10 ms·
Drone captured by Iran may mean military GPS RSA "red key" has been compromised
- 7952 15y agoWhy would you need to have keys at all? Just rebroadcast the signal with a different delay for each satellite.
- pferreir 15y agoI guess there should be some kind of timestamp preventing that kind of attack, no?
- deleted 15y ago[deleted]
- sern 15y agoThe GPS military signal is protected by virtue of being CDMA-modulated by a long, pseudorandom sequence (the output of a keyed, secret PRNG). Because of the spread-spectrum nature of CDMA, it would be impractical to record the signal without having the key in the first place. And if you did have the key, why go through the trouble of recording and replaying the signal when you could directly spoof it?
- ck2 15y agoIran is not some backwater and it's not north korea. When politicians sing about "bomb Iran" these are the innocent people they are talking about killing http://www.youtube.com/watch?v=6v6kF8i-mbw http://www.youtube.com/watch?v=6v6kF8i-mbw http://www.theatlantic.com/infocus/2012/01/a-view-inside-iran/100219/ http://www.theatlantic.com/infocus/2012/01/a-view-inside-ira... Before 1970 you would not be able to identify pictures of iran from parts of the usa http://www.pagef30.com/2009/04/iran-in-1970s-before-islamic-revolution.html http://www.pagef30.com/2009/04/iran-in-1970s-before-islamic-... Currently Iran is just the result of what happens if conservative fundamentals got ahold of the government of a country. Yeah the nuclear bomb makers and holocaust deniers have to be stopped, but let's show some care and understanding for innocent people under their rule first.
- ctchocula 15y agoAm I being paranoid or did "A View Inside Iran" link get deleted from Hacker News? edit: Yes, I was being way too paranoid. The article only has 3 upvotes and isn't on the first three pages, which surprised me, but I suppose more technologically interesting articles such as this one may be more appreciated here.
- zalew 15y ago> Before 1970 you mean before 1979 > but let's show some care and understanding for innocent people under their rule first. if they cared, they'd lift the embargo on aircraft parts so these people don't die because of badly maintained passenger planes
- burgerbrain 15y ago"if they cared, they'd lift the embargo on aircraft parts so these people don't die because of badly maintained passenger planes" Huh? He is saying that we should show care... I think you should re-read what he wrote.
- zalew 15y agoIn the context as a whole it looks different for me. But does it really matter? offtopic: from the fluctuation of upvotes/downvotes on my few last comments in the last few hours, I see some people treat hn like reddit - downvoting based on opinion. Not that I care about those 3 karma points, just sayin'.
- burgerbrain 15y agoThe entire sentence is: "Yeah the nuclear bomb makers and holocaust deniers have to be stopped, but let's show some care and understanding for innocent people under their rule first." The context is condemning people who think of Iran as "something that we should bomb", without considering the human factor. Your comment is just very bizarre to be honest. I can only interpret it as a complete non sequitur. offtopic: In my experience, fluctuations in voting indicate that people are experience a significant amount of confusion when reading your post.
- sern 15y agoThe encrypted GPS service doesn't use RSA.
- avit 15y agoOne thing I've never understood all along is how Iran managed to capture the drone intact. Was it guided into a runway landing somehow? Or else how did they not crash it?
- pja 15y agoReading http://news.softpedia.com/news/Iranians-Capture-US-Drone-with-GPS-Attack-241075.shtml http://news.softpedia.com/news/Iranians-Capture-US-Drone-wit... it sounds more like the attack was on the drone itself which manifests itself if the drone loses GPS lock. Perhaps a secondary navigation system that can more easily be spoofed? Also, this article in New Scientist http://www.newscientist.com/blogs/onepercent/2011/12/did-iran-hack-us-drones-gps.html http://www.newscientist.com/blogs/onepercent/2011/12/did-ira... says that the drone was damaged on landing, hence the drapes around the bottom of the aircraft in the picture.
- deleted 15y ago[deleted]
- Luc 15y agoThe wings appeared to be held on by duct tape. Perhaps it didn't fall from very high.
- Luc 15y agoThis is being downvoted, but I am serious. In the pictures you can see the wings have been crudely reattached to the body using a white tape to cover up the supposed break. Hence it seems possible that the plane crashed, but not from an altitude that would do major damage.
- mrb 15y agoThe (alleged) story is that Iran spoofed the GPS signal to make the drone believe it was approaching its friendly landing strip, when in fact it was approaching an iranian field of the same orientation/altitude...
- Steuard 15y agoThe article confuses me: it seems to be conflating the RSA algorithm (which I could easily believe might be used to encrypt military GPS) with the RSA company (a division of EMC which was hacked and had its SecurID product compromised recently). Am I missing something, or is the author just confused? Why would having "broken into EMC's RSA servers" be at all related to being "in pursuit of a cryptanalytic attack against RSA"?
- dekz 15y agoI was a little confused also, I am under the impression that he is mentioning 2 points. 1) Attack on RSA to attempt to see if RSA has some attack on the RSA algorithm hidden. 2) Using an attack on SecurID to attempt to get more information from a Lockheed Martin or other breach.
- sunchild 15y agoYes, it was widely reported that Lockheed was a target after SecurID was breached. Whether or not anything useful was extracted from Lockheed's systems, and whether or not any Lockheed data was involved in spoofing the drone, is pure speculation. It seems equally plausible that Iran had an inside man at a defense contractor. After all, history has shown how relatively inexpensive and effective double agents are to state actors.
- rbanffy 15y agoWhy not jam the military signal and spoof the civilian one?
- ajb 15y agoIt uses spread spectrum transmission, which is resistant to jamming unless you know the secret key.
- sern 15y agoNevertheless, it's still possible to jam (see LightSquared). I actually think this is how Iran did it.
- ma2rten 15y agoAccording to this wired article it is possible, but still unlikely. http://www.wired.com/dangerroom/2011/12/iran-drone-hack-gps/ http://www.wired.com/dangerroom/2011/12/iran-drone-hack-gps/
- Someone 15y agoResistent to accidental jamming, but jamming a broad range of frequencies would easily jam it, wouldn't it? That might require more hardware, but it do not think it require superior technology.
- shareme 15y agoI have some conjecture based on some prior knowledge/connections.. First the info: Phil Zimmermann has a company working on Secure VOIP. I was contacted past 18 months ago to build the android mobile client. Project never lifted off due to some large distraction and the excuses I was given never matched up to reality. I submit because of Phil's connections to other RSA inventors and break-ins that occurred in the past 24 months that the distraction was a major hole was found in RSA or the process to secure it. The RSA inventors are consultants/board members of the the secure VOIP firm(Phil Zimmermann's firm). At this time its only conjecture and there are no concrete facts out in the open to fully confirm it. However, there are some analysis out there such as the authors that point to a major breach of RSA in the last 24 months that highlights new RSA holes in either the RSA itself or the process in securing RSA keys.
- 0x0 15y agoEven if this is still just a rumour, this is quite a bombshell story! :-O
- burgerbrain 15y agoA "RSA hole", as far as I am aware, would be "somebody found a fast way to factor numbers". There wouldn't exactly be a fix for that except to move to another trap door function.
- __alexs 15y agored key is from the older PPS-SM system which hasn't been used in new hardware since 2006. GPS M-Code isn't even meant to be fully operational until 2016. Which suggests he actually means SAASM.
- vbtemp 15y agoHow much certainty is there that the Iranians actually spoofed the GPS signal? How much evidence is there to overturn the null hypothesis (being that the GPS signal was either jammed, or the plane simply crash-landed inside Iran)
- brown9-2 15y agoI would love to know the answer to this. It seems that people are taking Iran at their word. If you did capture an enemy's drone though sheer luck, isn't it in your best interest to tell the world that the cause was the exact opposite?
- regularfry 15y agoIt's unlikely that the drone relies exclusively on GPS. If the designers believe the red key to be axiomatically secure, it's not an unreasonable assumption for them to say "We'll believe GPS while it's present. Only if it's not present will we fall back to inertial navigation" (or whatever). Obviously, a spoofed signal would be hugely problematic for that system. And yes, Occam's Razor does point to a crash-landing rather than a hack, but a GPS crack isn't unlikely enough to be completely discounted.
- gvb 15y agoAvWeek is a more reliable source than the blogs repeating breathless "OMG IRAN SPOOFED GPS" stories. http://www.aviationweek.com/aw/blogs/defense/index.jsp?plckController=Blog&plckBlogPage=BlogViewPost&newspaperUserId=27ec4a53-dcc8-42d0-bd3a-01329aef79a7&plckPostId=Blog%3a27ec4a53-dcc8-42d0-bd3a-01329aef79a7Post%3abca8e6e2-70ef-40a3-8c56-f83aa6fc7ade http://www.aviationweek.com/aw/blogs/defense/index.jsp?plckC...
- parfe 15y agoAll these complex and sophisticated attacks seem like too much work. It looks like the author either omits a step from the attack where the SecurID compromise allowed someone access to flight control systems or that RSA has a master key/method for breaking any RSA encrypted data. I think the drone ran out of fuel. The flight control system prevented a stall by trading altitude for speed. Some emergency collision code attempted to avoid a ground impact at the last second making for a soft landing. Something as simple as bad weather forecasting causing the drone to fly into a headwind during both inbound and outbound could easily account for the fuel drying up.
- regularfry 15y agoI think he's arguing that the attack in which SecurID was compromised also resulted in the red key being compromised.
- parfe 15y agoIs the "red key" real or mythical?
- regularfry 15y agoThere's a secret key involved in the anti-spoofing part of GPS, but I don't know if it's actually called a "red key" by people who use it.
- parfe 15y agoThe wiki article on GPS encryption seems to say that stealing the key for one satellite is possible (720 gigabytes), but the master key at 26 terabytes seems slightly harder to sneak out in an email or USB key. Of course I'm a wiki expert on this, so someone with actual knowledge could probably be more informative.
- regularfry 15y agoThose are just the sizes of the pseudorandom sequences produced by a PRNG. They'll be defined by structures much smaller than that. However, that's not the bit that needs stealing, and doesn't even strictly need to be secret.
- agwa 15y agoIt's pretty rash for the article to suggest that the RSA algorithm might have been broken. If the key really has been stolen, it seems far more likely that it was breached due to crap IT security than a recently-discovered bombshell weakness in the RSA algorithm. For example, the RSA corporation's SecurID service (not to be confused with the RSA algorithm) was compromised due to a spear-phishing attack containing an Excel spreadsheet with a Flash exploit. Then Lockheed Martin was breached because they use SecurID[1]. Lockheed Martin happens to make GPS satellites[2], so they might have a copy of the key... This is completely speculative (in particular, Lockheed Martin claims no data was stolen and I know nothing about how GPS works). But in the past, there have been way more exploits due to insecure systems than to weak crypto (especially well-established crypto like RSA). [1] http://en.wikipedia.org/wiki/SecurID#March_2011_system_compromise http://en.wikipedia.org/wiki/SecurID#March_2011_system_compr... [2] http://en.wikipedia.org/wiki/USA-206 http://en.wikipedia.org/wiki/USA-206
- 46Bit 15y ago> in particular, Lockheed Martin claims no data was stolen If you had something particularly secret stolen you're not going to air it publicly. Agree with everything else though - even if this hypothesising is true it'll be down to a stolen key.
- freddealmeida 15y agoI find this fascinating. However, I think a sale to China would have greater impact than breaking military crypto. More interesting is that this drone was flown illegally into sovereign airspace and no one seems to mention that. Imagine if China flew a drone over LA. As for Iran being a target for military action, history has shown that any country that it sanctions economically is always attacked. Might as well just prepare for it.