Slashdot Mirror
Pentagon's New Next-Gen Weapons Systems Are Laughably Easy To Hack (zdnet.com)
An anonymous reader quotes a report from ZDNet: New computerized weapons systems currently under development by the U.S. Department of Defense (DOD) can be easily hacked, according to a new report published today. The report was put together by the U.S. Government Accountability Office (GAO), an agency that provides auditing, evaluation, and investigative services for Congress. The report detailed some of the most eye-catching hacks GAO testers performed during their analysis: "In one case, it took a two-person test team just one hour to gain initial access to a weapon system and one day to gain full control of the system they were testing. Some programs fared better than others. For example, one assessment found that the weapon system satisfactorily prevented unauthorized access by remote users, but not insiders and near-siders. Once they gained initial access, test teams were often able to move throughout a system, escalating their privileges until they had taken full or partial control of a system. In one case, the test team took control of the operators' terminals. They could see, in real-time, what the operators were seeing on their screens and could manipulate the system. They were able to disrupt the system and observe how the operators responded. Another test team reported that they caused a pop-up message to appear on users' terminals instructing them to insert two quarters to continue operating. Multiple test teams reported that they were able to copy, change, or delete system data including one team that downloaded 100 gigabytes, approximately 142 compact discs, of data."
The report claims the DOD documented many of these "mission-critical cyber vulnerabilities," but Pentagon officials who met with GAO testers claimed their systems were secure, and "discounted some test results as unrealistic." GAO said all tests were performed on computerized weapons systems that are still under development. GAO officials highlighted that hackers can't yet take control over current weapons systems and turn them against the U.S. But if these new weapons systems go live, the threat is more than real, GAO said.
The report claims the DOD documented many of these "mission-critical cyber vulnerabilities," but Pentagon officials who met with GAO testers claimed their systems were secure, and "discounted some test results as unrealistic." GAO said all tests were performed on computerized weapons systems that are still under development. GAO officials highlighted that hackers can't yet take control over current weapons systems and turn them against the U.S. But if these new weapons systems go live, the threat is more than real, GAO said.
[comment redacted]
When will the rest of the world starting measuring data volume in CD's instead of bytes?
This smells like the result of MBAs ignoring engineers...
Moscow Don's pooper is easy to hack with the anaconda swinging between my legs. WOOOOOOOOOO~~~~~!!!!
They are not vulnerabilities, they are features and backdoors for the NSA.
Yeah. Lets laugh. Russia or China hack them and use them on us. Yeah. Lets laugh. /sarcasm
just enter that as the username
ban laughing.
Table-ized A.I.
GAO said all tests were performed on computerized weapons systems that are still under development.
You can't add security on as an afterthought. It needs to be a core feature.
"First they came for the slanderers and i said nothing."
ebooks and dropping them on the enemy? In tests almost half of enemy soldiers committed suicide just seeing "C.D. REIM".
Especially since Trump gave Putin and Netanyahu all the passwords.
You are welcome on my lawn.
To be fair, managers are more likely to be rewarded for delivering a sufficient product on time than ensuring proper safeguards. A missed deadline will almost surely be noticed and put on them, while slipshod security has roughly a 1 in 10 chance of showing its head during a manager's actual reign. (The marketing people negotiated the contract, not the project manager, and the marketers often under-bid to win.)
They are behaving "rationally" in terms of their OWN risks versus rewards. The managers are following the carrots and sticks which are actually applied to them like donkeys would.
It's kind of like debt and pensions versus politicians: they won't likely be in office anymore if they muck either of those up bad enough for the public to notice, so they give short-term handouts instead, dumping the long term problem onto the future. In the future, you will hear, "I didn't do it, my predecessors did."
Table-ized A.I.
Guns & defribulators donâ(TM)t have passwords for a reason: you donâ(TM)t want to be killed or watch someone die because ohhhh right cyber security. I work on industrial control systems where the rule is âoeanyone with physical access to equipment is authorized to operate it.â Admin/config/db/etc is locked down appropriately.
This garbage article has no real details from which to evaluate its claims. Does GAO even know how, where, or with what access controls these systems might be installed?
is all that it would take MacGuyver to take full control.
Mass hyperbole.
"For example, one assessment found that the weapon system satisfactorily prevented unauthorized access by remote users, but not insiders and near-siders"
Oh, just like...
-..... an ammunition depot protected against attacks from intruders, but not against an insider planting a bomb inside it
-..... a plane protected against being shot down by missiles, but not against having its engine sabotaged on the airfield
-..... a tank protected against electronic warfare weapons, but not against someone sitting inside the tank trying to sabotage it
Protected against remote attackers but not against insiders is the current standard.
"It's a trap!"
That's the password actually.
Slashdot, fix the reply notifications... You won't get away with it...
Shit not original.... NUKE BING BANG ...GAME OVER !!
thats more like it
Not archaic enough. I'm gonna need that in number of baskets of scrolls please.
-
Something Something government contractors something something lowest bidder.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
Amazing report. The GAO must have gained access to cloud data, although the report doesn't mention the cloud. It would be too blatant, shameful, and embarrassing to have that revealed.
Correction re: "they won't likely be in office anymore if...
Corrected version: ...they won't likely be in office down the road. If they muck either of those up bad enough for the public to notice, it will probably be after their reign. Therefore, they give short-term handouts instead, dumping the long term problem onto the future.
Table-ized A.I.
What is that in terms of 5.25" floppies?
That's the only archaic storage medium analogy I consider worthy of consideration
Lets not forget the anti hacking. A bullet in the head of the traitor.
Systems in development are not complete
Systems are in very high security locations, especially when deployed
Systems are surrounded by many soldiers
So letâ(TM)s be realistic and intelligent about this. Security is needed, is intrinsic, and focus should be concentrated on important areas. Which are mostly secret so letâ(TM)s read the arm chair guys chime in on python scripts and WiFi
It's because with no conception of storage sizes obviously are completely aware that a CD holds 650/700MB.
At least the comparo isn't 'songs'. Love me do long? Or day in the life long? 128kb/s MP3 or 44k1 s/s WAV?
The problem is obviously HACKERS from the CYBER SPACE. With HACKS. HACKING. I'm TELLING YOU.
https://www.gutdolls.com/ Die medizinische Simulation von Mannequins, Modellen oder verwandten Handarbeiten, wie SimMan, [9] transparente anatomische Mannequins oder Harvey, sind in der medizinischen Ausbildung weit verbreitet. https://www.gutdolls.com/silik... https://www.gutdolls.com/leben...
https://www.gutdolls.com/lebensechte-TPE-puppe-von-voll-erotikmarkt-kaufen.html
"100 gigabytes, approximately 142 compact discs, of data."
Probably the same type of people that call the internet AOL.
Wanna buy a shirt?
https://www.redbubble.com/people/stealthfinger/shop?asc=u
I was part of a cancelled program. AFOTEC failed it for a lack of "field maintenance ability" ... it wasn't even a fucking prototype. It was a mockup.
"Another test team reported that they caused a pop-up message to appear on users' terminals instructing them to insert two quarters to continue operating."
Private Snafu: Sir! I need to you to break a dollar so I can keep firing, sir!
Commander: Damn.. anyone got some quarters? Someone ride on back and get us a hand full of quarters!
Not that they shouldn't do better, but, say, if someone can only hack a Phalanx system from inside the aircraft carrier from a secure access terminal then it is probably not going to end up exploited, since if you can get a mole in that deep they can probably do more damage throwing a wrench into the right place.
More fun data conversions here: http://www.unitarium.com/data
I wonder what "more than real" means. Is it surreal? Is it hyper-real? Wait, this is 2018. The only thing that can be more than something is is when it's Literally Real. Like, "that hack is literally better than my soy chai latte." The data was so much more than real that it was as much data as 10 real Libraries of Congress.
Don't disappoint your bird dog. Go to the range.
Blind faith in systems and strategy, just because you are heavily invested in it, will not necessarily save you
No, no, fuck you, and no.
This is a horribly bad approach to security. You're making assumptions about the external environment, and using them to excuse system vulnerabilities. That's not realistic or intelligent. It's just lazy.
Lets not forget the anti hacking. A bullet in the head of the traitor.
That's assuming you can find a traitor. If the system logs aren't secure, or if their integrity is questionable, or if they don't uniquely identify an individual, you have no hope of identifying exactly who attacked the system.
Systems in development are not complete
So? Security isn't something to be bolted-on late in the development process. Systems should be secured first, then the functionality is applied on top of that. If that means you have to use more-costly (but more secure) solutions in your design, so be it. When functionality comes before security, management is far too justified in saying "but we've spent too much already developing this insecure system!" and refuse to reimplement it securely.
For a related example in the public sector, we're almost done implementing HTTPS, after only 10 years or so...
Systems are in very high security locations, especially when deployed
At first, maybe... then a truck gets ambushed, or a base is overrun, or we get an impulsive politician who promises an arbitrary date to get out of an unpopular conflict area. Then those systems fall into enemy hands, and you just have to hope that it's a useless pile of hardware by then.
Systems are surrounded by many soldiers
Soldiers are underpaid, overworked, and usually focused on things other than countering highly-technical intelligence techniques. If an attacker walks onto a base, steals classified data (or even whole systems), and tries to leave, they'll be saluted at the gate as long as their paperwork looks right.
There is no valid excuse for leaving a system insecure by design. Every layer of the system should be built securely, with the functionality added afterward.
You do not have a moral or legal right to do absolutely anything you want.
Most of the responsibility of this falls on the Pentagon. The government insists on tightly controlling all the requirements, and so in an environment where cost is king, if the customer doesn't properly write in cyber as a requirement, there isn't any incentive by the contractors to go beyond what is written. That is what the GAO report is primarily criticizing: that the DoD did not take cyber seriously until recently and that they are still trying to figure out how to architect a secure environment and write requirements for it. So even if a contractor says, "Hey, government Contracting Officer, you should tighten security around this system," the government Contracting Officer, if they understand even what's going on, will probably say, "I dunno, does that change the requirements? We're not going to pay you for it."
Anonymous and Tor for obvious reasons.
Here is a quick thumbnail of the environment we who do this kind of cyber security work live with:
Point out probable issues during early development and get told, "We don't believe that, you can't prove that, we'll fix it if it actually happens."
Prove the problems after the system is built and get told, "We've already spent millions of dollars, it's too late now!"
Mix in being forced to restrict testing to a subset that's nothing more that a rubber stamp.
Continuously being told we're: not team players, hard to get along with, trouble makers, need to go along to get along.
We have our jobs threatened and are transferred awayor fired if our revelations are large enough to embarrass the powers that be.
if the customer doesn't properly write in cyber as a requirement
There's a more important question: Is it proper?
Computerized gun turret. It is only connected to a network that goes to a small number of secure terminals, which are not connected to any other network.
Why do you need to encrypt that link? If you control physical access via people with guns, why do you need secure logins?
"We made this guy change his 16-character password every 2 months and he forgot it while getting shot at. Now he's locked out of the terminal due to three failed login attempts. The local sysadmin is dead, so he can't unlock it. It would be nice to return fire, but we gotta have network security on this air-gapped network!"
Military requirements are not the same as civilian requirements. There's a reason tanks do not have ignition keys like cars do.
so only those with physical access can hack them, a remote user can't. nothing is secure from someone with physical access. someone with physical access could pour a gallon of locktite into the mechanism of a weapon too too.
non-news
Lets not forget the anti hacking. A bullet in the head of the traitor.
So you kill some traitors then. Won't prevent the betrayal. Some are more loyal to another country - who is paying enough that "it is worth the risk". Some really believe in the other country's ideology or religion. They either succeed in betraying you, or become martyrs while trying. Becoming a martyr is not a problem for some. Your bullet simply don't scare them.
During WWII, the loosers learned the hard way the cost of insecure communications. They were so sure their enigma & purple machines could not be hacked. So sure - until they were defeated and learned that every order & every report had been read by their enemy - and used for what it was worth. Took an estimated 2 years off the war effort, to know the position of every u-boat & the contents of every order from hq. The fights get easier, when you know their plans in advance. Getting remote control of enemy weapons is even better. Failing that, knowing how to jam comms so those screens only show garbage.
Protected against remote attackers but not against insiders is the current standard.
In battle, the two sides overrun each others positions. Sometimes, weapons get captured & recaptured. Loosing one piece of artillery is bad, but not the end of anything.
It is different with computer-controlled stuff like automated artillery or drones. If one guy getting too close can turn such weapons around - or control them via network intrusion - then you have worse problems. Suddenly, your base or carrier is bombed by your own drones. Or all the artillery fires - on your own positions. Not one big gun, but all of them. Or your soldiers retreat from hard-won positions, because they got such an order on their battle-hardened iPads. Because one guy got too close with hacking equipment somewhere. They can convince people to go on suicide missions, for spectacular results like that. Or perhaps they don't even need a suicide mission, if all they need is to hack into comms somewhere.
If an attacker walks onto a base, steals classified data (or even whole systems), and tries to leave, they'll be saluted at the gate as long as their paperwork looks right.
This!, even a moderate physical secure systems need to be secured. Everyone assumes everyone else is doing what they are suppose to, and question only when they are suppose to, and wouldn't know otherwise.
The spirit of resistance to government is so valuable on certain occasions that I wish it to be always kept alive
Friend of mine was part of a team that did a security assessment on an automatic 5in gun used for naval purposes. It was pretty much a tour de force of how not to do it, everything connected and enabled by default, little to no security/encryption, ancient insecure libraries, terrible coding practices, you name it, it was there. Apart from the direct security implications that anyone who gets access to the ship network, e.g. while berthed, has full control of an automatic 5in gun turret, it said really bad things about the rest of the software controlling the thing. They were limited in scope with what they were allowed to do, but said it responded in very unexpected ways to garbled control messages sent to it. In other words just normal, non-malicious operation in the presence of errors would cause it to do God knows what. Their recommendation was to disable as much computer-controlled automation on it as possible and run things under human control.
Between a competent IA and this. Every time I hear or read an article about how secure is IA and like never going to happen a terminator-like scenario I always wonder if the people in IA do know something about the (lacking) security in HIGH VALUE installations.