Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Rogue Raspberry Pi Let Hackers Into JPL Network

extremetech.com

Post reply on HN
Print view View original

11–20 of 37 posts

Re: A Rogue Raspberry Pi Let Hackers Into JPL Network

#11

Post by jascii »

jascii wrote: post #4

The actual OIG report: https://oig.nasa.gov/docs/IG-19-022.pdf I only did the briefest of scans, but the recommendations seem pretty basic best practices stuff. In my experience, research labs tend to be creative spaces with a focus on collaboration and information security is not foremost on peoples mind. I guess that will have to change.

It's kind of interesting to read in the report how the JPL was not compliant with several NIST guidelines (800-53 and others) what it does not mention is how this situation persisted despite the required audits for federal organizations..

Re: A Rogue Raspberry Pi Let Hackers Into JPL Network

#12

Post by [deleted] »

inamberclad wrote: post #9
kevin_b_er wrote: post #2

It would be nice to know what this specific "Raspberry Pi" vulnerability is, considering the software stack is almost entirely Debian.

Probably just ssh enabled with the default credentials. IIRC, raspberry pis have their own MAC address prefix, so it's pretty obvious when you find one.

[deleted]

Re: A Rogue Raspberry Pi Let Hackers Into JPL Network

#13

Post by fortran77 »

inamberclad wrote: post #9
kevin_b_er wrote: post #2

It would be nice to know what this specific "Raspberry Pi" vulnerability is, considering the software stack is almost entirely Debian.

Probably just ssh enabled with the default credentials. IIRC, raspberry pis have their own MAC address prefix, so it's pretty obvious when you find one.

My guess is this pi was connecting _out_, tunneling the network over ssh.

Or one of these things: https://blog.haschek.at/2018/the-curious-case-of-the-RasPi-i...

Re: A Rogue Raspberry Pi Let Hackers Into JPL Network

#14

Post by drivingmenuts »

NikkiA wrote: post #3

> If, however, they represented an adversarial nation, the data could be extremely valuable. Yes, heaven knows that data on manned spaceflight shouldn't be shared with all of mankind, only america and it's allies.

It would probably be more along the lines of altering the re-entry characteristics of a manned space flight, you know, for lulz. Or nationalism. Or it’s Tuesday. Or whatever other Hal-baked rationale they can come up with.

Guaranteed there’s someone out there jackass enough to do that.

Re: A Rogue Raspberry Pi Let Hackers Into JPL Network

#15

Post by molecule »

jascii wrote: post #11
jascii wrote: post #4

The actual OIG report: https://oig.nasa.gov/docs/IG-19-022.pdf I only did the briefest of scans, but the recommendations seem pretty basic best practices stuff. In my experience, research labs tend to be creative spaces with a focus on collaboration and information security is not foremost on peoples mind. I guess that will have to change.

It's kind of interesting to read in the report how the JPL was not compliant with several NIST guidelines (800-53 and others) what it does not mention is how this situation persisted despite the required audits for federal organizations..

There’s a significant distinction between federal organizations and federally-funded organizations— JPL is the latter.

Re: A Rogue Raspberry Pi Let Hackers Into JPL Network

#16

Post by ozim »

jascii wrote: post #4

The actual OIG report: https://oig.nasa.gov/docs/IG-19-022.pdf I only did the briefest of scans, but the recommendations seem pretty basic best practices stuff. In my experience, research labs tend to be creative spaces with a focus on collaboration and information security is not foremost on peoples mind. I guess that will have to change.

Recommendations suck, they just write couple of times that administrators should update "Information Technology Security Database" and that they failed to do that. That should be automated. They have all those "CISO", "SAISO", "OCIO" and "CIO" but there is no one who knows how to setup automated nmap scan for a network range? Then trigger someone and add it to some inventory like "hey there is some new raspberry pi in network" should you maybe check it?

Re: A Rogue Raspberry Pi Let Hackers Into JPL Network

#17

Post by kryogen1c »

>5,406 unresolved SPLs—about 86 percent of which were rated high or critical >JPL did not effectively address a known software vulnerability, first identified in 2017, with a critical score of 10. This software flaw can be used by cyberattackers to remotely execute malicious code >one of the projects has a waiver of JPL IT security requirements to change passwords every 90 days. Instead, the project relies on a designated application and team accounts to share password files, group files, host tables, and other files over the network

There seems to be a fair amount of filler in the report (review access logs, out of date inventory, etc) but these points seem pretty damning.

Re: A Rogue Raspberry Pi Let Hackers Into JPL Network

#18

Post by blantonl »

kryogen1c wrote: post #17

>5,406 unresolved SPLs—about 86 percent of which were rated high or critical >JPL did not effectively address a known software vulnerability, first identified in 2017, with a critical score of 10. This software flaw can be used by cyberattackers to remotely execute malicious code >one of the projects has a waiver of JPL IT security requirements to change passwords every 90 days. Instead, the project relies on a desig…

If I was a betting man, I'd bet that there are some old dusty areas of NASA facilities where there are open NFS exports, NIS providing security, and Sun workstations doing work.

I bet someone could fire up a SATAN scanning instance with a Mosaic browser and find some open stuff on some of those old and crusty computers. :)

Re: A Rogue Raspberry Pi Let Hackers Into JPL Network

#19

Post by giancarlostoro »

syn0byte wrote: post #8
kevin_b_er wrote: post #2

It would be nice to know what this specific "Raspberry Pi" vulnerability is, considering the software stack is almost entirely Debian.

There is no RPi vulnerability(in this article). The RPi was just used as a bastion into the internal network. It could have been any SBC. Once your already inside the internal network things get stupid lax. EG. I can't see your Windows shared folders from the internet, but the PC in the next room can. Someone sneaked an RPi into JPL to be that PC in the next room. See Also; Season 1 Mr Robot had this exact scenario a…

I was thinking Mr. Robot the whole time.

Re: A Rogue Raspberry Pi Let Hackers Into JPL Network

#20

Post by Avamander »

ozim wrote: post #16
jascii wrote: post #4

The actual OIG report: https://oig.nasa.gov/docs/IG-19-022.pdf I only did the briefest of scans, but the recommendations seem pretty basic best practices stuff. In my experience, research labs tend to be creative spaces with a focus on collaboration and information security is not foremost on peoples mind. I guess that will have to change.

Recommendations suck, they just write couple of times that administrators should update "Information Technology Security Database" and that they failed to do that. That should be automated. They have all those "CISO", "SAISO", "OCIO" and "CIO" but there is no one who knows how to setup automated nmap scan for a network range? Then trigger someone and add it to some inventory like "hey there is some new raspberry pi i…

It's not like you can easily detect a rogue RPi with just nmap. It's trivial not to respond to anything sent to you. You have to start looking at ARP, but that's not iron-clad either.
Post reply on HN