Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
Security The Military News

Air Force Comments On Drone Malware 74

Posted by samzenpus from the nothing-to-see-here-citizen dept.
wiredmikey writes "Air Force officials have revealed more details about a malware infection that impacted systems used to manage a fleet of drones at the Creech Air Force Base in Nevada as reported last week. The 24th Air Force first detected the malware – which they characterized as a 'credential stealer' as opposed to a keylogger as originally reported — and notified Creech Air Force Base officials Sept. 15 that malware was found on portable hard drives approved for transferring information between systems. The infected computers were part of the ground control system that supports remotely-piloted aircraft (RPA) operations. The malware is not designed to transmit data or video or corrupt any files, programs or data, according to the Air Force. The ground system is separate from the flight control system used by RPA pilots to fly the aircrafts."
This discussion has been archived. No new comments can be posted.

Air Force Comments On Drone Malware More

Air Force Comments On Drone Malware

Comments Filter:

  • I wonder if he was told he won the Slobobvian Lottery before he was hit.

    • Re: (Score:1)

      by mjwx ( 966435 )

      I wonder if he was told he won the Slobobvian Lottery before he was hit.

      So there is an entire country for Slobs and the have a lottery?

      Why is this only being posted on /. now?

    • At first I thought you were referring to the 80's movie Making The Grade "Exchange student from Lower Slobivia," but then stumbled upon the fact that Slobovia is used as a reference to any "non specific, far-away country." Wikipedia on Slobovia [wikipedia.org]

  • Possible typo. (Score:5, Informative)

    by pushing-robot ( 1037830 ) on Friday October 14, 2011 @12:11AM (#37710508)

    A "feet of drones" is the proper collective noun only when they're on the ground. In the air they're known as a "bungle".

    • Re: (Score:2, Informative)

      by Soulskill ( 1459 ) Works for Slashdot

      Fixed. Thanks for keeping us on our toes.

    • A "feet of drones" is the proper collective noun only when they're on the ground. In the air they're known as a "bungle".

      Prior Art!

      A 'bungle' is a large group of politicians in flight from reality.

      • Although, thinking about it a bit further, a bunch of drones in the air and the aforesaid flight of politicians are pretty similar concepts.

        Carry on!

  • Yeah, this makes much more sense. Didn't stop everyone from reporting that the drone fleet was infected with viruses when this first broke. I could be wrong but I'm fairly sure the Predator isn't running Windows 98 (or god help us all). I think those of us with some sense were wondering when the real story was going to break.

    • Re: (Score:1)

      by Anonymous Coward

      The drone itself may not be running a standard OS, but it's entirely possible that part of the flight control system might. More critical systems have been built atop Windows platforms before, and the DoD doesn't have a particularly good record with computer-related sensibilities, see: How all .mil domains are digitally signed by a CA that no web browser (including those on DoD computers) recognizes as legitimate.

    • Question! (Score:5, Funny)

      by MrEricSir ( 398214 ) on Friday October 14, 2011 @12:38AM (#37710654) Homepage

      If a drone running Windows 98 is destroyed, is it okay to re-use the license key on a new one?

      • Re: (Score:1)

        by atisss ( 1661313 )

        It will hang into BSOD (Blue Sky Of Death) and stay in the air forever, so it will technically still be running licensed version, so - no.

      • Yes, but you still have to call the 1-800 number in india and let them know you don't have in installed on more than on drone in your household.

    • Windows autorun strikes again. To nobody's great surprise.

  • Does this suggest (Score:4, Interesting)

    by phantomfive ( 622387 ) on Friday October 14, 2011 @12:21AM (#37710576) Journal

    malware was found on portable hard drives approved for transferring information between systems.

    Does that suggest that someone forgot to turn off auto-run? Or was it really only on the hard drive, and never actually infected the controlling computers?

  • My favorite quote from the article [securityweek.com]: “We continue to strengthen our cyber defenses, using the latest anti-virus software and other methods to protect Air Force resources and assure our ability to execute Air Force missions,” Cook said in a statement. “Continued education and training of all users will also help reduce the threat of malware to Department of Defense systems.” Why do I get the feeling that Norton/McAffee are offering their 'latest anti-virus software" to "strengthen our

    • Re: (Score:1)

      by Anonymous Coward

      99% of the usage is broken and misunderstood. I'd say that only 1% of the populace actually understand security, and a diminished number actually take steps to placate the problem. When I hear that someone thinks that sticky plaster Anti Virus - will be like a hand barrier cream I cringe. This is the nation state that had a hand in Stuxnet.

      Apparently, the air force has deduced that they understand this malware, and its just a password stealer for online games. So that's alright then. /SARCASM/ off.

      I work in

  • Sounds an awful lot like media damage control to me. Downplaying the scale of the failure and misinforming the public once the full scale has became known and the utter mind-boggling disaster it was has became apparent. So far it was "We've got an embarassing problems", and now it became "If the press learns of the full scale, heads will fall like rain."

    • Sounds like you wouldn't believe any explanation that doesn't fit your theory of what happened.

  • Quite sophisticated. Found "on hard drives approved for transferring information between systems". I'm sure it's harmless though. No doubt the pilots surfing Facebook use a different code to log into the kill drones flying above our troops...right?

  • Whitewash (Score:4, Insightful)

    by Daniel Phillips ( 238627 ) on Friday October 14, 2011 @02:05AM (#37710950)

    The implication is apparently that since it was only the ground control system, not the flight control system, there was no danger of the aircraft control being compromised. This is false. The ground control system is in fact in complete control of the aircraft, if it so chooses. The bottom line is, somebody should be put in the brig for allow Windows anywhere near a UAV.

    • Re:Whitewash (Score:4, Insightful)

      by Kaedrin ( 709478 ) on Friday October 14, 2011 @04:47AM (#37711716)

      Wrong. Someone does however need to explain why systems like this don't have SRP (Software Restriction Policies) or AppLocker Policies enabled with a ridged white listing rule set.

      Servers/Drones/etc like these should NEVER allow any account permission to run non-whitelisted applications. The fact is, barely any code should be allowed to execute, and itâ(TM)s completely inexcusable for them to not be using the whitelisting rules that are part of Windows/Active Directory. In an environment like this where there are ridged policies for doing practically anything related to production software, preventing rogue code execution should be mind boggling easy for one moderately skilled administrator.

      • Re: (Score:2, Troll)

        by zero0ne ( 1309517 )

        The real question is how can someone build drone piloting software that actually works well on Windows?

        I just don't see any type of Windows platform offering the kind of precision & computing speed needed to control a UAV 100 to 10,000 miles away.

        Seems like something you would want done in the fastest language available, not some hodgepodge of .NET & Silverlight.
        (I think I just threw up in my mouth a little)

        • Re: (Score:2)

          by merky1 ( 83978 )

          If you RTFA, you would have determined that the flight control system is not infected, and the the systems that are in question are ancillary information systems. Think of a monitor with google maps...

          The reason they use removable HDD's is probably so they can model the necessary mission data offsite, and then "replay" it at mission time.

        • Re: (Score:1)

          by Anonymous Coward

          I just don't see any type of Windows platform offering the kind of precision & computing speed needed to control a UAV 100 to 10,000 miles away.

          Do you know anything about Windows programming, or even Windows itself?

        • I remember reading somewhere that the latency is actually huge, something like 15-30 seconds (they are controlled from Nevada, after all). The AUVs do most of the flying themselves, and the people in Nevada tell them "go here" "go there" and "fire missile at that target." Then for takeoff and landing control is passed to someone onsite from the Middle East who has better latency.

      • Or just don't let Windows anywhere near deadly weapons, how about. Never has been secure, never will be, not in any real, shipping form, except according to cynical apologists with their hands in the cookie jar.

    • Re: (Score:2)

      by Ibiwan ( 763664 )
      They're still using awkward wording. Neither the computer on the plane nor the computer the pilot is sitting in front of runs Windows. In the same trailer, there are also several machines used for data analysis that DO run Windows, and are the only place this malware (virus? worm? trojan? I never could keep them straight) could possible have taken hold. Also, the "credentials" in question are video game registration keys. Good luck finding many of those on these workstations!
  • If the computers are really not connected to the Internet as I had read from the earlier articles, the virus can't send any information it captures nor can it receive commands. At most it could format their hard drive.

    • Re: (Score:1)

      by iive ( 721743 )

      Have you forgotten about Stuxnet?
      That virus was designed to sabotage industrial equipment that was not connected to internet. It was designed to propagate though removable drives and local networks. And Stuxnet did reach its target and sabotaged it successfully without even causing suspicion.

      Imagine that the Chinese/Russians modify Stuxnet (I've read it is quite modular) to infiltrate the UAV control. Imagine that they add module that activates only when the drone enters GPS coordinates of China/Russia. Thi

  • Why don't they allow only signed software that is on a whitelist to run on their computers?

    Sure, whitelists are highly undesirable for ordinary consumers (to say the least..), but for the military or other domains with high security demands they seem to make sense to me. Shouldn't their software be audited and signed first anyway? Shouldn't they run a custom BIOS and an operating system that can check signatures before running code? Are there technical reasons against this?

    Just wondering.

    • you assume the hardware / OS is sufficient for the function you described. How many hacked up versions of Windows CE do you know that can be properly software secured? I still remember bypassing whitelists by renaming Netscape to Notepad. :)

    • Re: (Score:2)

      by hAckz0r ( 989977 )
      And they should use a "default deny security enforcement policy" (e.g. Bit9 software). If the application's signature is not on the permitted list it should be prevented from running. Period.

      This however does not fix some underlying problems with remote distributions. Datasets have become too large to be easily handled on standard CD/DvD's, so many organizations have resorted to using hard drives to pass information. I still see potential problems. When mounting an 'untrusted' drive many things happen, n

  • This is a farce. Neither windows, nor linux or OS/X or commodity PC hardware should be let within 100 miles of these systems. Wtf are the military playing at? Is their trillion dollar budget not enough to afford some proper kit and in house software FFS?

    • The military has been told by GAO and OMB and other bean counters to use COTS --- it's also more expensive to get things developed on proprietary systems and that runs into single source issues.

      Arguably everyone should use NSA's security-enhanced Linux:

      http://www.nsa.gov/research/selinux/ [nsa.gov]

      Or similarly secured systems.

      • BINGO! Policies that carry significant political political weight, especially when they become fashionable routes to swift approval, are especially prone to misunderstanding, misapplication, and imbalance between indented and unintended consequences. COTS, when misused as a panacea to achieve affordability, tends to not only be less affordable in the long run, but often leads to less effective solutions. The problem is that panaceas rarely are. Policies mindlessly pursued lead to poor results decoupled from
  • "Remain calm, all is well."

  • All that the keylogger captured was a bunch of sequences of "IDDQD" and "IDKFA" typed over and over again.

  • Make the datalogger very infectious but otherwise look harmless.

    The datalogger dumps the information back into someplace like say the portable hard drive that brought it into the secured area to begin with. It sets up shop and makes a gazillion copies of the data it was designed to ferret out but it does nothing but log the data.

    Then the portable hard drive gets walked out of the building and used on other hosts, at least one of which is infected with a transmission vector which picks up the payload and for

  • But if the offending piece of malware was on an NTFS file system, and accessed the ADS, hundreds of megabytes worth of lifted data could be stored, and nobody would be the wiser unless they checked to see what kind of data was hidden if resource forking was implemented. Pray this isn't the case, because if it is, Victoria won't have too many secrets left.

Slashdot Top Deals

Decaffeinated coffee? Just Say No.

Close