10 ms·

In secret cyberwar game, reservist techies pummel miltary cyberwarriors

151 points by dctoedt 12y ago

deleted 12y ago
[deleted]
- MrZongle2 12y ago
  They certainly do; there's just no guarantee that the military will make use of them in an appropriate technical position.
  - ZanyProgrammer 12y ago
    Trans hackers and people who use illicit drugs most certainly do not, and until recently, LGB people.
    - Perdition 12y ago
      The weight and fitness standards would have kept more hackers out of the military than LGBT discrimination.
- aestra 12y ago
  Blatantly false. There have been posts on here to the contrary.
ohashi 12y ago
This doesn't seem quite right. It says reservists. They may also have roles in civilian life, but they are also part of the Military. That seems a bit deceptive in the title.
- dang 12y ago
  Thanks. We edited the title.
- mbrameld 12y ago
  Yeah, the real title of the article is "In supersecret cyberwar game, civilian-sector techies pummel active-duty cyberwarriors". Not sure why it's different here, usually the mods fix any deviation from the original title. I suspect they'll be along shortly.
- otoburb 12y ago
  If American reservists are expected to become a more critical component/dependency for US full-time cyberwarfare defensive or offensive capabilities, would this lead in any way to more time asked of reserve forces at least until internal military specialists are considered to be on par with their civilian and reservist counterparts? I'm curious if reservists deemed to have critical skills would be called upon to act beyond an amount comfortable for them, considering that they typically already have full-time day jobs as mentioned in the article.
  - mpyne 12y ago
    > I'm curious if reservists deemed to have critical skills would be called upon to act beyond an amount comfortable for them, considering that they typically already have full-time day jobs as mentioned in the article. Yes, that is certainly possible. The whole "1 weekend a month, 2 week a year" thing died with the World Trade Center. While Reserve units certainly try to maximize flexibility to try from interfering with their reservists work balance, getting called up unexpectedly (even for a period of months) is not that unusual if/when shit hits the fan somewhere.
    - walshemj 12y ago
      yes I know quite senior (RSM) people in the UK TA (reserves) who got sent to the gulf for an extended period - though that company does sponsor a TA unit so was fairly cool with it.
      - phaus 12y ago
        >though that company does sponsor a TA unit so was fairly cool with it. Do they have a choice in the matter? I'm just curious because here in the U.S. companies are obligated to hold your position for you until you get back.
        walshemj 12y ago
        I think there are sanctions (you are pissing of Liz II) and of course it might effect the senior mangers if their name came up for a gong or other honour. They have discussed making it mandatory for employers to give paid leave to TA members for annual training.
- dctoedt 12y ago
  Poster here -- I edited the original title to fit the 80-character limit, but otherwise left it alone.
mullingitover 12y ago
If we're trying to use uniformed military troops to hack servers remotely, we deserve to lose any 'cyber war.' They should be used to gain physical access to hardware and people, for the purpose of applying the xkcd decryption heuristic[1]. Leave the hacking to the experts. [1] http://xkcd.com/538/ http://xkcd.com/538/
- sliverstorm 12y ago
  Just because you can find it on the internet, doesn't mean you can get physical access, even if you are the US armed forces. First, you have to find it...
- lmkg 12y ago
  Why not both? I say that flippantly, but I mean that quite seriously. With the amount of resources available to the US military, I see no reason why they should constrain themselves to only a subset of capabilities, especially if the one they're cutting is less capital-intensive. I absolutely agree that the "$5 wrench algorithm" is a rational choice for the military to pursue: not only is it more available to them than to other organizations, it also aligns more closely with some of their existing core competencies. But that doesn't need to, and shouldn't be, pursued to the exclusion of other approaches.
- bithive123 12y ago
  I like xkcd as much as the next guy but we already had a perfectly serviceable metaphor: http://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis http://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis
- s_q_b 12y ago
  Those guys exist. But there are a whole host of reasons you'd want a force that could attack an enemy country's infrastructure remotely. As a chief example, it's far less inflammatory than boots on the ground. Can you imagine the difference in reaction if we sent door-kickers on the ground to Natanz and smashed the Iranian centrifuges, rather than using Stuxnet? The problem here is that there is a fundamental tension between hacking (or "advanced penetration testing" or "ethical hacking" or whatever) and the structure of the military. The military relies upon rules and procedures to accomplish repeatable tasks at massive scale. Hacking is an individual or small collective endeavor that involves non-linear thinking and creative leaps. Right now, they're trying to figure out how to work around that tension, and all we're seeing now are the early tests.
salem 12y ago
"suits and ties — or tie dyes and blue jeans" That says it all there, written by the navy times. Seems like there is a bit of a culture problem, and the perception of tech people by the regular army/navy/whatever. Apparently, anyone with deep technical skills in hacking computer systems is either a corporate drone, or a hippie.
- mabhatter 12y ago
  How about Polos and Kakis?
  - stonogo 12y ago
    Those who wear suits and ties see them as tie dye and jeans. Those who wear tie dye and jeans see them as suits and ties.
superuser2 12y ago
Civilian hackers have a solid intuitive understanding and can use that to select, build, and modify whatever tools they please according to their intentions, and use them however they want to. Do the military "cyberwarriors" even have local admin rights on their machines? Do they have the education necessary to think about systems and vulnerabilities and the requisite leeway to use that knowledge, or are they (as I would guess) "highly trained," where "trained" means "good at following a set of procedures"? I'm not knocking that as part of military culture. I want the people in control of weapons and aircraft, etc. to be great at following orders and the procedures they were trained to follow, and do little else. The ICMB fleet is not a place for improvisation. But computer security is. It's a creativity-driven field that moves quickly, evolves hourly, and requires intellectual agility. I would imagine that from a locked-down, out-of-date OS with a years-long procurement cycle to buy third-rate software from huge, blundering contractors and no leeway to try new things on a whim, it would be impossible to beat a team of educated, unencumbered civilians in a field like this. Of course, that's just a caricature of military culture that I'm imagining, but can anyone speak to this?
- figure_c 12y ago
  Special Operations forces are given considerable leeway to customize weapons and adjust uniform standards to the situation. I think the "cyberwarriors" would/should argue that their machines are their weapons and so should have similar latitude.
  - phaus 12y ago
    > I think the "cyberwarriors" would/should argue that their machines are their weapons and so should have similar latitude. They have argued and lost because the big picture military only cares about PT tests, marksmanship, and hair cuts. No one important enough to change policy understands how computers work.
    - Bahamut 12y ago
      Only the Marine Corps and maybe Army really care about PT performance - from what I understand, promotions in the Navy and Air Force are based off of exams.
ZanyProgrammer 12y ago
The fact is that people with unconventional (by military standards) are going to look at joining the military with skepticism, so right there the military is limiting its pool of potential security service men.
- TheSpiceIsLife 12y ago
  and women.
syncro 12y ago
I used to hear the term "cyber" when people didn't understand the internet. Now the only time I hear it is from the US military.
- kps 12y ago
  I used to hear the term "cyber" when it was the name of Control Data's mainframe series. http://en.wikipedia.org/wiki/CDC_Cyber http://en.wikipedia.org/wiki/CDC_Cyber
__john 12y ago
So I can off some first hand perspective here. >Do the military "cyberwarriors" even have local admin rights on their machines? We don't, hell I don't even have access to some of the basic tools I need (i.e. version control) >Hackers don't sign up for active duty military. They do, I've met the smartest people I know in the military . The hacker types never stay though they either get kicked out because they don't want to put up with the bullshit or separate after their first enlistment and quadruple their salary. Basically the problem with the military is that they won't (or can't) pay enough to retain any of the talent they have and are unwilling to compensate for the low salary by changing the "culture" they've developed over the last century.
- rdtsc 12y ago
  > We don't, hell I don't even have access to some of the basic tools I need (i.e. version control) Yap. Dealing with the military as a customer I have definitely have seen red tape that goes beyond reasonable for security and actually downright counter-productive (the steps needed to jump through to "secure" a box, many are wasteful, antiquated, yet some obvious ones are not mentioned. There are things like "tcpdump must not be installed". So debugging is a pain, so then fine, I'll just use a python wrapper around libpcap then. Some of the password policies are odd, don't remember exactly but requiring large passwords made of random gibberish instead of long pass phrases just make people write them posted notes and carrying them in their wallets.
  - phaus 12y ago
    >I'll just use a python wrapper around libpcap then. Must be nice, last government SOC I worked in, we could only script with powershell 1.0 installed. Sadly, that was just a year ago. We had tcpdump and Wireshark, but we weren't allowed to capture anything with it.
    - nitrogen 12y ago
      We had tcpdump and Wireshark, but we weren't allowed to capture anything with it. So how does anybody know there isn't data exfiltration going on?
frankydp 12y ago
The DOD cyber effort will be passed off department wide to a more function specific agency just as many other efforts before it. ie CDC NRC DARPA NASA The specific culture or technical requirements of network technology efficacy will/has end/ed up in a more mixed agency such as the NSA or DIA(redux). There are a lot of "hackers" in the DOD, as others have said they usually do not stay, but some do. The reason they seem like unicorns is because they usually end up working in the non cat video sector.
- themodelplumber 12y ago
  That first para is of the only comments here that gives me any hope for U.S. cyber capability and it really makes sense. Thanks.
vfclists 12y ago
Since when has investing in cyberwarfare skills become a substitute for writing correct code? Instead of thinking long term, and learning to write open, correct code in sane languages, the continued emphasis is in continuing to ship bug-ridden, untested, source either open with Linux, or closed source with Windows, in an insane languages like C, then announcing that investments need to be made in cybersecurity because the planet needs to be saved from hackers. Why not focus on getting things right in the first place?
twodayslate 12y ago
"cyberwarriors" makes me laugh every time
kaybe 12y ago
I have the feeling that the only people using the word 'cyber' at all are governments. Weird.

151 points by dctoedt 12y ago

deleted 12y ago

[deleted]

MrZongle2 12y ago
They certainly do; there's just no guarantee that the military will make use of them in an appropriate technical position.
- ZanyProgrammer 12y ago
  Trans hackers and people who use illicit drugs most certainly do not, and until recently, LGB people.
  - Perdition 12y ago
    The weight and fitness standards would have kept more hackers out of the military than LGBT discrimination.
aestra 12y ago
Blatantly false. There have been posts on here to the contrary.

ohashi 12y ago

This doesn't seem quite right. It says reservists. They may also have roles in civilian life, but they are also part of the Military. That seems a bit deceptive in the title.

dang 12y ago
Thanks. We edited the title.
mbrameld 12y ago
Yeah, the real title of the article is "In supersecret cyberwar game, civilian-sector techies pummel active-duty cyberwarriors". Not sure why it's different here, usually the mods fix any deviation from the original title. I suspect they'll be along shortly.
otoburb 12y ago
If American reservists are expected to become a more critical component/dependency for US full-time cyberwarfare defensive or offensive capabilities, would this lead in any way to more time asked of reserve forces at least until internal military specialists are considered to be on par with their civilian and reservist counterparts? I'm curious if reservists deemed to have critical skills would be called upon to act beyond an amount comfortable for them, considering that they typically already have full-time day jobs as mentioned in the article.
- mpyne 12y ago
  > I'm curious if reservists deemed to have critical skills would be called upon to act beyond an amount comfortable for them, considering that they typically already have full-time day jobs as mentioned in the article. Yes, that is certainly possible. The whole "1 weekend a month, 2 week a year" thing died with the World Trade Center. While Reserve units certainly try to maximize flexibility to try from interfering with their reservists work balance, getting called up unexpectedly (even for a period of months) is not that unusual if/when shit hits the fan somewhere.
  - walshemj 12y ago
    yes I know quite senior (RSM) people in the UK TA (reserves) who got sent to the gulf for an extended period - though that company does sponsor a TA unit so was fairly cool with it.
    - phaus 12y ago
      >though that company does sponsor a TA unit so was fairly cool with it. Do they have a choice in the matter? I'm just curious because here in the U.S. companies are obligated to hold your position for you until you get back.
      - walshemj 12y ago
        I think there are sanctions (you are pissing of Liz II) and of course it might effect the senior mangers if their name came up for a gong or other honour. They have discussed making it mandatory for employers to give paid leave to TA members for annual training.
dctoedt 12y ago
Poster here -- I edited the original title to fit the 80-character limit, but otherwise left it alone.

mullingitover 12y ago

If we're trying to use uniformed military troops to hack servers remotely, we deserve to lose any 'cyber war.' They should be used to gain physical access to hardware and people, for the purpose of applying the xkcd decryption heuristic[1]. Leave the hacking to the experts. [1] http://xkcd.com/538/ http://xkcd.com/538/

sliverstorm 12y ago
Just because you can find it on the internet, doesn't mean you can get physical access, even if you are the US armed forces. First, you have to find it...
lmkg 12y ago
Why not both? I say that flippantly, but I mean that quite seriously. With the amount of resources available to the US military, I see no reason why they should constrain themselves to only a subset of capabilities, especially if the one they're cutting is less capital-intensive. I absolutely agree that the "$5 wrench algorithm" is a rational choice for the military to pursue: not only is it more available to them than to other organizations, it also aligns more closely with some of their existing core competencies. But that doesn't need to, and shouldn't be, pursued to the exclusion of other approaches.
bithive123 12y ago
I like xkcd as much as the next guy but we already had a perfectly serviceable metaphor: http://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis http://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis
s_q_b 12y ago
Those guys exist. But there are a whole host of reasons you'd want a force that could attack an enemy country's infrastructure remotely. As a chief example, it's far less inflammatory than boots on the ground. Can you imagine the difference in reaction if we sent door-kickers on the ground to Natanz and smashed the Iranian centrifuges, rather than using Stuxnet? The problem here is that there is a fundamental tension between hacking (or "advanced penetration testing" or "ethical hacking" or whatever) and the structure of the military. The military relies upon rules and procedures to accomplish repeatable tasks at massive scale. Hacking is an individual or small collective endeavor that involves non-linear thinking and creative leaps. Right now, they're trying to figure out how to work around that tension, and all we're seeing now are the early tests.

salem 12y ago

"suits and ties — or tie dyes and blue jeans" That says it all there, written by the navy times. Seems like there is a bit of a culture problem, and the perception of tech people by the regular army/navy/whatever. Apparently, anyone with deep technical skills in hacking computer systems is either a corporate drone, or a hippie.

mabhatter 12y ago
How about Polos and Kakis?
- stonogo 12y ago
  Those who wear suits and ties see them as tie dye and jeans. Those who wear tie dye and jeans see them as suits and ties.

superuser2 12y ago

Civilian hackers have a solid intuitive understanding and can use that to select, build, and modify whatever tools they please according to their intentions, and use them however they want to. Do the military "cyberwarriors" even have local admin rights on their machines? Do they have the education necessary to think about systems and vulnerabilities and the requisite leeway to use that knowledge, or are they (as I would guess) "highly trained," where "trained" means "good at following a set of procedures"? I'm not knocking that as part of military culture. I want the people in control of weapons and aircraft, etc. to be great at following orders and the procedures they were trained to follow, and do little else. The ICMB fleet is not a place for improvisation. But computer security is. It's a creativity-driven field that moves quickly, evolves hourly, and requires intellectual agility. I would imagine that from a locked-down, out-of-date OS with a years-long procurement cycle to buy third-rate software from huge, blundering contractors and no leeway to try new things on a whim, it would be impossible to beat a team of educated, unencumbered civilians in a field like this. Of course, that's just a caricature of military culture that I'm imagining, but can anyone speak to this?

figure_c 12y ago
Special Operations forces are given considerable leeway to customize weapons and adjust uniform standards to the situation. I think the "cyberwarriors" would/should argue that their machines are their weapons and so should have similar latitude.
- phaus 12y ago
  > I think the "cyberwarriors" would/should argue that their machines are their weapons and so should have similar latitude. They have argued and lost because the big picture military only cares about PT tests, marksmanship, and hair cuts. No one important enough to change policy understands how computers work.
  - Bahamut 12y ago
    Only the Marine Corps and maybe Army really care about PT performance - from what I understand, promotions in the Navy and Air Force are based off of exams.

ZanyProgrammer 12y ago

The fact is that people with unconventional (by military standards) are going to look at joining the military with skepticism, so right there the military is limiting its pool of potential security service men.

TheSpiceIsLife 12y ago
and women.

syncro 12y ago

I used to hear the term "cyber" when people didn't understand the internet. Now the only time I hear it is from the US military.

kps 12y ago
I used to hear the term "cyber" when it was the name of Control Data's mainframe series. http://en.wikipedia.org/wiki/CDC_Cyber http://en.wikipedia.org/wiki/CDC_Cyber

__john 12y ago

So I can off some first hand perspective here. >Do the military "cyberwarriors" even have local admin rights on their machines? We don't, hell I don't even have access to some of the basic tools I need (i.e. version control) >Hackers don't sign up for active duty military. They do, I've met the smartest people I know in the military . The hacker types never stay though they either get kicked out because they don't want to put up with the bullshit or separate after their first enlistment and quadruple their salary. Basically the problem with the military is that they won't (or can't) pay enough to retain any of the talent they have and are unwilling to compensate for the low salary by changing the "culture" they've developed over the last century.

rdtsc 12y ago
> We don't, hell I don't even have access to some of the basic tools I need (i.e. version control) Yap. Dealing with the military as a customer I have definitely have seen red tape that goes beyond reasonable for security and actually downright counter-productive (the steps needed to jump through to "secure" a box, many are wasteful, antiquated, yet some obvious ones are not mentioned. There are things like "tcpdump must not be installed". So debugging is a pain, so then fine, I'll just use a python wrapper around libpcap then. Some of the password policies are odd, don't remember exactly but requiring large passwords made of random gibberish instead of long pass phrases just make people write them posted notes and carrying them in their wallets.
- phaus 12y ago
  >I'll just use a python wrapper around libpcap then. Must be nice, last government SOC I worked in, we could only script with powershell 1.0 installed. Sadly, that was just a year ago. We had tcpdump and Wireshark, but we weren't allowed to capture anything with it.
  - nitrogen 12y ago
    We had tcpdump and Wireshark, but we weren't allowed to capture anything with it. So how does anybody know there isn't data exfiltration going on?

frankydp 12y ago

The DOD cyber effort will be passed off department wide to a more function specific agency just as many other efforts before it. ie CDC NRC DARPA NASA The specific culture or technical requirements of network technology efficacy will/has end/ed up in a more mixed agency such as the NSA or DIA(redux). There are a lot of "hackers" in the DOD, as others have said they usually do not stay, but some do. The reason they seem like unicorns is because they usually end up working in the non cat video sector.

themodelplumber 12y ago
That first para is of the only comments here that gives me any hope for U.S. cyber capability and it really makes sense. Thanks.

vfclists 12y ago

Since when has investing in cyberwarfare skills become a substitute for writing correct code? Instead of thinking long term, and learning to write open, correct code in sane languages, the continued emphasis is in continuing to ship bug-ridden, untested, source either open with Linux, or closed source with Windows, in an insane languages like C, then announcing that investments need to be made in cybersecurity because the planet needs to be saved from hackers. Why not focus on getting things right in the first place?

twodayslate 12y ago

"cyberwarriors" makes me laugh every time

kaybe 12y ago

I have the feeling that the only people using the word 'cyber' at all are governments. Weird.