Cyber Vulnerabilities Found In Navy's Newest Warship 162
An anonymous reader writes with some potentially troubling news about some security issues with the Navy's newest class of coastal warships."A Navy team of computer hacking experts found some deficiencies when assigned to try to penetrate the network of the USS Freedom, the lead vessel in the $37 billion Littoral Combat Ship program, said the official, who spoke on condition of anonymity.
The Freedom arrived in Singapore last week for an eight-month stay, which its builder, Lockheed Martin Corp., hopes will stimulate Asian demand for the fast, agile and stealthy ships.
'We do these types of inspections across the fleet to find individual vulnerabilities, as well as fleet-wide trends,' said the official."
sitting afk for 8 months (Score:1)
"The Freedom arrived in Singapore last week for an eight-month stay, which its builder, Lockheed Martin Corp., hopes will stimulate Asian demand for the fast, agile and stealthy ships"
we paid for it so they can advertise?
Re: (Score:2, Insightful)
Surprisingly, much of the US Navy's job is to advertise, cf the Great White Fleet and various other show the flag exercises, it's just this time the shipbuilder foolishly thinks that the advertising being done is "buy our stuff" and not "do you REALLY want to mess with us?" I'd not be surprised if the Freedom hasn't already got orders for the North China Sea to "advertise" to the DPRK and is just taking Liberty Call to replenish and resupply before they go.
Re: (Score:2, Interesting)
Re: (Score:2)
we paid for it so they can advertise?
You'd rather the ship stayed in port forever just so Lockheed -Martin doesn't get the free advertising?
Some Things Never Change (Score:5, Informative)
USS Yorktown circa 1997 [wikipedia.org]
Re: (Score:1)
USS Yorktown circa 1997 [wikipedia.org]
Not exactly the same thing. On the Yorktown a crew member entered a zero into a database field using the MSSQL management console, causing a divide by zero error. This occurred during system testing and was later fixed.
Quite different from an exploitable security vulnerability.
Re: (Score:3, Insightful)
Fixed? You call running your propulsion control and maneuvering systems on windows nt fixed? This is simply laughable.
Such systems should only be run on a completely independent tactical network and run only on bulletproof RTOS's.
Re:Some Things Never Change (Score:4, Informative)
Such systems should only be run on a completely independent tactical network and run only on bulletproof RTOS's.
Plus you need an emergency backup that is independent of the network so you can run everything "locally" and have commands transferred from the bridge the old way.
Re: (Score:2)
The infamous, manual override. There is of course one serious problem with manual over ride in today's corporate run crazy ass world, you need skilled people (paid high wages) to do it and there just ain't no bloody corporate profit in that, hence no manual over ride. Obviously if you are fully capable of manual over ride, why bother with the automation, except for simple monitoring and reporting.
It needs to be extremely complicated, repairable and upgradeable only at base by private contractors at enor
Re: (Score:2)
Fixed? You call running your propulsion control and maneuvering systems on windows nt fixed? This is simply laughable. Such systems should only be run on a completely independent tactical network and run only on bulletproof RTOS's.
While I prefer a more traditional embedded environment with a RTOS, blaming the problem on Windows NT is perpetuating an urban myth. The divide by zero was in an application not the operating system. If this application had been running under Linux or Mac OS X or a RTOS it would not have mattered, the problem was internal to the application. Well at least according the the developers of the software and the Navy officers and chiefs on board the ship at the time.
Re:Some Things Never Change (Score:4, Funny)
Re:Some Things Never Change (Score:5, Interesting)
USS Yorktown circa 1997 [wikipedia.org]
Interesting quote from there:
“Because of politics, some things are being forced on us that without political pressure we might not do, like Windows NT. If it were up to me I probably would not have used Windows NT in this particular application ... Refining that is an ongoing process ... Unix is a better system for control of equipment and machinery, whereas NT is a better system for the transfer of information and data. NT has never been fully refined and there are times when we have had shutdowns that resulted from NT.”
—Ron Redman
Re: (Score:1)
Someone covering their ass isn't that interesting. He blames Windows NT rather than flaws in the client software, which was designed under his supervision, and the likes of you gulp it down without question.
Re:Some Things Never Change (Score:4, Interesting)
Client software shouldn't be able to bring down an O/S. Never mind an entire network.
LAN consoles crashed, not the network (Score:2)
Client software shouldn't be able to bring down an O/S. Never mind an entire network.
It didn't. The network did not go down. LAN consoles crashed.
Re: (Score:2)
There were no infamous BSOD errors.
In the infamous USS Yorktown [wikipedia.org] incident, the entire network was taken down. Blue screen or not, that just should never happen.
Re: (Score:2)
There were no infamous BSOD errors.
In the infamous USS Yorktown [wikipedia.org] incident, the entire network was taken down. Blue screen or not, that just should never happen.
Your own citation says otherwise. Devices connected to the network went down, not the network itself. In other words the devices that received the erroneous zero over the network had their application software crash. Unfortunately these applications controlled the engine. Windows NT, Linux, Mac OS X or RTOS would not have made a difference. It was the application controlling the equipment and it was the application that failed.
Re: (Score:2)
Re: (Score:2)
The ships network supported a number of machines and applications, including "monitoring condition assessment, damage control, machinery control and fuel control, monitoring the engines and navigating the ship". The divide by zero error brought all the connected "machines" down. Not applications, "machines".
No. LAN terminals crashed, that is it. The software that failed was *application* level software, not operating system level, not driver level. The *application* level software running on these terminals controlled ship's machinery.
Re: (Score:2)
"The network" also includes each machines network drivers and interface. If a client on a remote host can shut down all systems' network interfaces, then "the network" is down.
You put bad data into a system and the system will react accordingly
Evidently Microsoft hasn't learned the role of a proper O/S yet. Bringing a client process down with bad data is one thing. But a true O/S will prevent a client error from propagating to other clients or hosts.
Re: (Score:2)
I particularly enjoy how you're mindlessly ignoring the quote where the designer mentioned all of the problems they had with NT prior to the problem.
Really? The wiki article where the quote is found begins with a disclaimer stating that Windows NT had no role in this particular failure.
It sounds like he was railroaded into NT, and then had to use subpar developers who don't realize numbers cannot be divided by 0 instead of developers who never would have architected it in that manner to begin with.
No. The production version of the software, which was available at the time, had safeguards that handled the zero and would have prevented the problem. They were running a special development version that let people hand tweak values and permit those values into the system.
Re: (Score:2)
Indeed, but that's not what happened on the Yorktown. There were no infamous BSOD errors.
Not until the ship's cook tried to print off 100 copies of the day's menu from Word for Windows 6.0 on the NT 4.0 system in the galley.
Re: (Score:2)
NT is a better system for the transfer of information and data
I wonder where he got that idea?
I can't imagine... (Score:4, Informative)
Re: (Score:1)
I once heard an interview where that same rationale was used for healthcare in UK... it went something like ``if we can afford to spend $X on killing people, we can afford less than that to heal them''. (that interview had a lot of ww2 sentiment in it, but the basic idea is that military spending is way overboard compared to things-that-trully-help-people).
Re: (Score:1)
the basic idea is that military spending is way overboard compared to things-that-trully-help-people).
I'd give more credence to that view if it weren't for the fact that the US, which is one of the bigger defense spenders, didn't spend more than three times as much on health care as on defense. Britain spends less on health care as a percentage of GDP and still spends more than three times as much on health care as on defense.
Health care (15.2%): http://en.wikipedia.org/wiki/Health_care_in_the_United_States [wikipedia.org]
Defense (4.7%): http://en.wikipedia.org/wiki/Military_budget_of_the_United_States [wikipedia.org]
Britain health car
Re: (Score:3)
Re: (Score:1)
that's more than a thousand dollar per american. have the republicans protested against it ?
Re: (Score:2)
And there's the proof that the money needs to be spent on schools. Try $100, not $1000.
Re: (Score:2)
Stupid comment filters. I was assuming GP was talking about the $37 billion.
Re:I can't imagine... (Score:4, Informative)
One can argue defense spending needs to be reduced. But proposing it should be spent on schools instead is just shifting money from one bloated program to another.
Re: (Score:2)
U.S. spending per student on education is among the highest in the world [mercatus.org]. Of all the problems which plague our education system, funding is definitely not one of them.
So how come you have people with such large student debts?
Because, in my book, having universities that charge $100K for a degree course doesn't mean that you've spendt $100K on education, it just means you're funnelling money towards wealthy private educational institutions that should, self-evidently, all be nationalised and owned/run by the people.
Re: (Score:2)
Schools are paid for by local governments, not the federal government. Roads and "infrastructure" are frequently paid by a combination of federal and local governments with local governments paying almost all ongoing maintenance.
The navy meanwhile is a 100% federal responsibility.
Re: (Score:3)
Or, you know, give the money back to the tax-payers and stop fucking spending it - period. Still, I'd rather you pay for your children's education. That's not something that requires the collective effort of the entire nation to accomplish. Defense, however, is. So if it came between subsidizing the education/daycare of your snot-nosed rug-rats versus a navy ship, I'll take the ship.
However, I'd rather they just but that $37b, period.
It takes a village to train a village idiot.
Re: (Score:2)
Or, you know, give the money back to the tax-payers and stop fucking spending it - period. Still, I'd rather you pay for your children's education. That's not something that requires the collective effort of the entire nation to accomplish. Defense, however, is. So if it came between subsidizing the education/daycare of your snot-nosed rug-rats versus a navy ship, I'll take the ship.
However, I'd rather they just but that $37b, period.
You're one of those dicks who needs the word "shared infrastructure" explained to them in words of one syllable, via the clue bat.
But you keep your John Galt libertarian-wank fantasies if you want.
Re: (Score:2)
You're quite right. It's not as if there is any benefit to society from an educated populace. Except maybe with that whole voting thing. Tell you what! Let's get rid of the vote, then we won't need to educate anyone at all! Is that it? Because I can't believe you're seriously endorsing leaving education to those born into wealth?
You'd make an excellent serf young man.
Ah yes, but GP would OF COURSE be one of the rich elite. He's like those past-life fantasists who were always Queen Cleopatra, not a fucking slave building the pyramids.
Windows for Warships 2012 now with more touch cont (Score:5, Funny)
Windows for Warships 2012 now with more touch controls.
To fire swipe the screen.
Re:Windows for Warships 2012 now with more touch c (Score:5, Funny)
It looks like you're trying to return fire. Would you like help with this?
0 find hostile ships in the area using cloud services (recommended)
0 check online help for rules of engagement.
0 I don't need help. I can return fire by myself.
create demand? (Score:1, Insightful)
It should give pause to anyone joining the military that our citizens, and our own government would seek to arm the rest of the world, potentially to be used against us. better to stay in school, join the military industrial complex and create the weapons, rather than be paid a pittance and die prematurely on the battlefield. Take a page from our congressional leaders.
Wrong Name Is Wrong (Score:1)
The first mistake was to call it the "Littoral Combat Ship", which makes people confused about the intended mission specs. I mean, literally who the hell uses the word "littoral"? "Almighty Almighty, this is Littoral Combat Ship Street Gang. Radio check, over!" Yuck.
They should have called it the "Riparian Combat Ship". Ya, that's the ticket.
Re: (Score:2)
"Littoral" sounds meaner than "Shallow water".
Shallow water combat sounds like your mom won't let you into the deep end of the pool.
Re: (Score:2)
Hmmm someone needs an anatomy lesson or an actual girlfriend (probably both).
Designed by (Score:4)
Re: (Score:2)
That was my thought, exactly. "Didn't we already learn not to network our ships in BSG?"
Re: (Score:2)
We learned, yes. The people actually building our military systems, apparently not so much.
Re: (Score:2)
We (the US Navy) has been networking it's ships since it was born... first with flags and lights forming a sneakernet, then with telegraphy and voice radio in the same role, and finally with direct data and control links since the 1950's. Internal networks have followed the same arc. (The original practice of both stretches back into antiquity.)
Seriously, don't try and extrapolate technology lessons from TV or other fiction. It just makes you look like a fool.
Re: (Score:2)
Re: (Score:2)
Had I made such a claim, you'd have a point.
Re: (Score:2)
What a name. (Score:5, Insightful)
USS Freedom.
What a name, just like something out of a satirical comic book. Seriously, you 'murricans seem to have a fetish for the word, but the more you use it, the more you seem to forget its actual meaning.
Re: (Score:3)
Agreed.
Good Ship Names:
Bad Ship Names:
Ship Names Too Excellent to Use:
Re: (Score:2)
Re: (Score:2)
G.S.V. Eschatologist
My personal favorite:
R.O.U. Xenophobe
Re: (Score:2)
Re: (Score:1)
Why is it bad when Americans name a naval ship "Freedom" but not when the British have done so?
Re: (Score:1)
I don't think that the British have ever had a warship called Freedom. http://en.wikipedia.org/wiki/List_of_ship_names_of_the_Royal_Navy_%28D%E2%80%93F%29
Re: (Score:3)
I noticed on that list the H.M.S. Flambeau. Isn't that just asking for trouble? Hope it had a good fire suppression system...
There was also a U.S.S. Flambeau [wikipedia.org]
Re: (Score:2)
Previous shi
Re: (Score:1)
We have a saying here in America: "The beatings will continue until morale improves." You don't like our style of peace? We have a fully armed drone that'll fix that. We can easily send it your way. Don't you forget that! All you foreigners always complainin' 'bout the way we do things. Ha! You're just jealous because of the beat down we gave everyone after World War 2. Since then, we've preserved the peace in... uh... that middle eastern place. Or were there two? Or three? I lose count. But we
Stop saying Cyber! (Score:2)
That word is so overused, it's lost all meaning - and I don't even know what the meaning was in the first place any more.
Re: (Score:2)
That word is so overused, it's lost all meaning - and I don't even know what the meaning was in the first place any more.
Cyber: to have virtual sex with an overweight 48 year old virgin male sysadmin who is pretending to be a blonde 19 year old nymphomaniac cheerleader.
Re: (Score:2)
It did. But even that use is now vague - if you do it by phone, it's now 'sexting.' Or does sexting mean sending images? I've seen it used both ways.
People who actually do sexual roleplay online never refer to it as 'cybering' - they consider the term very vulgar and low-class.
Cyber vulnerabilities? (Score:2)
What the hell does that even mean? Perhaps you mean software vulnerabilities?
Littoral Rope A Dope (Score:1)
There is little difference in design philosphy between a WWII Fletcher class destroyer and the Freedom class Littoral Combat Ship. Fast, shallow draft, thin skinned. Just because they aren't currently bristling with armament doesn't mean they can't be up armed. One of the major design considerations for the LCS class is its "plug-and-shoot" architecture. From what I've seen of the design it wouldn't be hard to up gun the Freedom class LCS with 3 5"/62 guns. That would give the LCS about as much firepower as
Littorally (Score:1)
Just some littoral stimulation for Asia. Haha.
When the Blue Screen of Death becomes real... (Score:1)
I haven't read the article but I'll wager that they're using Windows. I remember an article posted here about ten years ago that reported on a Navy ship that was being run completely using Windows NT 4.0. It's kind of strange to depend upon such a wonky piece of software. But today with everything being so interconnected, using Windows today would seem to be a bad gamble. But then it might be interesting. When it was demonstrated that voting machines were using Windows it was seen to be an opportunity
Cyber.. (Score:1)
Cyber cyber..cyber....cyber.cybercyber..cybercybercyber... siber syberrrrrrr cibrasrdasnmb.. compewter hakka esperts..
I'm sorry - I don't care.
Just roll out Microsoft - it will be che-*snigger*-per.. pwahaha. You think 150 brazillion dollars would buy you a decent rig.. Old guys with cigars.
No worries (Score:2)
Is it just me... (Score:2)
or does naming ships like "Freedom" sound a bit too dystopic.
Also perhaps I am the only one that thinks it is funny that eventually someone is going to get killed by Freedom... It is a Warship after all.
"Today Freedom killed thousands of people, truly a great day for Freedom!" LOL
SITTING DUCK (Score:5, Interesting)
The software and network vulnerability issues are the least of the problems for this Water Turkey.
The LCS is not expected to be survivable in a hostile combat environment [usni.org]
From the Congressional Research Service: "The LCS is not expected to be survivable in a hostile combat environment as evidenced by the limited shock hardened design and results of full scale testing of representative hull structures completed in December 2006."
"So, we have a warship design that is not expected to fight and survive in the very environment in which it was produced to do so. Poorly-armed, poorly-protected, with an over-abundance of speed that will eat through a fuel supply in half a day."
This New $350 Million Combat Ship Has Nearly Two Equipment Failures For Every Million Bucks [businessinsider.com]
"The Project on Government Oversight (POGO) researches Pentagon weapons procurement and has published its April 23 letter to members of the House Armed Services Committee, who have themselves 'repeatedly questioned the utility and effectiveness of the Littoral Combat Ship program' in the past.... From the time the Navy accepted LCS-1 from Lockheed Martin on September 18, 2008, until the ship went into dry dock in the summer of 2011 - not even 1,000 days later - there were 640 chargeable equipment failures on the ship. On average then, something on the ship failed on two out of every three days."
Hello US Navy! Thanks for accelerating climate-change, while subverting your mission and betraying the tax payer. I guess your next job, at Lockheed or General Dynamics will be worth all the criminal fraud and needless deaths.
Re: (Score:3, Interesting)
Hello US Navy! Thanks for accelerating climate-change, while subverting your mission and betraying the tax payer. I guess your next job, at Lockheed or General Dynamics will be worth all the criminal fraud and needless deaths.
It seems to me that the U.S. military is 30% vocational-training program for people who are failed by k-12 education, 30% make-work (manning missile silos in Montana and maintaining the nuclear arsenal, for example) to sop up human capital that was freed up by the industrialization of agriculture, and 30% wealth-transfer program. I'll give "defense" 10%.
Realignment of the U.S. military's budget should consider what's important (vocational training, tech R&D), and what's not.
Re:SITTING DUCK (Score:5, Insightful)
Wouldn't you then prefer that the guns actually work?
Re: (Score:1)
You mean the freedoms that keep getting stripped from us one by one in the name of national security?
Re: (Score:1)
Another DoD Astroturfer heard from. (Slow clap)
Re:SITTING DUCK (Score:4, Informative)
Dumbass, that was a scene from "A Few Good Men", released in 1992.
Re: (Score:2)
Dumbass, that was a scene from "A Few Good Men", released in 1992.
Thank you, Lt. Obvious.
Re: (Score:1)
"A Few Good Men" was released in 1992, so it was a Bush-Clinton era film, not Regan era. And the whole plot of the film was about uncovering corruption by the military brass and holding them accountable.
Re: (Score:2)
I somehow suspect you havent seen A Few Good Men.
Hint: It doesnt legitimize anything except the legal system.
Re:SITTING DUCK (Score:4, Informative)
In our version, the guy giving the "you can't handle the truth"
speech is not one of the good guys...
Re: (Score:2)
As a repeat spam poster I'm not sure you are a qualified judge of honor.
What makes that doubly sad is that I remember a post of yours a number of years ago in which you claimed to only post under your own name and take the consequences. What happened to you, have you had an episode? It is certainly sad.
Re:SITTING DUCK (Score:4, Informative)
Hes actually court marshalled, and the guys "just following orders" get dishonorably discharged for "conduct unbecoming a US marine".
Re: (Score:2)
*martialled
Re: (Score:1)
You must have seen another movie than the rest of us. In our version, the guy giving the "you can't handle the truth" speech is not one of the good guys...
No, you seem to have missed the point that the notional "good guys" are in fact pretty feeble compared with Jack Nicholson's character. It's a bit like Satan in Paradise Lost, a classic case of deconstructing/undermining the ostensible moral authority of the nominal goodies.
Re: (Score:2)
Re: (Score:3)
Re: (Score:3)
I always thought it was telling that we remember this speech, but not what happens next.
Col. Jessup confesses to ordering the murder of one of his subordinates. He is then immediately told he need say nothing more and that "the witness has rights". He is arrested, and removed from his "post" at the "wall". This is because we should and do question the manner in which we are provided security. In a country where the rule of law is used to provide protection of rights against those who would abuse or usur
Re:SITTING DUCK (Score:5, Interesting)
While the articles are pretty inflammatory and don't really have any details (including the issue with cracks - that's not unexpected in prototypes of high performance watercraft, they can usually be fixed), the core issue is this:
This harsh analysis comes just days after the U.S. Government Accountability Office released a report concluding the Defense Department has a problem with committing to expensive new weapons systems before development is complete.
This makes no sense whatsoever except as a lucrative cash cow (even a spherical one) for the contractors.
If you want cutting edge, create a skunk works (maybe the marine equivalent would be slime eel works?). Let them work out the bugs. Your PRODUCTION ships are well defined technology, as kept as simple as possible. Designed for real mission work - not fantasy battles with aliens. Less sizzle, more steak.
Re:SITTING DUCK (Score:5, Insightful)
Why don't we save the country...
By slashing Military spending to just double the closest US rival - from 500%?
Re: (Score:2)
I think your hosts file got corrupted and you replied to the wrong comment.
Re: (Score:2)
And how would that "save the country"?
If the US Military budget were reduced that amount, we'd still be running deficits in the $500B range (which, admittedly, is lower than Obama has managed, but generally higher than Bush Jr managed - it's still too damn high).
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Insightful)
"So, we have a warship design that is not expected to fight and survive in the very environment in which it was produced to do so. Poorly-armed, poorly-protected, with an over-abundance of speed that will eat through a fuel supply in half a day."
Clearly, it was designed to turn tail and run. And by God, it performs that mission to perfection.
Re: (Score:2, Interesting)
There are actually two LCS classes in service: the Independence class and the Freedom class. The non-survivable LCS is the Freedom class, which is overweight, under-prepared to withstand hostile fire without external buoyancy aids, sucks at shooting anything due to poor weaps design, and its helicopter can't do minesweeping because it's too weak. The Independence class has some corrosion problems, but seems to be a better and more stable design overall.
They've both had serious operational problems; USS Co
Re:SITTING DUCK (Score:5, Insightful)
Ask that of the survivors of Auschwitz, Dachau, Treblinka, among others.
We might also mention the American Civil War and the American Revolution.
Taking down Napoleon might count too.
Re: (Score:2, Insightful)
All the "grand causes" you cite as fixed by wars, were casused by wars.
Re: (Score:1)
Ask that of the survivors of Auschwitz, Dachau, Treblinka, among others.
Try asking an Iraqi or Afghani what war bought them.
Sorry if this dulls your giant hard on for violence, but war caused more human misery than it has ever solved. Ask the dead if they accomplished anything, silence is the answer.
Re: (Score:2)
Say it, say it, say it again!
Re: (Score:1)
Re:It's an.... (Score:4, Informative)
That is like an official coming out and saying that some new Drone over in Iraq that can be taking control over by yelling your name and location into radio ch-4.
No. We have no reason to think it's anything like that.
The important takeaway is that the Navy is actually checking their shit. The deficiencies in network security were found by Navy pen testers, determined to be "not severe enough to prevent the deployment", the results are classified, and they're working on improving them.
That's how things get done. Test and improve, all the time, because no part of any complex system is, or ever will be, perfect.