NASA hack blamed on unauthorised Raspberry Pi

Scathing report details ten years of security issues and malpractice

NASA headquarters

An unsecure and unauthorised Raspberry Pi device has been blamed for a 2018 security breach in NASA's Jet Propulsion Laboratory (JPL), a department plagued with cyber security vulnerabilities, according to a new report from NASA's Office of Inspector General.

The security breach in question saw hackers target a NASA employee's Raspberry Pi device, which wasn't authorised to connect to the JPL's network, and make off with 500MB of data from one of its major mission systems.

Advertisement - Article continues below

This was just one of the more recent incidents from the past ten years of "notable cyber security incidents that have compromised major segments of its IT network," according to the report.

Back in 2011, the same department fell victim to another security breach which saw hackers gain full access to 18 servers that supported key missions, giving them read/write privileges of nearly all files, and steal 87GB of data. At the time, JPL managed 23 aircraft in active missions to Jupiter Mars and Saturn.

Across the entire organisation, 13 hacks were reported in 2011 alone with other incidents resulting in employee credentials being stolen because it failed to encrypt and protect sensitive data quickly enough, according to Paul Martin, NASA general testifying before Congress at the time.

Advertisement
Advertisement - Article continues below

The latest investigation into the cyber security malpractice revealed myriad weaknesses in JPL's IT network, one lying in the database it uses to monitor and track its physical assets and applications on its network. The database the department used was inaccurate and incomplete, meaning JPL couldn't effectively monitor the entire network and react to security threats.

Advertisement - Article continues below

"There's been a failing of appropriate policy definition and demonstrable compliance issues," said   Matt Walmsley, EMEA director at Vectra. "There have been technical gaps which have rendered JPL unaware of devices connected to their network and left them almost blind to indicators of active attackers who have defeated access and preventative controls and are now operating inside their network with impunity."

Feeding into the Raspberry Pi discovery, a more general weakness in network visibility was mentioned in the report as being a key influencer in the department's inability to secure its network too.

"Further, we found that JPL's network gateway that controls partner access to a shared IT environment for specific missions and data had not been properly segmented to limit users only to those systems and applications for which they had approved access," the report added.

"This shortcoming enabled an attacker to gain unauthorized access to JPL's mission network through a compromised external user system."

Advertisement - Article continues below

The scathing report added that tickets created by the network-monitoring database (aforementioned) regarding a vulnerability detection went unresolved for extended periods of time, in some cases more than 180 days. JPL system administrators were also confused about their responsibilities regarding management and review of logs for identifying malicious activity occurring on the network.

The report detailed a host of other issues in the safekeeping of the organisation's network, some of which deviated from industry best practices and advice from cyber security experts.

Of the 10 recommendations raised in the report, NASA has agreed to all but one: to establish a formal threat-hunting process - the one recommended by IT experts to "aggressively pursue" vulnerabilities that weren't just basic, surface level issues.

Featured Resources

Top 5 challenges of migrating applications to the cloud

Explore how VMware Cloud on AWS helps to address common cloud migration challenges

Download now

3 reasons why now is the time to rethink your network

Changing requirements call for new solutions

Download now

All-flash buyer’s guide

Tips for evaluating Solid-State Arrays

Download now

Enabling enterprise machine and deep learning with intelligent storage

The power of AI can only be realised through efficient and performant delivery of data

Download now
Advertisement
Advertisement

Recommended

Visit/security/355013/10-quick-tips-to-identifying-phishing-emails
Security

10 quick tips to identifying phishing emails

16 Mar 2020
Visit/business-strategy/mergers-and-acquisitions/354941/panda-security-to-be-acquired-by-watchguard
mergers and acquisitions

Panda Security to be acquired by WatchGuard

9 Mar 2020
Visit/security/internet-security/354417/avast-and-avg-extensions-pulled-from-chrome
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019
Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/software/video-conferencing/355138/zoom-beaming-ios-user-data-to-facebook-for-targeted-ads
video conferencing

Zoom beams iOS user data to Facebook for targeted ads

27 Mar 2020
Visit/infrastructure/server-storage/355118/hpe-warns-of-critical-bug-that-destroys-ssds-after-40000-hours
Server & storage

HPE warns of 'critical' bug that destroys SSDs after 40,000 hours

26 Mar 2020
Visit/software/355113/companies-offering-free-software-to-fight-covid-19
Software

These are the companies offering free software during the coronavirus crisis

25 Mar 2020
Visit/mobile/mobile-phones/355088/apple-lifts-iphone-purchase-restrictions
Mobile Phones

Apple lifts iPhone purchase restrictions

23 Mar 2020