4 ms·

Taking a look at a covert CIA virtual fencing solution [video]

79 points by Jerry2 7y ago

deleted 7y ago
[deleted]
nl 7y ago
Geeze - I'm all for freely discussing engineering but wow I'm not sure I've ever seen a more directly dangerous piece of work. For those who haven't read what this is about: The system is designed to stop weapon systems working outside specific geographic areas. This is so (for example) the US can arm a specific group in a conflict and if (when?) those arms fall into the wrong hands they are useless outside the area of that conflict. This work discusses weaknesses in the lockdown system. It's pretty advanced work, so it isn't like a script-kiddie is going to work this out themselves.
- maxfan8 7y ago
  I agree. Presenting on Protego doesn't seem like a good idea – the information given in this talk could aid terrorists.
  - jlgaddis 7y ago
    Toyota trucks are often used by terrorists. I don't think they should stop making them, though.
    - nl 7y ago
      I had a vague idea that perhaps there is a difference between a Toyota truck and a Stinger Anti-aircraft missile. But yes, I see we can't possible make that distinction.
  - Buge 7y ago
    It could also aid the CIA in making a more secure virtual fencing solution. It's similar to the debate about full disclosure vs coordinated disclosure. Some companies pay for bug bounties. Additionally it could convince the CIA to distribute less weapons.
    - maxfan8 7y ago
      This is a good point! However, the CIA surely has sufficient internal incentives to fix privately disclosed vulnerabilities. There is no need for "bad publicity" to motivate them to become more secure. The CIA may even have already started working on fixes after Vault 7. Who knows? The only thing this action serves to do is allow less than trusted third parties abuse the weapons given to them (a possibility that the speaker clearly recognizes).
      - Buge 7y ago
        > the CIA surely has sufficient internal incentives to fix privately disclosed vulnerabilities. Do they? Also various people could have different definitions of "sufficient". They might previously have had 3 people spending half their time on it, and this might cause them to increase it to 5 people working full time on it. Do major tech companies (Apple, Google, Microsoft) have less internal incentives than the CIA? This XSS vulnerability apparently took a year to be fixed: https://www.openbugbounty.org/reports/164180/ https://www.openbugbounty.org/reports/164180/
- deogeo 7y ago
  Perhaps the presenter views it as hampering a dangerous foreign power in its attempts to meddle with other nations. The CIA doesn't exactly have a clean record.
  - fit2rule 7y ago
    Yes, this. Why do people think the CIA should have a right to do this, but other nations' intelligence agencies shouldn't? The CIA are not the good guys here. This kind of duplicity just causes more war.
    - nl 7y ago
      I agree with this argument completely. No one is claiming the CIA doesn't also have responsibility here. I still don't think publishing a roadmap to disable this is anything like responsible disclosure. One of broader societies' big problems with technology proponents is the disclaiming of responsibility. I see this as a perfect example: - We know these weapons have fallen into the wrong hands - We know this is one of the techniques used to disable them - We know the groups who have them now want to use them in terrorist acts - The justification is "Well the CIA shouldn't have given them out/someone else might work out these techniques anyway" Both of these these things given as justifications may be true and yet it is still wrong to do this. An analogy is that someone leaves some cash at home while they go out. If someone posts on Twitter "hey person X has left cash at home and they have gone out and their address is XXX and here is how to bypass the model lock they have" is that defensible?
      - dmurray 7y ago
        If you think the person with the cash is the bad guy, maybe yes?
        nl 7y ago
        The "person with the cash" is the families on the civilian airliners that are more likely to be shot down.
- tastroder 7y ago
  > It's pretty advanced work, so it isn't like a script-kiddie is going to work this out themselves. Why not? Not sure what script kiddie would be motivated and have the necessary access to hack into abandoned weapons systems, whereas some motivated terrorist with an EE degree in an internet-connected cave structure would certainly have access to the same publicly available information these researchers did. They're not supplying a PoC to wannabe warlords here, on the other hand they provide an interesting new perspective on how these, already leaked, technologies were intended to be used.
- craftinator 7y ago
  Dangerous? Yes. At the same time, he built this presentation using two things; Google-fu for open source intelligence, and a background in microcontrollers. "Untrustworthy third parties", as described in the talk, also possess these skills (look up the sophistication of IEDs used in Iraq and Afghanistan if you don't believe me). This guy invested his spare time over a few weeks or months to do the research on this. Again, this is entirely doable by most people. The purpose of doing this kind of security research is to push organizations (the CIA obviously watches the CCC presentations every year) to fix prior security mistakes before they are misused, and to refine better security practices in the future.
Dinux 7y ago
It should be mentioned that this work was mostly speculation, like the speaker said. Most of the attacks shown are not 'advanced' by any means. Like the speaker explained; 'anyone can buy a GPS jammer for a few bucks online'. The research they did indeed confirmed GPS is the weakspot. However, such geofence systems are a step-up from any equipment lacking this ability. Its not so much about rendering these systems completely unusable outside of their intended purpose, but more about slowing down their use. The later will have a much better chance of accomplishing this goal. Assuming the claims made in this research are true, then its more likely the CIA wants to limit the use of US supplied weapons systems, not stop a war. And the CIA has quite the history there. Also, the situations in which such weapons systems are deployed do not exactly resemble the lab-like circumstances (like faraday cage, EE-tooling et.) necessary for these attacks.
- onetimemanytime 7y ago
  this is critical, considering that today's "allies" are very likely to be our enemies tomorrow. Or they can just sell ManPads to another group and (mil and/or civilian) planes would be falling out of the skies. Imagine if Stingers we gave to the Taliban were still in working mode...
  - wavefunction 7y ago
    This seems like it will lead to more CIA arming of militant groups which according to your post means likely more enemy militant groups. I'd liken this to giving police officers tasers or firearms: instead of having to consider de-escalating situations, they can just shoot or tase someone instead. I would prefer my government be forced to carefully consider whether giving any group weapons rather than "oh yeah totally cool we've got ways to shut them down if they turn on us."
perl4ever 7y ago
I'm glad the CIA is doing something; I guess virtual fencing hasn't really been a thing since the Summer Olympics tie-in games of the 80s. I'm surprised, really, given the existence of "Bus Simulator", "Farming Simulator" and so on, I would have thought there would be lots of ultra realistic virtual fencing. But a minute or two Googling didn't turn anything up - mostly people discuss fencing-like activities in random games with swordplay.
- tlb 7y ago
  The article mentions that the term 'fencing' is used in the sense of prohibiting electronic devices from working outside a geographic region to avoid their use as weapons, rather than swordfighting.
  - perl4ever 7y ago
    Well, if it's covert, then that is presumably just the cover story. Maybe it's a solution for region control of swords, in which case it would be a virtual virtual fencing fencing solution.

79 points by Jerry2 7y ago

deleted 7y ago

[deleted]

nl 7y ago

Geeze - I'm all for freely discussing engineering but wow I'm not sure I've ever seen a more directly dangerous piece of work. For those who haven't read what this is about: The system is designed to stop weapon systems working outside specific geographic areas. This is so (for example) the US can arm a specific group in a conflict and if (when?) those arms fall into the wrong hands they are useless outside the area of that conflict. This work discusses weaknesses in the lockdown system. It's pretty advanced work, so it isn't like a script-kiddie is going to work this out themselves.

maxfan8 7y ago
I agree. Presenting on Protego doesn't seem like a good idea – the information given in this talk could aid terrorists.
- jlgaddis 7y ago
  Toyota trucks are often used by terrorists. I don't think they should stop making them, though.
  - nl 7y ago
    I had a vague idea that perhaps there is a difference between a Toyota truck and a Stinger Anti-aircraft missile. But yes, I see we can't possible make that distinction.
- Buge 7y ago
  It could also aid the CIA in making a more secure virtual fencing solution. It's similar to the debate about full disclosure vs coordinated disclosure. Some companies pay for bug bounties. Additionally it could convince the CIA to distribute less weapons.
  - maxfan8 7y ago
    This is a good point! However, the CIA surely has sufficient internal incentives to fix privately disclosed vulnerabilities. There is no need for "bad publicity" to motivate them to become more secure. The CIA may even have already started working on fixes after Vault 7. Who knows? The only thing this action serves to do is allow less than trusted third parties abuse the weapons given to them (a possibility that the speaker clearly recognizes).
    - Buge 7y ago
      > the CIA surely has sufficient internal incentives to fix privately disclosed vulnerabilities. Do they? Also various people could have different definitions of "sufficient". They might previously have had 3 people spending half their time on it, and this might cause them to increase it to 5 people working full time on it. Do major tech companies (Apple, Google, Microsoft) have less internal incentives than the CIA? This XSS vulnerability apparently took a year to be fixed: https://www.openbugbounty.org/reports/164180/ https://www.openbugbounty.org/reports/164180/
deogeo 7y ago
Perhaps the presenter views it as hampering a dangerous foreign power in its attempts to meddle with other nations. The CIA doesn't exactly have a clean record.
- fit2rule 7y ago
  Yes, this. Why do people think the CIA should have a right to do this, but other nations' intelligence agencies shouldn't? The CIA are not the good guys here. This kind of duplicity just causes more war.
  - nl 7y ago
    I agree with this argument completely. No one is claiming the CIA doesn't also have responsibility here. I still don't think publishing a roadmap to disable this is anything like responsible disclosure. One of broader societies' big problems with technology proponents is the disclaiming of responsibility. I see this as a perfect example: - We know these weapons have fallen into the wrong hands - We know this is one of the techniques used to disable them - We know the groups who have them now want to use them in terrorist acts - The justification is "Well the CIA shouldn't have given them out/someone else might work out these techniques anyway" Both of these these things given as justifications may be true and yet it is still wrong to do this. An analogy is that someone leaves some cash at home while they go out. If someone posts on Twitter "hey person X has left cash at home and they have gone out and their address is XXX and here is how to bypass the model lock they have" is that defensible?
    - dmurray 7y ago
      If you think the person with the cash is the bad guy, maybe yes?
      - nl 7y ago
        The "person with the cash" is the families on the civilian airliners that are more likely to be shot down.
tastroder 7y ago
> It's pretty advanced work, so it isn't like a script-kiddie is going to work this out themselves. Why not? Not sure what script kiddie would be motivated and have the necessary access to hack into abandoned weapons systems, whereas some motivated terrorist with an EE degree in an internet-connected cave structure would certainly have access to the same publicly available information these researchers did. They're not supplying a PoC to wannabe warlords here, on the other hand they provide an interesting new perspective on how these, already leaked, technologies were intended to be used.
craftinator 7y ago
Dangerous? Yes. At the same time, he built this presentation using two things; Google-fu for open source intelligence, and a background in microcontrollers. "Untrustworthy third parties", as described in the talk, also possess these skills (look up the sophistication of IEDs used in Iraq and Afghanistan if you don't believe me). This guy invested his spare time over a few weeks or months to do the research on this. Again, this is entirely doable by most people. The purpose of doing this kind of security research is to push organizations (the CIA obviously watches the CCC presentations every year) to fix prior security mistakes before they are misused, and to refine better security practices in the future.

Dinux 7y ago

It should be mentioned that this work was mostly speculation, like the speaker said. Most of the attacks shown are not 'advanced' by any means. Like the speaker explained; 'anyone can buy a GPS jammer for a few bucks online'. The research they did indeed confirmed GPS is the weakspot. However, such geofence systems are a step-up from any equipment lacking this ability. Its not so much about rendering these systems completely unusable outside of their intended purpose, but more about slowing down their use. The later will have a much better chance of accomplishing this goal. Assuming the claims made in this research are true, then its more likely the CIA wants to limit the use of US supplied weapons systems, not stop a war. And the CIA has quite the history there. Also, the situations in which such weapons systems are deployed do not exactly resemble the lab-like circumstances (like faraday cage, EE-tooling et.) necessary for these attacks.

onetimemanytime 7y ago
this is critical, considering that today's "allies" are very likely to be our enemies tomorrow. Or they can just sell ManPads to another group and (mil and/or civilian) planes would be falling out of the skies. Imagine if Stingers we gave to the Taliban were still in working mode...
- wavefunction 7y ago
  This seems like it will lead to more CIA arming of militant groups which according to your post means likely more enemy militant groups. I'd liken this to giving police officers tasers or firearms: instead of having to consider de-escalating situations, they can just shoot or tase someone instead. I would prefer my government be forced to carefully consider whether giving any group weapons rather than "oh yeah totally cool we've got ways to shut them down if they turn on us."

perl4ever 7y ago

I'm glad the CIA is doing something; I guess virtual fencing hasn't really been a thing since the Summer Olympics tie-in games of the 80s. I'm surprised, really, given the existence of "Bus Simulator", "Farming Simulator" and so on, I would have thought there would be lots of ultra realistic virtual fencing. But a minute or two Googling didn't turn anything up - mostly people discuss fencing-like activities in random games with swordplay.

tlb 7y ago
The article mentions that the term 'fencing' is used in the sense of prohibiting electronic devices from working outside a geographic region to avoid their use as weapons, rather than swordfighting.
- perl4ever 7y ago
  Well, if it's covert, then that is presumably just the cover story. Maybe it's a solution for region control of swords, in which case it would be a virtual virtual fencing fencing solution.