US Drone Fleet Hit By Computer Virus

New submitter Golgafrinchan passes along this quote from an article at Wired: "A computer virus has infected the cockpits of America's Predator and Reaper drones, logging pilots' every keystroke as they remotely fly missions over Afghanistan and other warzones. The virus, first detected nearly two weeks ago by the military's Host-Based Security System, has not prevented pilots at Creech Air Force Base in Nevada from flying their missions overseas. Nor have there been any confirmed incidents of classified information being lost or sent to an outside source. But the virus has resisted multiple efforts to remove it from Creech's computers, network security specialists say. And the infection underscores the ongoing security risks in what has become the U.S. military's most important weapons system.'"

Comments

duh

[Aighearach]

Don't run windoze on bombs!

Or aircraft carriers!

Will we never learn??

Re:duh

[Pentium100]

Why? Windows crash and burn all the time, isn't that what a bomb is supposed to do?

Also, I doubt that this virus is just a random one, it most likely was created with the target in mind, so if Linux was used then the virus would have been created for Linux.

Re:duh

[fuzzyfuzzyfungus]

While your general point is valid: against targeted attackers the ratios for "desktops cracked, by platform" are pretty irrelevant"; there is more to it:

A game console, many smartphones, tivos, etc. do checks of the OSes they run. If the signature doesn't check, the device doesn't boot. Better implemenations(newer xbox360s, for instance, pretty much have to be voltage glitched to get past that.

If you are going to be strapping some hellfire missiles to something, you really, really shouldn't be running an OS/architecture so stock that desktop or corporate penetration and bug numbers are terribly relevant...

Re:duh

[Nefarious Wheel]

If you were serious about platform security, you wouldn't be running on an OS at all. You'd have one single application that included its own device drivers. Costly, yes -- but also very secure if you write the lot yourself. Just don't open any doors at all.

Talk about clueless IT

[Anonymous Coward]

“We keep wiping it off, and it keeps coming back,” says a source familiar with the network infection, one of three that told Danger Room about the virus. “We think it’s benign. But we just don’t know.”

If someone this incompetent was running a corporate network they'd have their ass on the street faster than they could say "network traffic analysis."

Just to clarify

[Baloroth]

When they say the drones were infected, what they mean is that the computers controlling the drones (located in the US and which are, apparently, running Windows...) were infected with a keylogger, probably spread through flash drives. Whether this actually compromises security at all is unknown (keyloggers generally assume you are connected to the Internet, which these computers aren't.) They don't have much security on the drone computers because they aren't hooked up to the Internet, and they would (apparently) rather educate their users than bother with antivirus, for whatever reason (although they do have a security system on the network which detected the virus. I would imagine it also should have stopped the virus).

Best comment in TFA

[arielCo]

The big problem is that the drones keep ordering refueling boom enlargement kits, and four of them tried to fly to Nigeria to collect on a half-million gallons of jet fuel that was left there by a former Minister of Aviation.

Other way around

[Toe, The]

No, I sincerely doubt this is some mysterious computer intelligence taking over our military.

BUT... this is clearly the path to skynet. What we are seeing is what pretty much all of us already understood: when you have increasingly autonomous killbots, disaster becomes a question of "when" not "if."

Spread by removable drives? How hard is this?

[bradley13]

This isn't exactly a new attack vector. Banks don't let people plug removable drives into sensitive systems - why does the US government?

You know what happened - either Joe private plugged his private pr0n collection into a classified computer, or else he took a classified drive home to use privately. Either was, really bad news.

If you've just got to have removable storage, then you pay for special connectors, so they are incompatible with anything else. Then you cast the guts in epoxy, so no solder jockey can change out the connector. This is not rocket science.

Re:Spread by removable drives? How hard is this?

[mclearn]

Actually, TFA believes that the vector was a removable drive by which they periodically update their map collections.

Use of the drives is now severely restricted throughout the military. But the base at Creech was one of the exceptions, until the virus hit. Predator and Reaper crews use removable hard drives to load map updates and transport mission videos from one computer to another. The virus is believed to have spread through these removable drives. Drone units at other Air Force bases worldwide have now been ordered to stop their use.

Re:No anti-virus?

[MozeeToby]

Unless someone really screwed the pooch, the results are never getting back to the virus writers. These computers are classified, that means no connection to the net, no writable media drives, many places even epoxy the USB ports so at least it's obvious if someone tries to use it. Specific steps are taken when moving data off them to prevent any data except what was requested is removed. At least, that is how it is in the private world working on classified material. Cases like Manning being able to get a dump of the entire international cable DB would indicate that the government holds itself to a much lower standard than it holds contractors.

Re:Military Intelligence

[Jeng]

They are not hacking the control software, all they are doing is receiving an unencrypted video feed.

You do not get anywhere close to being able to hack a drone just because you receive something similar to a TV station. You wouldn't be able to hack a TV station though a TV signal and you can't hack a drone though it's video feed.