Slashdot stories can be listened to in audio form via an RSS feed, as read by our own robotic overlord.

 



Forgot your password?
typodupeerror
The Military Security IT Technology

Predator Drone 'Virus' Could Be Military's Own Monitoring 99

Posted by timothy
from the anything's-possible dept.
jjp9999 writes "The virus that hit Predator and Reaper UAVs could be an internal monitoring system employed by the military. According to security researcher Miles Fidelman, there are vendors that sell security monitoring packages to the Defense Department which are 'essentially rootkits that do, among other things, key logging.' The virus is a keylogger that was found at pilot stations, and could be keeping tabs on keystrokes used by pilots to control the UAVs, found Wired's Danger Room blog. Fidelman adds, 'I kind of wonder if the virus that folks are fighting is something that some other part of DoD deployed intentionally.'"
This discussion has been archived. No new comments can be posted.

Predator Drone 'Virus' Could Be Military's Own Monitoring

Comments Filter:
  • Sounds like a lame excuse for incompetence to me.

    • by Daniel Dvorkin (106857) on Sunday October 09, 2011 @01:28AM (#37652366) Homepage Journal

      If they meant to do it, it's still incompetence, since they apparently just FORGOT TO MENTION it to the people whose job it is to detect actual outside attacks.

      To anyone who's spent any time dealing with military computer security, unfortunately, this really isn't a surprise.

      • Re: (Score:3, Insightful)

        by Anonymous Coward

        To anyone who's spent any time dealing with military computer security, unfortunately, this really isn't a surprise.

        To anyone who's spent any time dealing with computers, unfortunately, this really isn't a surprise.

      • I work for a normal every day company that is constantly going through transitions. I see behavior like this with our computer systems. Heck, I see it with even non-IT issues because of attempts to hide data from gossiping employees and the public.

        I am not sure if this is full out incompetence, but underestimating the skill (overestimating the incompetence) of those whose job is to detect actual outside attacks if this hypothesis is real. They probably didn't trust those technicians not to spill it to th

    • by djl4570 (801529)
      More likely to be a combination of security compartmentalization and silent updates. I surmise that the monitoring software was white listed in the scanning software until they pushed out an update that whacked the white list.
  • Or perhaps all this talk of viruses in drone systems is laying the ground work to create plausible deniability for hitting the "wrong" target, which in reality, may really be the intended target - think assassinations ... government could claim it wasn't us who killed "X", we would never do that, it must have been those pesky hackers; the virus did it.

    • Re: (Score:2, Insightful)

      by Anonymous Coward

      Or they could just do what they've been doing all along and label anyone on the wrong end of their detached and indiscriminate bombings as "enemy combatants." It works well enough at home and I sincerely doubt that the people living in fear of drone strikes respect appreciate their presence to begin with. "It wasn't me that upset the bear I put in your house, it was those guys over there!"

    • i think you have your tinfoil hat on too tight.

    • by LibRT (1966204) on Sunday October 09, 2011 @06:17AM (#37653128)
      I would think that if you have people whose job it is to push keys, the results of those key pushes being missiles firing and possibly killing other humans, one would insist on logging those key strokes:

      Officer: "The drone you're operating just launched a missile into a school yard and killed 30 children! What did you do?"

      Drone operator: "I dunno. I was pushing some keys and, well, it just kinda happened."

      Officer: "Which keys did you push?"

      Drone operator: "I'm not sure. I was kinda distracted eating a donut. You know how it is when you're eating a donut: you really want to focus in on it."

      Officer: "Hmmm. OK. Back to work. Got any more of those donuts?"
    • by timeOday (582209)
      Except everybody would consider that excuse even more contemptible and irresponsible than intentional remote killings in the first place. Nothing would hurt the drone program more than "proof" that they're not trustworthy.
    • by jjohnson (62583)

      Doubtful. Besides the fact that the military hasn't given much of a shit about collateral damage and mistaken targets so far, to confess that their war machines aren't actually under their control would do far more damage than to simply say "yup, we hit a schoolbus full of children."

      Remember, during the Yugoslavian action, they "accidentally" bombed the Chinese embassy. They don't seem to have a problem with making mistakes and then saying "what are you going to do about it?"

      • The Chinese accidental incident was partly because at the time the Chinese embassy was generating more EM traffic than NASA puts out during the launch and operations of the Space Shuttle. In this era GPS or laser guided targeting didn't exist. This same type of incident also played a part in the Israeli targeting the US Liberty reconnaissance ship. The US did not explain why they were there in the first place. Israel did provide compensation for this incident but the US government at the time did not to m
        • You are saying in 1999 GPS and laser guided targeting did not exist? Wtf?
          • Not to the extent it was used in later conflicts. Operational laser targeting at the time required someone on the ground to tag the target for the attacking aircraft and this is still used today depending the type of aircraft involved in the attack. There is no way the US would intentionally and openly attack a Chinese embassy. There is nothing to gain by attacking a foreign embassy and the US refrains from this course of action because their embassies would then become fair game rendering the laws regardin
        • by cusco (717999)
          Laser targeting has been in common use since the 1980s, it was a really big deal during the Gulf Slaughter. Nice try, but many of us are old enough to remember when that stuff was new.

          The Liberty??? Radio intercepts made it abundantly clear that the pilots knew what they were attacking, and even queried their supervisor to make sure this was the actual target. If you want a career as a Pentagon apologist you need a lot more practice, and probably should pick an easier and less-informed audience.
          • Laser targeting tech has been available for a while but it's use was limited because the aircraft and missile guidance tech capable of taking advantage of this was limited. Even in the first Iraq War the US guided munitions only represented about 10% of total expended air deployed munitions because the missiles and bombs were in relatively short supply. Guided missiles made for good TV but they were not the dominating factor. As far as being old enough to render an opinion I was alive when the Liberty attac
    • by arisvega (1414195) on Sunday October 09, 2011 @11:03AM (#37654372)

      it must have been those pesky hackers; the virus did it.

      No, I'm not buyin it.

      The military is the military, they do not "do" plausible deniability: they receive orders, and execute them.

      My guess is that these are nested "rootkits", if you will, reflecting the various levels of clearance that exist in a military foodchain. One can then log in and spy on all the others that his clearance allows him to.

      • You're likely spot on.

        My post was more playing devil's advocate to put that thought out there for discussion - many of the replies a good point that the military would have no need to do that...

        Good points about much of the so-called virus software likely being monitoring - often the best security will consist of a group who do not fully trust each other; keeping an eye on each others actions.

      • My guess is that these are nested "rootkits", if you will, reflecting the various levels of clearance that exist in a military foodchain. One can then log in and spy on all the others that his clearance allows him to.

        Yo dawg! I hear you like rootkits so we can put a rootkit in your rootkit.

  • by Arancaytar (966377) <arancaytar.ilyaran@gmail.com> on Sunday October 09, 2011 @01:53AM (#37652442) Homepage

    Digital warfare style.

    • by mjwx (966435)

      Digital warfare style.

      Field SGT: WTF command, that drone just killed half my unit.
      Drone Operator: Uh, hit the windows key by mistake.
      Field SGT: GTFO N00b.
      Drone Operator: STFU, my score is still higher then yours.
      Field SGT: Commander, Request ban 4 Drone Operator 4 TKing.
      Drone Operator ===> Field SGT.

  • sony (Score:3, Funny)

    by cheeks5965 (1682996) on Sunday October 09, 2011 @02:20AM (#37652458)
    must be a sony drone. oooh burrrn on sony!
  • by RotateLeftByte (797477) on Sunday October 09, 2011 @02:29AM (#37652468)

    Sorry, can't do that. It is classified.

  • That is soo lame :) I just recalled a movie Spies Like Us (1985).
  • Someone needs to be fired. And someone needs fix this shit PRONTO.
    • by Anonymous Coward

      exactly
      Thats the whole point, show your superiors your struggling then get a budget increase to solve your problems.
      PROFIT

      • Reminds me of one of the de-motivational posters from Despair, Inc entitled CONSULTING "If you aren't part of the solution there is great money to be made in prolonging the problem"
  • No no it's not a virus. Its... unannounced monitoring services. Double plus good.
    • by Anonymous Coward
      I agree comrade. If we were running drills like this before 9/11, then perhaps 9/11 wouldn't have ever happen.... wait, they were running drills, and then got confused by what happened, since they thought they were just drills. Anyway, we must have faith that more drills will save us comrade, please donate to the DoD to prevent the layoffs of the idle few.
  • The "researcher" gives the military an easy way to "explain" the discovered breach that doesn't make military look incompetent.

  • by AntiBasic (83586) on Sunday October 09, 2011 @02:54AM (#37652524)

    The centrifuges were designed to act that way.

  • 'I kind of wonder if the virus that folks are fighting is something that some other part of DoD deployed unintentionally.'

  • The engineering platform I am currently (and reluctantly) using uses systems supplied by corporate IT. As a result we get hit with software updates and tools of dubious benefit with interfere with our application when we run it. Engineering nodes (and particularly operational nodes) should always be managed differently from the administrators laptops, etc.

    • Re: (Score:2, Troll)

      by Rich0 (548339)

      Agreed - and I work in a corporate IT group. This sort of thing happens when you put MBAs in charge of everything - it becomes more about saving money than good operations. People blame IT usually for this sort of thing, but really this is the result of a directive to the IT manager to put cost savings above all else. The guys destroying your control systems are just following orders as a result.

      If I were managing PCs across the enterprise I'd probably put them into a couple of classes:
      1. Generic deskto

      • some times lack updates and or get messed up by software pushed by standardization of all systems.

        This Monitoring may just be part of some IT tool that some how get's in the way of the Drone software.

        • by Jurph (16396)

          Since HBSS was identified as the security software that caught the 'virus' I was immediately skeptical. Why? Because HBSS has found and deleted mission-critical software on classified networks before. HBSS was deployed in a hurry because security personnel wanted to lock the network down, and one of the steps that got skipped in a lot of places was coordinating what software is and isn't permitted on the network. Down at the operational level, this translates to an overworked captain or lieutenant passi

        • by Rich0 (548339)

          Well, security updates are important, unless you plan to firewall individual systems (which is an option if you REALLY need to be running unpatched systems, but should be frowned upon and such systems should probably be limited to point-to-point VPNs across the corporate network to specific other systems). Besides, most vendors will support basic OS security patches, or at least can be talked into it.

          However, all the desktop junk is a different story. You don't need to push out the latest MS Office upgrad

    • by nurb432 (527695)

      Engineering nodes (and particularly operational nodes) should always be managed differently from the administrators laptops, etc.

      As long as IT still manages them im ok wit that as I have found most engineers are some of the worst users out there, They *think* they know better because the are an 'engineer'. Sure they know THEIR field but they don't know how to manage their desktops. ( again this is not ALL of them as some do cross fields like i did, just a large percentage ). Also a good IT shop would have different polices for different classes of equipment and departments anyway.

      If IT doesn't manage them, then they should be cut of

  • by martin-boundary (547041) on Sunday October 09, 2011 @03:39AM (#37652644)

    'I kind of wonder if the virus that folks are fighting is something that some other part of DoD deployed intentionally.'

    Luckily, there's a simple test for that. Does the virus bring up the following dialog box?

    [Virus Message]
    This is not a drill.
    [OK] [Cancel]

    If so, then it's definitely a DoD virus.

  • by Anonymous Coward

    He's a security researcher and so are the Beagle boys. The guy is a well known crank with a rich fantasy life. Slashdot just keeps getting worse.

  • by evilviper (135110) on Sunday October 09, 2011 @05:29AM (#37652986) Journal

    The whole story can be summarized with the following quote:

    Miles Fidelman: "I kind of wonder if..."

    That's about it. Let's have some more fun.

    Predator Drone 'Virus' Could Have Been Planted By Dick Cheney.

    Predator Drone 'Virus' Could Be Product of Iran Intelligence Agency.

    Predator Drone 'Virus' Could Be Designed to Target Nude Beaches.

    etc.

  • http://en.wikipedia.org/wiki/Memoirs_Found_in_a_Bathtub

    Quote: "Set in the distant future, Memoirs Found in a Bathtub is the horrifying first-hand account of a bureaucratic agent trapped deep within the subterranean bowels of a vast underground military complex. In a Kafkaesque maelstrom of terrifying confusion and utter insanity, this man must attempt to follow his mission directives of conducting an "on-the-spot investigation. Verify. Search. Destroy. Incite. Inform. Over and out. On the nth day nth hour

  • by ka9dgx (72702) on Sunday October 09, 2011 @06:33AM (#37653186) Homepage Journal

    Argh... we're building weapons systems based on windows or mac or linux? What are these people, nuts?

    If there was ever a place where capability based security should be used, this is it. An application that has the ability to literally kill people should not be run in an environment which defaults to permissive... this means that ANY application on that system could potentially kill someone.

    With the exception of a few wise souls here and there, nobody else seems to get the idea that this kind of thing can be stopped, dead, in its tracks. (Pun intended)

    Capability based security offers a path forward to computers that trust nothing by default... the exact opposite of what we have now. They don't have to be unusable, nor layered with ineffective anti-spyware, anti-malware, etc...

    Just stop trusting applications, and specify what they can do, as a maximum extent, before you execute them. This limits the damage a rogue (or just confused) application can incur before it's even run.

    Now... I've obviously made some typos and a few things could be made clearer in the above... unfortunately /. doesn't allow editing or clarification of a post after it's written... nor does it offer any voting other than a popularity contest... so let the inefficient commenting begin.

    • by Anonymous Coward

      It's not a question of cost. It's a question of time. The DoD wants UAVs for the current war. You just don't get that agility with all-custom systems. Seriously, how many people have been accidentally killed because the UAVs are running a COTS OS? How many US soldier's lives have been saved because a UAV could do a mission? I'm guessing that we're way ahead.

      dom

      • by jjohnson (62583)

        No kidding. "Okay, phase one in the project involves training a bunch of Ada programmers..."

    • by DerekLyons (302214) <fairwater&gmail,com> on Sunday October 09, 2011 @11:58AM (#37654812) Homepage

      Argh... we're building weapons systems based on windows or mac or linux?

      I'd be willing to bet that since the drones started out as non combat systems, doing was acceptable in the beginning - and they've never gone back and redone the system as the drones have gradually morphed into combat systems and then into weapons systems. Or, they've justified not doing so on the basis that to do so would cost $X megabucks cause Y years delay in deployment.
       
      As to the whole "this may be caused by our own monitoring"... (Left hand/right hand.) It wouldn't be the first time I've seen something like this. Back in the 80's, one of the Navy's technical branches came up with a spiffy new system that needed the submarine's heading as one of it's inputs. So when they installed the prototype on my boat, they spliced into an existing analog signal - one that also also fed ships heading to the [Trident backfit] missile fire control system. When the spiffy was operating, it would read the signal every minute - loading down the line and taking it out of spec for fire control, causing fire control to go into alarm.
       
      Making things even more frustrating for the navigation guys and for us down in fire control, the spiffy (which was operated by a third, different, division) was only operated a couple of hours a day - making it look like an intermittent fault. An intermittent fault that didn't match up to anything either navigation or fire control was doing., and as any tech knows, that's hardest kind to troubleshoot. (Not to mention, what the hell kind of intermittent occurs precisely every sixty seconds for an hour - and then quits?) Finally, after a month of great frustration trying to track the fault, we made a Hail Mary pass and started physically tracing the signal from the nav center down to fire control - and discovered the splice.
       
      It turned out that the branch that 'owned'[1] the spiffy also 'owned' the junction box the splice was made in, even though they didn't 'own' the signal that passed through it. Since a) the spiffy was highly classified [2], b) they 'owned' the junction box, and c) it was cheaper to make that splice than to run a cable to a less accurate heading source that they 'owned', they didn't feel any need to ask permission or inform anyone that they had done so.
       
      Our CO solved the problem by ordering the spiffy shut down and tagged out... This then turned into an enormous turf war between the branches. It took Even Higher Authority explained the to spiffy's 'owners' that interfering with the ships strategic mission was Not Acceptable even if it made their spiffy more expensive. In the end, the spiffy was never deployed operationally anyhow because of other problems, and when the Cold War ended Congress declined further funding for it.
       
      [1] Everything on the boat belongs to someone, on and off hull, and that someone is responsible for maintenance, training, funding, etc...
       
      [2] Outside of the guys onboard that operated it and a few officers, all we knew was that "something" had been installed aboard for testing.
       

      Now... I've obviously made some typos and a few things could be made clearer in the above... unfortunately /. doesn't allow editing or clarification of a post after it's written...

      That's what the "preview" button is for, so you can see what it looks like and can edit it down int the edit box before submitting.

    • by evilviper (135110)

      Argh... we're building weapons systems based on windows or mac or linux? What are these people, nuts?

      If there was ever a place where capability based security should be used, this is it. An application that has the ability to literally kill people should not be run in an environment which defaults to permissive...

      You DO realize Linux has all those features already, don't you? It's called SELinux, it was created by the NSA, and it is enabled by default in RHEL. In fact "permissive" is one of the modes of

    • by Anonymous Coward

      Agreed. Running critical missions on Windows platforms is like asking the village idiot to remove your brain tumor.

    • by Ibiwan (763664)
      Nope. The planes and the ground stations that control them both use environments other than OS X or Windows. There are, however, also some data analysis workstations that sit in the same trailers as the Pilot bay, that happen to run Windows.
  • by Anonymous Coward

    Other people call it SkyNet.

  • Spin? (Score:4, Insightful)

    by astrashe (7452) on Sunday October 09, 2011 @07:45AM (#37653382) Journal

    A big story goes out about how the drone control system are really seriously compromised. Not only have they detected malware, but they're unable to get rid of it. A few days later, a new story comes out. "Yeah, we totally meant to do that." Only it doesn't even say that. Instead, it says, "Wouldn't it be interesting if they totally meant to do that?"

    Even if the malware was installed by some shadowy arm of our government, it's a giant screw up if the guys who are in charge of running the systems didn't keep it out and can't remove it once it's detected. If the guys running the system were competent, the shadowy arm of our own government shouldn't be able to install this crap and more easily than anyone else.

  • This sure sounds like baloney to me. Think about it ... do they not have all kinds of data logging software on these things? Why would the DoD need to be monitoring keystrokes, when they surely have better information available via data logs?

    This is simply an attempt to raise uncertainty about the incompetence of our digital security.

  • Skynet
  • Left hand meet right hand.
  • "We have met the enemy and he is us."

  • by Kuruk (631552)
    Is it working ?

Old programmers never die, they just branch to a new address.

Working...