81–90 of 197 posts
Earlier quoted context omitted.
then the general will tell you "y'know the boys tell me that their job would be easier if they could listen to pandora on this puppy. i order you to connect it to the internet. if you don't comply, i'll have you arrested." have fun!
Despite being as fucked up as it is, that's not how the military works.
Earlier quoted context omitted.
"I would disable the USB bus entirely" So how would you support Mice, Keyboards and Joysticks? And how long would it take you to retrofit all of the some 100K+ PCs rated "secret" or above in the Government?
I'd attach them to the PCIe bus somehow, or otherwise wire them straight into the motherboard. Let me remind you that this computer can fire missiles at people , and has a potentially unlimited budget.
in what has become the US military’s most important weapons system. Seriously? Already?
http://www.nybooks.com/articles/archives/2011/sep/29/predato...
The statement you quote is impossible to rate as true or false. But here's a fuller quote from the article above:
"But there are also quite a few things about drones that you might not have heard yet. Most Americans are probably unaware, for example, that the US Air Force now trains more UAV operators each year than traditional pilots. [...] As I write this, the US aerospace industry has for all practical purposes ceased research and development work on manned aircraft. "
One solution could be to keep machine images stored, like AMIs, and use a tool like Chef or Puppet to re-deploy a known good configuration. This strategy lends itself to the case where everything is virtualized. Of course, the source of the infection could be really nefarious. For example, imagine if someone replaced a keyboard with one that delivered a payload (trojan, keylogger, etc) when it is plugged into a compu…
It's probably Norton Ghost, and I'd put $5 on the Ghost image being cooked bad.
Terrorism is primarily a problem of technology, imho. As things become more automated, they have a capacity to be used for both intended and unintended purposes. If our military relies on drones, it should make sure they can't be used against us :) But to illustrate my main point, 1000 years ago it was impossible for one man to destroy a lot of people. 500 years ago a man Guy Fawkes could use gunpowder to blow up par…
Earlier quoted context omitted.
Or the military staff is leaking this to motivate the higher-up who green-lit the contract to exert some pressure, because they have unfortunately-little direct power themselves.
I don't think that is really an 'or' case. Either someone with authority to disclose makes an official statement or someone lacking that authority leaks it.
I certainly didn't intend my reply as a counterpoint to the "if it's not official it's a leak" point.
Earlier quoted context omitted.
google - top notch engineers, given whatever they need to get the job done, no bureaucracy, still get owned?
If you're talking about the China hacks, they were using ie6. I'd argue that would preclude the "top notch engineer" label.
Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1, and SP2; Windows Server 2008 Gold, SP2, and R2; and Windows 7
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0...
Like hugh says, this doesn't add up at all. “We keep wiping it off, and it keeps coming back,” says a source familiar with the network infection, one of three that told Danger Room about the virus. “We think it’s benign. But we just don’t know.” C'mon. You're the military. "It just keeps coming back?" So you decide to do a press release about it? Please. I wouldn't have whined like that when I was de-malwareing neigh…
I don't know how I can be any more clear here: If they are not smart enough to keep malware off of what should be the most secure systems around, perhaps they shouldn't be building the fricking FLYING REMOTE-CONTROL DEATH MACHINES for a while, until they can figure out the basics. Capisce, guys?
But you are glossing over a LOT of detail here. The military doesn't work like Apple: they don't design, oversee, or directly control the construction of the hardware they use. And they shouldn't - the government is woefully inefficient at building products, that's what corporations are good at.
Here's the situation:
- The Air Force contracts General Atomics Aeronautical Systems to build UAVs. You can bet your ass the contract covers things like "protected from malware"
- General Atomics contracts out the different components of the UAV. No device worth $150M gets built by one company alone. The radar, the metal shell, the inside components, and each component of the software are all made by different companies.
- Each component is meticulously specified and rigorously tested. The makers of a component is contractually liable if they fuck up, giving them an incentive to do it slow & right. That's why it's so damn expensive.
- General Atomics puts the pieces together into the final product and delivers it to the Air Force after another round of rigorous testing.
- A team of guys in the Air Force are trained on operating the UAVs to deploy on missions.
=====================
So to say something like "Ugh, military, don't deploy UAVs if you can't keep it virus free!" is an oversimplification. These are extremely complex machines, with highly specialized embedded software, meant to deliver explodey things with extreme precision, while being operated from very far away. You can't just slap Norton on these things and call it a day.
It would be great if Ars had used its security and technical staff to tell us if this is a problem or the minor annoyance that the military says it is. The article amounts to little more than a summary of the drone program and a bit of "he said she said" http://archive.pressthink.org/2009/04/12/hesaid_shesaid.html reportage.