Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NASA Has Been Hacked

forbes.com

Post reply on HN
Print view View original

101–110 of 114 posts

Re: NASA Has Been Hacked

#101

Post by jacquesm »

peterwwillis wrote: post #94
SamuelAdams wrote: post #14

I highly recommend reading the actual audit[1]. There's a lot of good details in there, similar to the Senate report on the Equifax breach a few days ago. There were several problems: the inventory tracking issue was particularly enlightening: >system administrators did not consistently update the inventory system when they added devices to the network. Specifically, we found that 8 of 11 system administrators respon…

Nobody ever manually maintains inventory correctly. That's why automated systems are supposed to scan networks and inform the inventory of what is actually there , versus what is "supposed to be there". Lack of training doesn't matter at all. This is just a mechanism to blame people, it doesn't ensure security at all. And of course JPL doesn't have a mechanism to allow DHS to scan its entire network . Nobody has a bi…

> inform the inventory of what is actually there

This works very well to identify stuff that actually answers and will yield devices that are not supposed to be there in the first place but someone planning mischief is not going to place a device that is easily identified like that.

Re: NASA Has Been Hacked

#102

Post by jacquesm »

JudgeWapner wrote: post #80
giarc wrote: post #10

Earlier quoted context omitted.

I was going to screenshot that page. A small auto play video in bottom left corner, a top bar pop up to get the "latest updates from Forbes", an email sign up for the Forbes Daily Dozen and in the background, blurred out is the article.

I envision a distributed system that simply renders pages, clicks "agree" or whatever, and uploads just the content to "archive" servers automatically. After a critical mass is reached, then instead of going to the URL, you plug the URL into archive server to see if it already has a copy and render that version. From there, you could go even further and daily download 100mb or so of pre-sanitized internet from the mo…

The one thing that approach would guarantee is that archive servers would end up getting the business end of the stick.

Re: NASA Has Been Hacked

#103

Post by dvtrn »

cbsks wrote: post #40
jeffmould wrote: post #30

Earlier quoted context omitted.

Back in the early 90s I had a summer internship for a contractor at Goddard Space Flight Center. My job for the entire summer was to track down and inventory a list of 1000s of devices across the entire campus. At the time they were building a tracking database for all the devices on the campus. The printout I was handed on my first day had not been updated in several years. It basically contained a tracking ID, what…

I interned at Goddard in 2006 and my PI had a rogue wireless access point for his interns to use. Apparently it was a long and convoluted process to get network access for personal computers, so he didn’t even bother trying. I remember some of my fellow interns complaining about having to work offline for the first month of their 10 week internship.

it was a long and convoluted process to get network access for personal computers, so he didn’t even bother trying

"When people can't work with you, they will look for ways to work around you". - former IT boss of mine.

Every time.

Re: NASA Has Been Hacked

#104

Post by Sushi-san »

tetha wrote: post #96
eggy wrote: post #79

I remember back in the late 80s telnetting out of the NYU Bobst library on their VAX 11(?) system to some pretty interesting systems. The Johnson Space Center in Houston (running VAX 11/785s was one I particularly remember. Of course, back then things were not battened down as much as they are now; the spirit was an open network. A sysadmin would interrupt your session with quesitons like "Who is this? You are unauth…

Sadly, that's an era old and gone. I'm still a friend of open WIFI like the freifunkers, or social computing - just ask and share some compute resources in my cellar. It's great to give kids access to programming and server resources. However, that requires a lot of legal considerations at this point to do right even if the users behave. And then you get the guys abusing something like this.

I've found that it is much harder to trust people on the internet now.

Re: NASA Has Been Hacked

#105

Post by 0xffff2 »

jlmorton wrote: post #99

Here's food for thought: while a proper firewall and network segmentation is a well-established best practice, I'm not sure this is a winning battle. There are probably a few dozen organizations out there that are properly implementing strong information security practices, and my hats go off to them. But they are the few, and I have never worked for one. Despite best laid plans and policies, every place I have worke…

I work at a non-JPL NASA center. My workstation and internal server resources are already locked down to a barely tolerable extreme. I can't imagine what kind of restrictions would be added if we went forward with something resembling the above proposal.

I don't want to go into much detail about our internal network architecture, but suffice to say it's extremely difficult to run any kind of service whatsoever even internally. It has literally taken me years to get approval to expose a fairly simple REST API to the public internet, and I'm not even there yet.

Re: NASA Has Been Hacked

#106

Post by majewsky »

jlmorton wrote: post #99

Here's food for thought: while a proper firewall and network segmentation is a well-established best practice, I'm not sure this is a winning battle. There are probably a few dozen organizations out there that are properly implementing strong information security practices, and my hats go off to them. But they are the few, and I have never worked for one. Despite best laid plans and policies, every place I have worke…

> Especially now that we live in an IPv6 world, why not just run everything publicly. Push security all the way down to the applications themselves, and rely on the software development lifecycle process to catch security issues.

Yeah, wouldn't it be nice if software just didn't have any bugs?

You got the correlation backwards: Software isn't garbage because we can rely on the band-aids. The band-aids were invented because all software is garbage.

Re: NASA Has Been Hacked

#107

Post by olliej »

txcwpalpha wrote: post #89
olliej wrote: post #81

Earlier quoted context omitted.

Then you need to either mandate updating, or isolate those machines.

> mandate updating hahahahahahahahaahaha > isolate those machines that's exactly what is done, but you just said that security people need to stop thinking in those terms, so...?

I work at a company that drops network access to privileged resources of any machine that is more than X days behind installed an update.

And isolating the machines: I mean separate networks, or vpn only access to privileged resources.

And it goes without saying: traffic from unknown systems on a privileged physical network get dropped at the router.

Re: NASA Has Been Hacked

#108

Post by killjoywashere »

Theodores wrote: post #83
eggy wrote: post #79

I remember back in the late 80s telnetting out of the NYU Bobst library on their VAX 11(?) system to some pretty interesting systems. The Johnson Space Center in Houston (running VAX 11/785s was one I particularly remember. Of course, back then things were not battened down as much as they are now; the spirit was an open network. A sysadmin would interrupt your session with quesitons like "Who is this? You are unauth…

I used to love roving around VAX networks. In the UK the ones for science (and defence research) were all setup the same. They didn't design the login scripts for pests like me. So I was able to go round the different boxes looking for interesting datasets. I only wanted super hi resolution satellite imagery, convinced there was some sub-metre resolution stuff out there. All was going well until I put my own backdoor…

I have two DEC VT510 terminals in my lab, serving mission critical functions, right now.

Re: NASA Has Been Hacked

#109

Post by olliej »

unethical_ban wrote: post #74
riffic wrote: post #52

Earlier quoted context omitted.

BeyondCorp would be an alternative to consider: https://thenewstack.io/beyondcorp-google-ditched-virtual-pri...

There should be a law about citing what Google does vs. what the rest of the world does. The Giants are in a class of their own. Lessons are often worth learning, but that doesn't mean most organizations can do what Google can do. >(The model benefited the fact that all of Google’s internal applications are already on the Web). Well then.

How is the US federal government considered exempt from this logic? Their budget dwarves more or less everything else in the world

Re: NASA Has Been Hacked

#110

Post by txcwpalpha »

olliej wrote: post #107
txcwpalpha wrote: post #89

Earlier quoted context omitted.

> mandate updating hahahahahahahahaahaha > isolate those machines that's exactly what is done, but you just said that security people need to stop thinking in those terms, so...?

I work at a company that drops network access to privileged resources of any machine that is more than X days behind installed an update. And isolating the machines: I mean separate networks, or vpn only access to privileged resources. And it goes without saying: traffic from unknown systems on a privileged physical network get dropped at the router.

>I work at a company that drops network access to privileged resources of any machine that is more than X days behind installed an update.

Congratulations to your company! That is quite a great policy. Unfortunately, that would be literally impossible in many of the rest of the world's companies.

We aren't talking about dropping access of a desktop machine that's a few days behind on its Windows updates. We're talking about massive, enterprise-spanning systems like mainframes, ERMs, industrial control systems, data pipelines, etc that interface with hundreds of other applications across your company and are 1000% mission critical. Dropping access could quite literally bring the entire company (and all of its revenue) to a grinding halt. And because of their size and importance, they take years and tens of millions of dollars (not an exaggeration; I've been on teams tasked with upgrades like this) to upgrade even when planned half a decade in advance.

Companies are complex, and security is not one-size-fits-all. You do what you can and hope for the best, but at some point there's only so much you can do without burning the entire company to the ground and starting all over.

Post reply on HN