Security News US Weapons Systems Can Be 'Easily Hacked'

[upnorth]

Content source

https://www.bbc.com/news/technology-45823180

The Government Accountability Office (GAO) found "mission-critical" cyber-vulnerabilities in nearly all weapons systems tested between 2012 and 2017. That includes the newest F-35 jet as well as missile systems.

Pentagon officials had no immediate response to the 50-page report from the Senate Armed Services Committee. The committee's members expressed concerns about how protected weapon systems were against cyber-attacks. The report's main findings were:

• the Pentagon did not change the default passwords on multiple weapons systems - and one changed password was guessed in nine seconds
• a team appointed by the GAO was able to easily gain control of one weapons system and watch in real time as the operators responded to the hackers
• it took another two-person team only one hour to gain initial access to a weapons system and one day to gain full control
• many of the test teams were able to copy, change or delete system data with one team downloading 100 gigabytes of information

The GAO added that the Pentagon "does not know the full scale of its weapons system vulnerabilities". Ken Munro, an expert at security firm Pen Test Partners, said he was "not at all surprised" by the findings. "It takes a long time to develop a weapons system, often based on iterations of much older systems. As a result, the components and software can be based on very old, vulnerable code. "Developers often overlook 'hardening' the security of systems after they've got them operating, with the philosophy, 'it's working, so don't mess with it'.

GAO Report

 

[509322]

The terminators will kill us all.

 

[LDogg]

Fairly worrying from that time period. Hopefully in 2018 that's changed massively.

~LDogg

 

[DeepWeb]

I bet those systems still run Windows Xp. I BET YOU $5 they still run Xp.

 

[Local Host]

I bet those systems still run Windows Xp. I BET YOU $5 they still run Xp.

I bet you $10 at least one still runs Windows 98.

 

[Daviworld]

I bet those systems still run Windows Xp. I BET YOU $5 they still run Xp.

I bet you $10 at least one still runs Windows 98.

Ha! I bet you both $15, there is still at least that one really critical mystery machine running MS-DOS. That no one bothered to document and it can never be restarted, but all anyone knows, is that they need it for this one really critical outdated piece of custom undocumented software that run's like two task

I feel sorry for their IT guy lol

 

[509322]

Think about this one. DoDs across the globe are developing autonomous systems. Sort of like free-range Ai chickens, but with guns, cannons and missles. How ya like that (hackable) Ai now ?

 

[Burrito]

Ha! I bet you both $15, there is still at least that one really critical mystery machine running MS-DOS. That no one bothered to document and it can never be restarted, but all anyone knows, is that they need it for this one really critical outdated piece of custom undocumented software that run's like two task

I feel sorry for their IT guy lol

Many of those systems are not run on Windows at all. Many are built on very simple platforms that are developed as part of the contract... think of the GUI for Revo (before they recently updated it). Some DoD proprietary programs have a 90's era look and feel to them. They were not built with security in mind, as it was not specified in the contract. The most sensitive systems are not supposed to touch the net at all.... which is why this recent news is strange to me..

 

[509322]

Many of those systems are not run on Windows at all. Many are built on very simple platforms that are developed as part of the contract... think of the GUI for Revo (before they recently updated it). Some DoD proprietary programs have a 90's era look and feel to them. They were not built with security in mind, as it was not specified in the contract. The most sensitive systems are not supposed to touch the net at all.... which is why this recent news is strange to me..

In the vast majority of cases, potential threat actors already know the platforms. None of this stuff is exactly state secrets. It is intended to be in theory, but in practice just give it enough time and it is all revealed through various means.

 

[Burrito]

In the vast majority of cases, potential threat actors already know the platforms. None of this stuff is exactly state secrets. It is intended to be in theory, but in practice just give it enough time and it is all revealed through various means.

At least for US systems, that's simply not correct.

 

[vtqhtr413]

Many of those systems are not run on Windows at all. Many are built on very simple platforms that are developed as part of the contract... think of the GUI for Revo (before they recently updated it). Some DoD proprietary programs have a 90's era look and feel to them. They were not built with security in mind, as it was not specified in the contract. The most sensitive systems are not supposed to touch the net at all.... which is why this recent news is strange to me..

Your response is encouraging as I notice you're from DC :emoji_fingers_crossed:

 

[509322]

At least for US systems, that's simply not correct.

It most certainly is and it is known in the industry. DoD has been well hacked and tons of stuff stolen. It's been happening for years. From everyone ranging from the military proper to its subcontractors. A large portion of suppliers aren't even U.S. based companies. They've been hacked to death too. Not to mention lots of stuff is purchased and reverse engineered. There is no such thing as eclusive military hardware contracts that prevents unwanted parties from getting their hands on a lot of stuff. It's been the way of the world, like, forever.

 

[cruelsister]

Well said, Lockdown!

Burrito- There were long-standing issues with Defense Dept computer security that were known for YEARS, but for whatever misguided kumbaya political reasons were not only ignored, but mocked (and led to a bunch of talented folk leaving in despair). Although I'm no longer in the game I have heard (and seen) that such things are taken more seriously now. But it takes time...

 

[DeepWeb]

The only security is that they require physical access. You would think that a million dollar missile comes with encryption or at least Kaspersky Free Antivirus lol!

 

[Local Host]

The only security is that they require physical access. You would think that a million dollar missile comes with encryption or at least Kaspersky Free Antivirus lol!

With physical access every system is compromised.
There are options to secure this types of Government Systems, but they're Premium and few are willing to pay and implement them.

 

[Entreri]

LOL! Most excellent. Probably running Win95.

This is what the US deserves.

Now these imbeciles are wanting even more backdoors, including to encryption. Genius!

 

[Eddie Morra]

Now these imbeciles are wanting even more backdoors, including to encryption. Genius!

The government/s have power and if they can push technology companies into complying with their requests by offering the government a way to decrypt the encryption of the services (e.g. for instant messaging) then they get a huge load more of intelligence with less work.

The intelligence they'll get will be helpful for things like counter-terrorism. There's no doubt about that.

However... if they have a master key to encryption then it means someone else can get their hands on it as well. If they insert a backdoor, then it means someone else can find and abuse it too. And so on.

Therefore, they would make services less secure to higher-resourceful attackers who may be able to take advantage of the benefits the government agencies included in the deal are getting, but at the same time the government/s are getting more intelligence to help save lives.

So you have to decide... do you want better security IRL at a cost for your privacy or keep your privacy and less security IRL?

Telegram have said that they will comply with governments like the U.S government as long as proper justification is provided before they hand over intelligence on customers. Many other companies will work like this as well. Many VPN providers have handed over logs in the past to help police/government catch out criminals.

Google? You can guarantee that people get put on watch-lists for searching specific things and that such logs are shared with government agencies.

 

[cruelsister]

VK- seriously, in the past when a potential breach was pointed out to the Powers That Be it was disregarded as paranoia. Even the trashing of the Ukraine's C&C prior to the initial attacks did not make them realize that a threat existed; it was as if the Insane were in charge. I frequently went home in tears.

 

[Danielx64]

it can never be restarted

Why couldn't the system be restarted? What happen if there is a loss of power?

 

[Burrito]

Why couldn't the system be restarted?

There is no longer anybody around who knows how to program in BTOS / CTOS.... the operating system used for some defense systems.