Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Security The Military

The F-35's Greatest Vulnerability Isn't Enemy Weapons. It's Being Hacked. (popularmechanics.com) 137

Posted by msmash from the closer-look dept.
schwit1 shares a report: Every F-35 squadron, no matter the country, has a 13-server ALIS package that is connected to the worldwide ALIS network. Individual jets send logistical data back to their nation's Central Point of Entry, which then passes it on to Lockheed's central server hub in Fort Worth, Texas. In fact, ALIS sends back so much data that some countries are worried it could give away too much information about their F-35 operations. Another networking system is the Joint Reprogramming Enterprise, or JRE. The JRE maintains a shared library of potential adversary sensors and weapon systems that is distributed to the worldwide F-35 fleet. For example, the JRE will seek out and share information on enemy radar and electronic warfare signals so that individual air forces will not have to track down the information themselves. This allows countries with the F-35 to tailor the mission around anticipated threats -- and fly one step ahead of them.

Although the networks have serious cybersecurity protections, they will undoubtedly be targets for hackers in times of peace, and war. Hackers might try to bring down the networks entirely, snarling the worldwide logistics system and even endangering the ability of individual aircraft to get much-needed spare parts. Alternately, it might be possible to compromise the integrity of the ALIS data -- by, say, reporting a worldwide shortage of F-35 engines. Hackers could conceivably introduce bad data in the JRE that could compromise the safety of a mission, shortening the range of a weapon system so that a pilot thinks she is safely outside the engagement zone when she is most certainly not. Even the F-35 simulators that train pilots could conceivably leak data to an adversary. Flight simulators are programmed to mirror flying a real aircraft as much as possible, so data retrieved from a simulator will closely follow the data from a real F-35.
This discussion has been archived. No new comments can be posted.

The F-35's Greatest Vulnerability Isn't Enemy Weapons. It's Being Hacked. More

The F-35's Greatest Vulnerability Isn't Enemy Weapons. It's Being Hacked.

Comments Filter:

  • Lockheed takes this pretty seriously (Score:3)

    by raymorris ( 2726007 ) on Thursday November 15, 2018 @03:33PM (#57650586) Journal

    Lockheed takes the security of this system, and all of their weapons systems, pretty darn seriously.

    • Re: (Score:1)

      by Anonymous Coward

      So do Microsoft and Intel.

    • Proof?

      • With Glassdoor you can see them hiring a lot of experienced security professionals, and see what the pay is, along with the qualifications they expect of everyone working on the system.

        That's all from ONE open source intelligence resource, which anyone can see in less than 20 minutes.

        If you happen to be a 20-year career veteran in the security space, working 25 minutes Lockheed headquarters and hanging out with their engineers at ISC2 meetings every month, you can really get to know their security culture i

        • I get your point, but I also work with a bunch of guys that are, on the surface, very intelligent and professional. They make a lot of money, and they seem happy with their lives. However this in no way seems to help them make good decisions when it comes to very basic operations in the work environment. When it comes to egos and personal interests, those things tend to forbid common sense.

          Sometimes, here at work, I feel like our ticketing system runs the same course as slashdot discussions. And the

          • I figure management sets the overall tone and priorities, the culture. Management values security.

            Their people have the ability and interest to deliver security.

            So there is a pretty good chance that they do a good job. Lockheed isn't a customer of ours, so I haven't done a security audit of them. I do have enough information to make an educated prediction or hypothesis.

            Of course that's relative to other companies. We do have banks as customers, so I know how bad / good some banks are regarding security. Ove

            • Re: (Score:2)

              by pnutjam ( 523990 )
              I work for a small to midsize company that sells to enterprise customers. They are always poking at our security and making us do audits, normally in ways that degrade things.
              The open source stuff we use doesn't check their boxes and we end up shelling out for stuff that doesn't improve our security and adds another layer of integration (which of course degrades security).
              We're usually dealing with an HR style department so the hardest thing for companies to understand (aside from linux), is that security r
      • They're serious about software update security, I've seen the manual, it's just:

        curl -sSL https://firmware-upgrade-f35.lockheed.com/ | bash

        As you can see, they use SSL, so it's perfectly safe.

    • China has an aircraft that is said to be a copy of the F35. The plans for the F35 should be better protected than the Alis data, since they don't need to be remotely accessed.
    • The problem isn't Lockheed's seriousness; the problem is Lockheed.

    • Re: (Score:2)

      by rtb61 ( 674572 )

      Obviously the idiot countries buying the F35 flying pig, take their defence a whole lot less seriously. WTF? a US corporation can control all F35s at all times, put them straight out of the air if it wants to. You totally dumb fuckers, you are not buying aircraft you are renting them, wait until the next model comes out, the current model will fall out of the sky like nobodies business. Seriously what are you stupid fuckers thinking.

    • Lockheed takes the security of this system, and all of their weapons systems, pretty darn seriously.

      Then how did this happen? https://en.wikipedia.org/wiki/... [wikipedia.org]

      • We don't know how that happened, unfortunately. We do know the Iraqi air force had Russian-built fighter jets, so they certainly have the ability to shoot an aircraft down. They have have aerial refueling capability, the ability to fly precisely next to another aircraft and give it fuel, or even drop a cargo net on it.

        The primary navigation system is inertial guidance, explicitly because spoofing GPS is pretty easy, so GPS spoofing wouldn't be a possibility that would be expected to work.

        It *could* have had

  • Greatest? (Score:5, Insightful)

    by mi ( 197448 ) <slashdot-2017q4@virtual-estates.net> on Thursday November 15, 2018 @03:42PM (#57650652) Homepage Journal

    The F-35's Greatest Vulnerability Isn't Enemy Weapons. It's Being Hacked.

    Although we should not discount the danger of such hacks, I doubt, it is the greatest vulnerability of the weapon.

    TFA goes to great length explaining the potential dangers, but offers no justification for using "the greatest" in the title... Seems like a cheap sensationalism...

    • Re: (Score:3)

      by PPH ( 736903 )

      Not by a long shot. The greatest vulnerability would be fueling an F-35 from a truck painted something other than white.

    • How can you hack something that doesn't even always run as it is? Did ALIS suddently start working and become highly available? Last I heard....not so much.
      You gotta fly before you can crash. (but you can burn without flying!)

    • Re: (Score:3)

      by Nidi62 ( 1525137 )

      The F-35's Greatest Vulnerability Isn't Enemy Weapons. It's Being Hacked.

      Although we should not discount the danger of such hacks, I doubt, it is the greatest vulnerability of the weapon.

      TFA goes to great length explaining the potential dangers, but offers no justification for using "the greatest" in the title... Seems like a cheap sensationalism...

      Right now the biggest danger to the F-35 fleet are pilots passing out due to oxygen flow issues.

    • it is the greatest vulnerability of the weapon.

      Nope, that would likely br gravity. Pedantic much?

  • A non-story (Score:5, Insightful)

    by Sarten-X ( 1102295 ) on Thursday November 15, 2018 @03:46PM (#57650706) Homepage

    TFA reads like FUD. If I were trying to sell my services as a cybersecurity contractor, this is the kind of crap I'd write. Essentially, it boils down to "complexity is bad", and "wireless is scary".

    I've worked defense contracts. They're always trying to "shore up vulnerabilities", and always making a big deal about every tiny detail that isn't perfectly in compliance with a rule written for an entirely-different scenario. Exceptions are the norm. That doesn't mean the system is actually vulnerable to any attack, or even that a possible attack would be successful.

    Now, I'm not suggesting that anyone stop looking at security, especially in such important systems... I'm just saying that shouting about generic insecurity doesn't improve anything, and in fact makes things worse by encouraging a checklist-based approach to compliance.

    • Re:A non-story (Score:4, Interesting)

      by Drethon ( 1445051 ) on Thursday November 15, 2018 @04:28PM (#57651006)

      TFA reads like FUD. If I were trying to sell my services as a cybersecurity contractor, this is the kind of crap I'd write. Essentially, it boils down to "complexity is bad", and "wireless is scary".

      I've worked defense contracts. They're always trying to "shore up vulnerabilities", and always making a big deal about every tiny detail that isn't perfectly in compliance with a rule written for an entirely-different scenario. Exceptions are the norm. That doesn't mean the system is actually vulnerable to any attack, or even that a possible attack would be successful.

      Now, I'm not suggesting that anyone stop looking at security, especially in such important systems... I'm just saying that shouting about generic insecurity doesn't improve anything, and in fact makes things worse by encouraging a checklist-based approach to compliance.

      I don't know how the F-35 handles network security, but I found this a fascinating read for network security for a military UAV prototype helicopter: https://journals.plos.org/plos... [plos.org]

  • I did not know that F35 were considered IOT devices. Any one has a link to live webcam?

  • I wonder if I can use Shodan to find F-35s (Score:4, Funny)

    by sinij ( 911942 ) on Thursday November 15, 2018 @03:53PM (#57650746)
    I wonder if I can use Shodan to find F-35s?

    • I wonder if I can use Shodan to find F-35s?

      You COULD, but they're not there if you look, only if you ping. And if it's flying greater than Mach 1 even that'll be in the wrong place. ;-)

  • It's greatest vulnerability? Its own cost.

    At $85 million per plane, that probably resulted in several hundred aircraft that were supposed to be purchased, never being bought - far more than will ever be brought down in combat.

    • It's greatest vulnerability? Its own cost.

      At $85 million per plane, that probably resulted in several hundred aircraft that were supposed to be purchased, never being bought - far more than will ever be brought down in combat.

      The only comparable Fighter is the Advanced Super Hornet F/A-18F and Boeing is pricing it at $80 million. Not exactly tremendous savings

    • Re: (Score:2)

      by sycodon ( 149926 )

      The planned acquisitions is in the thousands (2,443).

      The more that are bought the cheaper they become as sunk costs are recovered.

    • It's not $85 million. The current design has hundreds of critical flaws that must be fixed, and Lockheed won't do that for free. Expect to pay another $100 million for repairs to get a working aircraft.

    • Our military has traditionally accepted "ahead of the curve" jet designs, expecting that manufacturing and technology will eventually catch up. The theory is that you have to stay at least one step ahead of the enemy, otherwise your kill ratio will be close to 1-to-1.

      While this philosophy has mostly worked, it has hippucced from time to time. The F-35 may be one of these hiccups.

      For example, our planes had difficulty during the early phases of the Vietnam war because it was felt that air-to-air missiles wou

      • improved training in "team based" tactics

        NAS Miramar...

      • For example, our planes had difficulty during the early phases of the Vietnam war because it was felt that air-to-air missiles would render dogfights obsolete, and our planes were designed with this assumption in mind

        Note this is also the assumption of the F-35 design.

        • Missile guidance systems have gotten better and better with every decade. Flares can still confuse some dirt cheap systems, but how do you fool a well designed phased array radar? It is not the 80s anymore: Russia and China have access to excellent computer technology to build their guidance systems with. What they sell to the highest bidder today is both more lethal and cheaper than

          The bigger question is whether a big expensive craft carrying a pilot makes sense when you might have better mission capabi

          • It makes sense still to have a pilot because larger countries have the capability to jam GPS and other wireless signals.

      • The ahead of the curve design is a euphemism for 'far too long development cycle'. In a rapidly changing environment it does not make sense to try and look decades ahead. In a short development cycle you can be allowed to have duds. Long development cycles are too big to fail.
        With the F35 the all-in-one approach exacerbates those weaknesses. The development process becomes bigger and the compromises become bigger.
        Except of course if you consider that these things are built to make money but not ment to be u

  • Crash and Burn (Score:2, Offtopic)

    by PopeRatzo ( 965947 )

    What we spent on these stupid fucking planes that we're never going to use would be enough to pay for universal health care AND shore up social security for decades to come.

    I mean, as long as we're borrowing the money anyway, can we please invest it in people and not dumb shit?

    • Unless they get hit on the ground, they'll see use.

      Unfortunately.

  • Power Mac G4s in the Sky. (Score:5, Informative)

    by 0100010001010011 ( 652467 ) on Thursday November 15, 2018 @04:20PM (#57650940)

    It's more or less a PowerPC G4 right down to the Firewire bus.

    Components were billed as "COTS". However those chips were still back when they were Motorola/Freescale

    The system departed from the historical use of low speed Mil-Std-1553B busses, using the high speed Fibre Channel-Avionics Environment (FC-AE) serial bus for high speed internal interconnects.

    built around PowerPC RISC processors - essentially a bigger and faster cousin to the 6U VME packaged PowerPC processors now being used in F-15E, F/A-18E/F and F-111C Block C-4.

    "So we have designed for technology refresh, so at the appropriate time we can stop putting in the 1 GHz processor board and swap out to the 2 GHz board without having to go back and do any redesign. We were once required to use a MIL-STD-1760 processor with Ada or other military languages; now we use commercial PowerPC with C++."

    http://www.ausairpower.net/APA... [ausairpower.net]

    https://www.militaryaerospace.... [militaryaerospace.com]

  • Slashdot cannot be the first to consider all this (Score:3)

    by Aristos Mazer ( 181252 ) on Thursday November 15, 2018 @04:21PM (#57650954)
    I find it impossible to believe that this is the first time any of these concerns have been brought up. Lockheed has a lot of very savvy and security-conscious engineers. Yes, the networks might be vulnerable to hacks. The question is whether that risk downside is worth the upside of these highly networked machines (say, avoiding friendly fire). I don't know what those tradeoffs are, but this article lacks any analysis of why these security risks were considered acceptable and what is done to mitigate them. Without that balancing content, this is just FUD and useless blather.

  • JRE? (Score:3)

    by cormandy ( 513901 ) on Thursday November 15, 2018 @04:28PM (#57651016)
    The f15 was programmed using Java?????

  • Give me an A-10 anyday (Score:4, Insightful)

    by neo-mkrey ( 948389 ) on Thursday November 15, 2018 @04:51PM (#57651160)
    "It Just Works"

  • Yeah can't EVER get down to visual range or it will get bagged by a $100 MANPAD or a 12.7 MM machine gun.

  • Over teched (Score:2, Interesting)

    by Anonymous Coward

    I think were developing stuff that is over teched to a point of being fragile in a way. Especially in military environments you have to wonder how these incredibly technical machines can ever survive a war?

  • "As the plane finally reaches full production, the Air Force is racing to plug holes that could allow hackers to exploit the jet's connected systems—with disastrous results".

    Major fail.

    Security cannot be added like a bag on the side, as an afterthought. Since Mr Mizokami evidently thinks it can (as far as one can judge from his breathless prose) it's pretty obvious he doesn't know much about software or security.

  • so that a pilot thinks she is safely outside the engagement zone when she is most certainly not

    She? Considering that very few women have the physical aptitudes to become fighter pilots, considering that men will always be the best fighter pilots, I think the pronoun "he" should be used here. Seriously, can feminists stop trying to shove their crap down everyone's throat?

  • Info-cartoon highlight:
    "The system is unique because each user helps improve the system for others."

    Wouldn't it be great if you could write messages to other users:
    "Hi infidels. So glad we're finally using the same technology as you now. We've submitted so much feedback on the system but we've noticed maybe you need to contribute more. Perhaps we could get together over a coffee sometime? Lots of love, (insert evil dictator here)"

    I just love this. It seems like something that was specifically designed by a

Slashdot Top Deals

FORTRAN is not a flower but a weed -- it is hardy, occasionally blooms, and grows in every computer. -- A.J. Perlis

Close