NYT: Reuters: NASA Says Was Hacked 13 Times Last Year

http://www.nytimes.com/reuters/2012/03/02/technology/02reuters-nasa-cyberattack.html

March 2, 2012

NASA Says Was Hacked 13 Times Last Year

By REUTERS

(Reuters) - NASA said hackers stole employee credentials and gained access to mission-critical projects last year in 13 major network breaches that could compromise U.S. national security.

National Aeronautics and Space Administration Inspector General Paul Martin testified before Congress this week on the breaches, which appear to be among the more significant in a string of security problems for federal agencies.

The space agency discovered in November that hackers working through an Internet Protocol address in China broke into the network of NASA's Jet Propulsion Laboratory, Martin said in testimony released on Wednesday. One of NASA's key labs, JPL manages 23 spacecraft conducting active space missions, including missions to Jupiter, Mars and Saturn.

He said the hackers gained full system access, which allowed them to modify, copy, or delete sensitive files, create new user accounts and upload hacking tools to steal user credentials and compromise other NASA systems. They were also able to modify system logs to conceal their actions.

"Our review disclosed that the intruders had compromised the accounts of the most privileged JPL users, giving the intruders access to most of JPL's networks," he said. [1]

In another attack last year, intruders stole credentials for accessing NASA systems from more than 150 employees. Martin said the his office identified thousands of computer security lapses at the agency in 2010 and 2011.

He also said NASA has moved too slowly to encrypt or scramble the data on its laptop computers to protect information from falling into the wrong hands.

Unencrypted notebook computers that have been lost or stolen include ones containing codes for controlling the International Space Station, as well as sensitive data on NASA's Constellation and Orion programs, Martin said.

A NASA spokesman told Reuters on Friday the agency was implementing recommendations made by the Inspector General's Office.

"NASA takes the issue of IT security very seriously, and at no point in time have operations of the International Space Station been in jeopardy due to a data breach," said NASA spokesman Michael Cabbagehe.

AIR FORCE SCRAPS IPAD PURCHASE

In a separate development, the U.S. Air Force said on Friday it had scrapped a plan to outfit thousands of personnel with second-generation iPad tablet computers from Apple Inc, but denied the reversal was because some of the software it wanted on the devices had been written in Russia.

Two days ago, news website Nextgov raised questions about a requirement that the 2,861 iPad2s come equipped with GoodReader, an electronic document display program written by an independent Russian developer.

The devices were to be used to store and update flight information, regulations and orders, according to procurement documents.

"The cancellation was not the result of any concern about GoodReader," said Matt Durham, a spokesman at the Air Force Special Operations Command.

He said the cancellation of the six-week-old order followed a decision that the procurement should not have been reserved for small businesses.

The military and other branches of government have been putting an increased emphasis on "supply-chain security" as they try to make sure that hardware, software and other components have not been tampered with by other nations.

This has proved challenging because so many parts come from overseas. Even American companies often contract for programming work abroad.

Mike Jacobs, who headed the National Security Agency's program for defending U.S. equipment, said in an interview he had killed a major procurement of encryption software within seconds after learning that a U.S. supplier had included a small amount of Russian-made code.

(Reporting By Jim Finkle, Irene Klotz, Joseph Menn and Jim Wolf; editing by Gunna Dickson and Andre Grenon)

[1] http://oig.nasa.gov/congressional/FINAL_written_statement_for_%20IT_%20hearing_February_26_edit_v2.pdf