Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Computer virus hits US Predator and Reaper drone fleet

arstechnica.com

Post reply on HN
Print view View original

41–50 of 197 posts

Re: Computer virus hits US Predator and Reaper drone fleet

#41

Post by Vivtek »

jlarocco wrote: post #33
misterbwong wrote: post #18

Earlier quoted context omitted.

Wow can anyone confirm this? I'm surprised that the drones themselves are running windows. If so, I presume it's win CE or a custom variant of?

The way it works is some AF guy in Nevada remotely controls the drones flying half way across the world. My guess is it's not the drones themselves running Windows, but the consoles used to communicate with the drones. It makes sense. AF guy gets to work, plugs in his USB drive filled with music and pulls up the drone control program... Though, now that I think about it, I would be disappointed, but not entirely surp…

Well, there was that case maybe ten years ago of the nuclear carrier that had to be towed back to port after a BSoD killed it dead in the water; its control systems all ran Windows.

Re: Computer virus hits US Predator and Reaper drone fleet

#42

Post by roc »

civilian wrote: post #28

Okay! Here's what the sysadmins should be doing: Each GCS should be recording the identity & timestamp of each removable drive that is attached to it. Then we'll have a graph of all the connections between the machines. If any GCSes aren't infected (or if we have any information about which machines first showed evidence of the virus) then we might be able to trace out the path of infection. Hopefully it'll lead to p…

Or they could just fill all the usb ports with glue and remove the optical disk drives, if any.

I thought the whole point of an air gap network is that nothing crosses the gap. Having those ports/devices available is just asking for it.

Re: Computer virus hits US Predator and Reaper drone fleet

#43

Post by sliverstorm »

mindstab wrote: post #27

next up: "Virus ridden US attack drones strafe US cities" "Iran strikes back for virus that temporarily crippled nuclear infrastructure" Though really the drones probably live in middle east so it'd be more like drones would go berserk in a US military bases in middle east and kill troops or attack innocent foreign civilians drumming up more anti American sentiment "Americans use drone to assassinate Afgan president"

No, the headline would be "Americans use drone to murder hundreds of civillians". It would make us look even worse, and judging by the history of suicide bombers, the Taliban or whoever would not hesitate.

Edit: This may be a bit of a cynical view, but if you believe I'm actually wrong, I'd like to hear why

Re: Computer virus hits US Predator and Reaper drone fleet

#44

Post by sadfasdfads »

JonnieCache wrote: post #26
rdl wrote: post #15

Earlier quoted context omitted.

There are hundreds of thousands of machines and millions of removable drives. Tracking down every last instance of a piece of malware and then dealing with it is quite hard at that scale. Usually they fall back on policy ("no usb/removable drives") They're handicapped by a need AND compulsion to use contractors for everything. Actual government employees didn't build drones; they were all developed and in many cases…

If I'm ever in charge of a PC capable of firing guns at people, then at a bare minimum I would disable the USB bus entirely, I probably wouldn't fit a NIC either. I'd also definitely install some of that software that makes the HDD read only and transparently passes through all writes to RAM. Fuckit, if I'm the US military I'd develop such a device in hardware. Send the recorded video/telemetry data to a write-only v…

The difference between the military and the neighborhood computers you used to assist with are the military has to deal with a plethora of entry points for viruses, and can't scrub every USB thumb drive that is at home rather than at the office. I get the feeling that you've not been doing this for 10-12 years yet. Am I right?

Re: Computer virus hits US Predator and Reaper drone fleet

#45

Post by NinetyNine »

roc wrote: post #25
runjake wrote: post #16

Clarification: It's infecting the control station computers (which I believe are still Windows XP), not the UAVs themselves.

Those computers have access to every bit of data coming from the UAVs and every bit of control data going to the UAVs. So the fact that the compromised machine is in Nevada and not over Pakistan is pretty close to irrelevant. Unless you want to make the argument that it's far worse for the ground control systems to be continually reinfected, as they have access to the rest of the air-gapped private network as well.

>So the fact that the compromised machine is in Nevada and not over Pakistan is pretty close to irrelevant.

Well, at least it's easier to axe a box in the room than to shoot down a rogue UAV across the world.

Re: Computer virus hits US Predator and Reaper drone fleet

#46

Post by ChuckMcM »

misterbwong wrote: post #18
rdl wrote: post #10

Earlier quoted context omitted.

That's funny. It's Windows. Very little Unix anywhere in the DoD over the past few years on new systems; it's mainly legacy, or embedded in products they purchase. There are definitely some Unix server deployments within DoD even now, but they're few and far between. Blue Screen of Death and all.

Wow can anyone confirm this? I'm surprised that the drones themselves are running windows. If so, I presume it's win CE or a custom variant of?

Well the ISS uses windows [1] and there were reports of malware getting up there. They also had driver compatibility issues and were rebooting the systems that controlled the gyros a lot. One would think you could just write a mil-spec OS for their computers but government, and more specficially government procurement, doesn't really work that way.

[1] http://www.zdnet.com/blog/security/malware-detected-at-the-i...

Re: Computer virus hits US Predator and Reaper drone fleet

#47

Post by rdl »

phillmv wrote: post #37
JonnieCache wrote: post #26

Earlier quoted context omitted.

If I'm ever in charge of a PC capable of firing guns at people, then at a bare minimum I would disable the USB bus entirely, I probably wouldn't fit a NIC either. I'd also definitely install some of that software that makes the HDD read only and transparently passes through all writes to RAM. Fuckit, if I'm the US military I'd develop such a device in hardware. Send the recorded video/telemetry data to a write-only v…

>It's not that hard. eye roll

It's hard (in an engineering sense) at that scale, but certainly not impossible, and easier than a lot of engineering problems the world has solved. It's harder because DoD is actively being attacked, but easier because they have a near-infinite budget.

The thing which makes it hard is humans, politics, and economics -- there is a huge amount of CYA with respect to vendor choice (hence, they're a huge Microsoft/Cisco shop), lots of little fiefdoms, an "up or out" promotion policy combined with people being in leadership roles for short periods (with minimal prior background), and lack of real accountability.

The Microsoft-ness isn't enough to kill them on its own; look at the Israeli military, which is also heavily Microsoft based, and has world-class computer security.

Re: Computer virus hits US Predator and Reaper drone fleet

#48

Post by ghshephard »

roc wrote: post #42
civilian wrote: post #28

Okay! Here's what the sysadmins should be doing: Each GCS should be recording the identity & timestamp of each removable drive that is attached to it. Then we'll have a graph of all the connections between the machines. If any GCSes aren't infected (or if we have any information about which machines first showed evidence of the virus) then we might be able to trace out the path of infection. Hopefully it'll lead to p…

Or they could just fill all the usb ports with glue and remove the optical disk drives, if any. I thought the whole point of an air gap network is that nothing crosses the gap. Having those ports/devices available is just asking for it.

"usb ports with glue" Keyboards, Mice, Joysticks for these systems were probably designed with the idea that a USB bus would be available.

It will take a while to replace all of these systems with their non-USB configurations.

Given that BlueTooth is probably a no-no as well, how would one build a system these days that needs to support Mice, Joysticks, and Keyboards without using USB?

Re: Computer virus hits US Predator and Reaper drone fleet

#49

Post by chadgeidel »

FrojoS wrote: post #36

in what has become the US military’s most important weapons system. Seriously? Already?

Any technology that enables you to strike the "enemy" from further away is your "most important weapons system". Slings, Arrows, Gunpowder, Aircraft, Missles, and now Drones all follow this paradigm.

Re: Computer virus hits US Predator and Reaper drone fleet

#50

Post by ghshephard »

JonnieCache wrote: post #26
rdl wrote: post #15

Earlier quoted context omitted.

There are hundreds of thousands of machines and millions of removable drives. Tracking down every last instance of a piece of malware and then dealing with it is quite hard at that scale. Usually they fall back on policy ("no usb/removable drives") They're handicapped by a need AND compulsion to use contractors for everything. Actual government employees didn't build drones; they were all developed and in many cases…

If I'm ever in charge of a PC capable of firing guns at people, then at a bare minimum I would disable the USB bus entirely, I probably wouldn't fit a NIC either. I'd also definitely install some of that software that makes the HDD read only and transparently passes through all writes to RAM. Fuckit, if I'm the US military I'd develop such a device in hardware. Send the recorded video/telemetry data to a write-only v…

"I would disable the USB bus entirely" So how would you support Mice, Keyboards and Joysticks? And how long would it take you to retrofit all of the some 100K+ PCs rated "secret" or above in the Government?
Post reply on HN