Stories
Slash Boxes
Comments

SoylentNews is people

posted by martyb on Wednesday October 10 2018, @04:37PM   Printer-friendly
from the who's-aiming-that-thing,-anyhow? dept.

Submitted via IRC for chromas

Pentagon's new next-gen weapons systems are laughably easy to hack | ZDNet

New computerized weapons systems currently under development by the US Department of Defense (DOD) can be easily hacked, according to a new report published today.

The report was put together by the US Government Accountability Office (GAO), an agency that provides auditing, evaluation, and investigative services for Congress.

Congress ordered the GAO report in preparation to approve DOD funding of over $1.66 trillion, so the Pentagon could expand its weapons portfolio with new toys in the coming years.

But according to the new report, GAO testers "playing the role of adversary" found a slew of vulnerabilities of all sort of types affecting these new weapons systems.

"Using relatively simple tools and techniques, testers were able to take control of systems and largely operate undetected, due in part to basic issues such as poor password management and unencrypted communications," GAO officials said.

The report detailed some of the most eye-catching hacks GAO testers performed during their analysis.

In one case, it took a two-person test team just one hour to gain initial access to a weapon system and one day to gain full control of the system they were testing.

Some programs fared better than others. For example, one assessment found that the weapon system satisfactorily prevented unauthorized access by remote users, but not insiders and near-siders. Once they gained initial access, test teams were often able to move throughout a system, escalating their privileges until they had taken full or partial control of a system.

In one case, the test team took control of the operators' terminals. They could see, in real-time, what the operators were seeing on their screens and could manipulate the system. They were able to disrupt the system and observe how the operators responded.

Another test team reported that they caused a pop-up message to appear on users' terminals instructing them to insert two quarters to continue operating.

Multiple test teams reported that they were able to copy, change, or delete system data including one team that downloaded 100 gigabytes, approximately 142 compact discs, of data.

The report claims the DOD documented many of these "mission-critical cyber vulnerabilities," but Pentagon officials who met with GAO testers claimed their systems were secure, and "discounted some test results as unrealistic."


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 2) by MrGuy on Wednesday October 10 2018, @04:46PM (17 children)

    by MrGuy (1007) on Wednesday October 10 2018, @04:46PM (#747023)

    one team that downloaded 100 gigabytes, approximately 142 compact discs, of data.

    2003 called - they want their unit of measurement for data back.

    Seriously - who is currently thinking in terms of "how much data fits on a CD?" as their frame of reference for "how big is a given dataset?" Most modern computers no longer ship with a CD drive.

    For those who prefer more well known units of measure, 100GB is one centi-LibraryOfCongress. [loc.gov]

    Starting Score:    1  point
    Karma-Bonus Modifier   +1  

    Total Score:   2  
  • (Score: 2) by rigrig on Wednesday October 10 2018, @06:14PM (3 children)

    by rigrig (5129) Subscriber Badge <soylentnews@tubul.net> on Wednesday October 10 2018, @06:14PM (#747070) Homepage

    Nobody is, reporters are thinking "What well-known object can I convert <measurement> to and have it come out as a number between 10 and 1000?"
    (Sadly, they have somehow missed the opportunity to convert data to "USB sticks")

    --
    No one remembers the singer.
    • (Score: 3, Funny) by bob_super on Wednesday October 10 2018, @06:25PM (1 child)

      by bob_super (1357) on Wednesday October 10 2018, @06:25PM (#747073)

      Anything after the DVD has not has fixed standard sizes, and 21 DVDs (or 11 double-layer ones) didn't look like enough stolen information.

      "44.4 PBR hours" would be a good metric (Pai broadband rate = 5Mb/s = 2.25GB/h)

      • (Score: 5, Funny) by Anonymous Coward on Wednesday October 10 2018, @07:36PM

        by Anonymous Coward on Wednesday October 10 2018, @07:36PM (#747100)

        21 DVDs (or 11 double-layer ones) didn't look like enough stolen information.

        What? How could that not be enough stolen information? 21 DVDs is something like 21 movies, which I understand from the MPAA is something like $840 billion dollars of economic damage.

    • (Score: 0) by Anonymous Coward on Wednesday October 10 2018, @07:04PM

      by Anonymous Coward on Wednesday October 10 2018, @07:04PM (#747087)

      Maybe they should have measured it in porn minutes? "Approximately 8.64 minutes of average porn bandwith for RedTube"

  • (Score: 3, Interesting) by Immerman on Wednesday October 10 2018, @06:18PM (11 children)

    by Immerman (3985) on Wednesday October 10 2018, @06:18PM (#747071)

    How about DVDs then? Blue-Ray discs? The problem with any more modern "standardized" unit of capacity is that it's not actually standard. How much is 1 DVD in GB? 4.7? 8.5? I'll bet you your answer depends very much on how large you want your number to look.

    If we could trust people to reliably use use the maximum standard capacity though, then at least we'd get a bit more reasonable 100GB = 12 DVDs.

    • (Score: 1) by nitehawk214 on Wednesday October 10 2018, @08:45PM (4 children)

      by nitehawk214 (1304) on Wednesday October 10 2018, @08:45PM (#747126)

      Or just say 100 gigabytes and leave it at that. Converting it to elephants per library of congress isn't going to make any more sense to someone that doesn't know what a gigabyte is.

      --
      "Don't you ever miss the days when you used to be nostalgic?" -Loiosh
      • (Score: 2) by Immerman on Friday October 12 2018, @02:29AM (3 children)

        by Immerman (3985) on Friday October 12 2018, @02:29AM (#747757)

        A number that means absolutely nothing to a vast swath of humanity. Think of it as a courtesy for the techno-illiterate - not unlike providing non-metric measurements in an article. I'd wager that far more people don't have a good feel of how big a GB is, than don't have a good feel for much a kilogram weighs.

        • (Score: 0) by Anonymous Coward on Friday October 12 2018, @11:11AM (2 children)

          by Anonymous Coward on Friday October 12 2018, @11:11AM (#747850)

          A number that means absolutely nothing to a vast swath of humanity.

          Ah but "142 compact discs" means nothing to a similarly vast swath of humanity from the perspective of data storage.

          I suspect more people in India/China/Africa have a better (though still vague) idea of what a Gigabyte means than a CD in terms of storage.

          Because more of them own feature or smartphones where "GB" is used as a storage measurement, than have owned CD players (or CD writers). Or have data plans that use GB as unit for quota.

          In 2018 "approximately 142 compact discs" is more useful as padding to meet a word count target for an article, than for giving a good feel of data storage used.

          • (Score: 1) by nitehawk214 on Friday October 12 2018, @02:56PM

            by nitehawk214 (1304) on Friday October 12 2018, @02:56PM (#747909)

            Maybe it would have been more impressive to say "over 8 thousand floppy disks". Or better yet, "if this was on floppies and layed end-to-end, they would be over over 11 football fields long!"

            --
            "Don't you ever miss the days when you used to be nostalgic?" -Loiosh
          • (Score: 2) by Immerman on Friday October 12 2018, @07:37PM

            by Immerman (3985) on Friday October 12 2018, @07:37PM (#748013)

            Which is why it's great that they give the actual 100GB number as well.

            Just because I give a measurement in miles, doesn't mean I can't give it in km as well. And if I'm writing for maximum comprehension, I'll give both.

    • (Score: 2) by c0lo on Wednesday October 10 2018, @09:52PM (5 children)

      by c0lo (156) Subscriber Badge on Wednesday October 10 2018, @09:52PM (#747161) Journal

      I'll bet you your answer depends very much on how large you want your number to look.

      Yeah, they should have used the 'single side single density 8" floppy disks' MU.

      (360kB [wikipedia.org] for those not old enough to have had worked with one)

      --
      https://www.youtube.com/watch?v=aoFiw2jMy-0 https://soylentnews.org/~MichaelDavidCrawford
      • (Score: 2, Funny) by redneckmother on Wednesday October 10 2018, @11:25PM (1 child)

        by redneckmother (3597) on Wednesday October 10 2018, @11:25PM (#747198)

        How much in Hollerith cards?
        :)

        --
        Mas cerveza por favor.
        • (Score: 2) by c0lo on Thursday October 11 2018, @12:40AM

          by c0lo (156) Subscriber Badge on Thursday October 11 2018, @12:40AM (#747214) Journal

          Depends. For a 80 cols card used with FORTRAN
          - if it's DATA or COMMENT section, you can use 78 characters/card
          - if it's code section, only 72 characters/card, reserve 8 for jump label and continuation character.

          Then you'll need to choose your MU to make sense for the layman - probably assume a certain cardboard density and express the amount of information in metric tonnes of punch cards (alternativelym, use firkins in FFF system).

          ---

          On a personal experience note: I never managed to write a program on punch cards that didn't results in a listing completely made of syntax errors. Happened in my first year at Uni, the effing punchers where mechanically comatose and needed very determined keypresses to actuate or would lock a key and fill the rest of the card with the same character, the keyboard layout was weird and the paint for the letters almost gone.
          On top of it, you delivered your stack of card on Monday and get the listing on Thursday - the bloody C++ programmers whinging today of long compilations! Don't have a clue on the meaning of "long compilation times".

          After one semester trying to do a simple "trapezoidal rule" integration I gave up and found myself a Sinclaire Spectrum clone to play with.

          --
          https://www.youtube.com/watch?v=aoFiw2jMy-0 https://soylentnews.org/~MichaelDavidCrawford
      • (Score: 2) by legont on Thursday October 11 2018, @12:55AM (2 children)

        by legont (4179) on Thursday October 11 2018, @12:55AM (#747222)

        Everybody forgets reliability factor. How many copies of that floppies one needs?

        I still have software and data on 4 bit paper rolls that are in perfect condition to run (inherited from my mother). My own punch cards? They are forever.

        --
        "Wealth is the relentless enemy of understanding" - John Kenneth Galbraith.
        • (Score: 2) by c0lo on Thursday October 11 2018, @01:47AM (1 child)

          by c0lo (156) Subscriber Badge on Thursday October 11 2018, @01:47AM (#747242) Journal

          Everybody forgets reliability factor. How many copies of that floppies one needs?

          I still have software and data on 4 bit paper rolls that are in perfect condition to run (inherited from my mother). My own punch cards? They are forever.

          What you seems to forget: the readers and, possible, the IO interfaces with the "computer" to get that data used.
          (e.g. good luck trying to find today a computer with RS-232 port. Yes, you can work around, but the info you encoded on that support is not immediately accessible to you)
          The problem is even more pronounced with high density storage technology and proprietary storage/document formats.
          E.g. good luck trying read a Word document from around 2000 with embedded Visio diagrams (that D/COM server technology? Bad for portability and long time storage of documents).

          --
          https://www.youtube.com/watch?v=aoFiw2jMy-0 https://soylentnews.org/~MichaelDavidCrawford
          • (Score: 2) by legont on Friday October 12 2018, @12:14AM

            by legont (4179) on Friday October 12 2018, @12:14AM (#747720)

            Well, I am pretty sure I can build a 4 bit punch tape reader in a long weekend basically from scratch. Come to think about it, I probably would be able to simply write a "character recognition software" for an existing scanner in a few hours.

            Later high density storage readers are more difficult, but very possible to build as well. I'd think though that the media would be often corrupted. That's where the interesting part starts - recovery of hidden data...)

            --
            "Wealth is the relentless enemy of understanding" - John Kenneth Galbraith.
  • (Score: 1) by nitehawk214 on Wednesday October 10 2018, @08:43PM

    by nitehawk214 (1304) on Wednesday October 10 2018, @08:43PM (#747123)

    This is a good measuring stick of how far behind the times the military's technology is.

    --
    "Don't you ever miss the days when you used to be nostalgic?" -Loiosh