uncompiled.com

In a US Senate Committee on Commerce, Science and Transportation hearing, security experts have expressed extreme concern about US defences against cyber-attacks. Former vice-admiral and head of National Intelligence Michael McConnell even went as far as claimingPDF that the US would be on the losing side should a hostile power launch a cyber war against it. This is not, according to McConnell, because US security staff are less talented or because its technology is inferior, but rather the US is vulnerable because it is the best networked country – for which reason it also has the most to lose.

It is precisely this state of affairs which the recently passed Cybersecurity Enhancement Act of 2009 is intended to resolve. It aims to ensure, by means of training, research and better coordination, that the government and government agencies are better protected against attacks originating from cyberspace. The Act still has to pass through the US Senate.

James Lewis of the Center for Strategic and International Studies (CSIS) also emphasisedPDF US vulnerability to attacks. According to Lewis, it is known that countries such as China and Russia are already carrying out espionage to determine how they can disable the US electricity grid. He believes that they and other countries are now in a position to be able to knock out the electricity grid in the event, for example, of a conflict over Taiwan or Georgia. However he thinks that it unlikely that China or Russia would go down this route, as it would be too great a risk politically, comparable to bombing a power plant, and would trigger a vigorous US reaction. In addition, he notes, even hostile states would suffer should, for example, Wall Street be knocked out.

However Lewis plays down concerns about terrorist attacks, saying that If terrorists were really in a position to carry out cyber-attacks, they would already have done so. The belief that they are in a position to do so, but have so far held back for whatever reason is “ridiculous”. Terrorists are, in his opinion, crazy people. Lewis warns that this situation could change if hostile powers were to provide terrorists with the requisite knowledge and skills. Lewis feels that at present, neither China nor Russia would cooperate with extremists.

Nonetheless, the US and the US economy is already being bled by constant small-scale cyber-attacks. According to Lewis, theft of important information and attacks by cyber-criminals are already doing immense damage to both business and government. If no action is taken, the patient will, Lewis told the hearing, eventually bleed to death – therefore he considers passage of the Act to be an urgent necessity.

Source

The House today overwhelmingly passed a bill aimed at building up the United States’ cybersecurity army and expertise, amid growing alarm over the country’s vulnerability online.

The bill, which passed 422-5, requires the Obama administration to conduct an agency-by-agency assessment of cybersecurity workforce skills and establishes a scholarship program for undergraduate and graduate students who agree to work as cybersecurity specialists for the government after graduation.

As officials puzzle over how to defend the nation from enemies that are often impossible to pinpoint, the lawmakers behind the bill said education and recruitment are crucial.

“Investing in cybersecurity is the Manhattan Project of our generation,” Representative Michael Arcuri, Democrat of New York, a sponsor of the bill said on the House floor Wednesday. “But this time around we are facing far greater threat. Nearly every high school hacker has the potential to hamper our unfettered access to the Internet. Just imagine what a rogue state could do.”

Mr. Arcuri said that the federal government will need to hire between 500 and 1,000 more “cyber warriors” each year to keep up with potential enemies. Troops online “are every bit as important to our security as a soldier in our field,” he said.

The Cybersecurity Enhancement Act, H.R. 4061, a major information security bill, closely follows a warning by Dennis Blair, the director of National Intelligence, who told lawmakers this week that computer-related attacks were becoming increasingly malicious.

The government’s four-year review of Defense Department strategies, also issued this week, stated that large-scale cyberattacks could massively disable or hurt international financial, commercial and physical infrastructure.

Mr. Obama has said cybersecurity is one of his top priorities and between the fallout from the attack on Google’s computers in January and the more modest hacking of Web sites of 49 House members and committees last week, the risk is felt acutely in Washington.

Still, the budget proposal the administration delivered to Congress Monday cut funding for the Homeland Security Department’s cybersecurity division.

There is no companion bill in the Senate, but senators are working on several unrelated information security bills.

The bill is based on a review of Mr. Obama’s review of cyberspace policies across the federal government in May, 2009. It authorizes one single entity, the director of the National Institute of Standards and Technology, to represent the government in negotiations over international standards and orders the White House office of technology to convene a cybersecurity university-industry task force to guide the direction of future research.

It also directs the National Science Foundation to research the social and behavioral aspects of cybersecurity, like how people interact with their computers and manage their online identities, in order to establish a new, more accessible awareness and education campaign.

Source

Romanian hackers continue to have a field day with SQL injection flaws in major Website applications: A vulnerability in a U.S. Army Website that leaves the database wide open to an attacker has now been exposed.

“TinKode,” a Romanian hacker who previously found holes in NASA’s Website, has posted a proof-of-concept on his findings on a SQL injection vulnerability in an Army Website that handles military housing, Army Housing OneStop. TinKode found a hole that leaves the site, which has since been taken offline, vulnerable to a vulnerable to a SQL injection attack. “With this vulnerability I can see/extract all things from databases,” he blogged.

TinKode was able to gain access to more than 75 databases on the server, according to his research, including potentially confidential Army data. He also discovered that the housing site was storing weak passwords in plain text. One password was AHOS, like the site’s name.

“Four-character passwords that are the same name as the database table names are inexcusable,” says Robert “RSnake” Hansen, founder of SecTheory.

Hansen says the ease with which TinKode discovered the SQL injection flaw highlights the state of Web security. “[This is] a good example of how terrible our security posture is, and he didn’t even have to do anything tricky to find the exploit,” he says.

TinKode is among a group of hackers out of Romania who have been disclosing SQL injection flaws in high-profile Websites during the past few months. Most recently hacker “unu” demonstrated a major SQL injection hole in an Intel channel partner events Website that exposed personal passport information. Unu was able to hack into the front-end Web app and, like TinKode, found that the server administrators had their passwords stored in clear text.

SQL injection is a common Website vulnerability that is increasingly being used as a foot in the door to the back-end database.

“Every organization has these problems,” Hansen says. “They may not realize it, but they’re just waiting for a smart kid to come along and copy off every critical piece of information they have.”

Source