Air Force Aims for Control of 'Any and All' Computers

Noah Shachtman on Wired.com's Danger Room reports that Monday, the Air Force Research Laboratory at Wright-Patterson AFB introduced a two-year, $11 million effort to put together hardware and software tools for 'Dominant Cyber Offensive Engagement.' 'Of interest are any and all techniques to enable user and/or root level access,' a request for proposals notes, 'to both fixed (PC) or mobile computing platforms ... any and all operating systems, patch levels, applications and hardware.' This isn't just some computer science study, mind you; 'research efforts under this program are expected to result in complete functional capabilities.' The Air Force has already announced their desire to manage an offensive BotNet, comprised of unwitting participatory computers. How long before they slip a root kit on you?

new meme

new meme -

Imagine an AirWolf cluster of these......

Re:new meme

Since we're talking about the military, shouldn't it be, "Imagine a clusterfuck of these"?

Who comes up with ideas like this?

This must be the ultimate example of "solutions" to engineering problems coming from a manager and not an engineer. I bet they'd like a pony while they're at it.

You know they'll get what they want out of commercial OSs by putting pressure on the vendors. Linux and the BSDs are too much of a moving target, and OpenBSD is run out of Canada anyway. If ever there was an article that needed to be tagged 'goodluckwiththat,' this would be it.

Re:Who comes up with ideas like this?

I love your "pony" comment. A couple of months ago, I was on a conference call with a client, a large defense contractor whose name sounds like it might refer to a hole in the ground where sweet, sticky bee-made syrup comes from, and I used that line. They said, "We would like to see X and Y done by Z date," and I said, "I understand, and similarly, I would very much like a pony."

My boss called me two seconds after the conf call ended. Since I saw the caller ID, I knew what was coming, and I answered the phone, "Was that inappropriate?" "Yes," was the answer, "but very funny. Don't do it again."

I think you don't know what "hard-kill" means.

It's just zeros and ones. You can TALK tough, but when a 5 cent CD foils your "hard-kill" on my "information" you're really just wasting time and effort.

"Soft-kill" would mean destroying you computer and therefor rendering you ineffective. "Hard-kill" would mean shooting you in the face and therefor rendering you dead.

Re:Seconded.

The dumb thing is, we've already proven that we are the world leader in unleashing the "hard kill" smackdown on information infrastructure.

Just putting effort into the software side would only add to that threat, and doing what the NSA does and just smirking and saying, "That's classified" when anyone asks them about their cyber crap would only make the threat more credible.

This is like watching some script kiddie waltz into an IRC channel and start swaggering. You know people are going to sneer, and you know someone is going to take a shot at them.

If you ask me.... you didn't but....

I'd say this was as illegal an idea as malicious botnets. My computer cpu cycles are NOT for sale to the US Government, or any government. They can have them when they pry them from my dead cold pc case...

Re:If you ask me.... you didn't but....

I hope I catch the USAF inside MY computer. The civil rights suit will be worth millions, when I retire I'll retire in comfort instead of poverty.

In fact I think I'll set up a honeypot just for them. Bastards got 4 years of my life, they're NOT welcome to the contents of my computer. Like you said, it is illegal for them to do so, and whatever lawless nutcake Colonel that thought up this outrage should be court-martialed and sent to Leavenworth [wikipedia.org].

3rd Amendment fun?

Chances are that they'll want to try to compromise foreign systems and not US systems to use in a botnet to avoid legal liability within the country.

Humorously, I could see a lawsuit from this opening up the door for the first expansion of the 3rd Amendment since Engblom v. Carey [wikipedia.org] if they did compromise the machines of US citizens to use in an offensive botnet. Arguably being forced to host Air Force activities on your private property violates the same kinds of rights that the 3rd Amendment protects.

The Second Circuit said:

[W]e hold that property-based privacy interests protected by the Third Amendment are not limited solely to those arising out of fee simple ownership [of homes] but extend to those recognized and permitted by society as founded on lawful occupation or possession with a legal right to exclude others.

The court was talking about state-owned rental properties where striking prison guards were evicted and replaced with National Guardsmen, but I can see an argument for extending this to being forced to host Air Force use of one's chattels within a home (or maybe even outside of a home since the same possessory "right to exclude others" exists). I don't see Scalia or Thomas buying the argument, but it would be fun to watch someone try and argue it before the rest of the court.

Eleven million? Good luck.

Establishing total and completely control across all hardware and operating systems, all patch levels, etc?

I admire your optimism, USAF, but $11 million dollars is simply not going to make that happen -if it can even be done. Software companies have enough trouble just getting their *own* software to work installed on *willing systems*, and some of the bigger ones spend that kind of money just getting it to work on one operating system withing a reasonable set of constraints.

Take into account the fact that you will also be most likely using pre-existing exploits, which will be repaired swiftly by responsible developers that watch security RSS feeds, and this is a red herring task. If you are talking about spending 11 million dollars on doing your own research towards establishing remote control by examining source code or reverse engineering to find new exploits, then honestly, you aren't just crazy- you are batshit crazy. You're going to need a whole hell of a lot of money to do that.

Better than the Great Firewall of China

The internet is said to route around censorship; however, you don't need to censor the internet if you can pwn the world's PCs.

At first glance, it seems that this would easier to do by simply mandating government backdoors in all operating systems. Wait. Not only does a legislative fix not work work for FOSS, it's also likely to start a tremendous uproar until you show enough people a video of Britney Spears's latest car accident...

The big problem with this...

... is a taxpayer money sink.

Over time, systems change. That means after this two-year study and eleventy-million dollars later, it's worth very little a year down the road. In three years, we're virtually guaranteed to have nothing for the efforts, except a statement saying "Oh, we learned a lot, and now need continuing funding. Please give us more money."

Although many holes in software exist for a long time, they are generally patched within a couple months once discovered, usually sooner. And as soon as the military activates one of these holes, it'll be analyzed and patched. That will remove one of their finite resources.

100% control of all platforms and systems is beyond ludicrous. They might as well wish they could read minds, teleport, and find Carmen Sandiego. Or at least Osama.

They wouldn't do that...

it would be unethical!

Even more reason

not to click on the DonaldRumsfeldNude.mpg.exe attachment in my inbox.

Re:Even more reason

Um... Dude... You need MORE reasons?

what they want and what they'll get rarely match

I bet when the military was studying psychic remote viewing and psychic assassination the project goal was for completely functional capabilities as well. How did that turn out? ;)

Yeah, sure.

Good luck hacking my laptop. It runs BeOS.

Constitution Violated by Domestic Military Ops

In the same speech in which Attorney General Mukasey lied about a fake "phonecall from Afghanistan" [globalresearch.ca] to con us into cowardly acceptance of amnesty for illegally wiretapping telcos (and the Bush officials who they did it for), Mukasey avoided denying that

the Fourth Amendment, which bars unreasonable searches and seizures, did not apply to "domestic military operations" against terrorist threats.

So the Air Force can do whatever the spooks (and their Bush crony masters) want, like fly surveillance drones, record and datamine us against satellite surveillance, and help the NSA filter every bit of our telecom.

Because these people hate the Constitution. They hate our freedoms and rights the Constitution instructs them to protect. They hate us. Because we get in the way of business, which is to spend on war the maximum amount Americans can make or borrow.

Feel safer?

Armed Forces used against American Citizens

Isn't there a law that says the government can't use the Armed Forces against us? Like isn't that the reason why the National Guard is called to stop riots and not like the Marines? If the Air Force is building a bot net that comprises American PC's then shouldn't that follow under the same law?

dear air force morons:

you don't defeat your enemies by engaging in their tactics. that just makes you the moral equivalent of your enemy, thereby nullifying any moral high ground you claim to have, thereby nullifying any reason any citizen of your country or ally of your country would side with you

Re:SETI@Home

The whole botnet thing just shows how absurdly out of touch they are. A botnet is a tool created by a bunch of guys who have limited computer resources in a bid to increase those resources.

Why the fuck would the United States Air Force want a botnet, when they could have the real thing? A tightly integrated computer network with near unlimited bandwidth, satellites, super computers, massive clustering, and secure, integrated control.

Botnet. Jesus. Someone take the freaking tech magazines away from the air force brass before they start doing social networking or some crap.

I can think of a few reasons

Why would the USAF want a botnet? One, a botnet is distributed and harder to block than a centralized computing facility, or even a reasonably distributed one. Two, a botnet can grow as needed. When fighting an enemy botnet, this could prove very necessary.

Not that I'm condoning any of this, mind you. Just saying, I don't think the Air Force brass are all total idiots.

Re:SETI@Home

That doesn't bother me; games can be a legitimate training tool, and paying for the tool, then making it available to the public is acceptable. It doesn't even bother me when they use it to recruit.

What bothers me is when they do something that's just flat boneheaded, and clearly the result of someone in the chain of command who doesn't know crap about anything, shooting his mouth off and making policy.

If they want to do the whole "cyberwar" thing, they need to take it seriously, and put people in charge who have the faintest fucking CLUE about what they're supposed to be doing.

Re:SETI@Home

I think it's you that doesn't have a clue. By having their own botnet not only can they infect people in the country they are attacking locally they can deny any responsibility for the attack. It also costs the virtually nothing when then enemy is paying for those computers to be online.

Re:SETI@Home

Hmm...not sure how many computers have downloaded America's Army, but how hard would it be to slip a botnet agent into a patch or download?