Hackers gained unauthorized access to the Interior Department’s internal systems by breaching agency Wi-Fi networks using $200 homemade hacking kits. Luckily, the attackers were white hat hackers from the Interior Office of the Inspector General.
Earlier this year, the Interior IG’s IT audit team conducted several penetration tests at bureau offices, using easily accessible hacking tools to demonstrate the fragility of the agency’s wireless networks.
“We found that the department did not deploy and operate a secure wireless network infrastructure,” the team wrote in an audit report released Wednesday. “Specifically, the department’s wireless network policy did not ensure bureaus kept inventories of their wireless networks, enforce strong user authentication measures, require periodic tests of network security, or require network monitoring to detect and repel well-known attacks.”
To expose just how vulnerable the agency’s networks are, the pentesting work was done entirely by the IG’s in-house IT audit team, which constructed portable test units that fit inside backpacks and purses and could be operated using a smartphone. Auditors then set up in public areas near Interior offices—such as park benches—or got limited access to buildings and set to work infiltrating the agency’s networks.
Each kit cost less than $200 and used widely available open source software.
“These attacks—which went undetected by security guards and IT security staff as we explored department facilities—were highly successful,” the team wrote, noting they were able to intercept and decrypt network traffic at multiple offices.
The intrusion tests showed Interior’s poor Wi-Fi security, as well as other deeper problems with resilience.
At two locations, the team was able to go “far beyond the wireless networ ..
Support the originator by clicking the read the rest link below.
