Pentagon's New Next-Gen Weapons Systems Are Laughably Easy To Hack (zdnet.com) 93
An anonymous reader quotes a report from ZDNet: New computerized weapons systems currently under development by the U.S. Department of Defense (DOD) can be easily hacked, according to a new report published today. The report was put together by the U.S. Government Accountability Office (GAO), an agency that provides auditing, evaluation, and investigative services for Congress. The report detailed some of the most eye-catching hacks GAO testers performed during their analysis: "In one case, it took a two-person test team just one hour to gain initial access to a weapon system and one day to gain full control of the system they were testing. Some programs fared better than others. For example, one assessment found that the weapon system satisfactorily prevented unauthorized access by remote users, but not insiders and near-siders. Once they gained initial access, test teams were often able to move throughout a system, escalating their privileges until they had taken full or partial control of a system. In one case, the test team took control of the operators' terminals. They could see, in real-time, what the operators were seeing on their screens and could manipulate the system. They were able to disrupt the system and observe how the operators responded. Another test team reported that they caused a pop-up message to appear on users' terminals instructing them to insert two quarters to continue operating. Multiple test teams reported that they were able to copy, change, or delete system data including one team that downloaded 100 gigabytes, approximately 142 compact discs, of data."
The report claims the DOD documented many of these "mission-critical cyber vulnerabilities," but Pentagon officials who met with GAO testers claimed their systems were secure, and "discounted some test results as unrealistic." GAO said all tests were performed on computerized weapons systems that are still under development. GAO officials highlighted that hackers can't yet take control over current weapons systems and turn them against the U.S. But if these new weapons systems go live, the threat is more than real, GAO said.
The report claims the DOD documented many of these "mission-critical cyber vulnerabilities," but Pentagon officials who met with GAO testers claimed their systems were secure, and "discounted some test results as unrealistic." GAO said all tests were performed on computerized weapons systems that are still under development. GAO officials highlighted that hackers can't yet take control over current weapons systems and turn them against the U.S. But if these new weapons systems go live, the threat is more than real, GAO said.
Re: Gee, good thing they didn't open source any of (Score:5, Interesting)
No, no, fuck you, and no.
This is a horribly bad approach to security. You're making assumptions about the external environment, and using them to excuse system vulnerabilities. That's not realistic or intelligent. It's just lazy.
Lets not forget the anti hacking. A bullet in the head of the traitor.
That's assuming you can find a traitor. If the system logs aren't secure, or if their integrity is questionable, or if they don't uniquely identify an individual, you have no hope of identifying exactly who attacked the system.
Systems in development are not complete
So? Security isn't something to be bolted-on late in the development process. Systems should be secured first, then the functionality is applied on top of that. If that means you have to use more-costly (but more secure) solutions in your design, so be it. When functionality comes before security, management is far too justified in saying "but we've spent too much already developing this insecure system!" and refuse to reimplement it securely.
For a related example in the public sector, we're almost done implementing HTTPS, after only 10 years or so...
Systems are in very high security locations, especially when deployed
At first, maybe... then a truck gets ambushed, or a base is overrun, or we get an impulsive politician who promises an arbitrary date to get out of an unpopular conflict area. Then those systems fall into enemy hands, and you just have to hope that it's a useless pile of hardware by then.
Systems are surrounded by many soldiers
Soldiers are underpaid, overworked, and usually focused on things other than countering highly-technical intelligence techniques. If an attacker walks onto a base, steals classified data (or even whole systems), and tries to leave, they'll be saluted at the gate as long as their paperwork looks right.
There is no valid excuse for leaving a system insecure by design. Every layer of the system should be built securely, with the functionality added afterward.
Re: (Score:3)
If an attacker walks onto a base, steals classified data (or even whole systems), and tries to leave, they'll be saluted at the gate as long as their paperwork looks right.
This!, even a moderate physical secure systems need to be secured. Everyone assumes everyone else is doing what they are suppose to, and question only when they are suppose to, and wouldn't know otherwise.
Re: (Score:3)
Re: (Score:2)
Exactly this .. I was previewing my exact comment on that - it's a sign that GAO are measuring storage in compact discs, still. Welcome to the 1990s?
Re: (Score:2)
During the era of dead tree publishing the unit was the "Encyclopedia Britannica".
Re: GB vs. CD (Score:2)
CDs (Score:1)
It's because with no conception of storage sizes obviously are completely aware that a CD holds 650/700MB.
At least the comparo isn't 'songs'. Love me do long? Or day in the life long? 128kb/s MP3 or 44k1 s/s WAV?
Re: GB vs. CD (Score:1)
With our new blistering fast broadband options you can see speeds up to 0.17857142857CDps!
Comment removed (Score:5, Insightful)
Rational risk/reward calculations (Score:5, Insightful)
To be fair, managers are more likely to be rewarded for delivering a sufficient product on time than ensuring proper safeguards. A missed deadline will almost surely be noticed and put on them, while slipshod security has roughly a 1 in 10 chance of showing its head during a manager's actual reign. (The marketing people negotiated the contract, not the project manager, and the marketers often under-bid to win.)
They are behaving "rationally" in terms of their OWN risks versus rewards. The managers are following the carrots and sticks which are actually applied to them like donkeys would.
It's kind of like debt and pensions versus politicians: they won't likely be in office anymore if they muck either of those up bad enough for the public to notice, so they give short-term handouts instead, dumping the long term problem onto the future. In the future, you will hear, "I didn't do it, my predecessors did."
Re: (Score:1)
Re: (Score:2)
There's only so much inspection-by-checkbox can do. The actual source-code would have be carefully read (and understood) for a good inspection, and that cost is probably more than most want to pay. (A compromise might be random spot checking.)
Re: (Score:1)
To be fair, managers are more likely to be rewarded for delivering a sufficient product on time than...
The ellipses at the end seemed appropriate, since you can fill in the blank.
In short managers, like politicians of late, particularly on the R side are more than happy to burn ethics to fuel their futures, even if the world burns, and a lot of people are happy enough to go along with it, particularly if at the end of it is something they really wanted.
Is it even possible to teach ethics such that people are truly ethical? I'm doubtful. The hard right seems to have found a way around many of those religiou
Re: Rational risk/reward calculations (Score:3)
The foundations of Trump's rise to power were laid by both parties. Taking people's futures from them and telling them it's their own fault was never going to end well.
Re: (Score:2)
I can personally vouch for that, except I'm not expensive, just ignored. People in general do NOT like accurate news. They prefer hearing what they want to hear. It's partly why the country is polarized: it's easier to find sources now that tell you what you want to hear.
People actually like fake news: they just kvetch about o
Re:Rational risk/reward calculations [correction] (Score:2)
Correction re: "they won't likely be in office anymore if...
Corrected version: ...they won't likely be in office down the road. If they muck either of those up bad enough for the public to notice, it will probably be after their reign. Therefore, they give short-term handouts instead, dumping the long term problem onto the future.
Re: (Score:3)
The managers are following the carrots and sticks which are actually applied to them like donkeys would.
That says it all, really.
For better results, a good start would be appointing managers who are smarter (and more moral) than donkeys.
If they can find any.
Re: (Score:1)
They set up a front company in the USA with a few staff who have the needed security clearances and the needed legal team.
The actual products and services then get done in the low cost nations with just enough final US oversight to win a bid.
Nobody knows who is making what, who worked on what computer system.
The result is products and services from deep in the EU, China getting passed as from a US company.
Re:What? (Score:5, Interesting)
This smells like the result of MBAs ignoring engineers...
It is worse in the military, because communication is inherently unidirectional, and they can go years between real world validations (i.e. wars).
"War games" are setup by the same people that are being tested, so if they fail the test, they can just change the rules and have a do-over. This famously happened during the run up to the 2003 Iraqi invasions, when opfor was repeatedly banned from using unconventional tactics, such as underage bicycle messengers and roadside bombs, because that was "unrealistic".
I had personal experience with this nonsense when I was a young lieutenant. I was part of the Red Team (opfor), and we were hopelessly out numbered and out gunned since we were playing "insurgents". So we decided to go asymmetric ... and cut off the Blue Team's water supply. I was told that wasn't allowed, and to turn it back on immediately. So then we set up road blocks that targeted their chow trucks. Nope, that wasn't allowed either.
But we were permitted to launch a hopeless frontal attack directly into their entrenchments, which we did on the last day of the exercise so we could go home early. In the after-action critique, I can remember the colonel getting up and congratulating everyone on a job well done. That's when I decided a military career was not for me, and I am not surprised that America proceeded to lose several wars.
Semper Fi.
Re: (Score:3)
Re: (Score:1, Insightful)
Re: What? (Score:2)
Re:What? (Score:4, Insightful)
"That's because the purpose of wargames is to test systems and get people used to doing their jobs under stress"
Im genuinly curious, why do they call it war games then and not system testing?
Why do they not provide a procedure for the Red team to follow?
If not a procedure, why do they not provide limitations for the Red team?
I mean if the purpose is to test the systems under specific circumstances then why not lay those circumstances out ahead of time? If they do, then yes the previous poster that you replied to is an idiot for not following the rules of the game. If not, then isnt it someone else's fault that they didn't define the rules properly in the first place?
I mean if you go and tell me to perform action X (like attack a base) and then i perform action X, how can anyone call me an IYI if they didn't specify how they want action X done? wouldn't that mean that someone higher up the food-chain is the IYI by assuming that someone else would perform action X in a specific manner? To me it sounds like there were several IYI's in the scenario mentioned.
note: I do not actually know anything about war-games in the us military, so i am curious how these things are supposed to work.
Re: (Score:2)
Re: (Score:3)
joshua (Score:1)
just enter that as the username
s-h-a-l-l w-e p-l-a-y a g-a-m-e (Score:2)
Simple solution: (Score:1)
ban laughing.
Security as an afterthought (Score:5, Insightful)
GAO said all tests were performed on computerized weapons systems that are still under development.
You can't add security on as an afterthought. It needs to be a core feature.
Re: (Score:2)
Re: Security as an afterthought (Score:3)
Re: (Score:3)
You can't add security on as an afterthought. It needs to be a core feature.
Adding security in and of itself is dangerous. If the operator can't fire the weapon because he's locked out of the terminal, it is worse than not having that weapon there at all. Because you make your plans assuming the weapon is present, and when it won't work then your plans are fucked.
Military security comes from people walking around with guns and not plugging everything into the Internet.
Re: Security as an afterthought (Score:3)
Re: (Score:2)
If the safety disables the gun until a tech unlocked it, yes we should not have those.
If the safety is a simple lever that any half-sentient being can successfully operate under extreme stress, then have the safety.
Quid pro quo (Score:1, Offtopic)
Especially since Trump gave Putin and Netanyahu all the passwords.
Re: (Score:1)
PopeRatzo, one of the most legendary hate preachers and conspiracy theorists on Slashdot.
Re: Quid pro quo (Score:2)
You're losing your edge.
unit conversion help (Score:5, Funny)
Not archaic enough. I'm gonna need that in number of baskets of scrolls please.
Re: (Score:3)
So lets assume a bushel basket as that is fairly easily hand-held and a Torah scroll as a standard (still in use!) scroll. Well in that case your bushel (2150-2219 cu. in.) can hold right at two Torah scrolls (roughly 1100 cu. in. per scroll). Now the Torah scroll contains exactly 304,805 characters. If we use a standard 7-bit ASCII character set that's ((304805 * 7) / 8)/1024 = 260.453 KB per scroll, or 520.91 KB per basket.
Now 100GB is 104,857,600 KB so you would need 104,857,600 / (5
Something Something (Score:3)
Target audience detected (Score:3, Funny)
Probably the same type of people that call the internet AOL.
Re: (Score:2)
Bah, that's not even one football field of CDs.
Insiders though? (Score:5, Insightful)
Re: (Score:3)
That's really the dumb part of this story. These systems are air-gapped.
At that point, you have to decide if the air gap is enough or if you want to add more security. When making that decision, you have to consider things like "If we can't fire this when we need to because a certificate expired, we will die".
And "an operator could sabotage this" doesn't require hacking the computer. As you say, throw a wrench in it. Or unplug it. Or fill the operator's station with bullets.
Re: (Score:2)
Well, the fact that a single spy, working as a service member, could make the whole ship unusable. And with out methods to detect, deter, or catch the person doing this.
Now think of that single person, planting something that accepts remote (like via satellite phone, or even cellular if in port) can now remotely own these billion dollar weapon platforms.
So while physical is important, that physical should be protected, not just some random terminal on the ship.
Re: (Score:2)
Now think of that single person, planting something that accepts remote (like via satellite phone, or even cellular if in port) can now remotely own these billion dollar weapon platforms.
Now think about how they could do this even if you apply any security measures you can come up with.
"We kept him from hacking the phalanx system! Instead, he planted something that broke the engines, so the phalanx system is down because we have no power."
142 CD-ROMs = 65,636 1.44MB floppies! (Score:2)
More fun data conversions here: http://www.unitarium.com/data
The threat is "more than real" (Score:2)
Dangers of faith in any weapons tech (Score:3)
Blind faith in systems and strategy, just because you are heavily invested in it, will not necessarily save you [wearethemighty.com]
Most of the Responsibility Falls on the Pentagon (Score:3)
Re: (Score:2)
if the customer doesn't properly write in cyber as a requirement
There's a more important question: Is it proper?
Computerized gun turret. It is only connected to a network that goes to a small number of secure terminals, which are not connected to any other network.
Why do you need to encrypt that link? If you control physical access via people with guns, why do you need secure logins?
"We made this guy change his 16-character password every 2 months and he forgot it while getting shot at. Now he's locked out of the terminal due to three failed login attempts. The loca
they are secure (Score:2)
so only those with physical access can hack them, a remote user can't. nothing is secure from someone with physical access. someone with physical access could pour a gallon of locktite into the mechanism of a weapon too too.
non-news