P-to-P users expose US government secrets
Contractors and US government employees are sharing hundreds of secret documents on peer-to-peer networks, in many cases overriding the default security settings on their P-to-P software to do so, according to a company that monitors the networks.
Robert Boback, CEO of P-to-P monitoring service vendor Tiversa, and retired US Army General Wesley Clark, a Tiversa board member, said the company found more than 200 sensitive US government documents during a recent scan of three popular P-to-P networks. The two testified earlier this week before the US House of Representatives Oversight and Government Reform Committee.
Among the files shared: Physical threat assessments for multiple cities, including Philadelphia and Miami; a physical security attack assessment for a US Air Force base; a detailed report from a government contractor on how to connect two secure Department of Defence (DOD) networks; a document titled, ‘NSA (National Security Agency) Security Handbook’.
Many lawmakers directed their criticism toward the Lime Group, distributor of the popular P-to-P software Lime Wire, during a contentious hearing Tuesday. But Boback, in a later interview, said his testimony wasn’t intended to cast blame on Lime Wire.
In many cases, P-to-P users override the default security settings in the software. In Lime Wire, the default setting allows users to share files only from a ‘shared’ folder, but many users apparently override the default settings, ignore warnings from the software, and share their entire ‘my documents’ folder or other folders, Lime Group CEO Mark Gorton testified.
In other cases, government employees or contractors apparently ignore policies prohibiting the use of P-to-P software on computers containing sensitive government information, witnesses testified.
P-to-P users can also download files with hidden executables that can index the entire hard drive, Boback said, and that can create victims of even expert computer users. But the fault doesn't lie with Lime Wire or other P-to-P vendors, he added.
“It’s the malicious user writing code that will expose the entire hard drive,” he said. “Just because that user is a Lime Wire user, it makes it look as though Lime Wire indexed their system, when actually it was an executable within a download.”
The problem isn’t with the P-to-P network itself, he added. “It’s just another access for malicious users to index one’s information,” he said.
In preparation for the congressional hearing, Tiversa scanned the three most popular P-to-P networks, including the Gnutella network Lime Wire uses, for two days. Tiversa staff entered common military search terms and found more than 200 secret US government documents, Boback said.
The problem with official government documents on P-to-P networks in general is likely to be much greater; since Tiversa confined itself to military search terms, he said. The company reported its findings to US government officials, some of whom took action to remove the documents, Boback said.
In another scan, on July 17, Tiversa found a defence contractor employee sharing 1,900 files, including 534 sensitive files, from what was apparently a home computer. The contractor, an IT expert, supported 34 US government agencies including the DOD and intelligence agencies, Tiversa said.
Among the files shared from the contractor’s computer: the infrastructure diagram for the entire Pentagon secret backbone network; password change scripts for secret Pentagon network servers; Secure Sockets Layer instructions and certificates allowing access to the contractor’s IT systems; a contract issued by the US Army Contracting Agency authorising $1.5 million (£740,000) in fees from the contractor.
The contractor’s shared files also included a letter from the US White House Office of Management and Budget warning about the risks of P-to-P networks.
Representative Henry Waxman, a California Democrat and chairman of the oversight committee, asked during the hearing how sensitive the information was. “Would this kind of information jeopardise the US if it fell into the wrong hands?” he asked.
“Of course it would,” answered Tiversa’s Clark. “There’s all kinds of information that's getting out.”
Several lawmakers targeted Lime Wire’s Gorton, even though US Department of Transportation CIO Daniel Mintz said employees broke agency policy by using P-to-P software on computers containing government information.
Representative Darrell Issa, a California Republican, said he’s unsure how Lime Wire avoids lawsuits from users whose personal information has been exposed. Representative Jim Cooper, a Tennessee Democrat, scolded Gorton for having a “failure of imagination” about the security lapses associated with P-to-P.
“If I were you... I’d feel more than shame and guilt at this point for having made the laptop a dangerous weapon against the security of the US,” he said.
Gorton, whose company does not monitor what’s shared over Lime Wire, said he was surprised that so much secret government data was being shared over P-to-P networks. Lime Wire will look at ways to block users from sharing personal and sensitive information, he said, but he also called on Congress to look at ways to block sharing at the internet service provider (ISP) level. ISPs would have the power to block such data, he said.
“I had no idea there was the amount of classified data out there,” he said. “Clearly, some people are not paying attention to our warnings. We need to do a better job of making it very, very, very difficult for users to accidentally share files.”
SMS: P-to-P users are sharing hundreds of US government files, according to a monitoring company.