5 ms·

It’s unbelievable that any military allows its soldiers to deploy carrying consumer technology equipped with GPS tracking.

madez 9y ago
By now we all should have realized that all but a tiny fraction of people is illiterate about computers, the internet and their possibilities and dangers.
- madez 9y ago
  Let me piggyback on my own comment. Because there are only so few people who have factually so much power, I urge every hacker, everybody who understands the digital world, to act in the best faith of everybody. This technological revolution is too important to serve only a few. Luckily, many hackers do the right thing and don't do everything they could to maximize their immediate benefit. I sincerely hope for humanity, for the people of poor countries, for people suffering from corrupted governments, for people who weren't as fortunate as we were, that we provide them with the technology they need. But we must not maintain control over it to have control over them. Free and just software and hardware must prevail.
knolan 9y ago
There are troves of historically important photographs from various wars taken by soldiers with forbidden personal cameras. [0] In some ways this is similar however the immediacy of the data in an active conflict is more troubling. [0] https://www.amazon.com/Lens-Infantryman-Memoir-Photographs-Hidden/dp/0786428678 https://www.amazon.com/Lens-Infantryman-Memoir-Photographs-H...
ribasushi 9y ago
I have a close friend with the US military, who was deployed to Germany in 2017. Their brigade was moving various equipment from base to base. Their only means of communication with superiors was a bog-standard cell phone with a US-number SIM-card. Forget the tracking implications: orders were texted, often via SMS.
- 3pt14159 9y ago
  Yeah people on HN and elsewhere really have this warped view about how secure things are. They don’t understand that militaries and intelligence agencies are run by normal people with normal beauracies and dumb rules and shortsights. Look at the Snowden leaks, these people are not magical space wizards.
  - pferde 9y ago
    No, we understand that. We're just continually surprised that world's largest and most expensive army keeps shooting itself in the foot like this.
    - TeMPOraL 9y ago
      It's a trade-off, I think. I doubt there's much actionable intel for an enemy to be found in logistics orders of a base in Germany.
      - lostlogin 9y ago
        Maybe not now, but in a war there definitely is.
      - mseebach 9y ago
        Use your imagination. Having a scrap of inside knowledge is a great asset for recruitment. You establish yourself as an insider and the target is more likely to spill some beans. “Yeah, getting all those Foo widgets to that secret storage place was a real pain, I know! It was bunker X9, I think.. that’s the worst, am I right?"
      - izacus 9y ago
        More importantly, it's a bit harder to find (or operate) a reliable fully secure US owned communication system in Germany. Especially when compared to reliability and scale of the civilian GSM system.
      - acct1771 9y ago
JonnyNova 9y ago
The US military is ass-backwards when it comes to dealing with technology. Want to transfer files between computers? Can't use a thumb drive! You need to burn a disk (for real).
- toomanybeersies 9y ago
  That does't sound like terrible infosec. Flash drives are a huge security vulnerability. With more secure workstations you can't plug in any USB peripherals, because they're such big risk. Write only media is a lot safer, despite the waste it causes.
  - rocqua 9y ago
    I'm pretty sure SD cards have a lot less vulnerabilities than USB sticks. Especially because they cannot pretend to be a keyboard.
    - acdha 9y ago
      They can still pretend to have / not have files so it’s hard to say that you’ve verified nothing sensitive is leaving or that no malware is coming in.
    - lawl 9y ago
      There's WiFi enabled SD cards[0]. I had one of those and it was running Linux, you could SSH into it. Maybe the attack-surface to the host computer is smaller (I'm not sure about that either). But there's certainly enough bad stuff an SD card could do. [0] https://hackaday.com/2016/06/30/transcend-wifi-sd-card-is-a-tiny-linux-server/ https://hackaday.com/2016/06/30/transcend-wifi-sd-card-is-a-...
- acdha 9y ago
  If you look deeper into the security issues of USB and it’s less surprising: beyond the risk of basic malware, the devices are usually hackable which makes really hard to be certain about anything. Cutting out whole classes of attack makes sense when you know you have highly-skilled, well-funded adversaries and the budget to simply write off the extra overhead. Remember that their threat model doesn’t end at “my dirty picture collection leaked” but “we lost a war” or “we have to ask Congress for 10e9+ dollars for repairs/replacements”. This got a lot of attention a couple years ago: https://www.blackhat.com/us-14/briefings.html#badusb-on-accessories-that-turn-evil https://www.blackhat.com/us-14/briefings.html#badusb-on-acce... This kind of problem is endemic to small cheap devices, too – for example: https://www.bunniestudios.com/blog/?p=3554 https://www.bunniestudios.com/blog/?p=3554
sailfast 9y ago
I respectfully disagree. For most troops, deploying with your personal device is a huge morale boost. Blocking GPS on these devices is not practical, and might actually help when it comes to innovation in the field (helicopter pilots using iPads to innovate routing, for example) - not to mention just basic morale (movies / music / what have you). These tools also go a long way toward operational readiness / fitness. They incentivize these things and are used for a reason. There are trade-offs with all these things, not to mention the practical issues of blocking them. I would expect, however, that identifying this as a huge security problem is relatively easy. "HEY DO NOT UPLOAD YOUR RUN WHILE DEPLOYED OR YOU MAY GET MORTARED" is likely a better option here, just below "MAKE SURE YOU WEAR YOUR NEON BELT" on every sign.
- lostlogin 9y ago
  > basic morale (movies / music / what have you). Communication with family and friends would be my first thought. Many historical accounts put a lot of emphasise on the mail delivery and what the news from home was. It must be/have been a significant problem dealing with the mail when you had a lot of troops in the field.
  - sailfast 9y ago
    Totally Agree. I was not assuming broadband capability / cell service for my hypothetical (also traditional comms may be limited in remote / classified environments) but that's definitely another reason to have a personal device. Comms with family would be critical if they are possible.
- jonahx 9y ago
  > "HEY DO NOT UPLOAD YOUR RUN WHILE DEPLOYED OR YOU MAY GET MORTARED" is likely a better option here, just below "MAKE SURE YOU WEAR YOUR NEON BELT" on every sign. I take the whole lesson here to be: information can leak in unexpected ways. So solving this particular issue does nothing to help the larger problem. I'd imagine there are countless similar side channel leaks that already exist... and then even more that don't exist yet but will retroactively exist with a future phone or app update. The fox is in henhouse.
einarfd 9y ago
I'm not surprised at all. If you look at GPS watches like Garmin tactix Bravo. It has a feature set, where some of the features, really only makes sense in a military/hunting setting. Although I wonder what kind of animal you are hunting if you start your hunting trip by doing a HALO parachute jump. Garmin is not the only one making those kind of GPS watches either. I believe that Suunto has similar watches as well. Obviously the soldiers should not be uploading their GPS tracks to Strava. But banning your non special forces soldiers from buying the same "civilian" watches that your special forces soldiers use. Sounds like a morale killer.

madez 9y ago

By now we all should have realized that all but a tiny fraction of people is illiterate about computers, the internet and their possibilities and dangers.

madez 9y ago
Let me piggyback on my own comment. Because there are only so few people who have factually so much power, I urge every hacker, everybody who understands the digital world, to act in the best faith of everybody. This technological revolution is too important to serve only a few. Luckily, many hackers do the right thing and don't do everything they could to maximize their immediate benefit. I sincerely hope for humanity, for the people of poor countries, for people suffering from corrupted governments, for people who weren't as fortunate as we were, that we provide them with the technology they need. But we must not maintain control over it to have control over them. Free and just software and hardware must prevail.

knolan 9y ago

There are troves of historically important photographs from various wars taken by soldiers with forbidden personal cameras. [0] In some ways this is similar however the immediacy of the data in an active conflict is more troubling. [0] https://www.amazon.com/Lens-Infantryman-Memoir-Photographs-Hidden/dp/0786428678 https://www.amazon.com/Lens-Infantryman-Memoir-Photographs-H...

ribasushi 9y ago

I have a close friend with the US military, who was deployed to Germany in 2017. Their brigade was moving various equipment from base to base. Their only means of communication with superiors was a bog-standard cell phone with a US-number SIM-card. Forget the tracking implications: orders were texted, often via SMS.

3pt14159 9y ago
Yeah people on HN and elsewhere really have this warped view about how secure things are. They don’t understand that militaries and intelligence agencies are run by normal people with normal beauracies and dumb rules and shortsights. Look at the Snowden leaks, these people are not magical space wizards.
- pferde 9y ago
  No, we understand that. We're just continually surprised that world's largest and most expensive army keeps shooting itself in the foot like this.
  - TeMPOraL 9y ago
    It's a trade-off, I think. I doubt there's much actionable intel for an enemy to be found in logistics orders of a base in Germany.
    - lostlogin 9y ago
      Maybe not now, but in a war there definitely is.
    - mseebach 9y ago
      Use your imagination. Having a scrap of inside knowledge is a great asset for recruitment. You establish yourself as an insider and the target is more likely to spill some beans. “Yeah, getting all those Foo widgets to that secret storage place was a real pain, I know! It was bunker X9, I think.. that’s the worst, am I right?"
    - izacus 9y ago
      More importantly, it's a bit harder to find (or operate) a reliable fully secure US owned communication system in Germany. Especially when compared to reliability and scale of the civilian GSM system.
    - acct1771 9y ago

JonnyNova 9y ago

The US military is ass-backwards when it comes to dealing with technology. Want to transfer files between computers? Can't use a thumb drive! You need to burn a disk (for real).

toomanybeersies 9y ago
That does't sound like terrible infosec. Flash drives are a huge security vulnerability. With more secure workstations you can't plug in any USB peripherals, because they're such big risk. Write only media is a lot safer, despite the waste it causes.
- rocqua 9y ago
  I'm pretty sure SD cards have a lot less vulnerabilities than USB sticks. Especially because they cannot pretend to be a keyboard.
  - acdha 9y ago
    They can still pretend to have / not have files so it’s hard to say that you’ve verified nothing sensitive is leaving or that no malware is coming in.
  - lawl 9y ago
    There's WiFi enabled SD cards[0]. I had one of those and it was running Linux, you could SSH into it. Maybe the attack-surface to the host computer is smaller (I'm not sure about that either). But there's certainly enough bad stuff an SD card could do. [0] https://hackaday.com/2016/06/30/transcend-wifi-sd-card-is-a-tiny-linux-server/ https://hackaday.com/2016/06/30/transcend-wifi-sd-card-is-a-...
acdha 9y ago
If you look deeper into the security issues of USB and it’s less surprising: beyond the risk of basic malware, the devices are usually hackable which makes really hard to be certain about anything. Cutting out whole classes of attack makes sense when you know you have highly-skilled, well-funded adversaries and the budget to simply write off the extra overhead. Remember that their threat model doesn’t end at “my dirty picture collection leaked” but “we lost a war” or “we have to ask Congress for 10e9+ dollars for repairs/replacements”. This got a lot of attention a couple years ago: https://www.blackhat.com/us-14/briefings.html#badusb-on-accessories-that-turn-evil https://www.blackhat.com/us-14/briefings.html#badusb-on-acce... This kind of problem is endemic to small cheap devices, too – for example: https://www.bunniestudios.com/blog/?p=3554 https://www.bunniestudios.com/blog/?p=3554

sailfast 9y ago

I respectfully disagree. For most troops, deploying with your personal device is a huge morale boost. Blocking GPS on these devices is not practical, and might actually help when it comes to innovation in the field (helicopter pilots using iPads to innovate routing, for example) - not to mention just basic morale (movies / music / what have you). These tools also go a long way toward operational readiness / fitness. They incentivize these things and are used for a reason. There are trade-offs with all these things, not to mention the practical issues of blocking them. I would expect, however, that identifying this as a huge security problem is relatively easy. "HEY DO NOT UPLOAD YOUR RUN WHILE DEPLOYED OR YOU MAY GET MORTARED" is likely a better option here, just below "MAKE SURE YOU WEAR YOUR NEON BELT" on every sign.

lostlogin 9y ago
> basic morale (movies / music / what have you). Communication with family and friends would be my first thought. Many historical accounts put a lot of emphasise on the mail delivery and what the news from home was. It must be/have been a significant problem dealing with the mail when you had a lot of troops in the field.
- sailfast 9y ago
  Totally Agree. I was not assuming broadband capability / cell service for my hypothetical (also traditional comms may be limited in remote / classified environments) but that's definitely another reason to have a personal device. Comms with family would be critical if they are possible.
jonahx 9y ago
> "HEY DO NOT UPLOAD YOUR RUN WHILE DEPLOYED OR YOU MAY GET MORTARED" is likely a better option here, just below "MAKE SURE YOU WEAR YOUR NEON BELT" on every sign. I take the whole lesson here to be: information can leak in unexpected ways. So solving this particular issue does nothing to help the larger problem. I'd imagine there are countless similar side channel leaks that already exist... and then even more that don't exist yet but will retroactively exist with a future phone or app update. The fox is in henhouse.

einarfd 9y ago

I'm not surprised at all. If you look at GPS watches like Garmin tactix Bravo. It has a feature set, where some of the features, really only makes sense in a military/hunting setting. Although I wonder what kind of animal you are hunting if you start your hunting trip by doing a HALO parachute jump. Garmin is not the only one making those kind of GPS watches either. I believe that Suunto has similar watches as well. Obviously the soldiers should not be uploading their GPS tracks to Strava. But banning your non special forces soldiers from buying the same "civilian" watches that your special forces soldiers use. Sounds like a morale killer.