Slashdot Mirror
$26 of Software Defeats American Military
reporter writes "A computer program that can be easily purchased for $25.95 off the Internet can read and store the data transmitted on an unsecured channel by an unmanned drone. Drones are crucial to American military operations, for these aerial vehicles enable Washington to conduct war with a reduced number of soldiers. '... the intercepts could give America's enemies battlefield advantages by removing the element of surprise from certain missions and making it easier for insurgents to determine which roads and buildings are under US surveillance.'"
...you observe uav
Well, demodulating an unencrypted digital signal is not news.
I am more interested in what kind of RF equipment one would need to capture it off the air. ;)
It's not like you can do this with your WiFi card.
Don't tell the DoD. They've been paying $7,000 per license for that software.
Those who do study history are doomed to stand helplessly by while everyone else repeats it.
We need an OSS option stat. Nobody should have to give up their software freedom just to make a mockery of America's finest tech toys.
The only question is, would this make more sense as an added option in wireshark, or GNU Radio?
Counting the cheapest part of the machine is silly.
Software is often free. $26 is a lot for software. The radio reception, etc. and knowing where to aim are all much more expensive and require skill.
excitingthingstodo.blogspot.com
So they recorded unencrypted OTA video feeds? While yes, they probably should have been encrypted in the first place and . . .
The U.S. government has known about the flaw since the U.S. campaign in Bosnia in the 1990s, current and former officials said. But the Pentagon assumed local adversaries wouldn't know how to exploit it, the officials said.
Yea that's kinda bad and lazy of them,
Senior military and intelligence officials said the U.S. was working to encrypt all of its drone video feeds from Iraq, Afghanistan and Pakistan, but said it wasn't yet clear if the problem had been completely resolved.
they're fixing it.
Your hair look like poop, Bob! - Wanker.
Perhaps the US can put an IP copyright on the data then sue anyone who looks at it without a licesnce! More money!
-- if you mod me down, I will become more powerful than you can possibly imagine
why didn't the DoD just start passing a fake feed from the drone? They could have added another encrypted channel for the real feed, which I would assume is trivial given the military's budget. Then pass fake data over the unencrypted channel. Sometimes disinformation to the enemy is far more valuable than real intelligence. I can see a bunch of jihadis sitting around watching a tv screen. "Look at those infidels. They are going to blow up the wrong building! Our secret base is 100 kilometers away! Say, does anyone else hear that noi..." [BOOM]
-Arthur
Cave ne ante ullas catapultas ambules
"U.S. military personnel in Iraq discovered the problem late last year when they apprehended a Shiite militant whose laptop contained files of intercepted drone video feeds. In July, the U.S. military found pirated drone video feeds on other militant laptops, leading some officials to conclude that militant groups trained and funded by Iran were regularly intercepting feeds." The Germans did not think the Poles could break their codes. The Japanese did not think the US and the Australians would break their codes. The British did not think Argentina would finish assembling the Exocets on their own without the French manuals or use them in a way differently than designed. The Afghan and Iraqi insurgents have the money and the brains to break into Western weapon systems, don't underestimate them (or the probable help from Iran, Syria, Korea, etc...) The prospect of getting killed is a powerful motivator.
Not all religious zealots with huge bushy beards who fight in jihads and live in caves and don't use commercial software are terrorists.
From what I could make out, it's just the video stream transmitted by the drone that's unencrypted, not communications that control the drone. The obvious reason this might be done is to save on the computational requirements onboard the drone by not making it encrypt the presumably immense data stream of the video. Decrypting the rest of the communication the drone receives is probably an order of magnitude less processing load, or even two.
If received and understood by the enemy in a timely manner, very useful information. But if it is just the image unencrypted and not GPS coordinates, etc, the enemy would have to have enough people watching the feeds to recognize the terrain that was being photographed... it's easy to see why this might not be considered likely and lead to the poor judgement to leave it unencrypted when the drones were designed, many years ago with less powerful processors available.
It should've been encrypted, for sure. Agreed.
However, it does need to be encryption that works over a noisy channel, with possible gaps in the datastream. Your typical block-cipher using chaining thus doesn't qualify. (If you wonder why, try encrypting a one-megabyte file, then change a few characters randomly in the first half of the file, then decrypt it)
It's still not a hard problem mind you, just slightly more so than "grab AES, set it to CBC-mode"
Is there any real security risk in this? I suspect it is very small. The Russians never bothered to encrypt the telemetry on their ICBM tests, because after all even assuming someone was reading it, they had no way of stopping the thing. Even if you know where the drone is, it is going to be very hard to shoot down; RPGs and IEDs really aren't much use. And given that this is a video feed, how do you ray trace back to the actual position of the camera?
Unfortunately there are plenty of assholes out there who will exaggerate anything in order to claim that they are more security conscious than the next person (and perhaps hope to get a contract for their company). But this is surely small war, no-one dead, move along please.
From scarped cliff or quarried stone she cries "A thousand types are gone, I care for nothing, no not one."
furthermore, there's nothing to say they still can't do that, or aren't actually doing that already. in fact, a big story in the international press about how dumb the military is on these video feeds is a good cover. one can hope, anyways, that the military is smarter than depicted in this story
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Sensationalist... i would expect this from a tabloid.
Title should have been: Unencrypted data broadcasted everywhere ... can be received by anyone!
The leap from that to "$26 of Software Defeats American Military" is quite a big leap in my opinion.
Sigs are for the weak.
"Hey I can see my house from here! Oh Wai..."
Not to be harsh about it, but think back to high school and college and ask yourself if you would describe the people who were planning military careers as the "best and brightest" of your class.
Ahh, you are thinking of the one or two guys who were all gung ho but not especially bright and had delusions about being a badass commando. Yeah, my school had some too. See the thing is though that those guys aren't the guys running the military. The guys you are thinking of end up as infantry grunts or something similar and exit the service after a few years. I have a cousin who is one of those guys. Smart but classic ADHD and socially stunted and not someone I'd trust right now to be in charge of anything. But he served two tours in Iraq and now he's in college so I have hope for him.
The guys in the officer corps (commissioned and higher level NCO) are almost invariably bright and hard working and most of them that I've ever met didn't talk much about their interest in the military. I have a classmate who is a major in the US Navy who never gave the slightest hint he was interested in a military career. He was quiet, very smart, and I would have guessed he'd be an engineer but instead he's become a heck of a good officer. I have a number of friends who were graduates of West Point and Annapolis and I've been impressed as hell by each one of them. Smart, incredibly disciplined, and I'd hire any one of them in a heartbeat.
The US military is an incredibly complicated and large organization with huge budgets, difficult goals, and a huge workforce. If you think managing all that is easy and doesn't require tremendous skill, you are delusional. Sure they make mistakes just like any other large organization but their mission is also more complicated than most and if they fail, people die.
As an engineer in the defense industry you probably also know how long defense systems live and how hard it can be to get upgrades pushed out into the field. It wouldn't surprise me at all if it wasn't technically feasible to encrypt the video stream at the time this system was first deployed and since then upgrading it has never been a priority for anyone with enough clout to make it happen. Now that its on SecDef's radar how long do you think its gonna take before this gets fixed?
...
You are a dangerous fool. Never use a one-time pad more than once, even for "light" security. Doing that turns the whole thing into a Vigenère cipher and destroys all security. You might as well just XOR each byte of the message with 0x42.