By This may bring up a debate of whether the geniuses behind this major scandal were really that good or whether the organisation responsible for exploring other planets and managing the Deep Space Network really has such kind of shitty system security or to put it better “Gameboy level of security”. But yes, someone did actually make up a really risky idea of using a Raspberry Pi to hack into the servers of NASA Jet Propulsion Laboratory.
This nuisance was brought into the light after an audit was released by the NASA Office of Inspector General (OIG) on June 18th revealing that the cyber attack made on one of the mini-computers got a hacker lucky enough to run away with strictly classified documents.
Many of us may not be familiar with Raspberry Pi which is simply a tiny computer and by tiny we mean the size of a credit card that is as cheap as $35.
Start off your week with tech news recap and trending conversations in your inbox
Being this cheap, it has been a popular tool among techies who wish to learn basic computer programming, robotics and DIY projects. And even though many “teachers” have been referencing to the tool a lot and recommending tech geeks to prioritise a Raspberry Pi as a must-have, exploiting an unauthorised tool to hack into NASA’s system is, to say the least, a really horrible idea.
Raspberry Pi
Unfortunately for the NASA though, the hacker used it to create a portal for siphoning files from the laboratory that is tasked with handling robotic space and Earth science missions, including the Mars Curiosity rover, according to the agency’s OIG.
The hack was executed in April last year once an external user’s account was found to be compromised with which the attacker used to log in to the network and expand their access to the system.
NASA Files Stolen
Let us satisfy your obvious curiosity with informing you that 23 total files were stolen, two of them (about 500MB in total) involved secret info on International Traffic in Arms Regulation and Mars Science Laboratory mission.
More to this, two out of the three networks belonging to JPL were hacked, which resulted in an immediate temporary shut down of several space-flight related systems from the lab.
What may, however, frighten you further is that the hack went undetected for 10 months. If that doesn’t cut it, the report went further to say that JPL didn’t have a complete or absolutely correct inventory of system element on its network, meaning that not everything of what the hacker got to access is known yet. Moreover, the lab never had security controls well able to monitor any cyber attacks on its network, so administrators never detected the hacker since the Raspberry Pi wasn’t properly logged in.
And this meant that the device that was practically “non-existent” was most likely used to access the system, a task that is very easy for a hacker who is not monitored and can’t be identified.
According to more reports, several other “unknown” devices were identified on the system though none were believed to be malicious. “The device should not have been permitted on the JPL network without the JPL [Office of the Chief Information Officer]’s review and approval.” says the report, which is something we can all agree on.
None has been identified or arrested for the attack till now even though NASA’s OIG report is still in the works. To be extra careful though, the lab has installed various monitoring agents on its firewalls to keep an eye on the system and has promised to review network access agreements for external partners.
No further comment from NASA has been aired out so probably more of the report will let us know what’s at stake. What I would be curious about is whether aliens really exist. Wouldn’t you?
Comments