NASA hacked because of unauthorized Raspberry Pi connected to its network (2019)

A consultant who works with NASA once told me that there was an incident where they had exposed several petabytes of data to the public Internet. Because no one had the storage capability for the data though, they wrote off the security incident completely.

I once worked with a company who on occasion sent people to very secure sites. (yes I've told this story before)

You arrived at the facility in a rental car with your keys, clothing, ID (credit cards were ok and could be left in the car), and anything you needed to do the job (laptop, hardware, whatever).

You were told to expect to leave with your clothes, keys, ID, and rental car (obviously the previously mentioned credit cards).

You parked at the gate, were blindfolded, and escorted to the place you did your job, and then the same process out.

NOTHING left the facility beyond those things, even the front gate. (Car was searched and anything in the car might be confiscated).

I honestly think that's a level of security (well maybe without blindfold) that many places will eventually have to adopt.

> "The attacker exfiltrated approximately 500 megabytes of data from 23 files, 2 of which contained International Traffic in Arms Regulations information related to the Mars Science Laboratory mission," the NASA OIG said.

wait, what? ITAR REGULATION for Mars Missions??

This was the old scare scenario for "Plug Computing" way back when. It was new that you could fit a capable linux system (>1GHz core, >.5GB RAM, network interfaces, bluetooth etc) into something that hung off a socket and looked just like any other power supply or dumb device or whatever.

Of course that was forseeing malicious placement of something that would be scanning for vulnerabilities, rather than a remote exploit of an unsecured device on a secure network.

I'm at NASA and a while ago I wanted to experiment with using Pi's to monitor experimental setups, instead of using full-on PCs as we do now, which would save a ton of money. Trying to get permission to put one on the network, even for just a quick test, was so difficult I gave up. And that was a few years ago, now we have so much mandatory compliance monitoring software, I don't know if it would even be possible anymore. Some of those packages may not be available for the Pi, even if it were running a supported OS like Ubuntu instead of Raspios. I understand why incidents like this one have made NASA management extra sensitive to IT security matters, but it sure feels like a creativity straight-jacket at times. There is not much fun in being an SA at NASA these days, I'm sorry to say.

> The report blamed the JPL's failure to segment its internal network into smaller segments

Network boundary can never provide strong enough security protection. No matter how small each segment is. Just because a device is in your network doesn't mean you can trust it.

Implement authnz correctly everywhere and make sure the system can verify "if you are who you say you are" is more efficient.

The Rasperry Pi really isn't the point here. It's really about general bad security hygiene. The section labeled "HACKERS DESCRIBED AS AN APT" covers the actual problems that allowed this to happen. The NASA combined with Rasperry Pi components of the headline are more clickbait than anything.

Remind you of Mr.Robot anyone?

"The robot looks a lot like the US space agency's (Nasa) Spirit and Opportunity vehicles from the 2000s."

https://www.yahoo.com/news/us-satellite-looks-down-chinas-11...

Mac addresses should be registered with the network and run an endpoint security agent to continue physical access.

But how did the Pi get there? Was it just some NASA employee's project? Or was there physical intrustion and the Pi was part of the plan?

I'm curious if it was wired or wireless? Also was it just someones hobby raspberry with default creds or was it there for this purpose?

From June 21, 2019

Reminds me of Mr. Robot