Slashdot Mirror
Two Android Apps Used In Combat By US Troops Contained Severe Vulnerabilities (zdnet.com)
According to a Navy Inspector General report, U.S. military troops used two Android apps that contained severe vulnerabilities in live combat scenarios. "The two apps are named KILSWITCH (Kinetic Integrated Low-Cost Software Integrated Tactical Combat Handheld) and APASS (Android Precision Assault Strike Suite)," reports ZDNet. From the report: Both apps work by showing satellite imagery of surroundings, including objectives, mission goals, nearby enemy and friendly forces. The two apps work as a modern-day replacement for radios and paper maps and allow troops to use a real-time messaging client to coordinate with other military branches, and even call in air-strike support with a few simple screen taps, according to a DARPA press release and accompanying YouTube video. The apps have been under development since 2012 and starting 2015, they have been made generally available to all U.S. troops via a public app store managed by the National Geospatial-Intelligence Agency. But according to a Navy Inspector General report from March that was made public today, both apps contained vulnerabilities that could have allowed enemy forces access to troops' information.
The heavily redacted report doesn't detail the nature of the two vulnerabilities, but it does point out that the Navy had failed to control the distribution of these two applications, and later failed to act in warning troops of the danger they were in for almost a year. The report says that the two apps, KILSWITCH and APASS, were never meant or approved to be deployed in live combat zones. But the two apps, because of their flashy features and easier to use interface, became wildly popular among U.S. troops, but also other military branches, including foreign allied forces.
The heavily redacted report doesn't detail the nature of the two vulnerabilities, but it does point out that the Navy had failed to control the distribution of these two applications, and later failed to act in warning troops of the danger they were in for almost a year. The report says that the two apps, KILSWITCH and APASS, were never meant or approved to be deployed in live combat zones. But the two apps, because of their flashy features and easier to use interface, became wildly popular among U.S. troops, but also other military branches, including foreign allied forces.
We got our best people on it and similar apps in case they donâ(TM)t work
Somethung you never hear from an app developer
This after the fitbit / apple watch debacles mapping bases, IN COMBAT, they're bringing ANDROID along with unknown opsec 3rd party shit. Trump is right, Russia wins, let's all go home. WHAT THE ACTUAL FUCK.
An app in a public app store that you can use to call in an airstrike? Seems like a delightful change of pace from the usual fart apps that are so common.
What they really failed to cover was the ramifications of a hack, firing on friendly forces, would have been the result. Do no put idiot failed jock strap douche bags in charge of computer equipment, catastrophic failure is guaranteed but I know, the problem, really smart people have no interest in running around killing people.
Chaos - everything, everywhere, everywhen
Who the hell uses cell phone gadget programs (apps) in a life-critical situation? And why are troops in combat carrying cell phones at all? Both are ridiculous security risks, cell phones shouldn't be allowed to be carried at all.
"call in air-strike support with a few simple screen taps" ...
"The two apps, KILSWITCH and APASS, were never meant or approved to be deployed in combat zones."
So it has an "airstrike" button, but it was never meant to be used in war zones. Where, exactly was it meant to be used? I suppose it would be useful for handling used car dealers and pay day lenders?
Have gnu, will travel.
So it has an "airstrike" button, but it was never meant to be used in war zones. Where, exactly was it meant to be used?
Probably the schools. No wait, they're war zones too. How 'bout gay night clubs in Miami? Nope... I know! The churches... Oh damn!... A trailer park?... Suburbia.. Fuck! Every place is a war zone! Does Android do nukes?
It's Android, it literally a surveillance engine for Google, the core OS components are spyware, what they failed to cover is if Google sells the data the way the Facebook app sells the data.
Every country in the world, knows what troops are where, their families, their kids, their special training, their CV, phone numbers of their friends and families, restaurants they've eaten at,.... the lot. All would be for sale.
Now that Mattis has resigned, perhaps we can learn the real deal behind Putin's attack on US troops. Since the bigger issue with security is when the chain of command itself is compromised.
https://www.bloomberg.com/opinion/articles/2018-02-16/russia-attacked-u-s-troops-in-syria
I'm guessing it went something like: Putin attacks US troops, Putin and Trump blame ISIS, Trump pulls troops out of Syria, Putin gets Syria on a plate. Presumably that was the game there. But US didn't suffer any casualties as hoped, so Trump didn't get his cover story.
what else is new?
The NSA and GCHQ did not say this would be a bad idea as bad people use the "internet" looking for anything US "mil"?
Want a new network for the US mil, build your own encrypted and secret network.
Let the spies use the "internet".
Don't let other nations spies and criminals find anything about your mil on the "internet".
Domestic spying is now "Benign Information Gathering"
They get their software from a public app store? Do they get targeted ads during combat?
now that this problem is sorted out, im sure theres nothing between us and certain victory
Doesn't really matter if the US invading troops are basically running roughshod over a poorly armed adversary in the 3rd world countries that it attacks. There's no one there wasting their energy dicking around with cyber attacks on iPhone and Android Apps that a bunch of trigger happy combat 'vets' may or may not be using in between their turkey shoots on the local population.
You shouldn't trust Android. Or anything Linux based. This sort of thing is bound to happen with Linux devices.
Yemen. Other people's war zones don't count.
Seven puppies were harmed during the making of this post.
Details are lacking, but I feel sure they are talking about Android devices being used on the secure military network, not on the public internet. If the secure battlefield network is penetrated, you're likely hosed anyway.
Seems like the developers spent far more time coming up with cute acronyms for the app name than they did applying any military spec validation process. What was the DoD thinking signing off on these?
Yemen is just Semen spelled wrong.
The solution being to encrypt the end-to-end communications channel.
The Vietnamese DID manage to pretend to be American enough to call in strikes on Americans. How easy would it be to change the color of the bad guys and have shelling blow each other up. Dead easy. Android is security vomit, and will never be safe. It would also be lethal to assume Apple iphone apps are OK in the field.
As an aside, how much stray RF eminates from a cheap Android device - enough to rain down shells by DF?
Training exercises.
War games.
They almost certainly meant that it had been approved for use in exercises and war games in order to evaluate it with the intent of determining whether it would be approved for use in combat, but had not yet approved it's use in combat situations likely in fear of problems like this exact vulnerability.