US government being hit by massive security breaches

Contractors and US government employees are sharing hundreds of secret documents on peer-to-peer networks, in many cases overriding the default security settings on their P-to-P software to do so, according to a company that monitors the networks.

Share

Contractors and US government employees are sharing hundreds of secret documents on peer-to-peer networks, in many cases overriding the default security settings on their P-to-P software to do so, according to a company that monitors the networks.

Robert Boback, CEO of P-to-P monitoring service vendor Tiversa, and retired US army general Wesley Clark, a Tiversa board member, said the company found more than 200 sensitive US government documents during a recent scan of three popular P-to-P networks. The two testified earlier this week before the US House of Representatives Oversight and Government Reform Committee.

Among the files shared were physical threat assessments for cities including Philadelphia and Miami, a physical security attack assessment for a US Air Force base, and a detailed report from a government contractor on how to connect two secure Department of Defence (DOD) networks.

Many lawmakers directed their criticism toward the Lime Group, distributor of the popular P-to-P software Lime Wire, during a contentious hearing. But Boback, in a later interview, said his testimony wasn’t intended to cast blame on Lime Wire.

In many cases, P-to-P users override the default security settings in the software. In Lime Wire, the default setting allows users to share files only from a ‘shared’ folder, but many users apparently override the default settings, ignore warnings from the software, and share their entire ‘my documents’ folder or other folders, Lime Group CEO Mark Gorton testified.

In other cases, government employees or contractors apparently ignore policies prohibiting the use of P-to-P software on computers containing sensitive government information, witnesses testified.

P-to-P users can also download files with hidden executables that can index the entire hard drive, Boback said, and that could create victims of even expert computer users. But the fault doesn't lie with Lime Wire or other P-to-P vendors, he added.

“It’s the malicious user writing code that will expose the entire hard drive,” he said. “Just because that user is a Lime Wire user, it makes it look as though Lime Wire indexed their system, when actually it was an executable within a download.”

The problem isn’t with the P-to-P network itself, he added. “It’s just another access for malicious users to index one’s information,” he said.

In preparation for the congressional hearing, Tiversa scanned the three most popular P-to-P networks, including the Gnutella network Lime Wire uses, for two days. Tiversa staff entered common military search terms and found more than 200 secret US government documents, Boback said.

Find your next job with computerworld UK jobs