Slashdot Mirror

If one resercher sitting at his desk can take down the whole hospital system accidentally just by "overusing" the network, it's just a matter of time.

Much as I dislike NT, especially in critical environments, this problem had nothing to do with NT. It had everything to do with bad coding.

As we all know, information systems are only as smart as people make them. In the case of the USS Yorktown, an admin/operator entered data which caused a divide by zero condition in the application. Because the application did not have any exception handling built into it for a divide by zero condition, it died.

You can't blame the OS for this. The application should have had exception handling built into it in a couple of places. It probably should have checked any new entries before comitting them to ensure the new data would not introduce such a condition, and the app itself should have had appropriate error handling to prevent a panic/dump when a divide by zero condition was encountered.

If the app was coded by the same people on another platform, the end result would have been the same.

this to happen again.

Also look how hooked on MS marketing they are. Although Unix is more reliable, Redman said, NT may become more reliable with time. Personally, and for my tax dollars, I'd like to see the most reliable system available used, regardless of how reliable it may be in the future. It would keep people safer and probably would reduce the chances of our cruisers being crippled.

• Backhoe Event Cuts East Coast Internet Artery
• Unscheduled Outages Monday March 27

Of course, by "open" I mean non-DRM. I mean, come on, no sane military would trust its computing needs to a system with secret source code, proprietary undocumented file formats, and remote-control licensing, any one of which could stop things in mid-flight.

Oh, wait...

The US Naval Academy is participating in this contest. Their vehicle is powered by ... a pc104 running Windows 98...

Some people might say that the navy hasn't learned anything from the past...

You are the one who claimed security and open source go hand in hand. But apparently they don't.

I never said OSS is a guarantee of security. My stance is that open source allows security and stability to be easier to implement than closed source. Unless you include obscurity as a security measure, which I don't.

It means that there is no open source software that is certified for use in some of the most security-conscious environments, despite your insistence that open source development must lead to more secure software.

Yeah, and NT4 was certified to the point where it could not be connected to any network, must have no removable media and have the POSIX layer removed! Software gets certified through payment for that certification. Who has paid to have a free BSD or a Linux distro certified? Lack of this does not show lack of security.

The point is, what is the cost of having your network go down once every so often,

It's not just network downtime, it could be corporate IP loss or exposure, public embarassment, loss or exposure of customer property leading to liability, etc.

versus lacking all the features Outlook & Office provide in the mean time.

People and companies serious about security, who use MS products for example, end up disabling and avoiding many of these "features".

Well, tell me about it. This is all about sharing, right?

I actually do read through source, along with books like Applied Cryptography (I've been into digital electronics since the 80's, starting with Navy Weapon systems) and have an unhealthy interest in building hardware pseudo random number generators. I read the source because I am interested. I didn't find the hole because software security is not my forte, but I am but one person. Someone did find the hole, which is easy to close.

No, it was perfected via painstaking attention to detail. In all those years nobody ever found the bug, which pretty much kills your "hundreds of thousands of eyes" theory.

But it was found, outside of the OpenBSD developers. We are looking at a single uncommon incident here too. Though the hole is uncommon, the discovery, quick workaround and subsequent fix is not.

Here's a single incident that also proves nothing... Windows NT Cripples US Navy Cruiser

My stance is that open source makes finding and fixing bugs easier and I have seen it first hand as a beta tester of open source video card drivers. Where people outside of the developers where submitting code or pointers to broken code. John Carmack made an extended visit to our list, fixed code and made the drivers faster. He was not invited personally, he just dived in to open code. Something he or anyone else would not have been able to do if they were not a part of it as a closed source project. I've heard he did this for other cards which have open source drivers also.

"The ship had to be towed into the Naval base at Norfolk, Va., because a database overflow caused its propulsion system to fail, according to Anthony DiGiorgio, a civilian engineer with the Atlantic Fleet Technical Support Center in Norfolk."

Find the complete article here: Windows NT Cripples US Navy Cruiser.

So, closed source, anyone ? :-)

...point to their software's excellent track record with the DoD.

I seem to remember a prior experience the navy had... I think it involved something like an aircraft carrier or some huge super-battleship or something of the sort -- whatever it was, the ship was big and had a lot of people on it.

I remember the story being something like all the ships computers were running some sort of windows NT, which crashed horribly -- in the middle of the ocean -- and effectively turned the ship off. I can't remember the solution to the problem, but I sure do remember laughing a lot.

Seems like someone at the pentagon should have the balls to turn around to MS and say something along the lines of "Yeah? Well, remember the USS Whatever incident?" the next time they call. That should shut 'em up. (either that or "Yeah, but now it crashes all the vital systems TWICE as fast!")

oh, I just found the link... it's an AEGIS cruiser, back in 1997...

At least with an open source system, they could have patched the code and moved on. But with the closed source Windows NT system, the USS Yorktown had to be towed into harbor and let the boys from Redmond check under the hood.

Thank God it was peacetime..

Wasn't Microsoft already shown to be a threat to
national security?

Way back in May of 2000:

http://www.info-sec.com/internet/00/internet_05150 0b_j.shtml

The Yorktown lost control of its propulsion system because its computers were unable to divide by the number zero, the memo said. The Yorktown's Standard Monitoring Control System administrator entered zero into the data field for the Remote Data Base Manager program. That caused the database to overflow and crash all LAN consoles and miniature remote terminal units, the memo said.

"If you understand computers, you know that a computer normally is immune to the character of the data it processes," he wrote in the June U.S. Naval Institute's Proceedings Magazine. "Your $2.95 calculator, for example, gives you a zero when you try to divide a number by zero, and does not stop executing the next set of instructions. It seems that the computers on the Yorktown were not designed to tolerate such a simple failure."

As harried parents scrambled in the weeks before Christmas to get their hands on these homely, high-tech cyberpets that supposedly repeat what they hear, the supersecret spy agency put out a "Furby Alert" on its internal intranet in early December and banned the Furby from Fort Meade.

"Personally owned photographic, video and audio recording equipment are prohibited items. This includes toys, such as 'Furbys,' with built-in recorders that repeat the audio with synthesized sound to mimic the original signal," the Furby Alert warned NSA workers. "We are prohibited from introducing these items into NSA spaces. Those who have should contact their Staff Security Officer for guidance."

Sig: What Happened To The Censorware Project (censorware.org)

Even the navy rely heavily on NT and...you get what you pay for.

The Yorktown lost control of its propulsion system because its computers were unable to divide by the number zero, the memo said. The Yorktown's Standard Monitoring Control System administrator entered zero into the data field for the Remote Data Base Manager program. That caused the database to overflow and crash all LAN consoles and miniature remote terminal units, the memo said.

I'm sure he was just checking up on bugs "hey what if I feed this thing a zero" when he suddenly rendered a 2billion dollar ship virtually defenseless and without propulsion. Something a 2.95$ calculator would avoid.
Oops.

Large UPS's are almost always SNMP Rev1 Managed. No security. Add that plus the recent spate of attacks on high-level security providers who use unsecured SNMP...

Yes, it really is just a f%*kup waiting to happen.

See Windows NT Cripples US Navy Cruiser for a story from 1998 on the Yorktown
"Blame it on the OS"
"But according to DiGiorgio, who in an interview said he has serviced automated control systems on Navy ships for the past 26 years, the NT operating system is the source of the Yorktown's computer problems. NT applications aboard the Yorktown provide damage control, run the ship's control center on the bridge, monitor the engines and navigate the ship when under way."
"Using Windows NT, which is known to have some failure modes, on a warship is similar to hoping that luck will be in our favor," DiGiorgio said.
"Pacific and Atlantic fleets in March 1997 selected NT 4.0 as the standard OS for both networks and PCs as part of the Navy's Information Technology for the 21st Century initiative. Current guidance approved by the Navy's chief information officer calls for all new applications to run under NT."
[snip]
"Although Unix is more reliable, Redman said, NT may become more reliable with time."
"The Navy is moving the service's command and control applications from Unix to NT as part of IT-21. Under IT-21, the Navy also plans to modernize ships in the Atlantic and Pacific fleets with asynchronous transfer mode LANs. Large ATM networks running NT have already been installed on the USS Abraham Lincoln and USS Essex."

Um, hate to break it to you, but how the hell do you hack a system that's on a ship and self contained? everyone's talking about virus this and worm that, who gives a crap? my guess is that the ship's navigation systems are secluded from anything that would have outside access.

what i'm guessing he wants to know is something more along the lines of this.Windows NT cripples US Navy Cruiser

in which case, he's really asking which software/OS is the least likely to puke and leave you up a creek without a paddle.

Backup systems have to be in place, and why captains have to be able to navigate manually. Just like how yachts have to have motors in case sails break, etc... and to be able to safely navigate in ports.

The threat of virii could be minimal because the physical security of the ship's navigation systems should be locked down. No internet access, no floppy disk drives, closed systems, etc.

However, there have been failures. I remember a Navy Submarine running Windows NT or something, and it crashed (the OS, not the sub). They had backup systems, of course, but they looked pretty stupid. Windows NT Crash on Navy ship

The key point here is that you can test systems anyway : running for long periods of time, checking memory leakage, hardware failure periods, etc... and bugs that come up are corrected for free, usually, when you're talking about expensive navigation systems.

Sure, you can lose money for being out of action for a few hours, but that could happen due to any number of other mechanical failures too, so you just calculate some kind of percentage chance of failure based on past history of the navigation system?

Too bad that idea has been around since the 70's. Read Cyberpunk's third chapter on RTM (Robert Tappan Morris), or follow this link I just found: http://www.info-sec.com/viruses/99/viruses_061599a _j.shtml .

I know you slashdotters are gonna love this one

We lost then and I hate vodka. Do the russians have any other liquor of significance?

Do the people who get first posts ever use correct grammar and punctuation? the phrase "I didn't just wanted" does not make sense. Perhaps you missed a comma?

And back to the topic on hand...

The laws of quantum mechanics dictate that it provides a way to guarantee that no-one has intercepted that key

Cool. That's half the insecurity problem solved. Or is it? In cryptography are most breaches caused by keys not being kept secure, or by algorithms being cracked?
When DES was released, didnt they say it would never be cracked? Well look what happened there. In fact, it's been done several times now.

Never say Never.

no, but sometimes software failures lead to major catastrophes. have you read a book call the gift of fire? did you hear about the navy ship that was disabled by a glitch? software problems can cause much more than an annoyance! in some cases people were killed!

Of course the military uses external software. It's my understanding that the Navy has even standardized on NT. I really haven't heard of any branch custom creating OSes that they then widely depoly, though I could be wrong.

If I recall correctly, there was even a notable Navy incident a few years back due to buggy Microsoft software... ah here it is: Navy Smartship "crashes" while running NT.

Here's an interesting article that mentions some steganographic pictures hidden on some ebay auctions! Bin Laden at work? ;-)

NSA, Pentagon, Police Fund Research Into Steganography

Hmmm... as a Canadian, I seem unable to recall the last time our government ever had a problem with the exporting and/or use of encryption by the general populace.

In fact, check out OpenBSD, or JAWS technology. Also, check out this article which gives a pretty decent overview of the electronic information policies of various countries.

I think you mean "Americans", our southerly neighbours.

-- kwashiorkor --
Leaps in Logic
should not be confused with

Now, I'm no expert, but a quick Google search turned up the following things, which may or may not be of any use as prior art.

'It was here a minute ago!' - Archiving on the Net - Part 1 of 2: "The Internet Archive [http://www.archive.org/] ... also uses an 'MD5 checksum' to compare new pages with old ones." The article is copyright 1997, and the Archive has been crawling since 1996.

IBM Agent Building Environment Developer's Toolkit: this manual, also copyrighted 1997, is documentation for using IBM's Java-based toolkit for writing automated agents, say, page-comparing and caching agents. Conveniently enough, they provide the following function: CheckMonitoredPagesForChanges, which states, "This effector will check all the web pages on the monitored-pages list for changes in the page... This function uses a checksum method against the content of the HTTP request to 'compare' the page content. Any difference in the checksums, or any change in the Last-Modified date in the HTTP header (if it exists), will cause a 'change' to be detected."

WebGUIDE: Querying and Navigating Changes in Web Repositories: This is an AT"T research paper. "The AIDE version repository is a centralized service that archives versions of pages... AIDE maintains a relational database containing meta-data about each page, each user, and the relationships between them. For each URL, it stores the following (among other information): Last modification date: This is used to find pages that have been modified since a user saw them... Checksum: This is used in case the last modification date is unavailable." This document is copyright 1993, 1994.

Another interesting note, is that Puma started out making synching software. They didn't acquire NetMind, what I'd gather would be the impetus for this patent, until 2000, over six years after that last AT"T URL, and PumaTech was founded.

--Vito

Consider the passphrase, for instance - much less entropy in a typical PGP pass phrase than in the key itself.

Or, how about advances in machine factoring a la TWINKLE.

If it's bugs you want, try the infamous ADK bug that went undetected for 3+ years, allowing third parties access to cleartext, a-la escrow.

Or the randpool bug of 1995?

I'd go on, but I'm bored of trying to pull heads out of sand.

-Isaac

-Isaac

I was unable to find a description of the JAWS algorithm on the JAWZ website (JAWS Home Page), now that they have become a security consulting firm. The best I could find was a small redaction of the original JAWS claims here: 4comm DataEncryptor.

I wonder if anybody still has a copy of the original JAWZ claims (quite a hoot).

Yes, they have. In fact, they've gone quite a long way, much further than was needed to pacify French businesses. As a result, they've changed from being one of the most oppressive countries in Europe with regards to encyption, to one of the most liberal. See http://www.info-sec.com/cr ypto/99/crypto_020699a_j.shtml.

They converted from HP-UX to NT for ship operations and the system crashed during sea trials. See it here