對美國政府電子安全官員宣稱的所謂“GOVnet”安全網路分析 (轉)

對美國政府電子安全官員宣稱的所謂“GOVnet”安全網路分析 (轉)[@more@]原始地址： /docs/govnet.htm" target=_blank>

對美國政府電子官員宣稱的所謂“GOVnet”安全分析

中文部分由 阿新(Seraph Chutium) 補充



這裡是華盛頓郵報對的相關報導。
鑑於上篇文章大家因為英文就沒仔細看，我把我理解的大意寫上……
是美國政府的新任電子資訊保安官員稱他們要為美國政府構建一個能夠抵擋任何，恐怖分子以及、的GOVnet網路。他們在做決定前想向業內認識詢問了構建這樣一個網路的花費及難度等等，業內的大部分安全專家認為這向計劃很難完成。其中還有一段介紹了前不久白宮遭紅色程式碼等攻擊的例子：
This year, the current network has been breached by ers, computer worms and viruses. In April, government sites were manipulated
by Chinese hackers angered by the death of a Chinese pilot in a collision with an American spy plane. 這段話看了比較欣慰！
The system was also roughed up by the "Code Red" computer woand an attack program called "ILoveYou." The viruses affected thousands of government computers.（先貼到這裡，大家先看看）。
文章的後面 Kurtz 說即使有這樣的網路，攻擊或病毒仍然可以透過和可信任的內部中傳播。一位現在美國國防部的資訊保安專案主管(information-security program director at the Defense Department 不知道是不是這個意思)說，要想在internet上完全阻止一個豐富的駭客或者設計精巧的病毒是幾乎不可能的。
大意就是這樣……

U.S. Seeks to Build Secure Online Network
TeleFirms Asked for Help in Constructing Private 'Govnet' System

By Krissah Williams
Washington Post Staff Writer
Thursday, October 11, 2001; Page A10

The government's new cyber-security officials yesterday asked telecommunications companies for help building a government computer network that would have "no risk of outs penetration" -- a task some computer security consultants say is nearly impossible.

Plans for the private network, called Govnet, hinge on whether a reliable network infrastructure can be built at an affordable price, officials said. Computer system consultants said they could not estimate how much the network would cost because of the government's enormous size and security needs.

Richard Clarke, who was appointed special adviser to the president for cyberspace security this week, said he believes a more reliable system can be built. Ninety percent of available fiber-optic space is unused and fairly inexpensive to obtain, he said.

Govnet is part of a plan Clarke announced earlier this week "to secure our cyberspace from a range of possible threats, from hackers to criminals to terrorist groups, to foreign nations, which might use cyber-war against us in the future." Govnet would be completely independent from the Internet to help keep out hackers and viruses, according to the government's plan.

The request from the General Services Administration asks that telecommunications companies submit proposals about how the network could be built, how much it would cost, and how long it would take to construct.

"Based upon that we will make a decision. We're waiting to hear from industry right now," Clarke said.

This year, the current network has been breached by hackers, computer worms and viruses. In April, government Web sites were manipulated by Chinese hackers angered by the death of a Chinese pilot in a collision with an American spy plane. The system was also roughed up by the "Code Red" computer worm and an attack program called "ILoveYou." The viruses affected thousands of government computers.

Last year a report by the General Accounting , an internal government watchdog, found weaknesses in the computer network that could allow terrorists or hackers to "severly damage or disrupt national defense or vital public operations or steal sensitive data."

Clarke said the government's current virtual private network is vulnerable to viruses and denial of service attacks that Govnet would make more difficult to execute.

George Kurtz, co-author of "Hacking Exposed" and chief executive of security consulting firm Foundstone Inc., said such a network is feasible but would be costly and difficult to build. It is impossible to stave off all attacks, he said.

"The gist of this entire effort is to try to segment critical government computer systems from the rest of the Internet," Kurtz said. "You can't guarantee against these sort of attacks. There is always going to be a flaw with software, a flaw with hardware or the human element."

Even on Govnet, viruses and attacks could still be spread by floppy disks or connections with trusted systems, Kurtz said.

An internal network, such as the Govnet proposal, is worth investigating but will probably fall to sophisticated hackers, said Amit Yoran, chief executive of security-services company Riptech Inc. and a former information-security program director at the Defense Department.

"It is probably more feasible to implement and strongly enforce global security postures and practices rather than go out and purchase new assets," Yoran said. "Once someone is able to get in, they will find a weak link. When you have a network the size of the government's there will be weak links. Someone will get in."

　
--------------------------------------------------------------------------------

下面是名為"m4chine"的fucktelus.com組織成員寫的一份深入分析。
主要介紹了它的目的、由來、撥號碼字首和最後作者做出的結論。
至於那個“News Article Pertaining to GOVnet”就是上面那篇華盛頓郵報的文章。

==>  'An Insightful Look at the GOVnet Network'  <==



==> By: m4chine
==> Date: 10/12/01
==> E-: m4chine@fucktelus.com

-

Description


 indeX =>  

  -> Introduction

  -> GOVnet's Purpose

  -> GOVnet's Origin

  -> Dial-In Prefixes

  -> News Article Pertaining to GOVnet

  -> Conclusion


<=>


   Introduction -

GOVnet is the name given to the network infrastructure which serves government offices in
Montpelier and Waterbury as well as district offices in twelve cities and towns statewide. In
the near future the Whitehouse and the DOD will be adopting this network for nation-wide usage.

The physical backbone consists of fiber optic cable connecting state buildings on the Montpelier
and Waterbury campuses as well as high-bandwidth digital circuits connecting district offices
statewide. The wide-area backbone is divided into OSPF regions with at least one alternative
route for each link. From the backbone nodes, 56 Kbps backfeeds serve other government offices,
schools, and libraries statewide.

In addition there are dial-in sites located in every local calling area of the state facilitating
network access with a local phone call from any school or library in the state that elects to have
dial-in access. SLand PPP access, as well as VT100 access, are supported on a dial-in basis.

The network uses the "open" non-proprietary communications protocol which pets connectivity
throughout the state, the nation and the world.

Network services include Internet access, government-wide , and WWW access to government.


--

 GOVnet's Purpose -

GOVnet was implemented to meet the twofold network challenge of improved access with reduced costs.
The network provides for complete inter-agency and inter-departmental information access through a single
system serving all agencies on a cerative basis. This eliminates the need for each agency or department
to provide redundant networks involving duplicate costs.

--

GOVnet's Origin -

The Vermont Information Strategy Plan (VISP) identified the requirement for information sharing and
networking in two of the critical success factors associated with its ives. The Information Systems
Advisory Council (ISAC), which was created by VISP (now called IRMAC), was commissioned by the Telecommun-
ication Ten-Year Plan to form a network subcommittee to "develop a plan to integrate network services where
such sharing is valuable for information sharing among government agencies (and) where it is designed and
implemented with the participation and unanimous approval of ISAC."

For a detailed analysis of GOVnet, including a chronology, see the Legislative Joint Fiscal Office's GOVnet.

--

Dial-In Prefixes -

The list below shows the local dial-in site(s) serving each telephone in the State.
For the telephone number of a specific GOVnet dial-in site, wardial the motherfuckin' prefix
or social engineer the technology coordinator of the department.

Dial-In Sites by Telephone Exchange Telephone Exchange Dial-In Site(s):

   222 (Bradford) Bradford
   223 (Montpelier) Montpelier, Morrisville
   226 (Proctor) field
   228 (Ludlow) South Londonderry
   229 (Montpelier) Montpelier, Morrisville
   234 (Bethel) Randolph, Rutland, Woodstock
   235 (Middle Town Springs) Rutland, Wells
   241, 244 (Waterbury) Montpelier
   247 (Brandon) Middlebury, Rutland
   253 (Stowe) Montpelier, Morrisville
   254, 257, 258 (Brattleboro) Brattleboro
   259 (Mount Holly) Rutland, South Londonderry
   263 (Perkinsville) Springfield
   265 (Fair Haven) Rutland
   266 (Canaan) Canaan
   273 (Hubbardton) Rutland
   276 (Brookfield) Montpelier, Randolph
   277 (Lemington) Canaan
   285 (Franklin) St. Albans
   287 (Poultney) Rutland, Wells
   291 (White River Junction) White River Junction, Woodstock
   293 (Danby) Rutland, South Londonderry
   295, 296 (White River Junction) White River Junction, Woodstock
   325 (Pawlet) Rutland, Wells
   326 (Montgomery) St. Albans
   328 (Guildhall) Island Pond
   333 (Fairlee) Bradford
   334 (Newport) Newport
   348 (Williamsville) Brattleboro
   352 (Salisbury) Middlebury
   362 (Manchester) Bennington, South Londonderry
   365 (Newfane) Brattleboro
   368 (Jacksonville) Brattleboro
   371 (Montpelier) Montpelier, Morrisville
   372 (Grand Isle) Burlington, St. Albans
   375 (Arlington) Bennington, Londonderry
   387 (Putney) Brattleboro
   388 (Middlebury) Middlebury
   394 (Rupert) Bennington, Wells
   422 (Sherburne) Rutland, Woodstock
   423 (Readsboro) Bennington
   425 (Charlotte) Burlington
   426 (Marshfield) Montpelier
   429 (West Newbury) Bradford
   433 (Williamstown) Montpelier, Randolph
   434 (Richmond) Burlington
   436 (Hartland) White River Junction, Woodstock
   438 (West Rutland) Rutland
   439 (East Corinth) Bradford
   442 (Bennington) Bennington
   446 (Wallingford) Rutland
   447 (Bennington) Bennington
   453 (Bristol) Middlebury
   454 (Plainfield) Montpelier
   456 (East Calais) Montpelier, Morrisville
   457 (Woodstock) White River Junction, Woodstock
   459 (Proctor) Rutland
   462 (Cornwall) Middlebury
   463 (Bellows Falls) Bellows Falls, Springfield
   464 (Wilmington) Bennington, Brattleboro
   467 (West Burke) Island Pond, St. Johnsbury
   468 (Castleton) Rutland
   472 (Hardwick) Montpelier, Morrisville, St. Johnsbury
   475 (Panton) Middlebury
   476, 479 (Barre) Montpelier
   482 (Hinesburg) Burlington
   483 (Pittord) Rutland
   484 (Reading) Woodstock
   485 (Northfield) Montpelier, Randolph
   492 (Cuttingsville) Rutland
   496 (Waitsfield) Middlebury, Montpelier, Randolph
   524 (St. Albans) St. Albans
   525 (Barton) Island Pond, Newport
   527 (St. Albans) St. Albans
   533 (Greensboro) Morrisville, St. Johnsbury
   537 (Benson) Rutland
   545 (Weybridge) Middlebury
   546 (Weathersfield) Springfield
   563 (Cabot) Montpelier, St. Johnsbury
   583 (Waitsfield) Middlebury, Montpelier, Randolph
   584 (Groton) Bradford
   586 (Craftsbury) Morrisville
   586 (Greensboro) Morrisville, St. Johnsbury
   592 (Peacham) St. Johnsbury
   623 (Whiting) Middlebury
   626 (Lyndonville) St. Johnsbury
   633 (Barnet) St. Johnsbury
   635 (Johnson) Morrisville
   644 (Jeffersonville) Morrisville
   645 (Wells) Wells
   649 (Norwich) White River Junction, Woodstock
   651, 654, 655, 656, 657, 658, 660 (Burlington) Burlington
   672 (Bridgewater) Woodstock
   674 (Windsor) Springfield, White River Junction, Woodstock
   676 (Maidstone) Island Pond
   684 (Danville) St. Johnsbury
   685 (Chelsea) Randolph
   694 (Stamford) Bennington
   695 (Concord) St. Johnsbury
   722 (Westminster) Bellows Falls
   723 (Island Pond) Island Pond, Newport
   728 (Randolph) Randolph
   744 (Troy) Newport
   746 (Pittsfield) Rutland
   747 (Rutland) Rutland
   748, 751 (St. Johnsbury) St. Johnsbury
   754 (Orleans) Island Pond, Newport
   755 (Albany) Morrisville, Newport
   757 (Wells River) St. Johnsbury
   758 (Bridport) Middlebury
   759 (Addison) Middlebury
   763 (South Royalton) Randolph, White River Junction, Woodstock
   765 (South Strafford) White River Junction
   766 (Derby) Newport
   767 (Rochester) Middlebury, Randolph
   769 (Essex Junction) Burlington
   770, 772, 773, 775 (Rutland) Rutland
   785 (Thetford) White River Junction
   786 (Rutland) Rutland
   796 (Alburg) St. Albans
   822 (Island Pond) Island Pond
   822 () Canaan, Island Pond
   823 (Pownal) Bennington
   824 (South Londonderry) South Londonderry
   827 (East Fairfield) St. Albans
   828 (Montpelier) Montpelier, Morrisville
   843 (Grafton) Bellows Falls, South Londonderry
   848 (Richford) St. Albans
   849 (Fairfax) St. Albans
   860, 862, 863, 864 (Burlington) Burlington
   866 (Newbury) Bradford
   867 (Dorset) Bennington
   868 (Swanton) St. Albans
   869 (Saxtons River) Bellows Falls, Springfield
   871, 872 (Essex Junction) Burlington
   873 (Derby Line) Newport
   874 (Jamaica) Brattleboro, South Londonderry
   875 (Chester) Bellows Falls, Springfield, South Londonderry
   877 (Vergennes) Middlebury
   878, 879 (Essex Junction) Burlington
   883 (Barre) Montpelier
   883 (Washington) Montpelier
   885, 886 (Springfield) Bellows Falls, Springfield
   888 (Morrisville) Montpelier, Morrisville
   889 (Tunbridge) Randolph
   899 (Underhill) Burlington
   892 (Lunenburg) Guildhall
   893 (Milton) Burlington, St. Albans
   895 (Morgan) Island Pond, Newport
   896 (Wardsboro) Bennington, Brattleboro, South Londonderry
   897 (Shoreham) Middlebury
   928 (Isle La Motte) St. Albans
   933 (Enosburg Falls) St. Albans
   948 (Orwell) Middlebury
   962 (Bloomfield) Island Pond
   988 (North Troy) Newport

--

 Conclusion -

This is what the US Government gets for publically releasing documentation on the Internet about
their so-called "secret" and "private" network... I know you'll have a few good laughs about that one
(I know I did). Love, Peace, And Afro Grease!


------------------------------------------------------------------------------------
阿新 - Seraph Chutium