10 ms·

Like hugh says, this doesn't add up at all. “We keep wiping it off, and it keeps coming back,” says a source familiar with the network infection, one of three

Like hugh says, this doesn't add up at all. “We keep wiping it off, and it keeps coming back,” says a source familiar with the network infection, one of three that told Danger Room about the virus. “We think it’s benign. But we just don’t know.” C'mon. You're the military. "It just keeps coming back?" So you decide to do a press release about it? Please. I wouldn't have whined like that when I was de-malwareing neighbourhood PCs at age 13, I would have fixed it. If I can successfully keep malware off the PCs of middle aged parents with teenaged children, then the government capable of developing and operating fleets of unmanned military drones can certainly isolate a network and disable the USB bus. There is definitely some high level shit going on right here. I doubt we'll know about it for many years, if ever.

rdl 15y ago
There are hundreds of thousands of machines and millions of removable drives. Tracking down every last instance of a piece of malware and then dealing with it is quite hard at that scale. Usually they fall back on policy ("no usb/removable drives") They're handicapped by a need AND compulsion to use contractors for everything. Actual government employees didn't build drones; they were all developed and in many cases largely maintained and even operated by private contractors, working to government requirements (which themselves are structured to make the contractors inefficient, compared to normal commercial companies). Same thing with networks.
- JonnieCache 15y ago
  If I'm ever in charge of a PC capable of firing guns at people, then at a bare minimum I would disable the USB bus entirely, I probably wouldn't fit a NIC either. I'd also definitely install some of that software that makes the HDD read only and transparently passes through all writes to RAM. Fuckit, if I'm the US military I'd develop such a device in hardware. Send the recorded video/telemetry data to a write-only volume. It's not that hard. But anyway, my point was that I don't for a second believe that they're this incompetent, there must be other factors at play.
  - phillmv 15y ago
    >It's not that hard. eye roll
    - rdl 15y ago
      It's hard (in an engineering sense) at that scale, but certainly not impossible, and easier than a lot of engineering problems the world has solved. It's harder because DoD is actively being attacked, but easier because they have a near-infinite budget. The thing which makes it hard is humans, politics, and economics -- there is a huge amount of CYA with respect to vendor choice (hence, they're a huge Microsoft/Cisco shop), lots of little fiefdoms, an "up or out" promotion policy combined with people being in leadership roles for short periods (with minimal prior background), and lack of real accountability. The Microsoft-ness isn't enough to kill them on its own; look at the Israeli military, which is also heavily Microsoft based, and has world-class computer security.
    - breck 15y ago
      It's not that hard if you have a top notch engineer in charge and give him whatever he needs to get the job done. If you have a good engineer or a great engineer but any kind of bureaucracy, yes, it's near impossible.
      - munin 15y ago
        google - top notch engineers, given whatever they need to get the job done, no bureaucracy, still get owned?
        redthrowaway 15y ago
        If you're talking about the China hacks, they were using ie6. I'd argue that would preclude the "top notch engineer" label.
        brandon 15y ago
        Nope. Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1, and SP2; Windows Server 2008 Gold, SP2, and R2; and Windows 7 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0249 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0...
- pavel_lishin 15y ago
  > Tracking down every last instance of a piece of malware and then dealing with it is quite hard at that scale. Sure, it's hard. But it's the fucking military. Figure it out.
eli 15y ago
Wired article citing anonymous sources != press release
Steko 15y ago
US hacks other countries war machines with targeted virus: brilliant! Other countries hack US war machines with targeted virus: man, I couldda stopped that shit easy.
- Radix 15y ago
  This is consistent. The assumption is that defense will be top notch. Therefore attacking is hard and defending is, if not easy, solved.
Bud 15y ago
I don't know how I can be any more clear here: If they are not smart enough to keep malware off of what should be the most secure systems around, perhaps they shouldn't be building the fricking FLYING REMOTE-CONTROL DEATH MACHINES for a while, until they can figure out the basics. Capisce, guys?
- teej 15y ago
  I am totally with you. If software is going to operate deadly weapons, it sure as hell better be secure. But you are glossing over a LOT of detail here. The military doesn't work like Apple: they don't design, oversee, or directly control the construction of the hardware they use. And they shouldn't - the government is woefully inefficient at building products, that's what corporations are good at. Here's the situation: - The Air Force contracts General Atomics Aeronautical Systems to build UAVs. You can bet your ass the contract covers things like "protected from malware" - General Atomics contracts out the different components of the UAV. No device worth $150M gets built by one company alone. The radar, the metal shell, the inside components, and each component of the software are all made by different companies. - Each component is meticulously specified and rigorously tested. The makers of a component is contractually liable if they fuck up, giving them an incentive to do it slow & right. That's why it's so damn expensive. - General Atomics puts the pieces together into the final product and delivers it to the Air Force after another round of rigorous testing. - A team of guys in the Air Force are trained on operating the UAVs to deploy on missions. ===================== So to say something like "Ugh, military, don't deploy UAVs if you can't keep it virus free!" is an oversimplification. These are extremely complex machines, with highly specialized embedded software, meant to deliver explodey things with extreme precision, while being operated from very far away. You can't just slap Norton on these things and call it a day.
  - noonespecial 15y ago
    Perhaps they shouldn't use a platform that runs Norton in the first place? I suspect that under it all, you'll find an unpatched XP or even Win2000.
    - 15y ago
rdtsc 15y ago
Are you so surprised? Have you worked with the military security and computer specialists? There are some good people but there lots of HBGary types...
pmorici 15y ago
This reminds me of that other news story from 2009 claiming that people were intercepting drone video feeds with $30 of software. http://arstechnica.com/tech-policy/news/2009/12/predator-drones-use-less-encryption-than-your-tv.ars http://arstechnica.com/tech-policy/news/2009/12/predator-dro...
naner 15y ago
There is definitely some high level shit going on right here. Such as: they discovered and disabled the virus but are still sending fake info over the virus's communication channel and want the Chinese/Iran/whoever to think it is still working? That sounds much better than a technically incompetent military with dangerous toys.
nikcub 15y ago
> So you decide to do a press release about it? The military deny this is happening, the info is from somebody leaking to the media - probably frustrated with what is going on.
mentat 15y ago
The "problem" is that people want to actually get stuff done. Security vs. availability is always the conflict. Perhaps the USB is being used to bring in the latest maps, perhaps it's being used to bring in mission orders, who knows. Unless you understand the system, it's absurd to say the equivalent of a military 13 year old can fix it.

rdl 15y ago

There are hundreds of thousands of machines and millions of removable drives. Tracking down every last instance of a piece of malware and then dealing with it is quite hard at that scale. Usually they fall back on policy ("no usb/removable drives") They're handicapped by a need AND compulsion to use contractors for everything. Actual government employees didn't build drones; they were all developed and in many cases largely maintained and even operated by private contractors, working to government requirements (which themselves are structured to make the contractors inefficient, compared to normal commercial companies). Same thing with networks.

JonnieCache 15y ago
If I'm ever in charge of a PC capable of firing guns at people, then at a bare minimum I would disable the USB bus entirely, I probably wouldn't fit a NIC either. I'd also definitely install some of that software that makes the HDD read only and transparently passes through all writes to RAM. Fuckit, if I'm the US military I'd develop such a device in hardware. Send the recorded video/telemetry data to a write-only volume. It's not that hard. But anyway, my point was that I don't for a second believe that they're this incompetent, there must be other factors at play.
- phillmv 15y ago
  >It's not that hard. eye roll
  - rdl 15y ago
    It's hard (in an engineering sense) at that scale, but certainly not impossible, and easier than a lot of engineering problems the world has solved. It's harder because DoD is actively being attacked, but easier because they have a near-infinite budget. The thing which makes it hard is humans, politics, and economics -- there is a huge amount of CYA with respect to vendor choice (hence, they're a huge Microsoft/Cisco shop), lots of little fiefdoms, an "up or out" promotion policy combined with people being in leadership roles for short periods (with minimal prior background), and lack of real accountability. The Microsoft-ness isn't enough to kill them on its own; look at the Israeli military, which is also heavily Microsoft based, and has world-class computer security.
  - breck 15y ago
    It's not that hard if you have a top notch engineer in charge and give him whatever he needs to get the job done. If you have a good engineer or a great engineer but any kind of bureaucracy, yes, it's near impossible.
    - munin 15y ago
      google - top notch engineers, given whatever they need to get the job done, no bureaucracy, still get owned?
      - redthrowaway 15y ago
        If you're talking about the China hacks, they were using ie6. I'd argue that would preclude the "top notch engineer" label.
        brandon 15y ago
        Nope. Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1, and SP2; Windows Server 2008 Gold, SP2, and R2; and Windows 7 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0249 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0...
pavel_lishin 15y ago
> Tracking down every last instance of a piece of malware and then dealing with it is quite hard at that scale. Sure, it's hard. But it's the fucking military. Figure it out.

eli 15y ago

Wired article citing anonymous sources != press release

Steko 15y ago

US hacks other countries war machines with targeted virus: brilliant! Other countries hack US war machines with targeted virus: man, I couldda stopped that shit easy.

Radix 15y ago
This is consistent. The assumption is that defense will be top notch. Therefore attacking is hard and defending is, if not easy, solved.

Bud 15y ago

I don't know how I can be any more clear here: If they are not smart enough to keep malware off of what should be the most secure systems around, perhaps they shouldn't be building the fricking FLYING REMOTE-CONTROL DEATH MACHINES for a while, until they can figure out the basics. Capisce, guys?

teej 15y ago
I am totally with you. If software is going to operate deadly weapons, it sure as hell better be secure. But you are glossing over a LOT of detail here. The military doesn't work like Apple: they don't design, oversee, or directly control the construction of the hardware they use. And they shouldn't - the government is woefully inefficient at building products, that's what corporations are good at. Here's the situation: - The Air Force contracts General Atomics Aeronautical Systems to build UAVs. You can bet your ass the contract covers things like "protected from malware" - General Atomics contracts out the different components of the UAV. No device worth $150M gets built by one company alone. The radar, the metal shell, the inside components, and each component of the software are all made by different companies. - Each component is meticulously specified and rigorously tested. The makers of a component is contractually liable if they fuck up, giving them an incentive to do it slow & right. That's why it's so damn expensive. - General Atomics puts the pieces together into the final product and delivers it to the Air Force after another round of rigorous testing. - A team of guys in the Air Force are trained on operating the UAVs to deploy on missions. ===================== So to say something like "Ugh, military, don't deploy UAVs if you can't keep it virus free!" is an oversimplification. These are extremely complex machines, with highly specialized embedded software, meant to deliver explodey things with extreme precision, while being operated from very far away. You can't just slap Norton on these things and call it a day.
- noonespecial 15y ago
  Perhaps they shouldn't use a platform that runs Norton in the first place? I suspect that under it all, you'll find an unpatched XP or even Win2000.
  - 15y ago

rdtsc 15y ago

Are you so surprised? Have you worked with the military security and computer specialists? There are some good people but there lots of HBGary types...

pmorici 15y ago

This reminds me of that other news story from 2009 claiming that people were intercepting drone video feeds with $30 of software. http://arstechnica.com/tech-policy/news/2009/12/predator-drones-use-less-encryption-than-your-tv.ars http://arstechnica.com/tech-policy/news/2009/12/predator-dro...

naner 15y ago

There is definitely some high level shit going on right here. Such as: they discovered and disabled the virus but are still sending fake info over the virus's communication channel and want the Chinese/Iran/whoever to think it is still working? That sounds much better than a technically incompetent military with dangerous toys.

nikcub 15y ago

> So you decide to do a press release about it? The military deny this is happening, the info is from somebody leaking to the media - probably frustrated with what is going on.

mentat 15y ago

The "problem" is that people want to actually get stuff done. Security vs. availability is always the conflict. Perhaps the USB is being used to bring in the latest maps, perhaps it's being used to bring in mission orders, who knows. Unless you understand the system, it's absurd to say the equivalent of a military 13 year old can fix it.