Researcher reveals GPS vulnerabilities

http://www.nextgov.com/nextgov/ng_20101018_4273.php

Janet's cyber security is now starting to look like a paid for development base for her corporate friends doesn't?
And YOU pick up the tab.
A Homeland Security pork bellied earmark, rammed right down your throat.
Or spoofs disable them from recording and collecting your data, since Sprint and Verizon can be incapacitated by them.

GPS timing signals that control the base stations in some cellular networks and other gadgets the size of small refrigerators that power the smart electric grid can fall prey to sophisticated spoofing attacks, according to a University of Texas researcher.

Todd Humphreys, an assistant professor at the University of Texas Radionavigation Laboratory, said he successfully spoofed a type of laboratory time reference receiver of the code division multiple access -- network technology Sprint and Verizon use that relies on GPS time -- with a transmitter he built for about $1,000




He also spoofed a type of timing receiver that provides precise signals to synchrophasors, which measure voltages and currents at diverse locations on a power grid so operators can assess the state of the electrical system. Humphreys said in less than an hour he degraded the timing signal so it sent spurious signals.

The North American SynchroPhasor Initiative, a partnership of the Energy Department and the North American Electric Reliability Corp., plans to install synchrophasors in power systems nationwide to help manage the smart grid; in turn the grid will use communications systems to manage distribution of power from generator to home or office.

The CDMA base stations and synchrophasors both use civil GPS timing receivers, which do not have built-in anti-spoofing protection, Humphreys said, noting only the GPS receivers the military uses have the ability to detect and frustrate spoofing attacks.

A spoofing attack against synchrophasors today would not bring down the power system, but Humphreys said, "it would make the smart grid less smart." Attacks against multiple cellular base stations in any city could shut down the network, he added.

Alison Silverstein, project manager for the North American SynchroPhasor Initiative, said her organization was well aware of the vulnerabilities of GPS and has redundant systems in place today, including a supervisory control and a data acquisition system, in case of spoofing attacks. She said her group wants to develop data check and validation methods to ensure the integrity of the information it uses to help run the grid

IRS fails to assign employees security roles and responsibilities, audit finds

http://www.nextgov.com/nextgov/ng_20100929_5218.phpHoly crap Batman


Holy crap Batman, you have got to be kidding me.
This has got to be the epitome of the government gone wild.
Talk about compromised. Private contractors used by the IRS and
the IRS has no idea which contractors are in security roles, because they don't train them for it.



The IRS is not required to train contract employees in cybersecurity because their companies are responsible for ensuring they have the necessary expertise. But the agency still should track contractor personnel's security duties and test them on compliance, the audit stated. In addition, the IRS has no method for determining which contractors are in security roles, the report found.

"We identified more than 1,350 contract employees with system access that held titles related to security roles, such as system administrators, database administrators, programmers, developers, security specialists, system architects, system engineers and Web developers," Phillips wrote. "These job titles may or may not align with IRS security roles."

IRS officials said they plan to establish a way to document the contract employees who have access to computer systems and then test the individuals appropriately, according to the report