Computer virus hits US Predator and Reaper drone fleet • Hacker News Board

Re: Computer virus hits US Predator and Reaper drone fleet

#121

Post by javert » Fri, Oct 07, 2011, 9:09 PM UTC

rdl wrote: post #114

javert wrote: post #102

Earlier quoted context omitted.

No. Windows boxes can communicate to an RTOS like VxWorks over a network just fine.

The level of performance needed in the GCS is even less than you might think, too -- for most of the UAVs, you don't have direct flight controls -- it's more like a naval ship, where you instruct it to go to certain altitude and fly a flight path you plot on a map. Some of them have more stick/rudder style controls, mainly for landings, which are often controlled by another operator physically at the launch/recovery…

it's more like a naval ship, where you instruct it to go to certain altitude and fly a flight path you plot on a map.

Woah, what Navy has ships like that? Bowser's navy?

But yah, I know what you're talking about.

Re: Computer virus hits US Predator and Reaper drone fleet

#122

Post by saturn7 » Fri, Oct 07, 2011, 9:14 PM UTC

wait wait this is my fav part, "At first, they followed removal instructions posted on the website of the Kaspersky security firm. “But the virus kept coming back,”" They have access to the same information my mom does? Don't they have their own people for stuff like that. Seriously Kaspersky isn't exactly the best antivirus program in the world and from their own website "The company’s headquarters are located in Moscow, Russia" US military uses a Russian antivirus company for help with military security.

Re: Computer virus hits US Predator and Reaper drone fleet

#123

Post by wanorris » Fri, Oct 07, 2011, 9:19 PM UTC

joeybaker wrote: post #105

brown9-2 wrote: post #90

Earlier quoted context omitted.

How could they do that analysis without having the virus or other data firsthand? They can only report what they have.

Analyse what they know: 1. It's a keylogger 2. They've been aware of it for weeks 3. They admit that they can't seem to beat it 4. These are isolated systems and it's likely that the attack was via USB drives Based on those facts, is it likely that this is benign? Are there known viruses that fit this pattern? Who's in charge of this project, and what do they say about it? Is it SOP for viruses to be able to complete…

1. As reported upthread, there was no press release to summarize. This was a story built on leaks from anonymous sources.

2. This is a Wired story republished on Ars, not actual Ars reportage.

I certainly agree that additional commentary from security researchers would be welcome, however.

Re: Computer virus hits US Predator and Reaper drone fleet

#124

Post by drzaiusapelord » Fri, Oct 07, 2011, 9:21 PM UTC

ChuckMcM wrote: post #46

misterbwong wrote: post #18

Earlier quoted context omitted.

Wow can anyone confirm this? I'm surprised that the drones themselves are running windows. If so, I presume it's win CE or a custom variant of?

Well the ISS uses windows [1] and there were reports of malware getting up there. They also had driver compatibility issues and were rebooting the systems that controlled the gyros a lot. One would think you could just write a mil-spec OS for their computers but government, and more specficially government procurement, doesn't really work that way. [1] http://www.zdnet.com/blog/security/malware-detected-at-the-i...

There's no virus on the ISS. It was on the laptops the crew carries around. Big difference. The control systems of the ISS aren't windows.

Re: Computer virus hits US Predator and Reaper drone fleet

#125

Post by wrs » Fri, Oct 07, 2011, 9:26 PM UTC

Hang on a minute... (a) You have malware on a computer on a secret network and you try to remove it? Shouldn't that be an automatic "shred the entire machine and start over" situation? (b) Flight suits? Really?

Re: Computer virus hits US Predator and Reaper drone fleet

#126

Post by hugh3 » Fri, Oct 07, 2011, 9:28 PM UTC

Pyrodogg wrote: post #13

hugh3 wrote: post #6

It seems to me that a more interesting question than "how did the malware get there?" is "why are they telling us that they found it?" Presumably the default thing to do under these circumstances would be to shut up about it, so the fact that they're broadcasting it to the whole world must mean something. In any case I wouldn't take any of the details at face value -- e.g. do they really not have any idea where it ca…

Because someone leaked it. > “We keep wiping it off, and it keeps coming back,” says a source familiar with the network infection, one of three that told Danger Room about the virus. “We think it’s benign. But we just don’t know.” The end of the article says they asked for an official response and were stonewalled. > The Air Force declined to comment directly on the virus. “We generally do not discuss specific vulner…

An unauthorized leak out of a secretive program disclosing a major vulnerability? That sounds very court-martialable. Especially considering the presumably small number of people who would know about it, and hence the high probability of the leaker getting caught, I find it hard to imagine anyone would risk it, let alone what their motivation for doing so would be. And especially not three different people.

Nope, I don't think the USAF leaks anything like this unless it means to.

Re: Computer virus hits US Predator and Reaper drone fleet

#127

Post by brianobush » Fri, Oct 07, 2011, 9:28 PM UTC

kakali wrote: post #17

brianobush wrote: post #5

Earlier quoted context omitted.

probably are... mission control at spacex has many windows terminals.

What does this have to do with SpaceX? They're not DoD and they don't fly drones.

They obviously fly satellites into low-orbit on contract for the govt. My point was control of expensive/dangerous things - by (or for) the govt with potentially dangerous sw.

Re: Computer virus hits US Predator and Reaper drone fleet

#128

Post by rbanffy » Fri, Oct 07, 2011, 9:28 PM UTC

bostonvaulter2 wrote: post #119

munin wrote: post #21

the quote used from the source seems to mean they don't know anything. a keylogger is benign? by what definition of benign are we operating under here? downside of things being "off the record" is this could be someone who oveheard two guys talking about something unrelated in the cafeteria, put "two and two" together, and picked up the phone. and since you can't get an official line ... you just run with the rumors…

Well if the keylogger is on an airgapped network it would be relatively hard for it to get data off of the network, so some might call it "benign".

unless, of course, it's designed to leak data out of the airgapped network when the next USB stick is connected...

Re: Computer virus hits US Predator and Reaper drone fleet

#129

Post by rbanffy » Fri, Oct 07, 2011, 9:33 PM UTC

pcottle wrote: post #72

jlarocco wrote: post #33

Earlier quoted context omitted.

The way it works is some AF guy in Nevada remotely controls the drones flying half way across the world. My guess is it's not the drones themselves running Windows, but the consoles used to communicate with the drones. It makes sense. AF guy gets to work, plugs in his USB drive filled with music and pulls up the drone control program... Though, now that I think about it, I would be disappointed, but not entirely surp…

No modern UAV has hardware capable of running an entire Windows installation. Think of arduino boards; those things can control huge robotics systems and they are very simple (and thus simple to debug). If you're designing a robot from the ground-up, why would you scale all the way to Windows? No one is going to be playing minesweeper inside the plane

> why would you scale all the way to Windows?

For the only reasons such stupid thing happens: the clueless manager wants the machine to run a modern OS and thinks Windows is the most modern OS out there.

post-downvote edit: I am saying nothing about viruses like Stuxnet, designed as weapons tailored to infect specific systems, for which no OS would be safe, but how brain-dead is it to design critical systems that control airborne weapon systems around an OS that's vulnerable to each and every piece of malware known to man?

Re: Computer virus hits US Predator and Reaper drone fleet

#130

Post by rbanffy » Fri, Oct 07, 2011, 9:35 PM UTC

rdl wrote: post #10

jarrett wrote: post #3

Does anybody know what operating system the infected machines run? If it's a Unix variant, ouch--I guess they have some really bad luck. But if this is just an everyday virus, as opposed to cyber warfare targeting the drones specifically, I can't help but think they might be running Windows. Air gap or not, that seems risky to me.

That's funny. It's Windows. Very little Unix anywhere in the DoD over the past few years on new systems; it's mainly legacy, or embedded in products they purchase. There are definitely some Unix server deployments within DoD even now, but they're few and far between. Blue Screen of Death and all.

> Blue Screen of Death and all.

Remember: for the military, death is just business as usual.