Air Force Aims for Control of 'Any and All' Computers 468
Noah Shachtman on Wired.com's Danger Room reports that Monday, the Air Force Research Laboratory at Wright-Patterson AFB introduced a two-year, $11 million effort to put together hardware and software tools for 'Dominant Cyber Offensive Engagement.' 'Of interest are any and all techniques to enable user and/or root level access,' a request for proposals notes, 'to both fixed (PC) or mobile computing platforms ... any and all operating systems, patch levels, applications and hardware.' This isn't just some computer science study, mind you; 'research efforts under this program are expected to result in complete functional capabilities.' The Air Force has already announced their desire to manage an offensive BotNet, comprised of unwitting participatory computers. How long before they slip a root kit on you?
Hmmm... (Score:4, Insightful)
Tools? Seriously? Any toolset is going to have to be constantly adaptable, and is going to fall victim to the same problem as all other computer security stuff: it's obsolete almost as soon as its written.
They'd be better building a strong infrastructure, and recruiting top talent than trying to build some kind of software package, presumably to be manned by some kind of enlisted man script kiddie.
Even then, they're going to get the same kind of penetration as everyone else. 20%, 30% maybe, on a good day. You can't even rely on vendors to insert backdoors; the best choice for that would be microsoft, and adding a backdoor to Windows would be redundant in most cases.
Who comes up with ideas like this? (Score:5, Insightful)
You know they'll get what they want out of commercial OSs by putting pressure on the vendors. Linux and the BSDs are too much of a moving target, and OpenBSD is run out of Canada anyway. If ever there was an article that needed to be tagged 'goodluckwiththat,' this would be it.
If you ask me.... you didn't but.... (Score:5, Insightful)
Eleven million? Good luck. (Score:5, Insightful)
I admire your optimism, USAF, but $11 million dollars is simply not going to make that happen -if it can even be done. Software companies have enough trouble just getting their *own* software to work installed on *willing systems*, and some of the bigger ones spend that kind of money just getting it to work on one operating system withing a reasonable set of constraints.
Take into account the fact that you will also be most likely using pre-existing exploits, which will be repaired swiftly by responsible developers that watch security RSS feeds, and this is a red herring task. If you are talking about spending 11 million dollars on doing your own research towards establishing remote control by examining source code or reverse engineering to find new exploits, then honestly, you aren't just crazy- you are batshit crazy. You're going to need a whole hell of a lot of money to do that.
Better than the Great Firewall of China (Score:5, Insightful)
At first glance, it seems that this would easier to do by simply mandating government backdoors in all operating systems. Wait. Not only does a legislative fix not work work for FOSS, it's also likely to start a tremendous uproar until you show enough people a video of Britney Spears's latest car accident...
The big problem with this... (Score:5, Insightful)
Over time, systems change. That means after this two-year study and eleventy-million dollars later, it's worth very little a year down the road. In three years, we're virtually guaranteed to have nothing for the efforts, except a statement saying "Oh, we learned a lot, and now need continuing funding. Please give us more money."
Although many holes in software exist for a long time, they are generally patched within a couple months once discovered, usually sooner. And as soon as the military activates one of these holes, it'll be analyzed and patched. That will remove one of their finite resources.
100% control of all platforms and systems is beyond ludicrous. They might as well wish they could read minds, teleport, and find Carmen Sandiego. Or at least Osama.
Re:SETI@Home (Score:5, Insightful)
Why the fuck would the United States Air Force want a botnet, when they could have the real thing? A tightly integrated computer network with near unlimited bandwidth, satellites, super computers, massive clustering, and secure, integrated control.
Botnet. Jesus. Someone take the freaking tech magazines away from the air force brass before they start doing social networking or some crap.
what they want and what they'll get rarely match (Score:5, Insightful)
Re:SETI@Home (Score:3, Insightful)
Re:Hmmm... (Score:4, Insightful)
Re:If you ask me.... you didn't but.... (Score:4, Insightful)
1) there is virtually 0 chance of implimentation
2) there are too many people out here who are smart enough to code there way out of anything the AirForce might attempt to implement
3) just how do they plan on getting root access to my box? I mean honestly - 11 Million dollars isn't going to cover the cost of getting to root on my little home computer - how precisely do they plan on getting root on every single server and home PC?
How long... (Score:1, Insightful)
How long before I sue them if I find they broke into my machine? About a week, and I'll go after class action status as well.
Re:SETI@Home (Score:5, Insightful)
What bothers me is when they do something that's just flat boneheaded, and clearly the result of someone in the chain of command who doesn't know crap about anything, shooting his mouth off and making policy.
If they want to do the whole "cyberwar" thing, they need to take it seriously, and put people in charge who have the faintest fucking CLUE about what they're supposed to be doing.
Re:If you ask me.... you didn't but.... (Score:5, Insightful)
In fact I think I'll set up a honeypot just for them. Bastards got 4 years of my life, they're NOT welcome to the contents of my computer. Like you said, it is illegal for them to do so, and whatever lawless nutcake Colonel that thought up this outrage should be court-martialed and sent to Leavenworth [wikipedia.org].
I can think of a few reasons (Score:5, Insightful)
Not that I'm condoning any of this, mind you. Just saying, I don't think the Air Force brass are all total idiots.
$11m? (Score:4, Insightful)
(Holds pinkey finger to corner of mouth) "One Million Dollars." (The one where he travels forward in time, not the one from the 60s.)
Armed Forces used against American Citizens (Score:5, Insightful)
Re:Seconded. (Score:5, Insightful)
Just putting effort into the software side would only add to that threat, and doing what the NSA does and just smirking and saying, "That's classified" when anyone asks them about their cyber crap would only make the threat more credible.
This is like watching some script kiddie waltz into an IRC channel and start swaggering. You know people are going to sneer, and you know someone is going to take a shot at them.
Re:If you ask me.... you didn't but.... (Score:3, Insightful)
Also, for all of the inevitable "They'd never be able to pwn MY PC" post here, please stop thinking that typical
dear air force morons: (Score:5, Insightful)
Re:Eleven million? Good luck. (Score:3, Insightful)
I am less pessimistic. WMF files were exploitable for what? 11 years before it was leaked? JPG files via Quicktime for years. Excel exploits that were not fixed for years. Just becauase a vulnerability was discovered on the 1st and patched on the 20th doesn't mean it only existed for 20 days.
All they have to do is locate these vulnerabilities and sit on them. They don't have to release this to Secunia. They don't even have to use the exploit outside a lab until needed. And if they want to "control" a PC, they probably either want to disable it or take data off of it. They will be less likely to leave traces of how they got onto the computer because of this.
Commander Adama was right... (Score:3, Insightful)
Re:SETI@Home (Score:5, Insightful)
Third Amendment, anyone? (Score:5, Insightful)
Re:SETI@Home (Score:5, Insightful)
From experience... (Score:5, Insightful)
Now the previous comments about them spending $11m and then 3 years later asking for $11m is close but also wrong. They will ask for at least double that, every 3 years (take a look at their POMs in the future), indefinitely...
Re:If you ask me.... you didn't but.... (Score:3, Insightful)
Isn't this a violation of my rights? (Score:3, Insightful)
3rd:prohibits the government from using private homes as quarters for soldiers without the consent of the owners.
4th:guards against searches, arrests, and seizures of property without a specific warrant or a "probable cause" to believe a crime has been committed.
Re:Hmmm... (Score:5, Insightful)
Trying to use automated tools is exactly the sort of thing I'd expect to see them do, but automated tools are of limited utility these days. Maybe one day computer systems will achieve some sort of "normal" configuration, where one size will fit all, but I don't see that happening for years.
My home machine takes innumerable hits from scripts trying automated attacks; 95% of them are trying to exploit software I'm not running. The ones that actually have it right still have a very low rate of trying attacks that could possibly succeed.
Some random hacker in China wouldn't care that they had to run an automated attack against 10,000,000 machines to infect 1,000, but that won't cut it in war. You need trained people. Those people need amazing resources.
This? This is a joke. That money could be better spent by not buying pre-hacked security appliances.
Re:They wouldn't do that... (Score:3, Insightful)
Military ethics are written by the military. If their code of ethics says it's OK to drop napalm on civilians (as the ethics were during Vietnam) than it is not unethical to drop napalm on civilian villages, even though it is certainly immoral by any moral standard I've ever heard.
Re:my fear ..... (Score:4, Insightful)
Disrupting communications is frequently an important move before attacking.
Re:SETI@Home (Score:3, Insightful)
Re:dear air force morons: (Score:3, Insightful)
I'm against it mostly because I think it's just a foolish waste of money that will only breed ill-will and accomplish nothing, or next to nothing.
Re:Hardware - the only solution to this problem (Score:4, Insightful)
Re:dear air force morons: (Score:3, Insightful)
Certainly you want to copy your enemy if the tactic is say, 'duck!'
Re:SETI@Home (Score:4, Insightful)
In your excitement you've overlooked one minor detail; the US gov't has decreed it is going to move all its systems down to 50 or so access points to the wider internet. So no matter how big and bad a system the Air Force might concoct on its own internal network, it would still be hampered by the internal to external gateway speed and if those 50 gateways are known, they're easily blocked. So they wouldn't be able to Botnet-bomb the whoever nearly as well.
Re:Eleven million? Good luck. (Score:4, Insightful)
Only a few years behind the Russians on this one (Score:2, Insightful)
there are many battlefields (Score:4, Insightful)
the battle of course, is abstract. it is the battle for the hearts and minds of the people in your country and other countries. so if you invalidate the cause you fight for, what have you won?
it is not good enough to merely dominate in all matter of physical warfare. you must also dominate in ideological warfare. and ideological warfare is not about media manipulation or propaganda. it is about simply picking a cause to stand for and adhering to it
if the people don't believe in what you are fighting for, then your physical military efforts are pointless. likewise, if the people do believe in what you are fighting for, then your enemy can achieve stunning battlefield dominance, and yet it all of their gains will fade over time. you have to ask yourself what the point of war is. is war merely a shoving match over physical turf? on one level it is, but it involves the values of the societies fighting over that turf as well. the groups that achieve physical military dominance and solidify their gains over time, are the ones that fight for values that actually have greater staying power than their enemy's. so the only lasting victories are the ones that actually stand for something
i am not in any way failing to understand traditional military wisdom. but i will suggest to you that my pov might have a better understanding of traditional military wisdom
Is Anyone Thinking About What Comes Next? (Score:1, Insightful)
In order for this to work, and stay feasible, they would start leaning on some level of cooperation from various aspects of the industry. Let's say that they have 3 good vectors for infecting machines with the military botnet. They will need some cooperation from the AV vendors to not publicize them and close them off (assuming they are not working to know backdoors).
Then what happens when someone like the Storm botnet starts using a vector that USAF has asked not be closed off?
The USAF botnet would need to be constant. It's not a tool that you can say "I need 10 million machines for an attack tonight, go get them". It has to be constantly infecting and attacking new systesm in order to maintain critical mass for use. What happens when the highly motivated guys behind a mahjor bot net find out how to identify the USAF botnet and assume control of those machines instead?
What happens when the USAF botnet causes some critical error and 3million PCs get hosed overnight?
What happens when some software company includes in it's ELUA and on-box requirements that it's not compatible with machines that are infected with the USAF botnet?
What happens when the AV and OS vendors get slapped into slience about the USAF botnet and the White Hats start exposing it and how to counteract it? Will they get visits from guys in dark suits explaining that it's a matter of national security? And if they do, will any of them let that keep them silent? And when they speak out, the cat will be out of the bag and ways to defeat it will become available to the enemy anyway.
The pseudo-legality and over-arching presence of an approach like this is fraught with peril. While it sounds fantastic on paper and even more amazing for a summer movie, it's realistic feasability is very limited.
If there's one thing that will set the tech community ablaze faster than an announcement that a major botnet on our computers belonds to a forigen power set on attacking us, it's the announcement that the botnet belongs to the US military!
Re:If you ask me.... you didn't but.... (Score:1, Insightful)
Re:Hmmm... (Score:3, Insightful)
Re:Third Amendment, anyone? (Score:3, Insightful)
Re:Who comes up with ideas like this? (Score:5, Insightful)
It's pretty much the same as in some European countries, where they try to create some sort of "cop trojans" for eavesdropping on suspects. They just heard how effective those bots and trojans are for the criminals and want the same efficiency for themselves.
Yes, botnets are hell of efficient in bringing down a network. Yes, trojans enable you to control your victim's computer. What they do not realize in either case is that the efficiency comes from liberal shotgun application of the infection. You spread your malware a billion times, it gets looked at a million times, it gets installed a thousand times.
In the case of the "copper trojan" it won't work because the chance to actually infect a machine is so minimal that it won't warrant the necessary expense (not to mention that it's far more likly to warn your suspect rather than get you any information). In the case of an "Air Force botnet", the fallout from negative PR is certainly going to do more damage than good.
Both problems don't apply to the criminals. Why should a botnetter care that nobody in the US likes him? Why should a phisher care whether he infects a certain machine?
And that's what our representatives (and military brickheads) don't get. Using criminal tactics first of all doesn't work. And second, resorting to the same tactics criminals use gives you really, really bad press.
Re:If you ask me.... you didn't but.... (Score:3, Insightful)
which immediately makes the host countries "complicit" with the efforts of the united states, thus making them legitimate targets as well.
which, in the case of a wartime situation, would arguably make them justifiably _real_ targets as well.
overall this is a monumentally fucking stupid idea of the united states air force, at every single level, in every single possible way, without exception and without any doubt.
Re:Hmmm... (Score:5, Insightful)
Anyway, hacking is more likely to be the domain of No Such Agency.
If you want "gifted," don't bother looking in Washington and environs. Plodders, ass-kissers and shysters, those you can easily find. It's the company town from hell.
Re:new meme (Score:2, Insightful)
You'll be rounded up at 3 AM and dragged off to a cell somewhere. You'll receive no phone call and no legal counsel. You will be thrown in front of a military tribunal that will read the crimes you have committed, and you will then be punished accordingly.
Re:If you ask me.... you didn't but.... (Score:3, Insightful)
Like it or not, the US has been pretty benevolent for a lone super power. Yes, you can point to Iraq where the US toppled a longstanding dictator that really was "evil". Sure, but that's about as bad as it gets less you go back a few 100 years to the native Americans. There are lesser evils the US has done, like some issues with South American governments. And more. But overall the US has been pretty damn good for what power their wield. It's not like the Dutch or English or French have clean records. And hell, screw the Russians and Chinese when it comes to the thought of them having lone super power status. The US isn't perfect, but they are pretty damn good overall. And like it or not "cyber warfare" is a real battlefield. Your military would be doing you a disservice if they were not doing things like this.
Re:Hmmm... (Score:3, Insightful)
Whether they succeed on not the implied precedence is that the government has the right to take over your "extended mindspace" whenever they jolly well feel like it.
Re:idea (Score:3, Insightful)
HINT: they do it all the time during investigations.
Re:SETI@Home (Score:3, Insightful)
The 'Air Force'? No. Idiot individual members? Yes.
14 yrs ago, we had an E-4 busted for having 100mb of porn on his work PC. 11 yrs ago, we had an entire office reprimanded for having a 'not illegal in the US but illegal in Saudi Arabia' screensaver on the office PC's.
Granted, its a lot harder now, because individual machines, and the network, are a locked down a lot more. But idiots will still bring stuff in from home on a DVD or USB stick.
Fifth amendment, I should think. . . (Score:3, Insightful)
". .
I would say that, were this air force initiative technologically successfuly, it, at least, could not be used on any computers of US citizens, because of the fifth ammendment. Of course, what the government will say is that this capability would only be used against computers of foreign nationals, foreign corporations, and foreign governments. I'm still not sure that makes it right, unless the foreign nation is at war with us, and then it should only be allowed against nations that are directly at war with us.
Re:I can think of a few reasons (Score:2, Insightful)
Re:new meme (Score:3, Insightful)
Re:new meme (Score:3, Insightful)
maybe, if GW had overthrown the government and gone for a third term, but, realistically, if the government is involved in rootkiting PCs they're going to at some point face civil litigation. Most likely, their argument is going to be something like this... "but you were already Rooted with Version xyz of botnet (insert name) "
If they're going to create a botnet, they're going to do it by taking already infected PCs and reinfecting them with a proprietary mil spec root-kit.
There are a number of things they can do to to minimize damages (only root computers in enemy nations) etc, but, if they really do put rootkits on people's PCs as 'weapons of war' then there are a lot of things the international community can do as a result... So really, I think this idea is going to get scrapped, at least as an 'official' program, with 'plausible deniability' they might have some form of program done by paid hackers who have no official ties to the government and who if they ever rat out the DDoS attacks or key logging they do, then the government can turn on them and claim they were lying etc... not to mention they could probably wind up with a bullet in the head for 'changing sides'
well, an 'official' program isn't going to fly, no more than 'sony' rootkits flew, people don't want rootkits on their computers, agencies that try to do this at least without being cautious enough that they can deny doing it intentionally, are foolish.
Re:I wish I could say that I am fscking shocked (Score:3, Insightful)
Keep dreaming and drinking the red/white/blue coolaid my friend. Blind faith and support for your government is NOT patriotism, it's pure folly
Blind faith in your government, or anything is folly.
"blind faith in a leader will get you killed"
That's just how it is. Would you like some quotes from the USA's founding fathers on this topic? They too think you a fool. Here is a pretty damn good start for you:
http://www.poliwatch.org/archives/Analysis/2003/06/11/03.03.51/ [poliwatch.org]
Re:If you ask me.... you didn't but.... (Score:2, Insightful)
Benevolent doesn't belong anywhere near this picture.