5 ms·

It's a bit disingenuous to say that a ship is ’running’ an OS. It isn't like a computer that is entirely managed by a given software system. Here computers are

by qubex 9y ago

It's a bit disingenuous to say that a ship is ’running’ an OS. It isn't like a computer that is entirely managed by a given software system. Here computers are but one component of an integrated system, and I'm presuming these systems are air-gapped and not connected to public networks. I'd be very surprised if these machines were reachable by public networks, or indeed any network at all that originates beyond the confines of the ship itself. And by God doesn't it irk me to hear mentions of ’cyber’ as if it were an object.

arethuza 9y ago
Presumably there must be some connectivity from onboard networks - even if only while in port? [NB I meant to watch as HMSQNLZ sailed down the Forth last night - but was later than I was expecting. The MarineTraffic app currently has her doing circuits out in the North Sea past the mouth of the Forth]
OscarCunningham 9y ago
Never assume that a large organisation has a sane computer policy. For example the computers in voting machines and cars both have the least sane design you could think up. I don't see why the navy would be any more competent.
waldfee 9y ago
relevant: https://cyber.equipment/ https://cyber.equipment/
overlordalex 9y ago
Just because they're only a part of a system doesn't mean they're not crucial[1]. Also its alarming how many systems you would presume are air-gapped but actually aren't, and air-gapping doesn't prevent PEBKAC errors (eg stuxnet being spread by flashdrive) [1] See https://en.wikipedia.org/wiki/USS_Yorktown_(CG-48) https://en.wikipedia.org/wiki/USS_Yorktown_(CG-48) where a divide-by-zero error brought down the ships propulsion for almost 3 hours.
- dsfyu404ed 9y ago
  You've got it backwards. That situation happened because a "more technology because computers and buzzwords and shit" resulted in political pressure to get stuff done and the end result was an OS jammed into a place it shouldn't have been without more testing and 3hr of downtime. That's why we run software that's been verified to work even if it's old.
kronos29296 9y ago
Not easily accessible doesn't mean inaccessible and invulnerable. Having a vulnerable OS means if it can be accessed even for a short time then you're done. Also in integrated systems Computers form an integral part where most of the automatic stuff happens. Most of the monitoring of all the dials you see in movies is done by computers. Screw that up and you have a big problem in your hands. Your ship may start sinking and you may not even know because the OS misinterpreted the input from a sensor responsible for this because of data corruption. As systems become more sophisticated, manual intervention becomes that much more difficult and vulnerable systems create that much more weak spots. So screw up a system to sink a ship may one day become a reality.
- rwmj 9y ago
  In other words if your ship is vulnerable to an enemy agent / spy / frogman sticking a USB key into any computer onboard, you've got problems.
  - qubex 9y ago
    If you have foreign combatants on your ship you have a problem, generally, whether they're armed with a USB stick or a plastic explosive.
    - PeterisP 9y ago
      You don't need foreign combatants on your ship. Something similar to the stuxnet approach (sprinkle infected USB drives around employees hoping they'll bring it into the facility) or spearphishing will easily work on sailors whenever they bring "reading material" from shore to the ship; and from there it's just a matter of some sloppiness (which is likely to happen) and the malware will spread from the personal devices to the ship's systems.
      - rwmj 9y ago
        The really devious approach would be to embed malware in the billions of USB keys manufactured in China every year. Not too hard if you make USB flash controllers. In fact I'd be surprised if $large_nation_states aren't doing this already.
raarts 9y ago
On the other hand naval ships are increasingly designed around onboard distributed datacenters, where IT is grabbing the power: everything runs in virtualized, HA environments. Just like the rest of the world, eaten by software.

by qubex 9y ago

arethuza 9y ago

Presumably there must be some connectivity from onboard networks - even if only while in port? [NB I meant to watch as HMSQNLZ sailed down the Forth last night - but was later than I was expecting. The MarineTraffic app currently has her doing circuits out in the North Sea past the mouth of the Forth]

OscarCunningham 9y ago

Never assume that a large organisation has a sane computer policy. For example the computers in voting machines and cars both have the least sane design you could think up. I don't see why the navy would be any more competent.

waldfee 9y ago

relevant: https://cyber.equipment/ https://cyber.equipment/

overlordalex 9y ago

Just because they're only a part of a system doesn't mean they're not crucial[1]. Also its alarming how many systems you would presume are air-gapped but actually aren't, and air-gapping doesn't prevent PEBKAC errors (eg stuxnet being spread by flashdrive) [1] See https://en.wikipedia.org/wiki/USS_Yorktown_(CG-48) https://en.wikipedia.org/wiki/USS_Yorktown_(CG-48) where a divide-by-zero error brought down the ships propulsion for almost 3 hours.

dsfyu404ed 9y ago
You've got it backwards. That situation happened because a "more technology because computers and buzzwords and shit" resulted in political pressure to get stuff done and the end result was an OS jammed into a place it shouldn't have been without more testing and 3hr of downtime. That's why we run software that's been verified to work even if it's old.

kronos29296 9y ago

Not easily accessible doesn't mean inaccessible and invulnerable. Having a vulnerable OS means if it can be accessed even for a short time then you're done. Also in integrated systems Computers form an integral part where most of the automatic stuff happens. Most of the monitoring of all the dials you see in movies is done by computers. Screw that up and you have a big problem in your hands. Your ship may start sinking and you may not even know because the OS misinterpreted the input from a sensor responsible for this because of data corruption. As systems become more sophisticated, manual intervention becomes that much more difficult and vulnerable systems create that much more weak spots. So screw up a system to sink a ship may one day become a reality.

rwmj 9y ago
In other words if your ship is vulnerable to an enemy agent / spy / frogman sticking a USB key into any computer onboard, you've got problems.
- qubex 9y ago
  If you have foreign combatants on your ship you have a problem, generally, whether they're armed with a USB stick or a plastic explosive.
  - PeterisP 9y ago
    You don't need foreign combatants on your ship. Something similar to the stuxnet approach (sprinkle infected USB drives around employees hoping they'll bring it into the facility) or spearphishing will easily work on sailors whenever they bring "reading material" from shore to the ship; and from there it's just a matter of some sloppiness (which is likely to happen) and the malware will spread from the personal devices to the ship's systems.
    - rwmj 9y ago
      The really devious approach would be to embed malware in the billions of USB keys manufactured in China every year. Not too hard if you make USB flash controllers. In fact I'd be surprised if $large_nation_states aren't doing this already.

raarts 9y ago

On the other hand naval ships are increasingly designed around onboard distributed datacenters, where IT is grabbing the power: everything runs in virtualized, HA environments. Just like the rest of the world, eaten by software.