ISIS 'hack' draws skepticism but raises wariness

Following last weekend’s leak of sensitive information on military personnel apparently by ISIS supporters, many are scrambling to discover how this information was accessed and if Pentagon servers were breached. Some military families, meanwhile, are altering their approach to what they post online.

A report from the Daily Beast earlier this week claimed that the hackers were able to get the majority of the information by simply Googling the members of the military, who were listed on Defense Department’s websites with biographical information provided. The report indicated that the leaked information “initially appeared to be a substantive penetration of Defense Department security,” but DOD personnel refuted those claims and attributed it to trolling search engines. 

However, a purported member of the Islamic State Hacking Division (ISHD), the group claiming responsibility for the leak, pushed back against the Pentagon, telling Motherboard that the group has access to Pentagon servers. The purported hacker claimed that ISHD gained access by scanning U.S. military domains ending with the .mil prefix and discovered several outdated content management systems, which web managers use to post information online. Once “in,” they were able to discover a vulnerability in the code and exploit it, which led to databases with names and personal information. Once the personal information was obtained, the hacking group turned to Google to fill in more blanks and gather the names of personnel stationed in the Middle East, according to what the purported hacker told Motherboard. 

The bold assertion of a Pentagon server breach appears to be specious and overstated, according to members of the military and security experts alike. One security expert was quoted as saying that the Pentagon probably “separates and compartmentalizes information… and only puts sensitive data on its internal networks that are not connected to the internet.” Such isolated networks, called air-gapped systems, while very hard to breach, do have vulnerabilities. But those vulnerabilities, which have been discovered by high-level researchers, are extremely complex.

Adm. Cecil Haney, commander of U.S. Strategic Command, assured reporters at a Pentagon briefing March 24 that wherever the ISHD obtained the information, it was not from DOD networks. 

Haney also stressed the importance of cyber deterrence noting that threats are increasing at an “an unprecedented and alarming rate.” 

To help combat these growing threats, Lt. Gen. Edward Cardon, commander of the Army Cyber Command, recently said that the armed forces as a whole have added 6,000 cyber personnel. Cardon also harped on the need to adapt acquisition and information sharing metrics to match the fast pace of the cyber domain, citing reverse engineering of vulnerabilities exploited by hackers, one of the biggest threats to develop in the cyber realm within the last five years. Cardon did express his confidence that the military will adapt to these threats and make a significant impact.