6 ms·

Sidenote, he lists "Push over-the-air software updates to weapon systems (U-2) while flying the jet" in his list of accomplishments. Is this what it sounds like

by evilos 5y ago

Sidenote, he lists "Push over-the-air software updates to weapon systems (U-2) while flying the jet" in his list of accomplishments. Is this what it sounds like? It sounds like a terrible idea.

markdjacobsen 5y ago
See https://www.c4isrnet.com/air/2020/10/09/the-air-force-updated-the-software-on-one-of-its-oldest-aircraft-while-it-was-in-the-air/ https://www.c4isrnet.com/air/2020/10/09/the-air-force-update...
ethbr0 5y ago
U-2s are surveillance platforms. Hint: look at the letter. He means the initiative to provide in-air updating of the surveillance payload in response to tasking. Probably ELINT-related. Edit: He's probably talking about this https://mobile.twitter.com/WILLROP3R/status/1318161379304591363 https://mobile.twitter.com/WILLROP3R/status/1318161379304591... and this https://www.thedrive.com/the-war-zone/38162/u-2-spy-plane-taps-into-computers-on-the-ground-to-help-process-sensor-data-mid-mission https://www.thedrive.com/the-war-zone/38162/u-2-spy-plane-ta...
chrisseaton 5y ago
If you're watching a target, and it's going to be gone in a few hours, and the plane is already in the air, and you want to run a program to run the sensors in a certain way to get what you need, makes sense to me.
_bnmd 5y ago
Two notes on this: 1) If the military gets it right with anything, it's encryption. This isn't connecting to the aircraft over the Internet using Verisign PKI. You're not gonna man-in-the-middle inject your own code into the update. The only attack vector is the software supply chain itself, but that is already an attack vector regardless of how the software gets loaded. 2) Part of the purpose of being able to do something like this is to push new software capabilities to platforms that can't be brought back to manually do it at all, like satellites in orbit. A software update that doesn't require you to launch a new rocket into space can save billions.
- wolverine876 5y ago
  > If the military gets it right with anything, it's encryption. This isn't connecting to the aircraft over the Internet using Verisign PKI. You're not gonna man-in-the-middle inject your own code into the update. The only attack vector is the software supply chain ... What gives you this confidence?
  - cryptonector 5y ago
    I second this question. Developers who know how to do this are relatively scarce. The military almost certainly does not have enough of them.
    - tablespoon 5y ago
      >>> If the military gets it right with anything, it's encryption. > Developers who know how to do this are relatively scarce. The military almost certainly does not have enough of them. FYI: the NSA is part of the DoD. They most certainly have plenty of people who know how to do encryption properly, and securing military communications is also part of their job. https://en.wikipedia.org/wiki/National_Security_Agency https://en.wikipedia.org/wiki/National_Security_Agency: > The National Security Agency (NSA) is a national-level intelligence agency of the United States Department of Defense... The NSA is also tasked with the protection of U.S. communications networks and information systems.
      - cryptonector 5y ago
        Thanks, I'm aware. That's not the same thing as the military having the right clue at the right places.
        mpyne 5y ago
        The military has operationalized encryption (what we call 'COMSEC') for longer than even the NSA has been in existence. I'll be the first to concede that the military is significantly behind on modern digital product management, cloud architecture, and software development. But that doesn't extend to key management and distribution or communications security in general, which is something we're pretty damn good at.
panzagl 5y ago
'Weapon System' is acquisition speak for a project of a certain size that has to go through certain processes involving design, funding, acceptance, etc. Whether it is actually intended to harm someone is somewhat orthogonal to the designation.

by evilos 5y ago

Sidenote, he lists "Push over-the-air software updates to weapon systems (U-2) while flying the jet" in his list of accomplishments. Is this what it sounds like? It sounds like a terrible idea.

markdjacobsen 5y ago

See https://www.c4isrnet.com/air/2020/10/09/the-air-force-updated-the-software-on-one-of-its-oldest-aircraft-while-it-was-in-the-air/ https://www.c4isrnet.com/air/2020/10/09/the-air-force-update...

ethbr0 5y ago

U-2s are surveillance platforms. Hint: look at the letter. He means the initiative to provide in-air updating of the surveillance payload in response to tasking. Probably ELINT-related. Edit: He's probably talking about this https://mobile.twitter.com/WILLROP3R/status/1318161379304591363 https://mobile.twitter.com/WILLROP3R/status/1318161379304591... and this https://www.thedrive.com/the-war-zone/38162/u-2-spy-plane-taps-into-computers-on-the-ground-to-help-process-sensor-data-mid-mission https://www.thedrive.com/the-war-zone/38162/u-2-spy-plane-ta...

chrisseaton 5y ago

If you're watching a target, and it's going to be gone in a few hours, and the plane is already in the air, and you want to run a program to run the sensors in a certain way to get what you need, makes sense to me.

_bnmd 5y ago

Two notes on this: 1) If the military gets it right with anything, it's encryption. This isn't connecting to the aircraft over the Internet using Verisign PKI. You're not gonna man-in-the-middle inject your own code into the update. The only attack vector is the software supply chain itself, but that is already an attack vector regardless of how the software gets loaded. 2) Part of the purpose of being able to do something like this is to push new software capabilities to platforms that can't be brought back to manually do it at all, like satellites in orbit. A software update that doesn't require you to launch a new rocket into space can save billions.

wolverine876 5y ago
> If the military gets it right with anything, it's encryption. This isn't connecting to the aircraft over the Internet using Verisign PKI. You're not gonna man-in-the-middle inject your own code into the update. The only attack vector is the software supply chain ... What gives you this confidence?
- cryptonector 5y ago
  I second this question. Developers who know how to do this are relatively scarce. The military almost certainly does not have enough of them.
  - tablespoon 5y ago
    >>> If the military gets it right with anything, it's encryption. > Developers who know how to do this are relatively scarce. The military almost certainly does not have enough of them. FYI: the NSA is part of the DoD. They most certainly have plenty of people who know how to do encryption properly, and securing military communications is also part of their job. https://en.wikipedia.org/wiki/National_Security_Agency https://en.wikipedia.org/wiki/National_Security_Agency: > The National Security Agency (NSA) is a national-level intelligence agency of the United States Department of Defense... The NSA is also tasked with the protection of U.S. communications networks and information systems.
    - cryptonector 5y ago
      Thanks, I'm aware. That's not the same thing as the military having the right clue at the right places.
      - mpyne 5y ago
        The military has operationalized encryption (what we call 'COMSEC') for longer than even the NSA has been in existence. I'll be the first to concede that the military is significantly behind on modern digital product management, cloud architecture, and software development. But that doesn't extend to key management and distribution or communications security in general, which is something we're pretty damn good at.

panzagl 5y ago

'Weapon System' is acquisition speak for a project of a certain size that has to go through certain processes involving design, funding, acceptance, etc. Whether it is actually intended to harm someone is somewhat orthogonal to the designation.