Feeds

DHS network vulnerable to attack

Remote access security issues

  • alert
  • submit to reddit

Combat fraud and increase customer satisfaction

The US Department of Homeland Security is having some homeland cyber security issues on its systems providing remote access to telecommuters, according to a newly-released report by the DHS Inspector General's office.

Earlier this year security auditors armed with ISS's Internet Scanner, @stake's L0phtCrack and Sandstorm Enterprises' PhoneSweep 4.0 spent five months probing hosts, attacking passwords and war dialing the Department.

They found that some of the hosts designed to allow home workers and other trusted users access to DHS networks by modem or over the internet lacked the authentication measures called for by official NIST guidelines and recommendations by the National Security Agency, like minimum password lengths and password aging.

Moreover, system patches were not kept up to date, leaving some systems open to known buffer overflows and other exploits. Meanwhile, a war dialing effort against 2,800 DHS phone lines turned up 20 modems that the Department couldn't immediately account for.

"Due to these remote access exposures, there is an increased risk that unauthorized people could gain access to DHS networks and compromise the confidentiality, integrity, and availability of sensitive information systems and resources," the report concludes.

The audit examined DHS's Emergency Preparedness and Response Directorate; the Bureau of Immigration and Customs Enforcement; the Bureau of Citizenship and Immigration Services; and DHS Management. Only DHS Management proved resistant to L0phtCrack. Of the other three components, passwords were crackable with user name and dictionary attacks at a rate between eight per cent and 37 per cent, with some accounts protected by no password at all.

In a written response attached to the report, Department CIO Steve Cooper said some of the auditors' concerns were overstated: The systems suffering known vulnerabilities were waiting for patches to come out of testing, and any genuine effort at password hacking would be hobbled by the Department's policy of limiting failed login attempts, wrote Cooper.

"As we complete the transition to Windows 2003 on most of our networks, it will be impossible to have a password that does not comply with DHS complexity requirements," he wrote.

Copyright © 2004, SecurityFocus logo

Related stories

Proposed Homeland Security Czar scratched
US Homeland Security Czar resigns
Uncle Sam demands all air travel records

SANS - Survey on application security programs

Whitepapers

Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.