5 ms·

Vulnerabilities in dozens of Military and Pentagon websites

77 points by Garbage 14y ago

deleted 14y ago
[deleted]
kbar13 14y ago
huh
- personalcompute 14y ago
  These are all SQL Inection vulnerabilities. You replace the (usually numeric) url parameter with crafted SQL. More info: https://www.owasp.org/index.php/SQL_Injection https://www.owasp.org/index.php/SQL_Injection
- rellik 14y ago
  My thoughts exactly.. though I didn't have the guts to paste these into my curl.
eurodance 14y ago
I want to see if these are real, but I don't want people knocking on my door tomorrow morning.
- shitlord 14y ago
  use tor then https://www.torproject.org/ https://www.torproject.org/
  - mylittlepony 14y ago
    In case someone too naive is reading, using something like tor won't give you hacker super powers. The only real protection you can have is knowing what you are doing, and even then you can fail. I wouldn't recommend messing with stuff like this while you are eating a donut and reading hacker news (nor any other moment for that matter).
    - deleted 14y ago
      [deleted]
- clicks 14y ago
  Well, HN receives a significant amount of traffic -- probably a good many people do go on to click the links. It's equivalent at this point to having the URL featured on some high-traffic tech news site. If you're still wary, pick the most unremarkable one, that you think most people are likely to click. That way it seems more normal from their perspective -- you're just one among many in the wide sea. Here, I'll even help you out: https://secureweb.hqda.pentagon.mil/dpo/Details.asp?ID=108 https://secureweb.hqda.pentagon.mil/dpo/Details.asp?ID=108
  - btilly 14y ago
    Huh, I thought you had pasted the URL wrong. But it is a bug on this site that swallowed the quote. Anyways add a ' to the end of that URL and you'll see clear evidence of a SQL injection bug. But it is just demonstrating that the bug is there. It would take more work to get access to their database.
  - dfc 14y ago
    If you're still wary, pick the most unremarkable one, that you think most people are likely to click. This sentence makes no sense whatsoever. It seems that you think "unremarkable" means likely to draw a lot of attention.
- daniel-cussen 14y ago
  For reals. I thoughtlessly clicked, as I would any other HN link, until I realized...it was not...kosher.
rookadook 14y ago
I hesitated a while before clicking on that link. At my previous job, I was responsible for maintaining a ".gov" site and this post got me thinking. Is there a code of conduct or a professional response that is expected of a web developer who sees a post like this on pastebin? Are we supposed to just ignore it? Maybe click the link to make sure we are not on the list? Not click on the link? I know I would have been thankful if someone had given me a heads up if my site was on that list.
- tantalor 14y ago
  The ethical thing would be to forward the information to the administrators of the listed sites. But since it's public now, I don't think you have any responsibility.
D9u 14y ago
Can you say "HoneyPot?"
- jcfrei 14y ago
  hmm, interesting point - however I doubt they would be this sophisticated. after all these are just informative web pages for the public and are most likely not held to the same rigorous standards in security like other systemic systems of the government.
vinhboy 14y ago
I tried a couple of the links. All SQLi vuln. All using microsoft sql server too it looks like. I don't know why I had this image of .gov and .mil sites being super secure. I no longer think that...
- Jach 14y ago
  I don't know why anyone would expect a public facing PR website to have the same level of security as actual military use systems... Obligatory XKCD: http://xkcd.com/932/ http://xkcd.com/932/
  - 46Bit 14y ago
    Most hackers aren't involved in government procurement and so assume that it will be done with extra care and attention, rather than the opposite for 10x the cost.
- mattmanser 14y ago
  You really did not need to click on the links to figure that out. And it's not SQL server that's the problem, it's the scripting language. asp means active server pages (VBScript). Very old. cfm means cold fusion markup (ColdFusion). Also very old. These are just very old websites built back in the day when no-one knew what they were doing. One of them even has 'legacyapps' in the address.
  - bdcravens 14y ago
    ASP hasn't been updated in about 10 years, so yes it's old. ColdFusion, however, isn't "very old". It's an actively supported platform with new versions released within the past year (commercially and 2 open source alternatives). It contains current features such as ESAPI support (for security) and web sockets (for the whiz bang buzzwordians). The fact that it was released in 1995 is irrelevant - similarly aged languages include Java, Ruby, JavaScript, and PHP. You're correct that the age of the websites has much to do with the vulnerabilities. I think "no-one knew what they were doing" borders on insulting for anyone who's been building web apps for more than a few years, however. Rather, things like SQL injection weren't common then, and older, unsupported apps are thus easily exposed.
danso 14y ago
It's a testament to the power of media that so many people not involved in the military automatically bequeath them with such impenetrable technical capability and diligence. One of my best friends served as a sniper but had slighty less than 20/20 vision. So they had a military surgeon fix that up and now, several years later, my friend is wearing glasses. It's not that this was substandard care, but that for someone who already completed elite training, they opted for nothing-special care. So why should we expect great diligence when it comes to building informational websites. Does anyone remember the ease with which Bradley Manning performed his hack*? edit: I think I'm getting downvoted because people disagree that Manning "hacked" something. I don't know why there is disagreement here...he himself disclosed the methods he used to get over the "air gap". Just because those methods were trivial doesn't undercut my point, in fact, it underscores my point that the military's information security is not without flaws: http://en.wikipedia.org/wiki/Bradley_Manning#Diplomatic_cables.2C_Guantanamo_Bay_files http://en.wikipedia.org/wiki/Bradley_Manning#Diplomatic_cabl...
- mpyne 14y ago
  > Does anyone remember the ease with which Bradley Manning performed his hack? You're right that the military is hardly going to treat a "Public Affairs" website with any special care, but I wanted to correct you on your description of a Bradley Manning "hack". There was no hack. There was never a hack. Bradley Manning was the proverbial "insider" threat. You may remember that in the wake of 9/11 there was a lot of acrimony regarding how poorly the various Federal agencies worked together. They often engaged in turf warfare to maximize the agency's important instead of maximizing the U.S.'s ability to respond to actual threats. No one shared info with one another, either because they were not sure they could share info, to prevent aiding other agencies getting more powerful, etc. And as a result there were thousands of Americans murdered, not to mention the horrific property losses. So, one of the "lessons learned" was that the intelligence agencies were going to work together from then on. Not just work together, they were going to share the intel. Counterterrorism would become a real mission goal, with real resources put to it, real organizations aligned around it, etc. So suddenly, military was working with CIA, FBI, Dept. of State, and more, and working together to prevent another 9/11 happening, prevent IED attacks against deployed troops, etc. There was never a hack. Manning had access to all of that data quite intentionally, to help him do his f'ing job as an intelligence specialist analyzing the various Islamist threat groups in his area. He even quoted (and was quite proud of) an award citation in his chat logs with Lamo that described how he was aiding the Army in that particular fight. But not once did he hack anything. He downloaded data he had authorized access to, and exfiltrated it to persons who did not have authorization.
mpyne 14y ago
This is more than .mil sites, there's also UN, NOAA, DOE. But it looks like these are mostly NIPR Public Affairs types of sites, from what I can tell.

77 points by Garbage 14y ago

deleted 14y ago

[deleted]

kbar13 14y ago

huh

personalcompute 14y ago
These are all SQL Inection vulnerabilities. You replace the (usually numeric) url parameter with crafted SQL. More info: https://www.owasp.org/index.php/SQL_Injection https://www.owasp.org/index.php/SQL_Injection
rellik 14y ago
My thoughts exactly.. though I didn't have the guts to paste these into my curl.

eurodance 14y ago

I want to see if these are real, but I don't want people knocking on my door tomorrow morning.

shitlord 14y ago
use tor then https://www.torproject.org/ https://www.torproject.org/
- mylittlepony 14y ago
  In case someone too naive is reading, using something like tor won't give you hacker super powers. The only real protection you can have is knowing what you are doing, and even then you can fail. I wouldn't recommend messing with stuff like this while you are eating a donut and reading hacker news (nor any other moment for that matter).
  - deleted 14y ago
    [deleted]
clicks 14y ago
Well, HN receives a significant amount of traffic -- probably a good many people do go on to click the links. It's equivalent at this point to having the URL featured on some high-traffic tech news site. If you're still wary, pick the most unremarkable one, that you think most people are likely to click. That way it seems more normal from their perspective -- you're just one among many in the wide sea. Here, I'll even help you out: https://secureweb.hqda.pentagon.mil/dpo/Details.asp?ID=108 https://secureweb.hqda.pentagon.mil/dpo/Details.asp?ID=108
- btilly 14y ago
  Huh, I thought you had pasted the URL wrong. But it is a bug on this site that swallowed the quote. Anyways add a ' to the end of that URL and you'll see clear evidence of a SQL injection bug. But it is just demonstrating that the bug is there. It would take more work to get access to their database.
- dfc 14y ago
  If you're still wary, pick the most unremarkable one, that you think most people are likely to click. This sentence makes no sense whatsoever. It seems that you think "unremarkable" means likely to draw a lot of attention.
daniel-cussen 14y ago
For reals. I thoughtlessly clicked, as I would any other HN link, until I realized...it was not...kosher.

rookadook 14y ago

I hesitated a while before clicking on that link. At my previous job, I was responsible for maintaining a ".gov" site and this post got me thinking. Is there a code of conduct or a professional response that is expected of a web developer who sees a post like this on pastebin? Are we supposed to just ignore it? Maybe click the link to make sure we are not on the list? Not click on the link? I know I would have been thankful if someone had given me a heads up if my site was on that list.

tantalor 14y ago
The ethical thing would be to forward the information to the administrators of the listed sites. But since it's public now, I don't think you have any responsibility.

D9u 14y ago

Can you say "HoneyPot?"

jcfrei 14y ago
hmm, interesting point - however I doubt they would be this sophisticated. after all these are just informative web pages for the public and are most likely not held to the same rigorous standards in security like other systemic systems of the government.

vinhboy 14y ago

I tried a couple of the links. All SQLi vuln. All using microsoft sql server too it looks like. I don't know why I had this image of .gov and .mil sites being super secure. I no longer think that...

Jach 14y ago
I don't know why anyone would expect a public facing PR website to have the same level of security as actual military use systems... Obligatory XKCD: http://xkcd.com/932/ http://xkcd.com/932/
- 46Bit 14y ago
  Most hackers aren't involved in government procurement and so assume that it will be done with extra care and attention, rather than the opposite for 10x the cost.
mattmanser 14y ago
You really did not need to click on the links to figure that out. And it's not SQL server that's the problem, it's the scripting language. asp means active server pages (VBScript). Very old. cfm means cold fusion markup (ColdFusion). Also very old. These are just very old websites built back in the day when no-one knew what they were doing. One of them even has 'legacyapps' in the address.
- bdcravens 14y ago
  ASP hasn't been updated in about 10 years, so yes it's old. ColdFusion, however, isn't "very old". It's an actively supported platform with new versions released within the past year (commercially and 2 open source alternatives). It contains current features such as ESAPI support (for security) and web sockets (for the whiz bang buzzwordians). The fact that it was released in 1995 is irrelevant - similarly aged languages include Java, Ruby, JavaScript, and PHP. You're correct that the age of the websites has much to do with the vulnerabilities. I think "no-one knew what they were doing" borders on insulting for anyone who's been building web apps for more than a few years, however. Rather, things like SQL injection weren't common then, and older, unsupported apps are thus easily exposed.

danso 14y ago

It's a testament to the power of media that so many people not involved in the military automatically bequeath them with such impenetrable technical capability and diligence. One of my best friends served as a sniper but had slighty less than 20/20 vision. So they had a military surgeon fix that up and now, several years later, my friend is wearing glasses. It's not that this was substandard care, but that for someone who already completed elite training, they opted for nothing-special care. So why should we expect great diligence when it comes to building informational websites. Does anyone remember the ease with which Bradley Manning performed his hack*? edit: I think I'm getting downvoted because people disagree that Manning "hacked" something. I don't know why there is disagreement here...he himself disclosed the methods he used to get over the "air gap". Just because those methods were trivial doesn't undercut my point, in fact, it underscores my point that the military's information security is not without flaws: http://en.wikipedia.org/wiki/Bradley_Manning#Diplomatic_cables.2C_Guantanamo_Bay_files http://en.wikipedia.org/wiki/Bradley_Manning#Diplomatic_cabl...

mpyne 14y ago
> Does anyone remember the ease with which Bradley Manning performed his hack? You're right that the military is hardly going to treat a "Public Affairs" website with any special care, but I wanted to correct you on your description of a Bradley Manning "hack". There was no hack. There was never a hack. Bradley Manning was the proverbial "insider" threat. You may remember that in the wake of 9/11 there was a lot of acrimony regarding how poorly the various Federal agencies worked together. They often engaged in turf warfare to maximize the agency's important instead of maximizing the U.S.'s ability to respond to actual threats. No one shared info with one another, either because they were not sure they could share info, to prevent aiding other agencies getting more powerful, etc. And as a result there were thousands of Americans murdered, not to mention the horrific property losses. So, one of the "lessons learned" was that the intelligence agencies were going to work together from then on. Not just work together, they were going to share the intel. Counterterrorism would become a real mission goal, with real resources put to it, real organizations aligned around it, etc. So suddenly, military was working with CIA, FBI, Dept. of State, and more, and working together to prevent another 9/11 happening, prevent IED attacks against deployed troops, etc. There was never a hack. Manning had access to all of that data quite intentionally, to help him do his f'ing job as an intelligence specialist analyzing the various Islamist threat groups in his area. He even quoted (and was quite proud of) an award citation in his chat logs with Lamo that described how he was aiding the Army in that particular fight. But not once did he hack anything. He downloaded data he had authorized access to, and exfiltrated it to persons who did not have authorization.

mpyne 14y ago

This is more than .mil sites, there's also UN, NOAA, DOE. But it looks like these are mostly NIPR Public Affairs types of sites, from what I can tell.