South Pole Research Station Hacked Twice 292
Marda writes "It's been known for a while that Romainian cyber extortionists cracked the computer network at the Amundsen-Scott South Pole Station last year. Now SecurityFocus is reporting that another computer intruder penetrated the station just two months before, and cracked the data acquisition system for the Degree Angular Scale Interferometer (DASI), a radiotelescope that measures properties of the cosmic microwave background. It turns out the station was insecure 'purposely, to allow for our scientists at this remotest of locations to exchange data under difficult circumstances,' according to internal reports."
Man, it's cold down here (Score:5, Funny)
Re:Man, it's cold down here (Score:2)
Rus
??????WTF?????? (Score:3, Insightful)
this is the most riddiculous thing I've ever heard.
Re:??????WTF?????? (Score:5, Insightful)
For Pete's sake HIRE A CONSULTANT or better yet ASK FOR VOLUNTEERS. I'm sure there are plenty of folks out there who'd LOVE to have something like this on their resume.
C'mon. How about: we were cracked because we were lazy. Now that I'll buy--the first time.
Re:??????WTF?????? (Score:5, Insightful)
It is a valid point. If you do not have the skills to do something, pay someone to do it. If you don't have the funds, ask for a volunteer.
These people have screwed around with their system until the data transfer did what they wanted. What they didn't realize (I hope) is that they have opened up their system to these sorts of attacks.
If business did this sort of thing, imagine what the web would be like now...
Re:??????WTF?????? (Score:4, Insightful)
Re:??????WTF?????? (Score:4, Interesting)
Re:??????WTF?????? (Score:5, Funny)
Mission : go to Antartica, maintain email services. Duration 6 months.
Week 1 : upgrade and patch all machines.
Week 2 : make snowman, look at machines, plat solitaire.
Week 3 : blizzard, look at machines
Week 4 : play solitaire, start drinking beer
week 5 : remember about the pinball game, install pinball game play pinball
week 6 : Got lost for 3 days in the blizzard when making a snowman
week 7 : can't play pinball because of bitefrost bandages, drinking bourbon, watching blinkenlights on hub
week 8 : poured bourbon in file server so I had something to fix, got scolded by director of base who saw me
week 9 : tried drinking kerosene
week 12 : woke up in infirmary when doctor was about to start autopsy
It seems doctor had been smoking joints, asked him if he had any left
week 13 : shagged a penguin. Finished last of bourbon
week 14 : damn pengion follows me everywhere 11 more weeks to go. Found an AOL cd in the mailbox yesterday, no idea how it got there.
Great job indeed.
Re:??????WTF?????? (Score:4, Interesting)
Re:??????WTF?????? (Score:3, Insightful)
It's a different field of knowledge. (Score:5, Insightful)
Computer security is another one of those fields that requires its own study time to be competent in, and most people aren't interested or don't want to spend the time.
Re:It's a different field of knowledge. (Score:2)
Re:It's a different field of knowledge. (Score:2)
I can think of more than a few so-called sys and net admins that this very remark describes to a tee. In fact the same could be said about their very area of expertise.
Re:??????WTF?????? (Score:5, Interesting)
Sooooo... They get cracked, and when they do, it causes major data loss and takes a long time to return the machines to full service as there are no recent backups. And somehow, it's the fault of the security type whose advice they ignored/derided.
Been there, done that, wanted to strangle several research group leaders/members with the t-shirt.
Put it in perspective... (Score:5, Insightful)
"Given the fact that no financial records or systems were compromised, no safety or loss of life was threatened, and no critical system corrupted, we need to balance legitimate security needs with the legitimate needs of our scientists at the Pole," the memo reads.
...Other documents show that less than two months earlier the NSF's security team was plunged into a similar fire drill when a computer intruder named "PoizonB0x" penetrated the primary and backup data acquisition servers for a radio telescope at the station called the Degree Angular Scale Interferometer (DASI), which measures properties of the cosmic microwave background radiation -- the afterglow of the Big Bang. The intruder, rated a prolific website defacer by tracking site Zone-H, used his moment of cosmic access to erect a webpage on the servers proclaiming, "I love my angel Laura."
Now, I'm not one for people snooping around in my stuff when they're not invited or anything, but consider this: The first hack modified a web page on a system that collects monitoring data (but most likely does not contain other meaningful data, like formulas), and the second intruder accessed no financial data, did not threaten safety, and did not corrupt any critical systems.
Isn't it possible that the systems that were compromised were actually left insecure, not necessarily "on purpose", but because they felt that there wasn't much of a need to secure them in the first place? They probably calculated the possible risks and decided that, if both systems did in fact only contain informational webpages or data collected from their equipment, that there wasn't much point in worrying a lot about securing them (after all, who would really care about the data besides them?).
Antarctic Bees (Score:3, Funny)
Re:Put it in perspective... (Score:3, Informative)
We need to take three big steps back and look at the forrest as a whole. Systems are frequently compromised for indirect gains. Ie. A compromised system can be used as a "diving board" - to access other systems that the attacker may not otherwise have access
Re:??????WTF?????? (Score:5, Informative)
In btw, I am speaking out of experience here.
Re:??????WTF?????? (Score:2)
Re:??????WTF?????? (Score:3, Funny)
not if they are having 'brain freeze'
Re:??????WTF?????? (Score:5, Interesting)
besides, there are a lot of remote montiroing tools out there that use various forms of encryption. Leaving your network umprotected is just asking for trouble. For that matter, why is it news worthy if they get hacked then? after all, its already wide open
Stupidity cust both ways - why no head on a pike? (Score:3, Interesting)
OTOH, I think this would be a great rallying point to bring together a multinational task force, or at least some headhunters under public sanction, to start going after the scum who screw people over on their networks. It's against the law for
RTFA. (Score:4, Informative)
Re:??????WTF?????? (Score:3, Informative)
Re:??????WTF?????? (Score:5, Funny)
South Pole. Chilled. Check.
Re:??????WTF?????? (Score:5, Insightful)
Exactly. Those of us immersed in the information technology world often have little or no exposure to the disciples of pure science. And undergraduate physics students don't count. Traditional scientists don't think the way IT people or even computer scientists do. We see a system, and the goal is to optimize that system to perform correctly and efficiently. Traditional scientists have no interest in applied technology. Their goal is to gather knowledge, and to hell with everything that gets in the way. Typing in a tough password, applying patches, and following "best practices" gets in the way.
To make matters worse, these people are highly educated and are often the resident lords of their specialties. Academic types tend to have swollen egos. Poke something swollen, and it hurts-these guys will be pissed off if you try to tell them what to do, and more pissed off if what you're telling them to do doesn't clearly further their scientific goals. They simply don't take the computer security threat seriously, and they refuse to worry about it until they get burned.
It's hard for you to understand rational people saying, "ha, who in their right mind would hack into our secret antarctic lab full of data?" But most slashdotters would have the same attitude towards other things they don't have experience with. How many of you fear the consequences of unsecured eyelash curlers? Yes, eyelash curlers, which so befuddle the opposite sex and are an essential in many ladies' makeup boxes double as a lethal instrument of pain and torture - as my best friend can testify.
Last week as she was getting glammed up for a party she was trying to do 25 million things at once and not concentrating on any of them. What exactly happened though remains a bit of mystery-all I know is that moments after whatever did happen, she was screaming in pain, bruised and bleeding, with lashes no longer in lids but in the curlers. Suffice to say she shan't be using eyelash curlers ever, ever, ever, EVER again.
She's not the only one who has been incapacitated as the result of a cosmetic catastrophe and it is actually more common than one would suppose. Another friend had a very unfortunate accident on the night of a May Ball last summer. She was rushing around straightening her hair, helping a friend with her makeup, making a phone call, and trying to decide which bag to take when she encountered the upturned business end of her electric hair straighteners. You could her the screams from across the street!
So now you know! which is like half the battle. Trying to do your lashes can land you in the hospital, a fiendish fate not "faced" by hacker victims! Girls will always want their makeup but for our peace of mind and for the longevity of your eyelashes and more importantly, your eyesight, I implore you to throw away your eyelash curlers. They are veryvery dangerous.
Now if you'll excuse me, I have to go wash up..this foundation doesn't cause cancer..right?
Re:??????WTF?????? (Score:5, Insightful)
I am not a car mechanic or an electrician, but if my car alarm and door locks stop working, I take it to a mechanic who can fix it. I don't park the car on public street at night where it may get stolen. The excuse that since they know and care little about security, they can skip it altogether, is - as others pointed out - lame. A computer network containing sensitive or important data connected to the Internet requires security, whether you are a 3-time Nobel prize laureate or a warehouse janitor.
And as far as things that "get in the way" - security practices, or lack thereof - could easily get in the way of collecting and keeping valuable scientific data.
Re:??????WTF?????? (Score:5, Insightful)
Clearly you're not a physicist. Most of the ones I've worked for, some of whom are also at the pole, are convinced that:
since physics is one bad mamajama of a difficult subject, and as they've kicked that bad mamajama's ass, they are gods among men, seemingly privy to the unknown secrets of the universe.
They hire IT people not because IT is too difficult for them to do on their own, but too mundane. Please don't make the mistake of telling them how things should be done.
burn karma burn! (Score:4, Funny)
Re:burn karma burn! (Score:3, Informative)
"all your base are belong to us".
See here [wikipedia.org] for the origin of that phrase.
Re:burn karma burn! (Score:2)
Penguin hack party (Score:4, Funny)
Hacking those harmless scientists? (Score:4, Funny)
FP! Almost... (Score:5, Funny)
Bah! (Score:4, Funny)
There must be SOME technology (VPNs, as previously mentioned, perhaps) that can make it both easy and secure?
Heck, if they'll buy me the books and fly me down there, I'll fix it myself.
Re:Bah! (Score:3, Insightful)
have you seen what happens when your encrypted link keeps dropping
Re:Bah! (Score:2)
Better known as they programmed the thing to hit hard-coded start and stop sequences based on the internal clock, and were shocked and amazed when it didn't work.
While I feel for them that this was a unique bit of equipment under some oddbals circumstances, you don't leave any
Re:Bah! (Score:2)
Re:Bah! (Score:2)
This is disgusting behavior (Score:5, Insightful)
I can just see it now. A buoy in the ocean with millions of dollars in scientific instruments and sensors, collecting data for good of all mankind. Then some hacker finds his way in through the radio connection and manages to burn out or blow up the equipment by playing with the settings. His excuse? "See! It should have been secure! Next time you'll know better!" Way to miss the point, jack.
Re:This is disgusting behavior (Score:5, Insightful)
Re:This is disgusting behavior (Score:5, Insightful)
The worst part is that the scientist is doing it so that that jack*$$ who broke his system has new technologies and knowledge available to him! Yet this punk goes around trashing other people's stuff because it makes him "hip and cool", and he's "doing the scientists a favor by testing their systems". He has NO F###ING CLUE what kind of conditions this equipment has to operate under!
Take the South Pole station in the article. They only get unreliable and intermittent Internet access from retired satellites that have had their orbits moved to support the South Pole! Only a FEW HOURS A DAY! And some hacker kid vandalizes them for trying to get work done.
Re:This is disgusting behavior (Score:3, Interesting)
A very real threat. In the 80s, Cliff Stoll watched a guy relay from his system into a machine called PETVAX. At the time, that machine controlled the output of a radioactive particle emitter. Specifically, it controlled whether it was routed to a medical patient or a science experiment.
Read Cuckoo's Egg [amazon.com].
Re:This is disgusting behavior (Score:3, Insightful)
I hate to say it, but then the scientists need to find someone WITH A COMPUTER SECURITY CLUE!
I don't expect physicists to know how to secure a network. But I would expect that, if they are dealing with precious data and networks, that they would hire or find
Eric S. Raymond Vocabulary Enforcement (Score:3, Informative)
http://catb.org/~esr/jargon/
Re:Eric S. Raymond Vocabulary Enforcement (Score:4, Funny)
Re:Eric S. Raymond Vocabulary Enforcement (Score:3, Interesting)
At this point it's a lost cause. Hackers, for good or ill are so vilified in the MSM(Main Stream Media) that once it(the MSM) collapses we'll have a chance to redeem ourselves. Until that happens, we have to put up with fuck-wits like those that are going to hit the RNC convention blocking out "freedom of expression" and ruin the name.
Re:This is disgusting behavior (Score:2)
Re: (Score:2)
Now we know.... (Score:5, Funny)
Come on, physical location means nothing now!!!
Re:Now we know.... (Score:2)
It's all Linux's fault (Score:2, Funny)
Back In The Day... (Score:5, Interesting)
Re:Back In The Day... (Score:3, Interesting)
Within four years, those ports were all shut down. Of course, we all had ICQ and AIM by then,
Re:Back In The Day... (Score:5, Funny)
So, you were one of those guys? Where you the one who told all his friends about us? Back then we only had a 64bps (yes, that's right 64bps not 64kbps) link and it was always getting clogged up with tourists trying to check out our machine and see who was on. Lots of kids sending us silly "phone" requests, for a couple of months there nobody could get any work done at all. Thanks a lot dude!
Hacks Could Cost the Scientists' Lives (Score:2, Funny)
On purpose for a reason... (Score:5, Informative)
Re:On purpose for a reason... (Score:2)
Re:On purpose for a reason... (Score:2)
Having been in an academic environment around people who have worked in Antarctica leads me to believe the reason they didn't want the system secure is well, they didn't want the system secure. Because they are in charge, they tend to get what they want (well, at least until there is a really big problem that requires external help). They wanted free and open exchange of information. Secur
Re:On purpose for a reason... (Score:3, Insightful)
Re:On purpose for a reason... (Score:2)
Re:On purpose for a reason... (Score:2)
Any orbit that passes above either pole will be a polar orbit. And while those are interesting and have their uses, they're definitely not geosync.
Re:On purpose for a reason... (Score:2)
Re:On purpose for a reason... (Score:5, Informative)
It is possible, however, to use inclined orbits to provide good coverage at high latitudes, including the poles. You'll need multiple satellites to provide continuous coverage, though. It's my understanding that the South Pole links use retired geostationary satellites that have run out of stationkeeping propellant. Without stationkeeping, solar and lunar perturbations increase the orbital inclination, the angle between the orbital plane and the equator, which is nominally zero for a geostationary satellite. This causes the satellite to move in a north-south figure-8 pattern, making it visible for part of each day at each pole.
Two good examples of satellites in orbits specifically designed to provide good high latitude coverage are the Russian Molniya series and the new Sirius digital radio broadcasting [sirius.com] satellites. (Sirius' competitor XM Radio [xmradio.com] uses conventional geostationary satellite orbits.)
Both Molniya and Sirius use elliptical orbits with inclinations of about 63 degrees. At this inclination, the effect of the earth's oblateness on the orbital argument of perigee is canceled out. That means the apogee (farthest point from the earth) will always occur at the same latitude, which in these two cases is selected to be the northernmost point of the orbit (since northern latitudes are being served). The result is a satellite that, while not stationary, spends much of each orbit nearly motionless at high latitude.
The Molniya and Sirius orbits differ in that the Molniya orbits have fairly low perigees and orbital periods of about 12 hours. The Sirius satellites are in geosynchronous (but not geostationary) orbits, meaning that even though they do not sit motionless over the equator, they still complete exactly one orbit per sidereal earth day.
The Russians use these orbits because their country sits at high latitudes. Sirius uses their orbits to increase the elevation at which their satellites appear over the northern US and southern Canada, minimizing blockage by buildings and reducing the number of terrestrial repeaters needed in urban areas.
A Sirius orbit can be seen here [heavens-above.com] and a Molniya orbit can be seen here [heavens-above.com].
Re:On purpose for a reason... (Score:2)
You Insensitive Clod! (Score:5, Funny)
Please help out (Score:4, Funny)
They should have used a Mac on the South Pole (Score:3, Funny)
1. They wouldn't have been 0wn3d so easily
2. It would keep them toasty warm! [slashdot.org]
Leave your front door open on the internet.... (Score:3, Insightful)
The correct way to deal with this is to have a DMZ - a nice public facing internet machine that isn't as security critical as your primary experiment instrument. This may mean a compromise in terms of budget and/or data availability.
You gotta wonder... (Score:5, Interesting)
I was dialed in over a microwave link running at about 10Kbps. Even pathetic bandwidth is no excuse not to use simple security measures.
P.S. I'm posting from yet another Pacific Island, where I regularly use an ssh tunnel to connect to my home IMAP server, over a modem line that I share with 12 other computers on our local network.
Re:You gotta wonder... (Score:5, Informative)
It's unsecured through necessity, not through choice.
Re:You gotta wonder... (Score:2, Insightful)
I know the scientists would rather work on their research but they are living in the 21st century just like the rest of us and security is a concern. If the hacking was important
Here's a view from the pole (Score:5, Informative)
I just found Big Dead Place [bigdeadplace.com] a couple days ago, and read their account of one of these 'hacker attacks' and Raytheon Polar Services' (RPSC) reaction to it.
Short version: Everyone at the pole was pissed. Denver (RPSC headquarters) took away their porn^H^H^H^Hnet access, and thus made a bunch of already deprived individuals even more deprived.
There's a ~500 K newsletter-spoof PDF [bigdeadplace.com] on the site that expresses some of their feelings.
Some other interesting things on the site:
slashdotters don't have a fucking clue, as usual (Score:3, Insightful)
The station is designed for one thing: scientific research. With that in mind, the people you send to the station are those capable of doing the research, or those that are capable of maintaining the station so that others can do their research. Most of the folks there are conversant in a half-dozen jobs - *because they have to be*. There isn't enough funding for critical positions, much less a position like 'computer network administrator' which is nothing more than dead weight 99% of the time. A person who, if they can't also fix tractor engines, maintain the fuel-based heating system, and help calibrate various pieces of astronomical equipment, is nothing more than a waste of space, food, and energy.
No doubt the Amundsen-Scott folks decided to do business 'as usual', e.g., in a not very secure manner, because a) who the hell would want to hack the system when there's nothing to gain?, and b) there isn't anyone there who's life work is system security.
(In fact, I'm willing to bet they *could* secure the system in a decent manner, but never saw the point of it since they couldn't conceive of why anyone would want to mess with it in the first place. Frankly, I can't either; it takes a real jack-off to do something like this.)
All those clueless gits out there who scream "they should have a network administrator!" might want to keep in mind that a network administrator isn't worth his weight in fuel to ship out there, much less keep around during the eight months of the year they're pretty much cut off from the outside world. And yes, that means *you*; if all you know is network administration/security then you're useless waste of good oxygen at Amundsen-Scott, and the people there neither want or need you cluttering up the cramped base, eating their food and using their heat.
Max
Re:slashdotters don't have a fucking clue, as usua (Score:2)
All those clueless gits out there who scream "they should have a network administrator!" might want to keep in mind that a network administrator isn't worth his weight in fuel to ship out there, much less keep around during the eight months of the year they're pretty much cut off from the outside world.
I administer numerous servers hundreds or thousands of miles away from me. No kidding. Who says I would have to be shipped down there to install things like patches, updates, firewalls, and the like?
I'm t
Don't need on the spot support (Score:2)
A network admin does not have to be on the spot - they can build a simple box required for the other end (plus a spare) and ship it down there with very clear concise setup instructions and a fat manual covering every aspect of the system. Having an identical box back home you can send simple messages down when things go seriously wrong, like "turn to page 32". You can probably get a simple embedded system off the shel
Re:slashdotters don't have a fucking clue, as usua (Score:3, Insightful)
It's easy to say the words "remote access", isn't it?
Call your local provider, ask them about getting a line to the South Pole. Keep calling until you find someone who can provide it. Once you do, ask them how much it will cost. Now, calculate how many slaves you'd have to keep working in full-time positions to be able to afford any decent amount of bandwidth.
steve
Re:slashdotters don't have a fucking clue, as usua (Score:3, Insightful)
Many measurement devices don't have required software ported for [insert your *nix].
OOo doesn't have the same capabilities as Excel, essential in many enviroments.
And who is going to pay for porting that Excel/VBA/Access/MS SQL/etc stuff to BSD/Linux?
Re:slashdotters don't have a fucking clue, as usua (Score:3, Insightful)
RTFA. The system wasn't trashed. Very little was done to it.
How much does downtime cost you?
Considering that they only have communication access to the outside world for a few hours a day, very little.
What does it cost to get someone to your site to fix your system?
When the fuel could be used to ship needed equipment, food, or just used for heating, a whole hell of a lot.
What POTENTIAL expenses/risks do you face if someone uses your equipment to
The real link... (Score:4, Informative)
Security is against scientific spirit! (Score:3, Informative)
Remember, RMS was against introducing passwords into the MIT AI lab, and when they eventually did it he sabotaged the system buy coercing users to choose a blank password. He even brags about it in the Revolution OS documentary.
Re:Security is against scientific spirit! (Score:2, Insightful)
I don't think a researcher would appreciate it if another, even a scientist, updated the research without the approval of the researcher. Reading that same information and giving feedback however, is different.
Ease of use != Insecure (Score:4, Insightful)
Re:Ease of use != Insecure (Score:3, Insightful)
Complex things require complex computer systems. Complex computer systems are complex to keep secure, more so when you need to maintain some kind of level of usability.
Makes perfect sense, from their perspective (Score:5, Interesting)
The key issue is that if an academic is given a computer, they're not going to have the faintest idea of what's required security wise. [In fact, I've seen academics go out and buy really big (30") screens and fancy macintoshs just to run email and a browser, if that gives you an idea of the mindset of many in the scientific community.] - and other than the penguins (who only work for herrings and probably don't want to pay tax), there aren't any "neighborhood geeks" nearby to help them with their machines.
I just spent two years in a science laboratory in North America at a VERY large institution. Of the two hundred or so scientists in that department alone, maybe ten or fifteen knew enough about computers to write HTML - and probably not a lot further. As the department evolved over time, computers were added in one at a time, by whom ever felt like putting in a computer. Thus, there wasn't a single coordinated plan , and some of the computers were left completely vulnerable intentionally! If there's no one in charge, no structure to coordinate the addition of computers, and no one able to make the decisions to put an infrastructure in place, there's no one to insist on security standards. Can you say welcome mat to hackers?
I'd be willing to bet that that's exactly what happened at the South Pole. Someone decided they wanted to be able to share files with another scientist, and I'd doubt either had ever heard of SSH. Net result: they intentionally put a hole in the flimsy security they had to begin with. I can imagine the thought process: "I need to share a file with someone 30000km away.. lets just create an annonymous ftp to c:\, that way I won't have to worry about them not having access to anything they need!"
Finally, the key point is that if you have computers at the south pole, it's going to cost an exorbitant amount to send someone out to mantain them, and the only alternative is to have the scientists call "tech support" back in the states (or is india closer?), which is probably like talking my father through a computer problem. It's bad enough when you're there, but 100x worse when you're at opposite ends of the country. Of course, if you leave a few "holes" open intentionally, someone back home can log in and maintain it for you. (-;
Sorry for the overlong rant!
Inevitable William Gibson reference... (Score:3, Funny)
Cold Computers (Score:2, Funny)
It's not cracking (Score:2, Funny)
It's like in Fahrenheit 9/11 where the cops "infiltrate" the peace group whose membership is, uh, open to the public.
bad summary of the article (Score:3, Informative)
The point of the securityfocus.com article was not "South Pole Research Station Hacked Twice", but that the US DoJ has used this as a spin campaign to justify the cyberterrorism provisions of the patriot act.
However, the FBI and DoJ's version of events is contradicted by the NSF internal assessment of the attack...
The previous security problems at the South Pole appears in the second to last paragraph as support for the claim that the attack was not threatening to life support at Amudsen-Scott.
WARNING TO HAXOR5! (Score:3, Funny)
ATTEMPT NO LANDINGS^H^H^H^H^H^H^H pwnings THERE
-the black obelisk
No,no,no,no. (Score:3, Funny)
Look, here's some free advice. If you want to make people care about the problem, you need to call them "cyber-TERRORISTS".
Many people don't know what extortion really means, but they know that terrorists can hurt their children.
Geez, its a good thing you guys are mostly libertarian/democrat/green, because you'd make crappy republicans.
All your base.. (Score:3, Funny)
Hacked or Cracked? (Score:4, Informative)
Re:So uh... (Score:3, Funny)
If the latter, then I'd like to point out that there's a great deal we can learn about the Earth's climate and biological history, as well as contained ecosystems. (Lakes under the ice with more than just bacteria? Who knew there'd be enough O2 for animal life?)
If the former, well, you know those haxxor guys...
Re:So uh... (Score:3, Informative)
Re:Very usefull data (Score:3, Informative)
Re:Very usefull data (Score:2)
Re:unsecure?? (Score:2)
Re:What's the big deal (Score:2, Insightful)
You come home, someone's obviously been inside your house. Your door is open, they've gone through everything in the house.
After days of searching everything in the house, it's determined that they didn't actually take anything. What's the big deal?
steve
Re:Spelling.... (Score:2, Insightful)