Interior IG Team Used Evil Twins and $200 Tech to Hack Department Wi-Fi Networks

Hackers gained unauthorized access to the Interior Department’s internal systems by breaching agency Wi-Fi networks using $200 homemade hacking kits. Luckily, the attackers were white hat hackers from the Interior Office of the Inspector General.

Earlier this year, the Interior IG’s IT audit team conducted several penetration tests at bureau offices, using easily accessible hacking tools to demonstrate the fragility of the agency’s wireless networks.

“We found that the department did not deploy and operate a secure wireless network infrastructure,” the team wrote in an audit report released Wednesday. “Specifically, the department’s wireless network policy did not ensure bureaus kept inventories of their wireless networks, enforce strong user authentication measures, require periodic tests of network security, or require network monitoring to detect and repel well-known attacks.”

To expose just how vulnerable the agency’s networks are, the pentesting work was done entirely by the IG’s in-house IT audit team, which constructed portable test units that fit inside backpacks and purses and could be operated using a smartphone. Auditors then set up in public areas near Interior offices—such as park benches—or got limited access to buildings and set to work infiltrating the agency’s networks.

Each kit cost less than $200 and used widely available open source software.

“These attacks—which went undetected by security guards and IT security staff as we explored department facilities—were highly successful,” the team wrote, noting they were able to intercept and decrypt network traffic at multiple offices.

The intrusion tests showed Interior’s poor Wi-Fi security, as well as other deeper problems with resilience.

At two locations, the team was able to go “far beyond the wireless network at issue” and again access to the department’s internal networks. The IG hackers were even able to steal the login credentials of an IT employee, gaining access to the internal help desk system and visibility into all of that employee’s open tickets.

“We also found that several bureaus and offices did not implement measures to limit the potential adverse effect of breaching a wireless network,” the report reads. “Because the bureaus did not have such protective measures in place, such as network segmentation, we were able to identify assets containing sensitive data or supporting mission-critical operations.”

The report outlines two types of attacks testers used to gain access to Interior networks: one in which the attackers deciphered the pre-shared key—like the single ID and password used to log on to a home network—and another in which they stole unique credentials using “evil twins” to access a more secure network.

In the former scenario, the team used the homemade hacking kits to eavesdrop on wireless network traffic, waiting for someone to log on or otherwise transmit encoded credentials. Depending on the quality of the password, the attacker might be able to break the encryption there on the spot. If it’s too complex, the “credentials can be transmitted to higher performance remote systems where additional efforts could be dedicated to breaking the encoding,” the report states.

“There is no control that can prevent an attacker from passively collecting wireless network traffic from a publicly accessible area and then attempting to recover the pre-shared key,” auditors wrote.

The second scenario was used to steal unique credentials given to individual network users. The team used the “evil twin” technique: create a new network and give the access point the same name as the true network, then record the credentials of a user attempting to log on.

“An evil twin attack exploits a fundamental weakness in wireless security—client devices do not distinguish between two access points broadcasting the same wireless network name,” the team said.

This exploit can be turned up a notch using some basic network commands and social engineering, as well.

“To speed up the attack, commands can be broadcast to client devices and access points to force them to reauthenticate,” the report reads. “This can cause the client to connect to the evil twin network and transmit encoded credentials.”

The evil twin method—which successfully breached networks at four Interior bureaus—could have been prevented using authentication methods that don’t let agency devices connect to networks without the proper digital certificates.

The report notes these tests were not merely “speculative or academic.”

“We used the same tools, techniques, and practices that malicious actors use to eavesdrop on communications and gain unauthorized access,” auditors wrote. “Many of the attacks we conducted were previously used by Russian intelligence agents around the world, as outlined in a 2018 U.S. Department of Justice indictment.”

The IG’s findings were so damming, “one bureau shut down its enterprisewide wireless infrastructure for three weeks” while it analyzed the issues. Another office limited wireless usage to just the public internet, forcing employees to launch a virtual private network, or VPN, before being allowed to access department apps and resources.

The audit lays the blame squarely on the Office of the Chief Information Officer as the lead office for ensuring IT security and compliance across the department.

Specifically, the IG determined the OCIO failed on three counts:

• Did not require regular testing of network security.
• Did not maintain complete inventories of its wireless networks.
• Published contradictory, outdated and incomplete guidance.

“Without operating secure wireless networks that include boundary controls between networks and active monitoring, the department is vulnerable to the breach of a high-value IT asset, which could cripple department operations and result in the loss of highly sensitive data,” auditors wrote.

The IG team ultimately made 14 recommendations for Interior OCIO. The IT office agreed with all 14, though there was some back-and-forth between the department and IG with regard to one recommendation.

“The Office of the Chief Information Officer takes the protection of our assets and systems very seriously,” a spokesperson told Nextgov in a statement. “Over the past two years, we have implemented multiple controls to standardize wireless networks across the department to ensure a consistent level of security. As a result, we substantially addressed all Office of Inspector General recommendations prior to the release of this report."

Editor's note: This article was updated with a comment from the Interior Department's Office of the Chief Information Officer.