Slashdot Log In
Air Force Aims for Control of 'Any and All' Computers
Journal written by Jeremiah Cornelius (137) and posted by
timothy
on Thu May 15, 2008 12:40 PM
from the we'd-rather-kill-them-off-by-peaceful-means dept.
from the we'd-rather-kill-them-off-by-peaceful-means dept.
Noah Shachtman on Wired.com's Danger Room reports that Monday, the Air Force Research Laboratory at Wright-Patterson AFB introduced a two-year, $11 million effort to put together hardware and software tools for 'Dominant Cyber Offensive Engagement.' 'Of interest are any and all techniques to enable user and/or root level access,' a request for proposals notes, 'to both fixed (PC) or mobile computing platforms ... any and all operating systems, patch levels, applications and hardware.' This isn't just some computer science study, mind you; 'research efforts under this program are expected to result in complete functional capabilities.' The Air Force has already announced their desire to manage an offensive BotNet, comprised of unwitting participatory computers. How long before they slip a root kit on you?
Related Stories
[+]
USAF Considers Creation of Military Botnet 440 comments
sowjetarschbajazzo writes "Air Force Col. Charles W. Williamson III believes that the United States military should maintain its own botnet, both as a deterrent towards those who would attempt to DDoS government networks, and an offensive weapon to be used against the networks of unfriendly nations, criminal groups, or terrorist organizations.
"Some people would fear the possibility of botnet attacks on innocent parties. If the botnet is used in a strictly offensive manner, civilian computers may be attacked, but only if the enemy compels us. The U.S. will perform the same target preparation as for traditional targets and respect the law of armed conflict as Defense Department policy requires by analyzing necessity, proportionality and distinction among military, dual-use or civilian targets. But neither the law of armed conflict nor common sense would allow belligerents to hide behind the skirts of its civilians. If the enemy is using civilian computers in his country so as to cause us harm, then we may attack them." What does Slashdot think of this proposal?"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
new meme (Score:5, Funny)
Imagine an AirWolf cluster of these......
Re:new meme (Score:5, Funny)
Parent
Hmmm... (Score:4, Insightful)
Tools? Seriously? Any toolset is going to have to be constantly adaptable, and is going to fall victim to the same problem as all other computer security stuff: it's obsolete almost as soon as its written.
They'd be better building a strong infrastructure, and recruiting top talent than trying to build some kind of software package, presumably to be manned by some kind of enlisted man script kiddie.
Even then, they're going to get the same kind of penetration as everyone else. 20%, 30% maybe, on a good day. You can't even rely on vendors to insert backdoors; the best choice for that would be microsoft, and adding a backdoor to Windows would be redundant in most cases.
Re:Hmmm... (Score:4, Insightful)
Parent
Re:Hmmm... (Score:5, Insightful)
Trying to use automated tools is exactly the sort of thing I'd expect to see them do, but automated tools are of limited utility these days. Maybe one day computer systems will achieve some sort of "normal" configuration, where one size will fit all, but I don't see that happening for years.
My home machine takes innumerable hits from scripts trying automated attacks; 95% of them are trying to exploit software I'm not running. The ones that actually have it right still have a very low rate of trying attacks that could possibly succeed.
Some random hacker in China wouldn't care that they had to run an automated attack against 10,000,000 machines to infect 1,000, but that won't cut it in war. You need trained people. Those people need amazing resources.
This? This is a joke. That money could be better spent by not buying pre-hacked security appliances.
Parent
Re:Hmmm... (Score:5, Insightful)
Anyway, hacking is more likely to be the domain of No Such Agency.
If you want "gifted," don't bother looking in Washington and environs. Plodders, ass-kissers and shysters, those you can easily find. It's the company town from hell.
Parent
Who comes up with ideas like this? (Score:5, Insightful)
You know they'll get what they want out of commercial OSs by putting pressure on the vendors. Linux and the BSDs are too much of a moving target, and OpenBSD is run out of Canada anyway. If ever there was an article that needed to be tagged 'goodluckwiththat,' this would be it.
Re:Who comes up with ideas like this? (Score:5, Funny)
My boss called me two seconds after the conf call ended. Since I saw the caller ID, I knew what was coming, and I answered the phone, "Was that inappropriate?" "Yes," was the answer, "but very funny. Don't do it again."
Parent
Re:Who comes up with ideas like this? (Score:5, Insightful)
It's pretty much the same as in some European countries, where they try to create some sort of "cop trojans" for eavesdropping on suspects. They just heard how effective those bots and trojans are for the criminals and want the same efficiency for themselves.
Yes, botnets are hell of efficient in bringing down a network. Yes, trojans enable you to control your victim's computer. What they do not realize in either case is that the efficiency comes from liberal shotgun application of the infection. You spread your malware a billion times, it gets looked at a million times, it gets installed a thousand times.
In the case of the "copper trojan" it won't work because the chance to actually infect a machine is so minimal that it won't warrant the necessary expense (not to mention that it's far more likly to warn your suspect rather than get you any information). In the case of an "Air Force botnet", the fallout from negative PR is certainly going to do more damage than good.
Both problems don't apply to the criminals. Why should a botnetter care that nobody in the US likes him? Why should a phisher care whether he infects a certain machine?
And that's what our representatives (and military brickheads) don't get. Using criminal tactics first of all doesn't work. And second, resorting to the same tactics criminals use gives you really, really bad press.
Parent
I think you don't know what "hard-kill" means. (Score:5, Funny)
"Soft-kill" would mean destroying you computer and therefor rendering you ineffective. "Hard-kill" would mean shooting you in the face and therefor rendering you dead.
Parent
Re:Seconded. (Score:5, Insightful)
Just putting effort into the software side would only add to that threat, and doing what the NSA does and just smirking and saying, "That's classified" when anyone asks them about their cyber crap would only make the threat more credible.
This is like watching some script kiddie waltz into an IRC channel and start swaggering. You know people are going to sneer, and you know someone is going to take a shot at them.
Parent
If you ask me.... you didn't but.... (Score:5, Insightful)
Re:If you ask me.... you didn't but.... (Score:4, Interesting)
Problem is (for them, not us), after this, any commits made to Linux or BSD or anything that don't seem to add anything, make unnecessary use of network commands or seem in any way unsafe will be set upon by every tinfoil hat freak out there, same with new contributors, so they'll have a really hard time doing this.
Parent
Re:If you ask me.... you didn't but.... (Score:5, Interesting)
accidental downloading of large bits of "spam" will contain encrypted data which, when the CPU notices that the network interfaces (or the nearby electro-magnetic spectrum) are blipping up-and-down in some not-exactly-random pattern, begins to interpret the SPAM (or EM noise) in some morse-code-like way that activates the CPU to "phone home".
suddenly all the DRM in your hard drive and motherboard which is normally used for DMCA coercion, gets activated for other purposes.
given that the encryption in the DRM is at a level higher than the highest level specified by the DoD for ultra-top-secret material, it will of course be perfect for taking over your computer.
overall i wish i was entirely joking about this, but it unfortunately makes far too cohesive a story.
let's call it a joke, anyway. ha ha.
Parent
Re:If you ask me.... you didn't but.... (Score:4, Insightful)
1) there is virtually 0 chance of implimentation
2) there are too many people out here who are smart enough to code there way out of anything the AirForce might attempt to implement
3) just how do they plan on getting root access to my box? I mean honestly - 11 Million dollars isn't going to cover the cost of getting to root on my little home computer - how precisely do they plan on getting root on every single server and home PC?
Parent
Re:If you ask me.... you didn't but.... (Score:5, Insightful)
In fact I think I'll set up a honeypot just for them. Bastards got 4 years of my life, they're NOT welcome to the contents of my computer. Like you said, it is illegal for them to do so, and whatever lawless nutcake Colonel that thought up this outrage should be court-martialed and sent to Leavenworth [wikipedia.org].
Parent
3rd Amendment fun? (Score:5, Interesting)
Humorously, I could see a lawsuit from this opening up the door for the first expansion of the 3rd Amendment since Engblom v. Carey [wikipedia.org] if they did compromise the machines of US citizens to use in an offensive botnet. Arguably being forced to host Air Force activities on your private property violates the same kinds of rights that the 3rd Amendment protects.
The Second Circuit said:
Parent
Eleven million? Good luck. (Score:5, Insightful)
I admire your optimism, USAF, but $11 million dollars is simply not going to make that happen -if it can even be done. Software companies have enough trouble just getting their *own* software to work installed on *willing systems*, and some of the bigger ones spend that kind of money just getting it to work on one operating system withing a reasonable set of constraints.
Take into account the fact that you will also be most likely using pre-existing exploits, which will be repaired swiftly by responsible developers that watch security RSS feeds, and this is a red herring task. If you are talking about spending 11 million dollars on doing your own research towards establishing remote control by examining source code or reverse engineering to find new exploits, then honestly, you aren't just crazy- you are batshit crazy. You're going to need a whole hell of a lot of money to do that.
Re:Eleven million? Good luck. (Score:4, Insightful)
Parent
Better than the Great Firewall of China (Score:5, Insightful)
At first glance, it seems that this would easier to do by simply mandating government backdoors in all operating systems. Wait. Not only does a legislative fix not work work for FOSS, it's also likely to start a tremendous uproar until you show enough people a video of Britney Spears's latest car accident...
The big problem with this... (Score:5, Insightful)
Over time, systems change. That means after this two-year study and eleventy-million dollars later, it's worth very little a year down the road. In three years, we're virtually guaranteed to have nothing for the efforts, except a statement saying "Oh, we learned a lot, and now need continuing funding. Please give us more money."
Although many holes in software exist for a long time, they are generally patched within a couple months once discovered, usually sooner. And as soon as the military activates one of these holes, it'll be analyzed and patched. That will remove one of their finite resources.
100% control of all platforms and systems is beyond ludicrous. They might as well wish they could read minds, teleport, and find Carmen Sandiego. Or at least Osama.
Re:The big problem with this... (Score:4, Informative)
Usually the types of holes stay consistent, and a hole can go unnoticed for quite a while (take a look at the recent Debian issue).
Yes, this is the sort of thing that needs to evolve over time, but even then, the computers you want to compromise may not have the latest patches and updates (may not be in the position to get them, may not be undergoing regular maintenance, may be deemed to critical to risk on untested patches leaving them vulnerable which the patches are tested, or the company may have simply EOL the OS/software and there may be no patch to get).
If you were right, and all holes were patched and fixed, leaving computers invulnerable, then there wouldn't be a problem today with malicious botnets being used to send spam, perform DDoS attacks, and for use in Phishing and other Fraud/Identity theft schemes.
Parent
They wouldn't do that... (Score:5, Funny)
Even more reason (Score:5, Funny)
Re:Even more reason (Score:5, Funny)
Parent
what they want and what they'll get rarely match (Score:5, Insightful)
Yeah, sure. (Score:5, Funny)
Re:Yeah, sure. (Score:5, Funny)
Parent
Constitution Violated by Domestic Military Ops (Score:5, Interesting)
So the Air Force can do whatever the spooks (and their Bush crony masters) want, like fly surveillance drones, record and datamine us against satellite surveillance, and help the NSA filter every bit of our telecom.
Because these people hate the Constitution. They hate our freedoms and rights the Constitution instructs them to protect. They hate us. Because we get in the way of business, which is to spend on war the maximum amount Americans can make or borrow.
Feel safer?
$11m? (Score:4, Insightful)
(Holds pinkey finger to corner of mouth) "One Million Dollars." (The one where he travels forward in time, not the one from the 60s.)
Armed Forces used against American Citizens (Score:5, Insightful)
Re:Armed Forces used against American Citizens (Score:5, Interesting)
You are probably thinking about the Posse Comitatus Act (http://en.wikipedia.org/wiki/Posse_Comitatus_Act [wikipedia.org]). However what that act really prohibits is the use of military forces as peace officers within US borders. Hacking into citizen's machines to use them as part of a botnet wouldn't fall under that.
A couple of people have brought up the Third Amendment (http://en.wikipedia.org/wiki/Third_Amendment_to_the_United_States_Constitution [wikipedia.org]) which covers the quartering of soldiers in private homes. I am not a Constitutional lawyer but I'm guessing that doesn't really apply either in a strict literal sense or in the spirit of what the authors intended. The intent was purely in people being forced to quarter soldiers. There's no mention of whether or not the military has the right to seize assets they might need, which is closer to what they would be doing in this case.
If I had to guess (and I would have to) I would think the Fifth Amendment (http://en.wikipedia.org/wiki/Fifth_Amendment_to_the_United_States_Constitution [wikipedia.org]) is probably more applicable. Its final clause is "nor shall private property be taken for public use, without just compensation". Hacking your system and using CPU cycles and bandwidth without permission would seem to constitute at least a form of taking of my property. They may not physically take it but they take control of it and even though I get it back later the clause doesn't say it's ok for them to take property as long as they bring it back.
Parent
Heh. (Score:4, Funny)
dear air force morons: (Score:5, Insightful)
there are many battlefields (Score:4, Insightful)
the battle of course, is abstract. it is the battle for the hearts and minds of the people in your country and other countries. so if you invalidate the cause you fight for, what have you won?
it is not good enough to merely dominate in all matter of physical warfare. you must also dominate in ideological warfare. and ideological warfare is not about media manipulation or propaganda. it is about simply picking a cause to stand for and adhering to it
if the people don't believe in what you are fighting for, then your physical military efforts are pointless. likewise, if the people do believe in what you are fighting for, then your enemy can achieve stunning battlefield dominance, and yet it all of their gains will fade over time. you have to ask yourself what the point of war is. is war merely a shoving match over physical turf? on one level it is, but it involves the values of the societies fighting over that turf as well. the groups that achieve physical military dominance and solidify their gains over time, are the ones that fight for values that actually have greater staying power than their enemy's. so the only lasting victories are the ones that actually stand for something
i am not in any way failing to understand traditional military wisdom. but i will suggest to you that my pov might have a better understanding of traditional military wisdom
Parent
Third Amendment, anyone? (Score:5, Insightful)
From experience... (Score:5, Insightful)
Now the previous comments about them spending $11m and then 3 years later asking for $11m is close but also wrong. They will ask for at least double that, every 3 years (take a look at their POMs in the future), indefinitely...
Re:SETI@Home (Score:5, Insightful)
Why the fuck would the United States Air Force want a botnet, when they could have the real thing? A tightly integrated computer network with near unlimited bandwidth, satellites, super computers, massive clustering, and secure, integrated control.
Botnet. Jesus. Someone take the freaking tech magazines away from the air force brass before they start doing social networking or some crap.
Parent
I can think of a few reasons (Score:5, Insightful)
Not that I'm condoning any of this, mind you. Just saying, I don't think the Air Force brass are all total idiots.
Parent
Re:I can think of a few reasons (Score:5, Interesting)
Of course, there's nothing to stop you from setting up some honey-pots, figuring out the control commands, and taking control of a large chunk of the botnet, since it *isn't* centralized. then turn it on the parts you don't control, or the central c&c computers, or other "targets of interest."
Or use it to create "false flag" attacks.
Or a few rounds of "Do you want to play a game?"
Parent
Re:SETI@Home (Score:5, Insightful)
Parent
Re:SETI@Home (Score:4, Insightful)
In your excitement you've overlooked one minor detail; the US gov't has decreed it is going to move all its systems down to 50 or so access points to the wider internet. So no matter how big and bad a system the Air Force might concoct on its own internal network, it would still be hampered by the internal to external gateway speed and if those 50 gateways are known, they're easily blocked. So they wouldn't be able to Botnet-bomb the whoever nearly as well.
Parent
Re:SETI@Home (Score:5, Insightful)
What bothers me is when they do something that's just flat boneheaded, and clearly the result of someone in the chain of command who doesn't know crap about anything, shooting his mouth off and making policy.
If they want to do the whole "cyberwar" thing, they need to take it seriously, and put people in charge who have the faintest fucking CLUE about what they're supposed to be doing.
Parent
Re:SETI@Home (Score:5, Insightful)
Parent
Re:SETI@Home (Score:5, Interesting)
Parent
Re:SETI@Home (Score:4, Informative)
Parent
Re:SETI@Home (Score:5, Interesting)
Parent
Re:my fear ..... (Score:4, Insightful)
Disrupting communications is frequently an important move before attacking.
Parent
Re:Hardware - the only solution to this problem (Score:4, Insightful)
Parent
Pushing rope (Score:5, Funny)
Parent