NASA has been hit repeatedly by hackers during the last two years – including an incident where attackers compromised systems at the agency’s Jet Propulsion Laboratory.
The situation was revealed in testimony Feb. 29 by NASA Inspector General Paul Martin before the House Science, Space and Technology subcommittee. According to Martin, the agency discovered in November 2011 that hackers using a China-based IP address had compromised the network of NASA’s Jet Propulsion Laboratory (JPL) and gained full access to JPL systems and sensitive user accounts. The incident remains under investigation. In fiscal year 2011, the agency was targeted with 47 attacks he called advanced persistent threats (APTs), of which 13 were successful at compromising agency systems.
All totaled, the agency reported 5,408 computer-security incidents from 2010 and 2011 that resulted in either the installation of malware or unauthorized access to the agency’s computer systems.
“These incidents ranged from individuals testing their hacking skills, to well-organized criminal enterprises seeking to exploit NASA systems for profit, to intrusions that may have been sponsored by foreign intelligence services,” Martin said in the hearing.
Martin also revealed that a notebook computer stolen in March 2011 resulted in the loss of algorithms used to control the International Space Station. The laptop was one of 48 NASA notebooks or mobile devices pilfered by thieves between April 2009 and April 2011; thefts that resulted in sensitive data leaks and the loss of personal information and intellectual property, Martin said.
As of Feb. 1, only one percent of NASA’s portable devices/laptops were encrypted, Martin added.
In 2010, a NASA audit revealed the agency’s policies towards machines slated for disposal were inconsistent and often lax. For example, there was no “sanitation verification testing” for PCs at the end of their lifecycle at the Lyndon B. Johnson Space Center, and 10 computers from the John F. Kennedy Space Center were released to the public despite failing tests to see if they had been properly wiped.
