6 ms·

I am totally with you. If software is going to operate deadly weapons, it sure as hell better be secure. But you are glossing over a LOT of detail here. The

by teej 15y ago

I am totally with you. If software is going to operate deadly weapons, it sure as hell better be secure. But you are glossing over a LOT of detail here. The military doesn't work like Apple: they don't design, oversee, or directly control the construction of the hardware they use. And they shouldn't - the government is woefully inefficient at building products, that's what corporations are good at. Here's the situation: - The Air Force contracts General Atomics Aeronautical Systems to build UAVs. You can bet your ass the contract covers things like "protected from malware" - General Atomics contracts out the different components of the UAV. No device worth $150M gets built by one company alone. The radar, the metal shell, the inside components, and each component of the software are all made by different companies. - Each component is meticulously specified and rigorously tested. The makers of a component is contractually liable if they fuck up, giving them an incentive to do it slow & right. That's why it's so damn expensive. - General Atomics puts the pieces together into the final product and delivers it to the Air Force after another round of rigorous testing. - A team of guys in the Air Force are trained on operating the UAVs to deploy on missions. ===================== So to say something like "Ugh, military, don't deploy UAVs if you can't keep it virus free!" is an oversimplification. These are extremely complex machines, with highly specialized embedded software, meant to deliver explodey things with extreme precision, while being operated from very far away. You can't just slap Norton on these things and call it a day.

noonespecial 15y ago
Perhaps they shouldn't use a platform that runs Norton in the first place? I suspect that under it all, you'll find an unpatched XP or even Win2000.
- iopuy 15y ago
  I guarantee UAV's are not running XP or Windows 2000. The government has heard of things called RTOS.
  - bostonvaulter2 15y ago
    But the computers controlling the Drones seem to be running some sort of Windows variant. There's no real need to control the drones directly if you can control the computer that controls the drones.
  - bronson 15y ago
    I wouldn't be so sure about that. http://gcn.com/articles/1998/07/13/software-glitches-leave-navy-smart-ship-dead-in-the-water.aspx http://gcn.com/articles/1998/07/13/software-glitches-leave-n... And, have you seen all the computers necessary to carry out a drone operation? I guarantee you not all of them are running an RTOS. Probably not even all of them onboard the drone.
    - iopuy 15y ago
      The article is from 1998. Please forgive me if I don't see it as framing the situation of today.
      - lucasjung 15y ago
        Military acquisitions take a long time. To give one example, I know for a fact that there are airplanes flying right now that use DEC Alphas to control their weapons systems. Those planes first came into use in the early 2000's. An older version of that plane is still in use, and will be for several more years; you don't even want to know what it's using.
  - VladRussian 15y ago
    >I guarantee UAV's are not running XP or Windows 2000. The government has heard of things called RTOS. Of course. There is Windows NT for _that_ : http://www.theragens.com/misc/MR%20-%20Windows%20NT%20Real-Time.htm http://www.theragens.com/misc/MR%20-%20Windows%20NT%20Real-T...
    - daeken 15y ago
      Soft real-time systems aren't used for things like drones. Look at things like INTEGRITY from Green Hills for that sort of task: http://www.ghs.com/customers/bae_herti.html http://www.ghs.com/customers/bae_herti.html
VladRussian 15y ago
>The military doesn't work like Apple: they don't design, oversee, or directly control the construction of the hardware they use. they are just wined and dined by the contractor when they should be directly overseeing and controlling. >And they shouldn't - the government is woefully inefficient at building products, that's what corporations are good at. Starting at some architectural level, many DoD systems is a just one-off system, not a product.
- lucasjung 15y ago
  >they are just wined and dined by the contractor when they should be directly overseeing and controlling. There are actually very strict controls on how much government personnel are allowed to accept from contractors. IIRC, the limit is something like $20-$50 per year in gifts. When contractors host large events with catered lunches, they put out bowls or some other sort of receptacle so that government personnel can pay for their lunch, otherwise it would count towards that annual limit. Enforcement at the level of "you didn't pay for that six-inch sub and can of coke" is not really practical, but quite a few government personnel have gone to jail in recent memory for accepting more lavish gifts from contractors. Now, if you send your lobbyists to buy expensive meals for legislators (you know, the ones who actually decide how the money gets spent) and write them big checks, that's generally perfectly legal.
Bud 15y ago
teej, I assure you, I am under no illusion that they can "slap Norton on these things and call it a day". I am at least somewhat conversant with the realities of designing complex military systems. But if the systems really are so highly specialized, and I assume they are, that's still no excuse. At all. If they can't keep malware off them, they have no business flying them, at least for the time being. Which is all I was saying. I know it's not easy.
- josefresco 15y ago
  The systems are less specialized than we all would hope. Even with our massive budget the military is still 'forced' to use existing tech, which opens them up to situations like this. And if you think this little press release means anything to actual national security, you have much to learn about our secret war against terrorism.
sc00ter 15y ago
"You can't just slap Norton on these things and call it a day" No, you can't - you have to slap Symantec Critical System Protection on them. /Then/ you can call it a day.

by teej 15y ago

noonespecial 15y ago

Perhaps they shouldn't use a platform that runs Norton in the first place? I suspect that under it all, you'll find an unpatched XP or even Win2000.

iopuy 15y ago
I guarantee UAV's are not running XP or Windows 2000. The government has heard of things called RTOS.
- bostonvaulter2 15y ago
  But the computers controlling the Drones seem to be running some sort of Windows variant. There's no real need to control the drones directly if you can control the computer that controls the drones.
- bronson 15y ago
  I wouldn't be so sure about that. http://gcn.com/articles/1998/07/13/software-glitches-leave-navy-smart-ship-dead-in-the-water.aspx http://gcn.com/articles/1998/07/13/software-glitches-leave-n... And, have you seen all the computers necessary to carry out a drone operation? I guarantee you not all of them are running an RTOS. Probably not even all of them onboard the drone.
  - iopuy 15y ago
    The article is from 1998. Please forgive me if I don't see it as framing the situation of today.
    - lucasjung 15y ago
      Military acquisitions take a long time. To give one example, I know for a fact that there are airplanes flying right now that use DEC Alphas to control their weapons systems. Those planes first came into use in the early 2000's. An older version of that plane is still in use, and will be for several more years; you don't even want to know what it's using.
- VladRussian 15y ago
  >I guarantee UAV's are not running XP or Windows 2000. The government has heard of things called RTOS. Of course. There is Windows NT for _that_ : http://www.theragens.com/misc/MR%20-%20Windows%20NT%20Real-Time.htm http://www.theragens.com/misc/MR%20-%20Windows%20NT%20Real-T...
  - daeken 15y ago
    Soft real-time systems aren't used for things like drones. Look at things like INTEGRITY from Green Hills for that sort of task: http://www.ghs.com/customers/bae_herti.html http://www.ghs.com/customers/bae_herti.html

VladRussian 15y ago

>The military doesn't work like Apple: they don't design, oversee, or directly control the construction of the hardware they use. they are just wined and dined by the contractor when they should be directly overseeing and controlling. >And they shouldn't - the government is woefully inefficient at building products, that's what corporations are good at. Starting at some architectural level, many DoD systems is a just one-off system, not a product.

lucasjung 15y ago
>they are just wined and dined by the contractor when they should be directly overseeing and controlling. There are actually very strict controls on how much government personnel are allowed to accept from contractors. IIRC, the limit is something like $20-$50 per year in gifts. When contractors host large events with catered lunches, they put out bowls or some other sort of receptacle so that government personnel can pay for their lunch, otherwise it would count towards that annual limit. Enforcement at the level of "you didn't pay for that six-inch sub and can of coke" is not really practical, but quite a few government personnel have gone to jail in recent memory for accepting more lavish gifts from contractors. Now, if you send your lobbyists to buy expensive meals for legislators (you know, the ones who actually decide how the money gets spent) and write them big checks, that's generally perfectly legal.

Bud 15y ago

teej, I assure you, I am under no illusion that they can "slap Norton on these things and call it a day". I am at least somewhat conversant with the realities of designing complex military systems. But if the systems really are so highly specialized, and I assume they are, that's still no excuse. At all. If they can't keep malware off them, they have no business flying them, at least for the time being. Which is all I was saying. I know it's not easy.

josefresco 15y ago
The systems are less specialized than we all would hope. Even with our massive budget the military is still 'forced' to use existing tech, which opens them up to situations like this. And if you think this little press release means anything to actual national security, you have much to learn about our secret war against terrorism.

sc00ter 15y ago

"You can't just slap Norton on these things and call it a day" No, you can't - you have to slap Symantec Critical System Protection on them. /Then/ you can call it a day.