Slashdot Mirror
Air Force To Rewrite the Rules of the Internet
meridiangod writes "The Air Force is fed up with a seemingly endless barrage of attacks on its computer networks from stealthy adversaries whose motives and even locations are unclear. So now the service is looking to restore its advantage on the virtual battlefield by doing nothing less than the rewriting the 'laws of cyberspace.'" I'm sure that'll work out really well for them.
If they were smart, they would disconnect their computers from the public internet. People can't access hardware they can't access.
The government is not your daddy. Its purpose is not to raid middle-class neighbors' wallets and give it to you.
""[M]ost threats should be made irrelevant by eliminating vulnerabilities beforehand by either moving them 'out of band' (i.e., making them technically or physically inaccessible to the adversary), or 'designing them out' completely," the request for proposals adds."
Luckily for the Air Force, they don't actually have to do any work at all to make this happen, since it's been not only possible, but actually implemented since at least 1998, when RFC 2341 was written all about Virtual Private Networks.
Helpful Hint for the Air Force: Pay your private sector computer engineers more and you'll get the innovation you're looking for.
How about no spoofing as a good start. No changeable MAC addresses and Client side certs.
I hope they don't overlook Rule 34.
Remember that the 304th Military Intelligence Battalion declared Twitter a terrorist weapon. God forbid they discover pen and paper. Or modulated farting, for that matter.
http://rocknerd.co.uk
for an organization the size of the air force, and with the mandate it has, there is nothing laughable or overly ambitious about say, creating and implementing your own supersecure protocol, and supporting it within its subnet
and, if successful, watch it leave its military surroundings, be adapted by universities, then corporations, then the general public
kind of like the internet itself
somebody is going to do this at some point, considering the various shortcomings of our present dominant protocol suite
that it would be the military to do it first makes sense
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
The only useful and meaningful thing they could do, is implement a secure internet protocol (i.e. with the missing session and presentation layers) and provide a good interface to the internet. Then the inherited insecurity of network protocols could be avoided from the beginning.
If it is done right, has advantages and is promoted and laid open to others, it might catch on and replace parts of the internet step by step. ;-)
Will probably not be faster than the IPv6 transition, but hey, they made the internet, why not make another one
Laws can not reach internet phenomena, they are too slow, and when they do, it doesn't matter anymore.
NB: The message above might reflect my opinion right now, but not necessarily tomorrow or next year.
http://en.wikipedia.org/wiki/Evil_bit
As usual, Penny Arcade predicted the future. (http://www.penny-arcade.com/comic/2007/07/16/)
Technician: Our webs are down, sir. We can't log in!
Agent: Which webs?
Technician: All of them.
Technician: They've penetrated our code walls. They're stealing the Internet!
Agent: We'll need to hack all IPs simultaneously.
Check out my sci-fi book "Lacuna" at http://goo.gl/MVxX8
actually there is a very simple measure ISPs can take to prevent many attacks.
and that is to prevent their customers from spoofing the source IP in their IP packets.
If governments (starting with the US) would pressure(force by law) ISPs to do this, it can be done with out much technological difficulties.
This anti-spoofing measure can be implemented on many levels, so that even if a certain ISP does not co-operate other ISPs could prevent its customers from spoofing any IP which does not belong to the problematic ISP. This in itself helps protect against IP spoofing.
Without IP spoofing attackers are more easily identified and blocked.
If you actually RTFA, you see that they aren't bonkers. Quite to the contrary. See this quote, for example:
"[M]ost threats should be made irrelevant by eliminating vulnerabilities beforehand by either moving them 'out of band' (i.e., making them technically or physically inaccessible to the adversary), or 'designing them out' completely," the request for proposals adds.
Yeah, absolutely. Remember that this is the military we're talking about. These are the guys who are the "customers" of stuff like the NSA's formally verifiable code project. These are the guys who still use 10 year old computers because those are hardened and tested to military standards. If they upgrade to 5 year old computers, the gain in speed will offset pretty much any performance penalty that security methods that don't fly in the commercial world because of said performance penalties, could cause.
These are also the guys who do a ton of things badly.
So it'll be interesting to watch.
Assorted stuff I do sometimes: Lemuria.org
Instead of letting them try to push us around, we the geeks can turn the tables and re-write government based on open source philosophy.
The plan for transition is practical, and folks like those running the Air Force will never see it coming until it is far too late for them to do anything about it.
"Hey its just a series of tubes, how hard can it be?!"
I will not be pushed, filed, stamped, indexed, briefed, debriefed or numbered. My life is my own.
So they want to simultaneously change the underlying network fabric in order to make their systems unattackable, and also be able to successfully attack any other system at any time? Does no one there see a disconnect between these goals?
First Rule: Don't talk about Internet
Second Rule: Don't talk about Internet
Third Rule: ???
Fourth Rule: Profit
Its not so crazy that they would replace TCP/IP with something else fairly similar for their internal use.
Aren't we sentencing some guy for logging into Windows computers from over in Europe that had no pass and ran the Windows Operating System? Maybe we should stop playing all these games and have Microsoft rebuild their operating system correctly as not to have hundreds of thousands of zombie computers online. How many of those Zombies run Apple or Linux? What's that you say less then 1%, or perhaps the answer is none at all? The government built the internet but can't secure it? We need 500 different anti virus programs because one specific operating system is incompetent at security? Send the users to jail you say because we can't stop kids from ignoring laws? Who woulda thunk it?
"I guess I'm gonna fade into Bolivian."
Newton, sick of all those apples falling on his head, is planning to rewrite the laws of physics to make gravitation a repulsive force.
Empires grow and crumble, and the Turtle Moves. Gods come and go, and still the Turtle Moves. The Turtle Moves.
I would expect that all of an ISP's addresses should be in the block(s) they received from ICANN. If something on their sub-net is generating headers with foreign addresses, then they ought not to route it.
That doesn't work because the low bid always wins. What would be better would be if the government shifted from a bid system to a fixed bid system. ie: This job is for $50k, this is what we want, now tell us how you are better than the other guys. That would be 100x more effective, but also 100x more time consuming because then they would have to READ EVERY PROPOSAL, not just the two lowest ones.
The dangers of knowledge trigger emotional distress in human beings.
Why, no one has ever thought of that before..
The Air Force excels at just about everything they do. But for the past decade or two, their Achilles Heel has been computing technology because it moves faster than anything else they're used to.
The Air Force is a very old organization and although they can generally respond to most anything quickly, overall change tends to happen very very slowly. Not long after I enlisted in 1998, there were rumors that the uniform was going to change from the classic camouflage pattern to a kind of pixellated-marble look. Based on what recent photos I can find, they're still only about halfway through getting the new uniform out to everyone.
Also, I know for a fact we're still flying some planes with vacuum tubes in the autopilot computer even though upgrades for all airframes have been around since at least the 80's. Most of the technical manuals that I used to repair avionics were between 25-40 years old and still had technical errors in them. (We weren't able to make corrections to technical manuals any more than you'd be allowed to make pen-and-ink corrections to a federal law.)
Computer use only became common in most squadrons about 10 years ago and even then, they were not really used for the correct purposes. Some captain would get the bright idea that somebody should use a spreadsheet program instead of a paper form for some menial task, force everybody to use it, ignore the pleas from his subordinates that it tripled the effort required to perform the task, and then make up some elaborate report for his commander about how he just saved the Air Force $358,000.
While I was in the service, the Air Force never really caught on that you had to hire and train smart people who know about computers if you wanted to make the most of them. Some squadrons took young administrative airman fresh out of tech school and sat them down in front of the admin console and said, "All right, it's your job now to make sure this doesn't break." This is very uncharacteristic of the Air Force as you normally need at least several weeks of training before you can be trusted to mop the floor correctly. But when a commander has something that needs to be done and he doesn't know how to do it, it's not at all uncommon for him to assign someone to it while implying that they should be rather quiet about it.
Others units farmed out network administration to government contractors like Lockheed Martin which wasn't any better because most of their employees are old military retirees who thought they were going to get paid more as a civilian for doing the same thing they did in the military and ended up being wrong on both counts. (Got seven stripes and an MSCE? Then they're hiring!)
I guess this long-winded point it that it doesn't surprise me that high-level Air Force officers are saying, "Hey, who says we can't control this thing? We're the Air Force, after all." They're used to having fine-grained control over everything in their view and a high degree of security surrounding it.
In other words, the Air Force is still nowhere near where they need to be in terms of network security. The only encouraging part of this is that they finally realize it.
The AF can deal with someone in a nearby van, but not easily deal with someone anonymously using a free wifi connection in Europe that is bounced through 5 different servers. Even if they were able to completely track an attacker, how do they deal with multiple international jurisdictions?
Kindness is the language which the deaf can hear and the blind can see. - Mark Twain
Yes, I'm sure every potential recruit would just love to have to install a VPN client to go check out af.mil.
I read the internet for the articles.
lameness filter forced me to munge the layout
RFC1149a - Standard for the transmission of flash memory on avia
Network Working Group_____________ TubeSteak
Request for Comments: 1149a__________LOL WTF
3 November 2008
A Standard for the Transmission of Flash Memory on Avian Carriers
Status of this Memo
This memo describes an experimental method for the encapsulation of
flash memory in avian carriers. This specification is primarily
useful in Metropolitan Area Networks. This is an experimental, not
recommended standard. Distribution of this memo is unlimited.
Overview and Rational
Avian carriers can provide high delay, low throughput, and low
altitude service. The connection topology is limited to a single
point-to-point path for each carrier, used with standard carriers,
but many carriers can be used without significant interference with
each other, outside of early spring. This is because of the 3D ether
space available to the carriers, in contrast to the 1D ether used by
IEEE802.3. The carriers have an intrinsic collision avoidance
system, which increases availability. Unlike some network
technologies, such as packet radio, communication is not limited to
line-of-sight distance. Connection oriented service is available in
some cities, usually based upon a central hub topology.
Frame Format
The flash memory is packaged, inside a small waterproof container,
and formatted to FAT32. The waterproof container is attached to the
back of the avian, between the wings, as a backpack. The bandwidth
is variable and limited by the carrying capacity of the avian.
Upon receipt, the backpack is removed, the flash memory extracted
and checked for physical and liquid damage.
Discussion
Multiple types of service can be provided with a prioritized pecking
order. An additional property is built-in worm detection and
eradication. With time, the carriers are self-regenerating. While
broadcasting is not specified, storms can cause data loss. There is
persistent delivery retry, until the carrier drops. Audit trails
are automatically generated, and can often be found on logs and
cable trays.
Security Considerations
Security is a problem during normal operation, as flash memory
has a non-trivial and intrinsic value. Special measures must be
taken (such as data encryption) when avian carriers are used in
a tactical environment.
[Fuck Beta]
o0t!
The headline here says 'rewrite the rules of the internet', whereas the Wired article talks about 'rewriting the rules of cyberspace.' Subtle difference here.
The internet exists as it is--fundamentally an IP-based network connected in all the ways we know about, routing, addressing, etc.
The thing is, there's no reason that the Air Force (or anyone else) couldn't create their own, entirely incompatible version. Start with something that has guaranteed QoS, hard-wired source addressing, encryption at the equivalent of the transport layer, content-metadata in the packets (or equivalent to packets--it doesn't have to be a packet protocol at all), etc..
If you need to connect it to the internet, create a tunneling protocol, or a translating switch. Make it different. Make it incompatible. Make it rigid in its requirements. You CAN create a secure network, but not if it's based on the same technology that makes up the existing internet.
"People who do stupid things with hazardous materials often die." -- Jim Davidson on alt.folklore.urban
I am a Liberal.
I believe in the Constitution which contains the right to bear arms and seperation of church and state.
I believe in the United States of America, not Jesusland.
When the American Right stops trying to destroy the First Amendment, which incidentally comes before the Second Amendment, I will consider it.
Until then, you're welcome to relocate to a country more amiable to your theocratic oligarchy: I think Iran would suit you nicely.
If someone is passing you on the right, you are an asshole for driving in the wrong lane.
I would mod it to +32,768.
Aah, change is good. -- Rafiki
Yeah, but it ain't easy. -- Simba
I couldn't have said it better.
Except I am neither liberal nor conservative. I am an American patriot and believe in the Declaration of Independence, the Constitution and the Bill of Rights. I also believe in capitalism and separation of church and state.
But, I will never again vote for any republican since they began their campaign to destroy the foundations of American democracy and switch the country to capitalistic dictatorship and the military industrial complex.
I have NO fear of Obama. And contrary to the neocon rhetoric, I have no doubt he will uphold the principals of democracy, unlike the last 2 douch bags he and Biden will be replacing shortly. I am also a gun owner and support the right for all Americans to form Militia to defend our land and freedoms.
Actually it's the neocon side of the isle that will seek to take our guns from us. Dictatorship is easier when the masses cannot shoot back.
Bush & Cheney have done more damage to the country and world than should have been allowed. I hold all republicans and their supporters guilty of high treason for this. Now they have 2 more whacked out fruit cakes, John McBush & Sarah McCheney they want in there to continue the destruction.
Isn't it obvious that McBush & McCheney, as people, are just as stupid as George W. Bush? Cheney is not stupid, he is just pure evil.
"Our enemies are innovative and resourceful, and so are we. They never stop thinking about new ways to harm our country and our people, and neither do we." George W. Bush
"Suppose you were an idiot...and suppose you were a member of Congress...but I repeat myself." Mark Twain
Comment removed based on user account deletion
You seem to have confused people exercising their first amendment right with attacks on the first amendment.
Criticism of someone else's speech is not an attack on the first amendment. Geographically restricting free speech, on the other hand, is.
No, instead they exclude the non-Christians, do their best to game the rules to punish them, and actively try to suppress their education and rights. Once you stop your stupid Creationist backdoor indoctrination campaign, leave women's bodies to themselves, stop butting into my bedroom and entertainment and start acting like good neighbors THEN I will stop bashing 'Christians'. Every time I have debated religion with a lay 'Christian' I have always known more about the true teachings of Jesus than they have, they only know the hate and vemon spat from the pulpit and pushed by their local conservative politicos.
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
Signed integer limit is +32767.
32768 is only possible in the - domain!
That's because you visit more atheist-friendly websites than religious websites. People prefer to express their opinions in like-minded company; thus you see more anti-religion post on your pro-atheist websites.
On this comment page, there are at least two anti-atheist posts. That is for a single story. Twenty slashdot stories a day, 500 posts per story makes your 20 000 posts to cover that. So you claim that almost every post made on slashdot is anti-religion? Or does slashdot have a different ratio because it is a particularly pro-religion website?
If it's in you sig, it's in your post.
I hold all republicans and their supporters guilty of high treason for this.
While I agree with a lot of what you say, I think you're overstepping a line here. Find the scumbags who've actually done something wrong, and hold them responsible for their wrongdoing. Charge them with treason if they've committed it.
But don't hold innocent republicans, or those who innocently vote republican, responsible. At least not if you value the rule of law.
"I disapprove of what you say, but I will defend to the death your right to say it."
I hate neocons just as much as you do, and I lean more left than right (so the republicans wouldn't get my vote, were I eligible to cast it) but I will defend them here in spite of that, so that someone will defend me when I need it.
I'm hard core atheist and every blog I post on knows it. I've received more crap from atheists than the few uberChristians. All I do is point out their hypocracy and whammo, they lose their nut.
For instance, I'm not excluded from any blog at all, no one actively tried to suppress my education or rights or those of my daughter or her children. You list a line of talking points that don't stand up on scrutiny and I seriously doubt your every time statement. Sounds more like pompous self-aggrandizement than truth. Also, the 'true teachings' statement is similar to that made by religious bigots because they 'hold the understanding'. I live in Bible belt country and rarely hear local conservative politicos spit hate and venom.
Signed integer limit is +32767. 32768 is only possible in the - domain!
He went long.
The higher the technology, the sharper that two-edged sword.
... and I am an Anarcocapitalist. I believe that there's no government you can design, that authoritarians of either the Communist-type or the Fascist-type won't eventually turn into their own tools of oppression (always, of course, "for everyone's benefit")
I know it sounds extreme, but if you're a fan of the work of Nobel-prize winning economist Milton Friedman, I suggest you have a look at the work of his son, David Friedman, which extended his father's work to its natural conclusion.
And in any case... whether you want a return to the limits of the Constitution, less government overall, or no government whatsoever, I suggest you check the link in my signature.
Part of the Second American Revolution!
I've never persecuted Christians or people of any other religion. The 'worst' thing I have ever done is try to keep their views out of schools and the workplaces I have been a part of. I am perfectly willing to discuss religion in a non-antagonistic manner outside of work hours. As I said my personal experience living in a battleground state is that there has been a lot more attempts by the religious right to control people than the other way around.
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.