NASA computer servers vulnerable to attack: audit

"We found that computer servers on NASA's agency-wide mission network had high-risk vulnerabilities that were exploitable from the Internet," NASA inspector general Paul Martin said in an audit of NASA's network security.

"Specifically, six computer servers associated with IT assets that control spacecraft and contain critical data had vulnerabilities that would allow a remote attacker to take control of or render them unavailable," the report said.

It said a cyber attacker who managed to penetrate the network could use compromised computers to exploit other weaknesses and "severely degrade or cripple NASA's operations."

The inspector general's audit of NASA's computer security found "network servers that revealed encryption keys, encrypted passwords, and user account information to potential attackers.

"These data are sensitive and provide attackers additional ways to gain unauthorized access to NASA networks," the report said.

The inspector general warned that "until NASA addresses these critical deficiencies and improves its IT security practices, the agency is vulnerable to computer incidents that could have a severe to catastrophic effect on agency assets, operations, and personnel."

The inspector general performed the audit after NASA experienced a number of cyber intrusions that the report said resulted in the "theft of export-controlled and other sensitive data from its mission computer networks."

The inspector general cited a May 2009 incident in which cyber criminals infected a computer system that supports one of NASA's mission networks.

"Due to the inadequate security configurations on the system, the infection caused the computer system to make over 3,000 unauthorized connections to domestic and international Internet Protocol (IP) addresses including addresses in China, the Netherlands, Saudi Arabia, and Estonia," the report said.

It said that in January 2009, cybercriminals stole 22 gigabytes of export-restricted data from a Jet Propulsion Laboratory computer system.

The inspector general recommended that NASA immediately act to mitigate risks on Internet-accessible computers on its mission networks and carry out an agency-wide IT security risk assessment.

(c) 2011 AFP