Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DOD Just Beginning to Grapple with Scale of Weapon Systems Vulnerabilities

gao.gov

Post reply on HN
Print view View original

111–120 of 225 posts

Re: DOD Just Beginning to Grapple with Scale of Weapon Systems Vulnerabilities

#111

Post by forapurpose »

outworlder wrote: post #22
komali2 wrote: post #8

Earlier quoted context omitted.

I had the opportunity to tour the "USS BONHOMME RICHARD," as well as talk to visiting sailors and marines, this weekend during SF Fleet Week. My takeaway impressions (other than that god damn do these people drink and holy shit are they young), especially after talking to the mechanics and network IT folks, is that a ton of their systems are old, the manpower turnover is between 1-2 years as they get cycled between b…

I too toured the boat. > The windshield wipers on all Ospreys (those dank helicopter/plane things, think Ghost in the Shell) have been disabled/removed because their motors would catch fire in inaccessible places near the pilot's feet. Well, this is not related to the main point about cyber security. If true, it's just a piece of equipment that was found to be flawed. It is a non-essential system that was made INOP.…

Good points, but physical access is a fundamental of security, and for good reason.

Re: DOD Just Beginning to Grapple with Scale of Weapon Systems Vulnerabilities

#112

Post by drawkbox »

Jtsummers wrote: post #61
drawkbox wrote: post #17

Earlier quoted context omitted.

> Test reports we reviewed make it clear that simply having cybersecurity controls does not mean a system is secure. How the controls are implemented can significantly affect cybersecurity. For example, one test report we reviewed indicated that the system had implemented rolebased access control, but internal system communications were unencrypted. Because the system’s internal communications were unencrypted, a reg…

The problem isn't just MBAs. It's that scientific management has become central to the DoD's mode of functioning. Which is remarkably sad. The DoD in the WWII and post-WWII era actually developed a lot of good systems engineering practices and was largely successful on some massive projects. Since then, however, there has been the constant desire to deskill workers. That is, they want explicit operating/work instruct…

Specialization, metrics that don't capture true growth/success, and too large of teams also ends up to skilled workers that care less because they have less power or responsibility/ownership.

Small teams with skilled people, the startup model, works best even in large companies. Closer to the customer and more cohesive unit makes for a better project, that is why innovation happens at smaller companies or small research groups in companies or universities.

n(n-1)/2 is the formula to calculate the number of communication channels on a project where n=the number of team members/stakeholders on a project.

On a team of 1, it is all you, you make sure it works.

On a team of 2-3, it is just that few, you make sure you and others are doing their part.

On a team of 10, 45 communication connections, you might not have the same level of care because that isn't my role or someone else has got it. Beyond 7-8 team members communication becomes humanely impossible.

On a team of 100, you have so little power/responsibility that you feel out of place calling attention to issues, you don't know of everyone on the team even.

Metrics are a good thing, to use as an input, so is customer feedback, product goals/focus, usability, employee satisfaction and many other things that aren't always measured like technical debt, product quality, security, simplicity of processes/production, research and development and more.

If you measure the wrong things, it can give you the wrong idea that you are moving in the right direction while possibly overlooking aspects not captured in metrics.

If you only looked at revenue and employee head count for instance, growth might be deceiving. Profit and revenue per employee better, but also employee satisfaction, customer satisfaction, the market, product quality, timing, security, long term direction etc etc get overlooked in the metrics department mainly because domain knowledge has less power than oversight in most mature organizations.

Re: DOD Just Beginning to Grapple with Scale of Weapon Systems Vulnerabilities

#113

Post by TeMPOraL »

InitialLastName wrote: post #78
jandrese wrote: post #18

Earlier quoted context omitted.

Even worse is that institutional problem where you have people constantly cycling on and off of this hardware that was never designed for a multi-user environment, so default passwords are the order of the day. At best they changed the password and then put it on a sticky note attached to the monitor. The last thing you want is someone forgetting their password to their tactical system while out at sea and having to…

> And really, the first case is no worse than the old days with manual controls that just anybody could walk up and fiddle with. In that case, you could trust physical security to some extent; someone really not intended to be in contact with the device could be prevented from doing so by some dude with a big gun. Now, those devices are networked, so someone could figure out an access method and use it on all the dev…

While not trying to reason from fictional evidence, this reminds me of Battlestar Galactica. In the series, they made a point of Galactica running on non-networked computers (unlike the rest of the fleet), as networking them together made it easy for the adversary to pwn the whole ship.

Re: DOD Just Beginning to Grapple with Scale of Weapon Systems Vulnerabilities

#114

Post by seppin »

ourmandave wrote: post #30

Not to play the Whataboutism card, (proceeds to play whataboutism card), but has anybody pen tested the Soviet's or Chinese' systems? Just thinking this isn't a U.S. only problem.

They are surely much worse, but the US has more to lose.

Re: DOD Just Beginning to Grapple with Scale of Weapon Systems Vulnerabilities

#115

Post by MrLeap »

spenrose wrote: post #105
MrLeap wrote: post #12

I was a dev contractor for the US Army for a few years. None of this surprises me. They had some goofballs policies that made it seem like vulnerabilities were the goal. I could bitch at length. Their TSA style security theater practices were the order of the day. The IA training was an embarrassing joke and they made you do it often enough to make you a little crazy. I just checked the certificate of networthiness p…

Thank you for your work and for this comment. Regarding the last line: if you can work in the US and are not hamstrung by personal circumstances, there is no way, given the skills you imply having, that you can't find meaningful work: health care, education, energy all have dozens of good companies straining to find additional competent technical staff.

Thank you for the kindness. I'm in a bit of a slump right now so my cynicism is leaking.

Job offers are trivial to get. Meaning.. proper autonomy / feedback balance.. impact.. Life must be too easy for me to be such a snob. Neural fatigue is real.

Re: DOD Just Beginning to Grapple with Scale of Weapon Systems Vulnerabilities

#116

Post by TeMPOraL »

pbhjpbhj wrote: post #63
WrtCdEvrydy wrote: post #54

Earlier quoted context omitted.

> The enemy here is fairly low-tech. Shouldn't be a problem. Would be perfectly acceptable if your hardware was only used for 2-3 years against only low tech enemies that don't have access to electricity during that whole time.

Sounds like classic underestimation of your opposition.

Yup. The enemy may be poorest of poor, but in this day and age, their entire population probably has smartphones (or at least dumbphones), and there's plenty of smart people with nothing better to do than to play with computers.

There aren't many low-tech places left on this planet, where it comes to computing.

Re: DOD Just Beginning to Grapple with Scale of Weapon Systems Vulnerabilities

#117

Post by TeMPOraL »

lifeisstillgood wrote: post #110
pjc50 wrote: post #89

Earlier quoted context omitted.

My thoughts on this are always related to "skin in the game": does it matter personally to the people making and procuring the systems, especially at senior management level, whether it actually works? Back in WW2 it definitely did, especially in the UK where bombing had no respect for the class system. Winning or losing the war would make a personal difference. But since then? All the wars have been overseas with no…

I would suggest that the problem is too much wriggle room / dissonance during the design process (in nice safe meeting rooms admittedly) We can all persuade ourselves that as all items are ticked, the job is done. But testing gives the lie to all this. The patriot system was battle tested in the 1990s and its deficiencies became apparent - and lessons seem to have been learnt. So perhaps more adversarial testing is t…

I always assumed the US military does such tests routinely. Don't they?

Re: DOD Just Beginning to Grapple with Scale of Weapon Systems Vulnerabilities

#118

Post by rkeene2 »

breatheoften wrote: post #96
noxToken wrote: post #40

Earlier quoted context omitted.

This bit is curious. I was issued a CAC while I was in, and as you said, it eliminated the need for passwords. But the internal sites (no matter if it was a laptop from the comm section, a hardwired desktop in a unit's building, or a desktop in a base facility) always failed the check for the certificate store. I always got the security warning (or insecure message) regardless of browser.

Slightly off-topic - but its semi-relevant here as this conversation involves the requirement of knowing (1) the state of the system security store (2) the state of an application's security store ... and maybe in some cases (3) understanding how an application modifies any trusted stores. It seems we end up with a lot of possibilities for the states of these stores to diverge from our expectations ... I've been wond…

I don't know the answer to your StackOverflow question as I don't use macOS/Mac OS X.

What I ended up doing to help this process along is including the relevant certificates inside my DOD Smartcard PKCS#11 module as certificate objects (with, of course, no corresponding private key objects).

For applications that use PKCS#11 (such as Firefox, via NSS), this means that when the module is loaded the appropriate certificates are also made available automatically. This was also (I believe) supported by the "TokenD" driver used to support macOS/Mac OS X so that enabling this driver made those certificates available and provided by the token, so no modifications to the local macOS system trust store were needed.

Re: DOD Just Beginning to Grapple with Scale of Weapon Systems Vulnerabilities

#119

Post by vermilingua »

kazagistar wrote: post #59
airstrike wrote: post #37

Earlier quoted context omitted.

No, but all that does is ensure we all lose collectively

That is true of any war that the US has even a remote possibility of losing.

That is true of any war that the US has even a remote possibility of entering.

Re: DOD Just Beginning to Grapple with Scale of Weapon Systems Vulnerabilities

#120

Post by solotronics »

maxxxxx wrote: post #72
ItsMe000001 wrote: post #27

Earlier quoted context omitted.

They will be in for a surprise: Using those massive buggy systems is not one bit easier for the hackers than for the actual users. Maybe the many bugs in those huge systems will turn out to be the best protection against enemy takeover... not actually too crazy an idea, when I think of biology and the mess that are biological systems, where even errors are vital for the functioning of the whole system (e.g. accidenta…

It's not about taking over. Disabling them is sufficient.

I have been thinking the recent Navy navigation related crashes are related to enemies tampering with systems. They are testing live how weak a windows based fighting ship is.

https://www.wired.com/1998/07/sunk-by-windows-nt/

Post reply on HN