5
$\begingroup$

The Engadget article A rogue Raspberry Pi helped hackers access NASA JPL systems highlights an incident where a networked Raspbery Pi at JPL was used to gain access to several other networks, including DSN.

NASA's Jet Propulsion Laboratory (JPL) suffers from multiple cybersecurity weaknesses despite the advances it has achieved in space technology, according to the agency's Office of Inspector General (PDF). Investigators looked into the research center's network security controls after an April 2018 security breach, wherein a Raspberry Pi that was not authorized to be linked to the JPL network was targeted by hackers. The attackers were able to steal 500 megabytes of data from one of its major mission systems, and they also used that chance to find a gateway that allowed them to go deeper into JPL's network. (emphasis added)

Diving deeper into the system gave the hackers access to several major missions, including NASA's Deep Space Network -- its network of spacecraft communication facilities. As a result, the security teams of some sensitive programs, such as the Orion Multi-Purpose Crew Vehicle and the International Space Station, have chosen to disconnect from the agency's network.

Question: What information was stolen from JPL during the Raspberry Pi hack? What was in the "500 megabytes of data from one of its major mission systems"? Was it for example design details of the Orion spacecraft, or images of one of Saturn's moons?

$\endgroup$
  • 1
    $\begingroup$ On some level I suspect the answer is locked away in some infosec office someplace, but I am following this with interest ... $\endgroup$ – Saiboogu Jun 20 at 13:43
2
$\begingroup$

As an information security professional this makes me cringe, but I'm not in the last surprised. I've read the OIG report, there's not that much information on the data that is lost, but the report states on page 10:

Prior to detection and containment of the incident, the attacker exfiltrated approximately 500 megabytes of data from 23 files, 2 of which contained International Traffic in Arms Regulations information related to the Mars Science Laboratory mission.

International Traffic in Arms Regulations (ITAR) is a law preventing the transfer of military applicable technology, it was most likely something to do with the design of the rover or scientific instruments which were derived from classified military technology. From the same page:

More importantly, the attacker successfully accessed two of the three primary JPL networks. Accordingly, NASA questioned the integrity of DSN data related to space flight systems and temporarily disconnected several space flight-related systems from the JPL network.

The document sites poor network segmentation between NASA and the JPL, and that after the April 2018 attack using the pi NASA cut their links. It's very possible that the DSN had traffic from classified missions at the time. If that's the case I doubt there's be any details on that publicly.

$\endgroup$
  • 1
    $\begingroup$ The first paragraph gives a bit more detail @OrganicMarble. I've put my best infosec interpretation to expand on what it might mean. Its not a lot but it's all I could find. $\endgroup$ – GdD Jun 21 at 12:03
  • 1
    $\begingroup$ One comment: ITAR and classified are two completely separate things. ITAR applies broadly to a number of topics related to space and launch vehicles, even those that have never been classified. $\endgroup$ – Tristan Jun 21 at 18:02
  • $\begingroup$ fyi I've just asked Shouldn't NASA JPL's network be secure against Raspberry Pi connections authorized or not? $\endgroup$ – uhoh Jun 24 at 0:04
  • 1
    $\begingroup$ That question is likely to be closed unfortunately @uhoh, it's almost rhetorical. Of course it should be protected. I'll comment on that site though. $\endgroup$ – GdD Jun 24 at 6:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.