n00bz are pwned... teh suX0r

Over two weeks ago a key logging virus was discovered in the Creech Air Force Base control stations for Predator and Reaper drones. The drones kept flying, but the techo-geeks at Creech apparently have not been able to permanently remove the virus. This is all bad enough but the worse part of this story is that the much vaunted Air Force cyber warriors of the 24th Air Force didn't find out about this until they read about it in Wired magazine on 7 October. 

I've read government and DoD plans on how we will defend our networks for over a decade. I've survived death by PowerPoint on this subject. DoD established Cyber Command as well as scores of other units and offices dedicated to protecting our networks. It's been all for naught… except for the money made by the beltway bandits. Does this bother anybody else?  

http://arstechnica.com/tech-policy/news/2011/10/get-hacked-dont-tell-drone-base-didnt-report-virus.ars

TTG

 

Comments

[J]

TTG,

One can 'hope' that some 'heads will roll' on this one. The 'don't tell' AND 'cyber security by the honor system' AND 'they just didn't think it was important enough' parts are most troubling.

They are 'supposed to' have some command structure about them, right? Where was it, and where in sam-hill IS it?

[Hank Foresman]

Pat, I had to go to AUSA this year. . .being on the floor made me ill as I saw all the purveyors of death marketing their wares like there was no tomorrow. The unfortunate thing is, like cyber, our senior leaders go flitting after the latest brightest shiny object often to no avail.

[William R. Cumming]

Takes both money and brains to defend the USA and its armed forces and civilian population. A difficult combination to find these days.

[Fred]

Yeah, a couple of NCO's will get the shaft and some coronel will get a pension - along with a cushy job at a contractor. A general getting canned? Don't hold your breath.

[Buzz Meeks]

Impossible to defend considering the level of penetration of US defense,judicial and governing arms by the dual-national Fifth Column.

[walrus]

"All ur drones are belong to us"...sorry, couldn't resist.

One hopes that the transport and deeper layers of the software are not windows based. The thought of a drone hijacked in flight is hilarious at one level, but depressing overall.

[The Twisted Genius]

Walrus, most of the tech comments I read say the system is running a version of Windows. I wouldn't be too surprised if it was Win95. A lot of the SCADA systems are based on that OS or even MS-DOS. Additionally, a lot of the drone traffic was, and probably still is, unencrypted. Even if the AF stops using removable drives, there are still bound to be infections.

During the time of the Fidonet bulletin boards (late 80s), an unknown person called "Old Red Cracker" or ORC+ was famous among the hacking community. One of his admonitions was, "If it runs, it can be defeated." What i find most disheartening about this affair is that we still don't have the situational awareness to know we've been screwed.

[Medicine Man]

They are running a version of Windows? I think I want to go drink now.

[pj20]

I have a suspicion that the best 'hackers' will always be anarchists.

[steve g]

I agree with Buzz Meeks. The USA and the
only democracy in ME applied Stuxnet to the
Iranian nuclear program. We must have shared
crypto codes with them. Did the Iranians break
codes and plant virus or the other participant?
They have been accused in the past of infiltrating
our telecom industry. Why not this also.

[walrus]

Excellent! Blame Iran!

[Ramojus]

In my IT consulting travels of the olden days, we had some clients who were too cheap to upgrade to Windows NT/200x from MS-DOS / W9x environments.

In order to comply with IT security requirements, I utilized Fortress Desktop software to provide a modicum of desktop security.

[steve g]

Walrus I was not referring to Iran as the
main culprit but the other participant
in Stuxnet plot. They being accused of
telecom compromises.

[The beaver]

Well when the CIA Predator drones can run on pirated S/W, who knows what can happen when contractors or the dual-nationals work on the military ones, the virus and its so-called “keylogger" payload were introduced either intentionally or by accident.....

If militants in Iraq have used $26 off-the-shelf Russian software to intercept live video feeds from U.S. Predator drones, well something stinks.....

[graywolf]

Anyone running WINDOWS for other than home or simple business applications deserves what they get.
Using an amateur POS like WINDOWS on a weapon system is well....not too surprising.
After all, it IS the government.
Let's get our health care from these morons.

[ISL]

I am too respectful a reader of Asimov to have a good warm fuzzy feeling about death machines that are gradually moving towards sentiency.

http://www.rawstory.com/rs/2011/10/11/japanese-scientist-unveils-thinking-robot/

[different clue]

Question to all or any,

Was there a time when our armed forces used their own specially designed and written programming for all computer uses? And did we then shift from using specially designed military-specific programs to using commercially available programs just re-adapted or re-applied to military use? If so, when was that time? When did adoption of commercial programs/computers/etc. begin? (I phrased that as best I could given how little I know about computers, programs, or any other digital thing).

[The Twisted Genius]

different clue,

Very good question! Two languages immediately come to my mind, COBOL and Ada. COBOL was first developed through a DoD led committee in 1959. It's further development was monitored and directed by ANSI and, later, NIST. One cannot mention COBOL without mentioning Rear Admiral Grace "Amazing Grace" Hopper. This woman was involved in Naval computing since WWII. I still remember a 60 Minutes interview of her done in 1983. She retired from the Navy in 1986 aboard the USS Constitution. We badly need an Amazing Grace today.

Ada was developed by DoD from 1977 to 1983 to become the standard language for DoD applications. The Military Standard reference manual for Ada was published in 1980. Efforts to standardize on Ada within DoD continued until 1997 when the push to COTS was made. In my opinion, current USG and DoD leadership in all things cyber pales in comparison to the early days of COBOL, Ada and Amazing Grace. I recommend you read the Wikipedia entry on these three to get an idea of how far we have fallen.

[Lee]

"...according to one defense official, it was malware that is routinely used to steal log-in and password data from people who gamble or play games like Mafia Wars online."

Looks like someone was playing internet games or was sharing thumbdrives with computers that were used for playing those games!

http://abcnews.go.com/Technology/wireStory/military-computer-virus-directed-drones-14725058

[PS]

On my way home from work last night they were running recruiting ads for Cyber Command on WTOP. Ironic.

[arbogast]

Suppose a drone was electronically hijacked (or for that matter an American Airlines 757), does anyone think the public would ever be informed?

Remember TWA Flight 800 that came down off Long Island? It had jet fuel fumes pouring out of its wingtips because it had spent so much time on the ground in 100 degree weather. An anti-submarine exercise was going on around it, Yankee something or other, and a missile was fired that narrowly missed the passenger plane, but ignited the fumes coming from the wing tip (the fly by is documented on radar).

The flap that protects the exhaust cylinder at the wingtip was the only piece of metal that was bent *in* on the plane, because the explosion occurred outside the plane as far as it was concerned.

The crew of the anti-submarine aircraft that fired the missile was dispersed to the four corners of the earth and never interviewed following the incident.

The official explanation is extremely weak and ultimately speculative. However speculation is okay as long as the government is doing the speculating.

Oh, I forgot to mention. The Flight 800 was carrying weapons of mass destruction to Iraq. Had it been able to complete its mission, those weapons would definitely have proven the case for the war.

[J]

TTG,

One has to wonder just 'whom' the contractor' was that developed their failed both software and security system?

FORTRAN anyone?

The thought of COBAL just makes my machine language appetite heighten.

[J]

All,

What scares the beejeez out of me regarding the use of drones to do the killing instead of a human behind the trigger (and I'm not talking joystick trigger either), is the advent of the Nationwide use by the FBI of facial recognition software. I can just see some greenhorn genius at DARPA putting the two (drone killer/facial recogition targeting) togeather, the ultimate Terminator killing machine. Then enter the 'hack' of the airborne Terminator, where somebody inputs a different picture of the intended target, i.e. the face of somebody our politicos don't like instead of the op's initial targeting such as a genuine military target on a battlefield like an insurgent leader's face.

Then we would have airborne chaos, literally with murder implications on the side.

Skynet from the Terminator movies may not be far from a reality, if we don't rein-in the DARPA wunderkinds. They already have invented gnat surveillance, imagine their gnat surveillance loaded with hellfires. That would give one a real buzz no?

[sophie]

I was serving in the mid-80's when an HP9020c with a standard unix port became the "Jerry O'Tuttle" system (JOTS after ADM Tuttle) for use aboard ships. As I recall, this box was the first commercial computer in the CIC. Commercial off the shelf (COTS) took off like mad since the development lifecycle was a fraction of a UCC-7 or UCC-43-type militarized computer system. The downside...oh, training and documentation and WTF if we don't know exactly how this works? I left the community in the early 90's but the COTS storm was still going strong. I was always nervous if I was trying to fix something - and instead of a Technical Order (TO) I had to try to use a "Users Guide". Cost made COTS so easy to justify.

v/r,
Sophie