Computer virus hits US Predator and Reaper drone fleet • Hacker News Board

Re: Computer virus hits US Predator and Reaper drone fleet

#61

Post by CamperBob » Fri, Oct 07, 2011, 7:06 PM UTC

JonnieCache wrote: post #26

rdl wrote: post #15

Earlier quoted context omitted.

There are hundreds of thousands of machines and millions of removable drives. Tracking down every last instance of a piece of malware and then dealing with it is quite hard at that scale. Usually they fall back on policy ("no usb/removable drives") They're handicapped by a need AND compulsion to use contractors for everything. Actual government employees didn't build drones; they were all developed and in many cases…

If I'm ever in charge of a PC capable of firing guns at people, then at a bare minimum I would disable the USB bus entirely, I probably wouldn't fit a NIC either. I'd also definitely install some of that software that makes the HDD read only and transparently passes through all writes to RAM. Fuckit, if I'm the US military I'd develop such a device in hardware. Send the recorded video/telemetry data to a write-only v…

(Shrug) I just wouldn't use Windows. What's wrong with VxWorks for this type of thing?

Re: Computer virus hits US Predator and Reaper drone fleet

#62

Post by SingleShot » Fri, Oct 07, 2011, 7:06 PM UTC

misterbwong wrote: post #18

rdl wrote: post #10

Earlier quoted context omitted.

That's funny. It's Windows. Very little Unix anywhere in the DoD over the past few years on new systems; it's mainly legacy, or embedded in products they purchase. There are definitely some Unix server deployments within DoD even now, but they're few and far between. Blue Screen of Death and all.

Wow can anyone confirm this? I'm surprised that the drones themselves are running windows. If so, I presume it's win CE or a custom variant of?

I have never heard of a drone running anything other than an RTOS. However the ground stations for command/control/monitoring are typically run on traditional Windows-OS machines.

Re: Computer virus hits US Predator and Reaper drone fleet

#63

Post by ldar15 » Fri, Oct 07, 2011, 7:07 PM UTC

ghshephard wrote: post #48

roc wrote: post #42

Earlier quoted context omitted.

Or they could just fill all the usb ports with glue and remove the optical disk drives, if any. I thought the whole point of an air gap network is that nothing crosses the gap. Having those ports/devices available is just asking for it.

"usb ports with glue" Keyboards, Mice, Joysticks for these systems were probably designed with the idea that a USB bus would be available. It will take a while to replace all of these systems with their non-USB configurations. Given that BlueTooth is probably a no-no as well, how would one build a system these days that needs to support Mice, Joysticks, and Keyboards without using USB?

I'd glue those into a PCIe USB card or straight on to the motherboard. Then fill all the remaining holes with glue.

Re: Computer virus hits US Predator and Reaper drone fleet

#64

Post by CWuestefeld » Fri, Oct 07, 2011, 7:10 PM UTC

falcolas wrote: post #23

hugh3 wrote: post #6

It seems to me that a more interesting question than "how did the malware get there?" is "why are they telling us that they found it?" Presumably the default thing to do under these circumstances would be to shut up about it, so the fact that they're broadcasting it to the whole world must mean something. In any case I wouldn't take any of the details at face value -- e.g. do they really not have any idea where it ca…

It's a leak, not an official comment. The official comment about the incident from the story is: “We generally do not discuss specific vulnerabilities, threats, or responses to our computer networks, since that helps people looking to exploit or attack our systems to refine their approach,” says Lt. Col. Tadd Sholtis, a spokesman for Air Combat Command, which oversees the drones and all other Air Force tactical aircr…

Perhaps. But in modern politics, diplomacy, etc., intentional strategic "leaks" are a common practice, for many reasons.

Re: Computer virus hits US Predator and Reaper drone fleet

#65

Post by munin » Fri, Oct 07, 2011, 7:11 PM UTC

breck wrote: post #51

phillmv wrote: post #37

Earlier quoted context omitted.

>It's not that hard. eye roll

It's not that hard if you have a top notch engineer in charge and give him whatever he needs to get the job done. If you have a good engineer or a great engineer but any kind of bureaucracy, yes, it's near impossible.

google - top notch engineers, given whatever they need to get the job done, no bureaucracy, still get owned?

Re: Computer virus hits US Predator and Reaper drone fleet

#66

Post by [deleted] » Fri, Oct 07, 2011, 7:12 PM UTC

rdl wrote: post #10

jarrett wrote: post #3

Does anybody know what operating system the infected machines run? If it's a Unix variant, ouch--I guess they have some really bad luck. But if this is just an everyday virus, as opposed to cyber warfare targeting the drones specifically, I can't help but think they might be running Windows. Air gap or not, that seems risky to me.

That's funny. It's Windows. Very little Unix anywhere in the DoD over the past few years on new systems; it's mainly legacy, or embedded in products they purchase. There are definitely some Unix server deployments within DoD even now, but they're few and far between. Blue Screen of Death and all.

[deleted]

Re: Computer virus hits US Predator and Reaper drone fleet

#67

Post by snorkel » Fri, Oct 07, 2011, 7:13 PM UTC

misterbwong wrote: post #18

rdl wrote: post #10

Earlier quoted context omitted.

That's funny. It's Windows. Very little Unix anywhere in the DoD over the past few years on new systems; it's mainly legacy, or embedded in products they purchase. There are definitely some Unix server deployments within DoD even now, but they're few and far between. Blue Screen of Death and all.

Wow can anyone confirm this? I'm surprised that the drones themselves are running windows. If so, I presume it's win CE or a custom variant of?

I don't know myself but I'm willing to bet for sure it's Windows. DoD contractors prefer hardware that has simple-stupid .NET libraries, you won't find Linux drivers for most of it, nor a developer that can separated from the cozy comfort of Visual Stupio.

Re: Computer virus hits US Predator and Reaper drone fleet

#68

Post by pcottle » Fri, Oct 07, 2011, 7:14 PM UTC

SingleShot wrote: post #62

misterbwong wrote: post #18

Earlier quoted context omitted.

Wow can anyone confirm this? I'm surprised that the drones themselves are running windows. If so, I presume it's win CE or a custom variant of?

I have never heard of a drone running anything other than an RTOS. However the ground stations for command/control/monitoring are typically run on traditional Windows-OS machines.

If the drone is running a RTOS, wouldn't the GCS need RTOS-like reliability as well to communicate with it? That's all I can say (I think)

Re: Computer virus hits US Predator and Reaper drone fleet

#69

Post by CWuestefeld » Fri, Oct 07, 2011, 7:14 PM UTC

LiveTheDream wrote: post #29

One solution could be to keep machine images stored, like AMIs, and use a tool like Chef or Puppet to re-deploy a known good configuration. This strategy lends itself to the case where everything is virtualized. Of course, the source of the infection could be really nefarious. For example, imagine if someone replaced a keyboard with one that delivered a payload (trojan, keylogger, etc) when it is plugged into a compu…

One solution could be to keep machine images stored

Didn't I read recently about a real virus discovered in the wild, that could infect the BIOS of certain computers?

Re: Computer virus hits US Predator and Reaper drone fleet

#70

Post by pcottle » Fri, Oct 07, 2011, 7:15 PM UTC

rdl wrote: post #10

jarrett wrote: post #3

Does anybody know what operating system the infected machines run? If it's a Unix variant, ouch--I guess they have some really bad luck. But if this is just an everyday virus, as opposed to cyber warfare targeting the drones specifically, I can't help but think they might be running Windows. Air gap or not, that seems risky to me.

That's funny. It's Windows. Very little Unix anywhere in the DoD over the past few years on new systems; it's mainly legacy, or embedded in products they purchase. There are definitely some Unix server deployments within DoD even now, but they're few and far between. Blue Screen of Death and all.

I would think about this for a second; the DoD doesn't manufacture, produce, or design these systems. They contract that out. Considering that General Atomics Aeronautical is a smaller defense company (relative to other ones), I'm sure they could make their own decision about what OS to run on the planes and on the ground. That's all I can say...