4 ms·

All these complex and sophisticated attacks seem like too much work. It looks like the author either omits a step from the attack where the SecurID compromise a

• regularfry 15y ago
  I think he's arguing that the attack in which SecurID was compromised also resulted in the red key being compromised.
  • parfe 15y ago
    Is the "red key" real or mythical?
    • regularfry 15y ago
      There's a secret key involved in the anti-spoofing part of GPS, but I don't know if it's actually called a "red key" by people who use it.
      • parfe 15y ago
        The wiki article on GPS encryption seems to say that stealing the key for one satellite is possible (720 gigabytes), but the master key at 26 terabytes seems slightly harder to sneak out in an email or USB key. Of course I'm a wiki expert on this, so someone with actual knowledge could probably be more informative.
        • regularfry 15y ago
          Those are just the sizes of the pseudorandom sequences produced by a PRNG. They'll be defined by structures much smaller than that. However, that's not the bit that needs stealing, and doesn't even strictly need to be secret.
    • fredonon 15y ago
      Red key means un-encrypted key. The opposite would be black. Usually, the key does not need to be exposed. It would be stored in a very hard to break container with some sort of self destruct mechanism. Communication with the box never involve the key itself. And to top it all, the key changes often. Additionally, protocols usually use the Diffie-Hellman algorithm (or something like it) to generate very short lived secret session keys. I would go and say (out of my ass) that recent military drones would have 2 or 3 different backup systems for everything, including positionning.
  • wmf 15y ago
    How? Why would RSA Inc. have a copy of a secret military crypto key? (Edit: I see a few other people have made the same point below.)
    • itsnotlupus 15y ago
      There were stories floating around* that Lockheed had a remote intrusion problem linked to the securid compromise, and that perhaps US contractor companies were the real target behind the RSA hack. That would draw a nice line between securid and secret data found on gps satellites manufactured by lockheed. *: http://www.theregister.co.uk/2011/05/27/lockheed_securid_hack_flap/ http://www.theregister.co.uk/2011/05/27/lockheed_securid_hac...
• vbtemp 15y ago
  Right - no one wants to consider this null hypothesis. Not exciting enough, I suppose. Actually spoofing GPS - which would involve masking the actual GPS signal and producing the precise nanosecond differentials from a simulated fleet of satellites needed to give a false location, seems highly unbelievable. GPS jamming is possible, which may have led to a loss of nav (although I would have thought there may be some inertial guidance), but either way, the guidance-and-control system probably just leveled off for a smooth crash landing. (hence the way the iranians not-so-cleverly hid the underside of the UAV in anti-american propoganda posters)
  • parfe 15y ago
    >Actually spoofing GPS - which would involve masking the actual GPS signal and producing the precise nanosecond differentials from a simulated fleet of satellites needed to give a false location, seems highly unbelievable. Literally the plot of the James Bond movie Tomorrow Never Dies.
  • cameldrv 15y ago
    Spoofing GPS, at least the C/A code is not such a huge challenge. You can buy the hard part off the shelf from many vendors. For example, http://sine.ni.com/nips/cds/view/p/lang/en/nid/206805 http://sine.ni.com/nips/cds/view/p/lang/en/nid/206805
    • jonknee 15y ago
      That works to spoof GPS for your phone in a controlled location, but not for a drone that's flying unpredictable routes.
      • burgerbrain 15y ago
        Any well funded group of HAMs should be able to iron out the implementation details.