4 ms·

Wait, is this write up by BAE systems, as in British aerospace engineering? If so, I'm scratching my head, as it appears they do have knowledgeable infosec peo

Wait, is this write up by BAE systems, as in British aerospace engineering? If so, I'm scratching my head, as it appears they do have knowledgeable infosec people, but their security is laughable. Anyone want schematics and parts lists for anything they make? There's an email address you can send a message to that will respond with them. All plain-text, no validation. The attitude that good security costs trillions and is therefore unattainable is all pervasive.

r0xz 10y ago
This write up is from their cyber division, which is separated from the main aerospace business.
ShinyCyril 10y ago
> Anyone want schematics and parts lists for anything they make? There's an email address you can send a message to that will respond with them. All plain-text, no validation. Could you expand on this?
sipos 10y ago
How valuable are the designs to most military parts though? If I am a government looking to buy cruise missiles (for example), do I really care if lots of people have the design? What I care about is whether a company will sell to me, how much it will cost to get the number I want made, whether they can continue to support them and, continue to produce them at the rate I want. Sure, there are some technologies that I want to not be leaked to allies where significant parts of how they work aren't public knowledge (stealth material/coating composition maybe?) but, it is only those that I would actually care about being secret, if I was a government/military buying hardware. If it isn't hard to figure out, I'd rather it was easy to access the knowledge so my engineers/technicians can get access. BAE Systems are a significant weapons manufacturer. Sorting security 'problems' like the one you are describing isn't that expensive so, if it was bothering their clients, you'd think they would do it. It is more plausible that they just don't care that the this information is so easy to access because it is easier either for them or their clients.
nickpsecurity 10y ago
You serious? Have you never heard of XTS-400 and SAGE guard? XTS decends from first, secure system to be evaluated called SCOMP. They've dropped assurance a bit due to market demand for features over assurance but it still has more security than most OS's. Also, SCOMP had an IO MMU before that phrase was invented and fashionable. :) Google SCOMP, XTS-400, or SAGE guard to know what kind of INFOSEC goes back to 80's in military before firewalls were invented or security went mainstream.
ttt54 10y ago
This is a write up by BAE Systems Applied Intelligence (and possibly not an official one, not sure), previously known as Detica, who were acquired by BAE a few years back. They have a consultancy side and a security side.
ceejayoz 10y ago
> Anyone want schematics and parts lists for anything they make? There's an email address you can send a message to that will respond with them. All plain-text, no validation. This seems like an odd complaint. I can do this with my car and dishwasher, too. Unless BAE makes classified military stuff they're exposing in this manner it seems less like a security hole and more like a useful thing for people maintaining the stuff they manufacture.
- userbinator 10y ago
  Indeed, that sounds like "a feature, not a bug". A lot of other companies don't even bother answering if you ask them for such things.

r0xz 10y ago

This write up is from their cyber division, which is separated from the main aerospace business.

ShinyCyril 10y ago

> Anyone want schematics and parts lists for anything they make? There's an email address you can send a message to that will respond with them. All plain-text, no validation. Could you expand on this?

sipos 10y ago

How valuable are the designs to most military parts though? If I am a government looking to buy cruise missiles (for example), do I really care if lots of people have the design? What I care about is whether a company will sell to me, how much it will cost to get the number I want made, whether they can continue to support them and, continue to produce them at the rate I want. Sure, there are some technologies that I want to not be leaked to allies where significant parts of how they work aren't public knowledge (stealth material/coating composition maybe?) but, it is only those that I would actually care about being secret, if I was a government/military buying hardware. If it isn't hard to figure out, I'd rather it was easy to access the knowledge so my engineers/technicians can get access. BAE Systems are a significant weapons manufacturer. Sorting security 'problems' like the one you are describing isn't that expensive so, if it was bothering their clients, you'd think they would do it. It is more plausible that they just don't care that the this information is so easy to access because it is easier either for them or their clients.

nickpsecurity 10y ago

You serious? Have you never heard of XTS-400 and SAGE guard? XTS decends from first, secure system to be evaluated called SCOMP. They've dropped assurance a bit due to market demand for features over assurance but it still has more security than most OS's. Also, SCOMP had an IO MMU before that phrase was invented and fashionable. :) Google SCOMP, XTS-400, or SAGE guard to know what kind of INFOSEC goes back to 80's in military before firewalls were invented or security went mainstream.

ttt54 10y ago

This is a write up by BAE Systems Applied Intelligence (and possibly not an official one, not sure), previously known as Detica, who were acquired by BAE a few years back. They have a consultancy side and a security side.

ceejayoz 10y ago

> Anyone want schematics and parts lists for anything they make? There's an email address you can send a message to that will respond with them. All plain-text, no validation. This seems like an odd complaint. I can do this with my car and dishwasher, too. Unless BAE makes classified military stuff they're exposing in this manner it seems less like a security hole and more like a useful thing for people maintaining the stuff they manufacture.

userbinator 10y ago
Indeed, that sounds like "a feature, not a bug". A lot of other companies don't even bother answering if you ask them for such things.