Hackers gained unauthorized access to the Interior Department’s internal systems by breaching agency Wi-Fi networks using $200 homemade hacking kits. Luckily, the attackers were white hat hackers from the Interior Office of the Inspector General.
Earlier this year, the Interior IG’s IT audit team conducted several penetration tests at bureau offices, using easily accessible hacking tools to demonstrate the fragility of the agency’s wireless networks.
“We found that the department did not deploy and operate a secure wireless network infrastructure,” the team wrote in an audit report released Wednesday. “Specifically, the department’s wireless network policy did not ensure bureaus kept inventories of their wireless networks, enforce strong user authentication measures, require periodic tests of network security, or require network monitoring to detect and repel well-known attacks.”
To expose just how vulnerable the agency’s networks are, the pentesting work was done entirely by the IG’s in-house IT audit team, which constructed portable test units that fit inside backpacks and purses and could be operated using a smartphone. Auditors then set up in public areas near Interior offices—such as park benches—or got limited access to buildings and set to work infiltrating the agency’s networks.
Each kit cost less than $200 and used widely available open source software.
“These attacks—which went undetected by security guards and IT security staff as we explored department facilities—were highly successful,” the team wrote, noting they were able to intercept and decrypt network traffic at multiple offices.
The intrusion tests showed Interior’s poor Wi-Fi security, as well as other deeper problems with resilience.
At two locations, the team was able to go “far beyond the wireless network at issue” and again access to the department’s internal networks. The IG hackers were even able to steal the login credentials of an IT employee, gaining access to the internal help desk system and visibility into all of that employee’s open tickets.
“We also found that several bureaus and offices did not implement measures to limit the potential adverse effect of breaching a wireless network,” the report reads. “Because the bureaus did not have such protective measures in place, such as network segmentation, we were able to identify assets containing sensitive data or supporting mission-critical operations.”
The report outlines two types of attacks testers used to gain access to Interior networks: one in which the attackers deciphered the pre-shared key—like the single ID and password used to log on to a home network—and another in which they stole unique credentials using “evil twins” to access a more secure network.
In the former scenario, the team used the homemade hacking kits to eavesdrop on wireless network traffic, waiting for someone to log on or otherwise transmit encoded credentials. Depending on the quality of the password, the attacker might be able to break the encryption there on the spot. If it’s too complex, the “credentials can be transmitted to higher performance remote systems where additional efforts could be dedicated to breaking the encoding,” the report states.
“There is no control that can prevent