Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DOD Just Beginning to Grapple with Scale of Weapon Systems Vulnerabilities

gao.gov

Post reply on HN
Print view View original

31–40 of 225 posts

Re: DOD Just Beginning to Grapple with Scale of Weapon Systems Vulnerabilities

#31

Post by rkeene2 »

MrLeap wrote: post #12

I was a dev contractor for the US Army for a few years. None of this surprises me. They had some goofballs policies that made it seem like vulnerabilities were the goal. I could bitch at length. Their TSA style security theater practices were the order of the day. The IA training was an embarrassing joke and they made you do it often enough to make you a little crazy. I just checked the certificate of networthiness p…

I'm not sure what specific training you're talking about regarding DIACAP (which it would likely have been when you were working there; now replaced with RMF), but over all the goal of certification and accreditation is about assuming risk, and the DAA (Designated Approving Authority) assumes the risk so they need to be informed about the risk. More information can be found in DoD Directive 8500 (DoD Instruction 8500.02 specifically).

As far as the SSL certificate, I assume you mean: https://www.atsc.army.mil/ ? That site seems like it has a valid certificate, if you validate against the DOD PKI (now cross-signed with FPKI) root CAs:

    $ openssl s_client -CApath ./dod -connect www.atsc.army.mil:443 -servername www.atsc.army.mil
    ...
    SSL-Session:
        Protocol  : TLSv1.2
        Cipher    : ECDHE-RSA-AES256-SHA
        Start Time: 1539109915
        Verify return code: 0 (ok)

Re: DOD Just Beginning to Grapple with Scale of Weapon Systems Vulnerabilities

#32

Post by closeparen »

danielvf wrote: post #2

The good stuff is in the PDF: https://www.gao.gov/assets/700/694913.pdf - Running a port scan caused the weapons system to fail - One admin password for a system was guessed in nine seconds - "Nearly all major acquisition programs that were operationally tested between 2012 and 2017 had mission-critical cyber vulnerabilities that adversaries could compromise." - Taking over systems was pretty much playing on easy mod…

Aren’t there reams of security standards and thousands of man-years of security compliance bureaucracy for even the most basic DOD IT projects? And they still have trivial vulnerabilities like this? Is the process really that useless?

Re: DOD Just Beginning to Grapple with Scale of Weapon Systems Vulnerabilities

#34

Post by airstrike »

drawkbox wrote: post #17
danielvf wrote: post #2

The good stuff is in the PDF: https://www.gao.gov/assets/700/694913.pdf - Running a port scan caused the weapons system to fail - One admin password for a system was guessed in nine seconds - "Nearly all major acquisition programs that were operationally tested between 2012 and 2017 had mission-critical cyber vulnerabilities that adversaries could compromise." - Taking over systems was pretty much playing on easy mod…

> Test reports we reviewed make it clear that simply having cybersecurity controls does not mean a system is secure. How the controls are implemented can significantly affect cybersecurity. For example, one test report we reviewed indicated that the system had implemented rolebased access control, but internal system communications were unencrypted. Because the system’s internal communications were unencrypted, a reg…

> an MBA only led business with no influence from engineering/security

As an MBA holder and avid HN user, I take issue with that statement...

Re: DOD Just Beginning to Grapple with Scale of Weapon Systems Vulnerabilities

#35

Post by rkeene2 »

noxToken wrote: post #24
MrLeap wrote: post #12

I was a dev contractor for the US Army for a few years. None of this surprises me. They had some goofballs policies that made it seem like vulnerabilities were the goal. I could bitch at length. Their TSA style security theater practices were the order of the day. The IA training was an embarrassing joke and they made you do it often enough to make you a little crazy. I just checked the certificate of networthiness p…

> I just checked the certificate of networthiness page and they don't have a valid SSL certificate. I recall that being the case years ago too. I wonder if it's been that way for the last 7 years? That's a cute little terrarium of the whole biome I remember. That's not quite true. Internal use sites don't have a valid cart issued by a "default" external vendor . Public sites use existing CAs that are in use by the pu…

They are trusted by internal machines -- since a lot of internal authentication relies on these certificates. The DOD long ago moved away from password-based authentication mechanisms to certificate-based authentication (GSC-IS initially (CAC), now NIST SP 800-73 (PIV; CAC II)) and so the system will have the correct certificates or the user generally won't be able to login.

What I find as the most common error is that users setup an alternate browser (such as Firefox) that does not use the system certificate store and then lack the system's local certificate authorities.

Additionally, DOD PKI is now cross-signed with Federal PKI (FPKI), so it's larger than the DOD now and other agencies also use the same smartcards (PIV).

Re: DOD Just Beginning to Grapple with Scale of Weapon Systems Vulnerabilities

#36

Post by MrLeap »

noxToken wrote: post #24
MrLeap wrote: post #12

I was a dev contractor for the US Army for a few years. None of this surprises me. They had some goofballs policies that made it seem like vulnerabilities were the goal. I could bitch at length. Their TSA style security theater practices were the order of the day. The IA training was an embarrassing joke and they made you do it often enough to make you a little crazy. I just checked the certificate of networthiness p…

> I just checked the certificate of networthiness page and they don't have a valid SSL certificate. I recall that being the case years ago too. I wonder if it's been that way for the last 7 years? That's a cute little terrarium of the whole biome I remember. That's not quite true. Internal use sites don't have a valid cart issued by a "default" external vendor . Public sites use existing CAs that are in use by the pu…

Ah thanks for educating me. My island at TRADOC didn't have anyone who knew those details. :P

Re: DOD Just Beginning to Grapple with Scale of Weapon Systems Vulnerabilities

#37

Post by airstrike »

ceejayoz wrote: post #33
Animats wrote: post #16

The US is going to lose a war this way.

Is there any reason to believe the state of Russian/Chinese/etc. security is any better in this regard?

No, but all that does is ensure we all lose collectively

Re: DOD Just Beginning to Grapple with Scale of Weapon Systems Vulnerabilities

#38

Post by 0xffff2 »

closeparen wrote: post #32
danielvf wrote: post #2

The good stuff is in the PDF: https://www.gao.gov/assets/700/694913.pdf - Running a port scan caused the weapons system to fail - One admin password for a system was guessed in nine seconds - "Nearly all major acquisition programs that were operationally tested between 2012 and 2017 had mission-critical cyber vulnerabilities that adversaries could compromise." - Taking over systems was pretty much playing on easy mod…

Aren’t there reams of security standards and thousands of man-years of security compliance bureaucracy for even the most basic DOD IT projects? And they still have trivial vulnerabilities like this? Is the process really that useless?

I think the difference is between "DoD IT projects" and DoD projects that have networked computer systems. My hunch is that most of these vulnerabilities are in systems that are not labeled as "IT projects".

Re: DOD Just Beginning to Grapple with Scale of Weapon Systems Vulnerabilities

#39

Post by MrLeap »

rkeene2 wrote: post #31
MrLeap wrote: post #12

I was a dev contractor for the US Army for a few years. None of this surprises me. They had some goofballs policies that made it seem like vulnerabilities were the goal. I could bitch at length. Their TSA style security theater practices were the order of the day. The IA training was an embarrassing joke and they made you do it often enough to make you a little crazy. I just checked the certificate of networthiness p…

I'm not sure what specific training you're talking about regarding DIACAP (which it would likely have been when you were working there; now replaced with RMF), but over all the goal of certification and accreditation is about assuming risk, and the DAA (Designated Approving Authority) assumes the risk so they need to be informed about the risk. More information can be found in DoD Directive 8500 (DoD Instruction 8500…

Looks like I was remembering the wrong acronyms. It was information assurance training. We had to do it every 6 months, and like twice in a month when Snowden did his thing.

My first year there it was a goofy flash game with uncanny valley cartoon characters awkwardly telling you not to share secrets at the bar to get laid. Every year I stayed it seemed to get longer and more awkward. At some point they added a boxing minigame that didn't have any training value. Nothing was optional.

It became a goal of mine that they'd let me remake it in a way that was... not patronizing... I never found anyone who knew who to talk to get me the project though. :(

Re: DOD Just Beginning to Grapple with Scale of Weapon Systems Vulnerabilities

#40

Post by noxToken »

rkeene2 wrote: post #35
noxToken wrote: post #24

Earlier quoted context omitted.

> I just checked the certificate of networthiness page and they don't have a valid SSL certificate. I recall that being the case years ago too. I wonder if it's been that way for the last 7 years? That's a cute little terrarium of the whole biome I remember. That's not quite true. Internal use sites don't have a valid cart issued by a "default" external vendor . Public sites use existing CAs that are in use by the pu…

They are trusted by internal machines -- since a lot of internal authentication relies on these certificates. The DOD long ago moved away from password-based authentication mechanisms to certificate-based authentication (GSC-IS initially (CAC), now NIST SP 800-73 (PIV; CAC II)) and so the system will have the correct certificates or the user generally won't be able to login. What I find as the most common error is th…

This bit is curious. I was issued a CAC while I was in, and as you said, it eliminated the need for passwords. But the internal sites (no matter if it was a laptop from the comm section, a hardwired desktop in a unit's building, or a desktop in a base facility) always failed the check for the certificate store. I always got the security warning (or insecure message) regardless of browser.
Post reply on HN