NASA's Network Security Breaches: A Brief History - Cyberiom
Channel: Cyberiom
Date: 09/01/2023

In 2008, BusinessWeek reported on a series of cyber attacks against NASA's computer networks. The attacks, which had been occurring for over a decade, were primarily focused on the Goddard Space Flight Center, the Marshall Space Flight Center, and the Kennedy Space Center.

It appears that the hackers were able to gain access to the network through a joint venture owned by NASA contractors Boeing and Lockheed Martin. They used a malware program called stame.exe to gather data from computers in the Vehicle Assembly Building, where the Space Shuttle was maintained. The program was able to send this data to a computer system in Taiwan, which is believed to be used by the Chinese government as a digital way station. The breach eventually spread to the satellite control complex in Maryland and the Johnson Space Center in Houston.

It is not clear how the hackers were able to initially gain access to the network, but they were able to remain undetected for several months and exfiltrate a large amount of data. The investigation revealed that the hackers were able to access sensitive information such as engineering designs and research, as well as potentially operational details about the Space Shuttle. This could include information about engine flow levels, maximum temperature levels, and other live performance data.

It is worth noting that NASA has a history of being targeted by hackers, with numerous incidents dating back to the late 1990s. These attacks have often been linked to foreign governments, including Russia and China. NASA's networks are particularly vulnerable due to the accessibility of their systems to outside researchers and contractors, as well as the agency's focus on minimizing embarrassment over data theft rather than preventing breaches in the first place.

To better protect against future cyber threats, it will be important for NASA to prioritize network security and implement stronger security measures. This includes regularly updating software and training employees to recognize and report potential security threats.