to the scale of uptake and amount of registrations that have actually taken place thus far.

In Ireland as of 21^st December 2015 it is now mandatory for all drone operators to register any drone that weighs more than 1kg in accordance with the Small Unmanned Aircraft (Drones) and Rockets Order S.I. 563 of 2015.  There is clear ‘do’s and don’t guide’ available on the Ireland Aviation Authority (IAA) website.

At present there is no actual regulation in place within the UK that requires operators to register their drones; however that is likely to change as more incidents occur that not only threaten life but also privacy.  There are plans afoot within the House of Lords EU Committee for a drone register to be created which initially would capture business and professional operators and eventually normal consumers too.  There is an Official UK Drone Register but this is specifically for drone operators/owners who voluntarily add their details to a public register to aid in returning drones if they go astray.