Lax security at a Nasa lab let a hacker lurk on the agency’s network for almost a year, says report.