DigitMemo.com

Two labs of America’s top scientists have fallen for the oldest trick in the hackers’ book

A report featured on ABC News concluded that two nuclear labs had been “hacked.”  The true story is a bit more entertaining and the reveals that there is no threat to the country’s nuclear safety.  Real threats such as concerted “hacks” conducted by the Chinese against the U.S. government are certainly a concern, but the only thing dangerous about the compromise at these labs is the stupidity of a few scientists and workers at the plants.

The Oak Ridge National Laboratory (ORNL) in Tennessee and Los Alamos National Lab in New Mexico have made a habit of collecting the social security numbers, names, and birth dates of scientists who visit the plants.  The information is put into a database, which reads like a who’s who of America’s top scientists.

Unfortunately, nobody thought such a practice might be a bit insecure.  Starting October 29, workers at the labs began receiving phishing emails, which followed a traditional attack pattern of containing malicious Trojan-containing attachments. 

There is no evidence that the attacks were specifically geared at the lab.  If the attacks were just a general Internet attack, those responsible might have been excited at the big fish they caught.  The two labs both have reported that the phishing emails gained access to their system, which indicates at least two employees — one at each plant — were foolish enough to click the attachment and commence the damage.  The result was that the database with the scientists’ information was compromised.

The phishers gained access to the records of all visitors at the plant between 1999 and 2004. 

Don’t blame the news networks solely for sensationalizing the attack and making it sound like a sophisticated assault.  Leaders at the labs have gone on record trying to fudge the facts in statements, making the attacks sound more complex than they really are and icing over that the attacks only succeeded due to employee failures.

In 2006 Los Alamos fell victim to social engineering and phishing when its emails were stolen and ended up on the USB stick of a drug dealer found in a police raid.  The emails contained data of simulated nuclear weapons tests considered sensitive.

At the time executive director of the Project On Government Oversight (POGO), Danielle Brian blasted Los Alamos for their lax security stating, “This appears to be a new low, even drug dealers can get classified information out of Los Alamos.”

Expect more pressure for  ORNL and LANL as the smoke of sensationalism begins to blow away, revealing atrocious security due to user stupidity.  Looks like some of America’s top minds have just fallen for the one of the oldest tricks in the hackers’ book.