Slashdot Mirror
DARPA Cyber Range Project Doomed to Failure
carusoj writes "Former black-hat hacker Noah Schiffman details why DARPA's National Cyber Range project is bound to fail. The NCR is proposed as a simulation of the Internet, including replicating 'human behavior and frailties.' Schiffman argues that if the Defense Department is really building something of this scope, it might as well use the actual Internet."
Won't they be learning valuable lessons even if they fail to meet their mission objectives?
This is the sort of thing for which DARPA built arpanet in the first place. They're probably pretty miffed that they can't use their own testbed because it proved so useful after the fact
If I had a simulation of the entire Internet, it'd be all over for me. I mean, there would then be absolutely no reason for me to leave my house. I'd just sit inside all day playing with this simulation of the Internet.
Fascism trolls keeping me up every night. When I starts a preachin', he HITS ME WITH HIS REICH!
On the other hand, by using the internet, the powers that be wouldn't be able to rig or dumb down any tests so that they succeed. Like they did with some of the Star Wars tests. Useful when justifying budgets to Congress.
30 billion dollars = 60 million PCs with decent processors to take care of pretty mcuh any cyber war they want.
Sigs are too short to say anything truly profound so read the above post instead.
They (DARPA) Can't test for every outcome at once, but they could and most likely will get valuable information when they test for well defined attacks.
Saying that a simulated Internet for cyberwaarfare (note the new meme!) has no point is like saying a simulated Earth has no point for studying global warming. To effectively study you need controls and variables. Having real controls on the actual Internet is impossible, not to mention the fact you'd be vulnerable to surveillance.
I also find it interesting to find that people say a realistic simulation is impossible, while in the same breath complaining this project costs too much. $30 Billion obviously won't get you 100% there, but I'll bet it'll get you there with 95% confidence. Yeah, I suppose you could argue that because that 5% exists, the project has no meaning, but any engineering effort has a little slack in it. If history is any indication DARPA should do a fairly good job at managing that risk.
If you can read this... 01110101 01110010 00100000 01100001 00100000 01100111 01100101 01100101 01101011
With a simulation you can always try out various senarios from the same starting condition. Which on the real Internet would be impossible. As to the cost of building said simulator being as the net itself is 'well' documented and is in essence all software then building a simulator should be no problem. It is certianly not a $30B project. Unless of course the Government and its favorite contractors are involved.
Undetectable Steganography? Yep, there's an app fo
Nothing in the solicitation has a $30 billion price tag on it. No idea where that number came from. There are no dollar amounts at this stage; DARPA is soliciting bids.
What DARPA is asking for is a 10,000 node Internet simulator, and that's in the final phase. The whole system can be started, stopped, and flushed to a clean state for new tests. Users are simulated: "Replicants will simulate physical interaction with device peripherals, such as keyboard and mice. Replicants will drive all common applications on a desktop environments." Attacks on the network are supported; the vendor even has to provide a "malware library".
The simulated machines have to be simulated at a fine level of detail. "The NCR must be capable of taking a physical computer and rapidly creating a functionally equivalent, logical instance of that machine that can be replicated repeatedly and injected into a testbed. Given a never-before-seen physical computing device, create logical instantiations of the physical native machine that accurately replicates, not only the software on the machine, but hardware to the interrupt level, chipset, and peripheral cards and devices.". That's going to be hard. They may end up with real computers hooked up to peripherals that simulate human inputs. (DoD does this all the time; it's how flight control software is debugged. Serious flight simulators use the real "black boxes" of real aircraft with simulated inputs and outputs.) They need that level of fidelity because they want to observe virus and attack behavior.
This is going to be a useful asset.
yeah, yeah, yeah. If one never tries anything, one never has to worry about failure. Does one ever think that one might learn something from failure. This guy is just looking for work at the moment. Oh, and remember, the hard stuff is too hard to try.
The fundamental cyber attack:
1) get enemy's AIM s/n and post it on a public chat room with a cute profile picture.
2) Soon enough all of enemy's supercomputers will be flooded with trillian windows with "a/s/l" and "wanna cyber?" messages
3) ???
4) Profit!!!
Cheers!
Atheist: Buddhist in a Prius
Excellent excerpts for us that are too lazy to read for ourselves! Now I'm 100% behind the idea. It's dumb NOT to have this
If you can read this... 01110101 01110010 00100000 01100001 00100000 01100111 01100101 01100101 01101011
Other than a stupid name -- both an overlap with NCR (that was supposed to be National Cash Register) company name, and the use of a word "cyber" in a way that suggests a sister project National Yiff Range, and the fact that military and not computer scientists are running it, of course.
Something has to provide an environment where potential damage from various existing kinds of malware and attacks, and effectiveness of various countermeasures, can be evaluated without waiting for those things to happen in the real-world Internet. It can be a valuable simulation tool, the only thing that makes me really concerned is the licensing of Windows for countless virtual machines that have to be involved in it -- that may singlehandedly double Microsoft's OS-related revenue unless government will find a way to avoid paying for it. However it's stupid to pretend that such a thing will be useful for creating worms and viruses specifically for damaging "enemy" users because by its nature malware can not specifically target people in particular organizations -- its power is in non-specific attacks and in using least-secure, poorly maintained computers to create large-scale effect. Claiming that military is either going to concoct a worm that only infects, say, computers in China, or that it intends to perpetrate computer fraud on a massive scale as a part of some idiotic DDoS on web site that it does not like is stupid, and it discredits the whole project.
Contrary to the popular belief, there indeed is no God.
will never be able to be accurately simulated. Example, 4chan.
I've built an Internet simulation before, it's neither easy nor possible to model the dynamics. It makes for great cyberterrorist fantasy roleplay though... when under attack and I can't get to Windows Update shit gets interesting. Biggest rush of my life.
Support my political activism on Patreon.
I can only imagine what the results would be if you had replicants on a site like that. Such a small network would be saturated with insane memes and eventually would just rebel a la Skynet. Except Terminators weren't dressed in nice suits with nothing but green instead of skin and a question mark for a face.
> Most vulernabilities are flaws with the applications, architectures, systems and protocols themselves.
Considering that the social engineering attack has been around since society started, as opposed to software and protocol vulnerabilities which are rather recent developments, I'd have to say that I think you're dead wrong (I assume, based on context, that your use of "system" didn't include society).
This is in addition to the added argument that fixing software or protocol vulnerabilities on a society-wide basis is rather straightforward, whereas "fixing" social engineering attacks is mainly based on individual education (e.g., teaching people not to fall for particular attacks, or changing people's mindsets), or societal change (e.g., making biometric info an essential part of personal identification) which is not straightforward at all.
The point of research...and that's what DARPA is all about...is pushing the envelope. I was at the DARPA event where potential respondents learned about the desired features and overall nature of the program, and it was extremely ambitious, yes. But in conversations with my peers, it turns out that an enormous amount of the technology to make it happen already exists. Sure, they may not get everything they want, but so what? If they only get half of it...and the lesser half at that...they'll still have something that our country desperately needs, which is a place to test and practice information warfare tactics. The components that exist today, if put together to form an "NCR lite," would still provide immense value, and for that alone, the NCR is bound to be a success. And let me tell you, with the people that were in that room, I would be profoundly surprised if a great deal of innovation did not take place as well.
For your security, this post has been encrypted with ROT-13, twice.