Slashdot Mirror
$26 of Software Defeats American Military
reporter writes "A computer program that can be easily purchased for $25.95 off the Internet can read and store the data transmitted on an unsecured channel by an unmanned drone. Drones are crucial to American military operations, for these aerial vehicles enable Washington to conduct war with a reduced number of soldiers. '... the intercepts could give America's enemies battlefield advantages by removing the element of surprise from certain missions and making it easier for insurgents to determine which roads and buildings are under US surveillance.'"
Counting the cheapest part of the machine is silly.
Software is often free. $26 is a lot for software. The radio reception, etc. and knowing where to aim are all much more expensive and require skill.
excitingthingstodo.blogspot.com
No, demodulating a signal is not news. But not encrypting it in the first place ought to be. (And TFA had a red herring in its focus on the software used to record the signal--the software is probably the easy part, once you've captured the signal).
.sig withheld by request
I'm frankly more worried about "But the Pentagon assumed local adversaries wouldn't know how to exploit it, the officials said." than I am about this particular security vulnerability.
Security vulnerabilities happen, and are unfortunate and need to be fixed, and we really should spend more time and resources on caring about them; but that is all manageable software/systems engineering stuff.
Making important decisions on the basis of "Eh, our enemies are just ignorant mud farmers anyway, no problem", on the other hand, is colossally arrogant and extremely dangerous. Particularly, since the US currently has the world's highest tech and most expensive military, "Eh, they're just primitives, no problem" is a practically all-purpose dismissal of virtually any problem that you are too lazy to fix. That is a recipe for learning, the hard way, about every new asymmetric warfare trick.
why didn't the DoD just start passing a fake feed from the drone? They could have added another encrypted channel for the real feed, which I would assume is trivial given the military's budget. Then pass fake data over the unencrypted channel. Sometimes disinformation to the enemy is far more valuable than real intelligence. I can see a bunch of jihadis sitting around watching a tv screen. "Look at those infidels. They are going to blow up the wrong building! Our secret base is 100 kilometers away! Say, does anyone else hear that noi..." [BOOM]
-Arthur
Cave ne ante ullas catapultas ambules
"U.S. military personnel in Iraq discovered the problem late last year when they apprehended a Shiite militant whose laptop contained files of intercepted drone video feeds. In July, the U.S. military found pirated drone video feeds on other militant laptops, leading some officials to conclude that militant groups trained and funded by Iran were regularly intercepting feeds." The Germans did not think the Poles could break their codes. The Japanese did not think the US and the Australians would break their codes. The British did not think Argentina would finish assembling the Exocets on their own without the French manuals or use them in a way differently than designed. The Afghan and Iraqi insurgents have the money and the brains to break into Western weapon systems, don't underestimate them (or the probable help from Iran, Syria, Korea, etc...) The prospect of getting killed is a powerful motivator.
From what I could make out, it's just the video stream transmitted by the drone that's unencrypted, not communications that control the drone. The obvious reason this might be done is to save on the computational requirements onboard the drone by not making it encrypt the presumably immense data stream of the video. Decrypting the rest of the communication the drone receives is probably an order of magnitude less processing load, or even two.
If received and understood by the enemy in a timely manner, very useful information. But if it is just the image unencrypted and not GPS coordinates, etc, the enemy would have to have enough people watching the feeds to recognize the terrain that was being photographed... it's easy to see why this might not be considered likely and lead to the poor judgement to leave it unencrypted when the drones were designed, many years ago with less powerful processors available.
If they can prevent me from watching porn on cable and satellite, they should be able to prevent these guys from hijacking the video feeds from the UAVs.
When Fascism comes to America, it will call itself Anti-Fascism, and tell you to give up your guns.
furthermore, there's nothing to say they still can't do that, or aren't actually doing that already. in fact, a big story in the international press about how dumb the military is on these video feeds is a good cover. one can hope, anyways, that the military is smarter than depicted in this story
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Sensationalist... i would expect this from a tabloid.
Title should have been: Unencrypted data broadcasted everywhere ... can be received by anyone!
The leap from that to "$26 of Software Defeats American Military" is quite a big leap in my opinion.
Sigs are for the weak.
This is just my experience but I met some computer engineers with top secret clearance working at the DoD. They are so incompetent that it's scary. Even worse, they were contractors/consultants. I'm not saying all DoD computer engineers are idiots. The problem is the government is so incompetent that they've given much of the work to large consulting companies whose sole purpose is to fill as many seats as possible for the revenue.
Unfortunately there are plenty of assholes out there who will exaggerate anything in order to claim that they are more security conscious than the next person (and perhaps hope to get a contract for their company). But this is surely small war, no-one dead, move along please.
And those same people don't know (or remember) the first rule of intelligence:
Those who know, don't talk. Those who talk, don't know.
I'm a consultant - I convert gibberish into cash-flow.
Not to be harsh about it, but think back to high school and college and ask yourself if you would describe the people who were planning military careers as the "best and brightest" of your class.
Ahh, you are thinking of the one or two guys who were all gung ho but not especially bright and had delusions about being a badass commando. Yeah, my school had some too. See the thing is though that those guys aren't the guys running the military. The guys you are thinking of end up as infantry grunts or something similar and exit the service after a few years. I have a cousin who is one of those guys. Smart but classic ADHD and socially stunted and not someone I'd trust right now to be in charge of anything. But he served two tours in Iraq and now he's in college so I have hope for him.
The guys in the officer corps (commissioned and higher level NCO) are almost invariably bright and hard working and most of them that I've ever met didn't talk much about their interest in the military. I have a classmate who is a major in the US Navy who never gave the slightest hint he was interested in a military career. He was quiet, very smart, and I would have guessed he'd be an engineer but instead he's become a heck of a good officer. I have a number of friends who were graduates of West Point and Annapolis and I've been impressed as hell by each one of them. Smart, incredibly disciplined, and I'd hire any one of them in a heartbeat.
The US military is an incredibly complicated and large organization with huge budgets, difficult goals, and a huge workforce. If you think managing all that is easy and doesn't require tremendous skill, you are delusional. Sure they make mistakes just like any other large organization but their mission is also more complicated than most and if they fail, people die.
Mods. That comment may be redundant, it may be old and tired, but it is certainly not offtopic. In fact, in the grand scheme of frist psots!, it might be the most on-topic one I've seen in years.
I think this has about as much to do with Army IT as IE vulnerabilities have to do with the Microsoft IT department.
Is there any real security risk in this? I suspect it is very small.
The risk to this is not a danger to troops. The risk of this is having a completely un-edited video source available to people who would have a field day if the official US proclamation of what happened was visibly different from the recorded video stream
I am Slashdot. Are you Slashdot as well?
As an engineer in the defense industry you probably also know how long defense systems live and how hard it can be to get upgrades pushed out into the field. It wouldn't surprise me at all if it wasn't technically feasible to encrypt the video stream at the time this system was first deployed and since then upgrading it has never been a priority for anyone with enough clout to make it happen. Now that its on SecDef's radar how long do you think its gonna take before this gets fixed?
...
You are a dangerous fool. Never use a one-time pad more than once, even for "light" security. Doing that turns the whole thing into a Vigenère cipher and destroys all security. You might as well just XOR each byte of the message with 0x42.
I truly hope this is sarcastic, because the ignorance of this statement baffles me. To say the military is comprised only of self-serving individuals who seek some sort of sick pleasure from killing people is offensive to everyone who served or is currently serving. Military members don't get free food, clothes, or housing more than anyone else with a job does. There are allowances for these necessities that are simply an extension to a member's base pay, which for enlisted members would be terribly low otherwise. If you worked a minimum wage job for the same number of hours per week as an average military member, you would probably make more money than their monthly base pay.
Apparently wizard is not a legitimate career path, so I chose programmer instead.
frequency hopping != encryption
especially if you are the only transmitter in that spectrum nearby.
Never let a mediocre career stand in the way of a good time