4 ms·

Get Hacked, Don’t Tell: Drone Base Didn’t Report Virus

39 points by mcantelon 15y ago

dasil003 15y ago
The plan to build a single centralized overseeing system doesn't seem to be the smartest choice security-wise.
- wladimir 15y ago
  Amen. But it will probably take a full-scale war to make people (and nations) aware of the security implications of armed remote-controlled robots. Some of them we can only guess at. Future war: nations will hack each other's drones and use those drones to attack their owner? (or a third party, to provoke counter-attack)
  - JonnieCache 15y ago
    Maybe we can have special drones to hack and take over other drones. That'd be pretty cool in a command and conquer sort of way.
Iv 15y ago
Does anyone else think this is a windows infection, and that this OS should be banned in sensitive areas ?
- JonnieCache 15y ago
  That would be security theatre. Any actually dangerous attack on systems such as these is likely to be bespoke, like stuxnet. Therefore the platform doesn't matter. Also, it shouldn't be too hard to create a virus that could spread via windows PCs but still carried a linux payload, for example. As soon as you're up against bespoke, targeted attacks, the whole game changes.
  - sek 15y ago
    You are right, but Linux is superior here, because it is open source and you know everything about it. For Windows you can simply buy a 0day and that's it. When you write something for Linux, you can't be sure the targeted program is even on the distribution. The NSA has excellent experience when it comes to secure UNIX systems. They published a very long RedHead guide somewhere, was posted on HN some time ago. But in reality there is no way they share their knowledge, totally different organization and different contractor so synergies are lost for sure. How much energy would be saved when you don't try to reinvent the wheel every time.
    - binarymax 15y ago
      I believe you mean this: http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf Regardless, if its a targeted attack you can probably figure out whats on the system you are targeting.
  - static_cast 15y ago
    I'm sure a vanilla linux-distribution is as easy an target as a windows box, if not even easier. But why don't they use some hardened (grsecurity,selinux) kernel + http://linux-ima.sourceforge.net/ http://linux-ima.sourceforge.net/ + a default forbid MAC policy + remote logging. I can't see how this attack vector could be used against such a system. These are deadly drones. It is probably a lot more work than using a plain windows box. But these machines can kill people. I thought the Military would use state of the art software security system.
    - Iv 15y ago
      About vanilla systems, I think no one can make a worse job than Microsoft. When I discovered that Windows XP was auto-executing some files in any USB stick you plugged in it, I decided to not take Microsoft seriously EVER about security. Yes, it was after their grand announcement they would focus on security. They probably improved many things since then, but I can't trust a company that did not understand the problem about arbitrary code execution during all these years to do a half-decent job at security. The world-wide epidemics in computer virus would not exist without Windows. It is not about it being the most prevalent OS : Linux is prevalent amongst webservers, highly valuable targets. iOs is the most prevalent OS on cellphone, always-on targets. Neither see virus spreading. Think about it.

39 points by mcantelon 15y ago

dasil003 15y ago

The plan to build a single centralized overseeing system doesn't seem to be the smartest choice security-wise.

wladimir 15y ago
Amen. But it will probably take a full-scale war to make people (and nations) aware of the security implications of armed remote-controlled robots. Some of them we can only guess at. Future war: nations will hack each other's drones and use those drones to attack their owner? (or a third party, to provoke counter-attack)
- JonnieCache 15y ago
  Maybe we can have special drones to hack and take over other drones. That'd be pretty cool in a command and conquer sort of way.

Iv 15y ago

Does anyone else think this is a windows infection, and that this OS should be banned in sensitive areas ?

JonnieCache 15y ago
That would be security theatre. Any actually dangerous attack on systems such as these is likely to be bespoke, like stuxnet. Therefore the platform doesn't matter. Also, it shouldn't be too hard to create a virus that could spread via windows PCs but still carried a linux payload, for example. As soon as you're up against bespoke, targeted attacks, the whole game changes.
- sek 15y ago
  You are right, but Linux is superior here, because it is open source and you know everything about it. For Windows you can simply buy a 0day and that's it. When you write something for Linux, you can't be sure the targeted program is even on the distribution. The NSA has excellent experience when it comes to secure UNIX systems. They published a very long RedHead guide somewhere, was posted on HN some time ago. But in reality there is no way they share their knowledge, totally different organization and different contractor so synergies are lost for sure. How much energy would be saved when you don't try to reinvent the wheel every time.
  - binarymax 15y ago
    I believe you mean this: http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf Regardless, if its a targeted attack you can probably figure out whats on the system you are targeting.
- static_cast 15y ago
  I'm sure a vanilla linux-distribution is as easy an target as a windows box, if not even easier. But why don't they use some hardened (grsecurity,selinux) kernel + http://linux-ima.sourceforge.net/ http://linux-ima.sourceforge.net/ + a default forbid MAC policy + remote logging. I can't see how this attack vector could be used against such a system. These are deadly drones. It is probably a lot more work than using a plain windows box. But these machines can kill people. I thought the Military would use state of the art software security system.
  - Iv 15y ago
    About vanilla systems, I think no one can make a worse job than Microsoft. When I discovered that Windows XP was auto-executing some files in any USB stick you plugged in it, I decided to not take Microsoft seriously EVER about security. Yes, it was after their grand announcement they would focus on security. They probably improved many things since then, but I can't trust a company that did not understand the problem about arbitrary code execution during all these years to do a half-decent job at security. The world-wide epidemics in computer virus would not exist without Windows. It is not about it being the most prevalent OS : Linux is prevalent amongst webservers, highly valuable targets. iOs is the most prevalent OS on cellphone, always-on targets. Neither see virus spreading. Think about it.