3 ms·
Not easily accessible doesn't mean inaccessible and invulnerable. Having a vulnerable OS means if it can be accessed even for a short time then you're done. Als
by kronos29296 9y ago
Not easily accessible doesn't mean inaccessible and invulnerable. Having a vulnerable OS means if it can be accessed even for a short time then you're done. Also in integrated systems Computers form an integral part where most of the automatic stuff happens. Most of the monitoring of all the dials you see in movies is done by computers. Screw that up and you have a big problem in your hands. Your ship may start sinking and you may not even know because the OS misinterpreted the input from a sensor responsible for this because of data corruption.
As systems become more sophisticated, manual intervention becomes that much more difficult and vulnerable systems create that much more weak spots. So screw up a system to sink a ship may one day become a reality.
- rwmj 9y agoIn other words if your ship is vulnerable to an enemy agent / spy / frogman sticking a USB key into any computer onboard, you've got problems.
- qubex 9y agoIf you have foreign combatants on your ship you have a problem, generally, whether they're armed with a USB stick or a plastic explosive.
- PeterisP 9y agoYou don't need foreign combatants on your ship. Something similar to the stuxnet approach (sprinkle infected USB drives around employees hoping they'll bring it into the facility) or spearphishing will easily work on sailors whenever they bring "reading material" from shore to the ship; and from there it's just a matter of some sloppiness (which is likely to happen) and the malware will spread from the personal devices to the ship's systems.
- rwmj 9y agoThe really devious approach would be to embed malware in the billions of USB keys manufactured in China every year. Not too hard if you make USB flash controllers. In fact I'd be surprised if $large_nation_states aren't doing this already.
- PeterisP 9y agoThat would burn the vulnerabilities/exploits you use in this malware (e.g. stuxnet used 4 zero-days that weren't discovered for years after it had been first deployed), causing them to be detected, the particular holes fixed, and the signature of that particular malware added to detection lists. No, you most likely want a targeted attack - manufacture such USB keys, distribute them only where you want them to be, and implement various triggers for the malware to delete itself (expiry date, IP ranges, regional settings) so that it doesn't spread worldwide beyond where you want it. Infecting millions of non-target systems is undesirable, that's how Stuxnet got discovered.
- andai 9y agoWasn't there some news of NSA etc intercepting shipments and doing exactly that?
- qubex 9y agoSeriously, I doubt that sailors and officers could be so clueless as to plug random USB drives into their embedded computers. Indeed I'd be really surprised if these machine's ports were exposed and their USB mass storage device drivers not disabled.
- RobAley 9y agoYou'd be surprised what sex-starved crew are capable of to get their fix of "reading material"...