United States General Accounting Office Testimony Before the Subcommittee on Government Information and Regulation Committee on Governmental Affairs United States Senate - For Release on Delivery Expected at 1 OClp m EST Wednesday November 20 1991 COMPUTER SECURITY Hackers Penetrate DOD Computer Systems Statement of Jack L Brock Jr Director Government Information and Financial Management Information Management and Technology Division GAOE-IMTEC-92-5 GAO Form 160 12 W Mr Chairman and Members of the Subcommittee I am pleased to participate in the Subcommittee's hearings on our work focused on hacker At your request computer security intrusions into Department of Defense DOD unclassified sensitive computer systems during Operation Desert Storm Shield My testimony today is based on our review of intrusions by a group of Dutch hackers into Army Navy and Air Force computer systems we conducted a detailed review of the hacker In particular intrusions and system administration responsibilities at three DOD While our focus was on unclassified sensitive systems sites some of the systems penetrated by this group of hackers did not contain sensitive information The government faces increased levels of risk for information security because of greater network use and computer literacy and For years greater dependency on information technology overall hackers have been exploiting security weaknesses of systems attached to the Internet--an unclassified network composed of over 5 000 smaller networks nationwide and overseas and used primarily Their techniques have been by government and academic researchers publicized in hacker bulletin boards and magazines and even in a Hackers The Cuckoo's Eqq written by Clifford Stoll bestseller to successfully exploit these security weaknesses however continue and undermine the integrity and confidentiality of sensitive government information Between April 1990 and May 1991 computer systems at 34 DOD sites attached to the Internet were successfully penetrated by foreign The hackers exploited well-known security weaknesses-hackers many of which were exploited in the past by other hacker groups These weaknesses persist because of inadequate attention to such as password management and the lack of computer security technical expertise on the part of some system administrators-persons responsible for the technical management of the system DUTCH HACKERS PENETRATE DOD COMPUTER SYSTEMS Between April 1990 and May 1991 computer hackers from the DOD officials however are Netherlands penetrated 34 DOD sites still unable to determine the full scope of the problem because security measures for identifying intrusions are frequently the hackers had access to lacking At many of the sites sensitive information on such topics as 1 military unclassified personnel--personnel performance reports travel information and 2 logistics--descriptions of the type and personnel reductions quantity of equipment being moved and 3 weapons systems development data Although such information particularly sensitive information For example successfully penetrated is unclassified it can be highly during times of international conflict from at least one system which was at several sites directly supported Operation Desert Storm Shield according to one DOD In addition personnel information can be used to target employees official who may be willing to sell classified information Further some DOD and government officials have expressed concern that the aggregation of unclassified sensitive information could result in the compromise of classified information Hackers Securitv Exploit Well-Known Weaknesses The hackers generally gained access to the DOD computer systems by Using travelling through several networks and computer systems commercial long-distance services such as Tymnet the hackers weaved their way on the Internet through university government often using these sites as platforms to and commercial systems enter military sites The hackers then exploited various security weaknesses to gain The most common weaknesses included access into military sites 1 accounts with easily guessed passwords or no passwords 2 well-known security holes in computer operating systems and 3 vendor-supplied accounts--privileged accounts with well-known passwords or no passwords at all that are used for system Once the hackers had access to a operation and maintenance access to other computers at that site computer at a given site was relatively easy because the computers were often configured to trust one another At several sites the hackers exploited a Trivial File Transfer Protocol1 TFTP Some versions of this program had a well-known security hole that allowed users on the Internet to access a file containing encrypted passwords without logging into the system Once the hackers accessed the password file they 1 probed for accounts with no passwords or accounts where the username and password were identical or 2 downloaded the password file to another computer and ran a password cracking program--a program that matches words found in the dictionary against the encrypted Finally password file the hackers entered the system using an authorized account and password and were granted the same privileges as the authorized user At two of the sites we visited the hackers were able to enter the systems because vendor-supplied accounts were left on the system with a well-known password or with no password at all Operating systems and software are often delivered to users with certain accounts necessary for system operation When delivered these accounts--some of which include system administrator privileges that allow them to do anything on the system without restriction-'TFTP is a file without logging transfer in program that 2 permits the copying of files are often unprotected or are protected with are therefore vulnerable until the password Hackers Methods known passwords is changed and Established For Reentry activities appeared to be aimed at The majority of the hackers' gaining access to DOD computer systems and then establishing -In many of the intrusions the hackers methods for later entry modified the system to obtain system administrator privileges and For example at some sites to create new privileged accounts where the hacker entered the system using a vendor-supplied password the hackers ran a program that elevated the privileges of the account and then erased evidence of the intrusion by The hackers then created new privileged removing the program accounts with passwords known only to them and that blended in making detection more naming conventions with the sites' difficult While there was little evidence that the hackers destroyed information in several instances the hackers modified and copied In a few cases the hackers stored this military information They modified system logs information at major U S universities The to avoid detection and to remove traces of their activities hackers also frequently browsed directories and read electronic messages In a few cases they searched these messages for such key words as military nuclear weapons missile Desert Shield and Desert Storm Aaencies' Response to the Incidents In most cases system administrators did not identify the but were instead notified of the intrusion by intrusion Once the system university contractor or DOD officials they usually secured their system-administrators were notified In a such as changing the password of a vendor-supplied account few cases however the sites left the vulnerability open temporarily in an effort to determine the intruder's identity At one site we visited where this was done the intruders' access to sensitive information was contained and coordinated with law enforcement agencies Only one of the three military services had written procedures for Since the intrusions incident handling prior to the intrusions however the other two services have established written procedures Despite the lack of procedures at two of the sites we visited security personnel prepared an incident report after they In addition one site we were notified about the intrusion visited established computer hacker reporting procedures for their organization They also included security tips such as changing 3 default passwords maintaining audit using trails randomly-selected passwords and HACKER INTRUSIONS HIGHLIGHT INADEQUATE ATTENTION TO COMPUTER SECURITY The security weaknesses that permitted the intrusions and prevented their timely discovery highlight DOD's inadequate Poor password management failure attention to computer security and inadequate computer to maintain and review audit trails security training all contributed to the intrusions DOD directives and military service regulations and instructions require both adequate computer security training for those and audit trails--records of system responsible for systems activities-that are reviewed periodically and detailed enough to In addition the determine the cause or magnitude of compromise The military services require password management procedures that these requirements were not intrusions however indicate always followed Poor password management--easily-guessed passwords and vendorsupplied accounts whose password had not been changed--was the most commonly exploited weakness contributing to the intrusions At one site we including those at each of the sites we visited visited the hacker exploited a vendor-supplied account left on that in turn provided system the system without a password administrator privileges officials also noted that failure to maintain or In addition periodically review audit trails was a key reason why most system administrators were unable to detect the intrusions or determine For example few of how long their system had been compromised the 34 sites whose systems were penetrated were able to identify or verify the intrusions Several officials stated that system administration duties are generally part-time duties and that administrators frequently have little computer security background or training At one site for example the system administrator had little knowledge of computers and system administrator responsibilities In addition with the exception of a brief overview of computer security as part of the had introductory training for the system the system administrator not received any computer security training Moreover after the intrusion occurred the newly appointed system administrator did not receive any additional computer security training and did not know the proper security reporting chain The security weaknesses that I have described here today have been and continue to be exploited by various hacker groups Two years ago we issued a report Computer Security Virus Hiqhliahts Need 4 for Improved Internet Manacement GAO IMTEC-89-57 highlighting some of the same weaknesses-- poor password management and system administrators who lacked the technical expertise to deal with security problems--that we discussed here today In addition numerous Computer Emergency Response Team CERT security available to anyone on the Internet have addressed advisories Yet despite these warnings these security these weaknesses weaknesses continue to exist Without the proper resources and these weaknesses will continue to exist and be attention thus undermining the integrity and confidentiality of exploited government information This concludes my remarks members of the Subcommittee I will now answer any questions you or may have concerning these issues 5 Ordering Information The first copy of each GAO report and testimony is free Additional copies are $2 each Orders should be sent to the following address accompanied by a check or money order made out to the Superintendent of Documents when necessary Orders for 100 or more copies to be mailed to a single address are discounted 25 percent U S General Accounting Office P O Box 6015 Gaithersburg MD 20877 Orders may also be placed by calling 202 2756241 United States General Accounting Office Washington D C 20548 Official Penalty Business for Private Use $300