Get Hacked, Don’t Tell: Drone Base Didn’t Report Virus

[Richard]

This is the kind of thing that makes me go, "W...T...F!!???!!"

Reminds me of this old poster.

And so it goes...

Richard

Get Hacked, Don’t Tell: Drone Base Didn’t Report Virus
Wired, 11 Oct 2011

Officials at Creech Air Force Base in Nevada knew for two weeks about a virus infecting the drone “cockpits” there. But they kept the information about the infection to themselves — leaving the unit that’s supposed to serve as the Air Force’s cybersecurity specialists in the dark. The network defenders at the 24th Air Force learned of the virus by reading about it in Danger Room.

The virus, which records the keystrokes of remote pilots as their drones fly over places like Afghanistan, is now receiving attention at the highest levels; the four-star general who oversees the Air Force’s networks was briefed on the infection this morning. But for weeks, it stayed (you will pardon the expression) below the radar: a local problem that local network administrators were determined to fix on their own.

“It was not highlighted to us,” says a source involved with Air Force network operations. “When your article came out, it was like, ‘What is this?’”

The drones are still flying over warzones from Afghanistan to Pakistan to Yemen. There’s no sign, yet, that the virus either damaged any of the systems associated with the remotely piloted aircraft or transmitted sensitive information outside the military chain of command — although three military insiders caution that a full-blown, high-level investigation into the virus is only now getting underway.

Nevertheless, the virus has sparked a bit of a firestorm in military circles. Not only were officials in charge kept out of the loop about an infection in America’s weapon and surveillance system of choice, but the surprise surrounding that infection highlights a flaw in the way the U.S. military secures its information infrastructure: There’s no one in the Defense Department with his hand on the network switch. In fact, there is no one switch to speak of.


The four branches of the U.S. armed forces each has a dedicated unit that, in theory, is supposed to handle cyber defense for the entire service. The 24th Air Force, for example, “is the operational warfighting organization that establishes, operates, maintains and defends Air Force networks,” according to a military fact sheet. These units are then supposed to provide personnel and information to U.S. Cyber Command, which is supposed to oversee the military’s overall network defense.

In practice, it’s not that simple. Unlike most big private enterprises, the 24th doesn’t have a centralized system for managing and monitoring its networks. There’s no place at the 24th’s San Antonio headquarters where someone could see all the digital traffic hurtling through the service’s pipes. In fact, most of the major commands within the Air Force don’t have formal agreements to carry the other’s network traffic. (The 24th Air Force did not immediately respond to requests to comment for this article.)

“We’d never managed the entire Air Force network as a single enterprise,” Vince Ross, the program manager of the Air Force Electronic Systems Center’s Cyber Integration Division, said in March. “That meant there was no centralized management of the network, that systems and hardware weren’t standardized, and that top-level commanders didn’t have complete situational awareness.”

The plan is to one day integrate all that infrastructure into a single Air Force network. But for now, it’s largely cybersecurity by the honor system. Each base and each unit in the Air Force has its own geek squad. They only call for help if there’s a broader network problem, or if they’re truly stumped.

That didn’t happen when a so-called “keylogger” virus hit Creech more than two weeks ago.

“Nothing was ever reported anywhere. They just didn’t think it was important enough,” says a second source involved with operating the Air Force’s networks. “The incentive to share weaknesses is just not there.”

Not even when that weakness hits the robotic weapons that have become the lynchpin for American military operations around the planet.

http://www.wired.com/dangerroom/2011...tories+2%29%29

[albeham]

I bet they will now get a medal for it...some AF stress thingy.

[JJ_BPK]

This needs an in-depth classified AAR, with details..

Without knowing what the virus was and it's intent, WIRED.com and all others are just guessing.

If their security plan that rates an active threats was:

not executed
not timely
not vertical in notification

Someone will be spanked..

BUT,, If their transmit/receive technology is of a robust nature,, recording the transmission is of little concern. Properly encoded streaming binary is not going to compromise anything.

and WIRED.com,, in their very left leaning way, is blowing smoke up someones patootie.....

It's is not unlike the Enigma machine of WW II. If we didn't capture one, we may have never known how to use it..

Unless I guess wrong, the message should have had an encoding scheme exactly like other NSA devices..


In any case,, I think it's to early to judge...

My $00.0002

[BOfH]

The attitude of "why do I need to bring in someone smarter than I am if I *think* I know enough to deal with it myself", essentially the system/network administrators(if you can even call them that) over there felt there was no need to call in the experts, declared the virus harmless even though they had no idea what it was capable of and why it was there. This attitude is alive and well in the corporate world as well, except that we (most of the time) have more visibility into the network and less politics, allowing us to keep the "I *think* I know more than you" WoW gamer in HR in check.

My devalued .0002...

[JimP]

Some pretty callous attitudes towards our air force brethren here. I mean...come on!!! They would have had to write a report, ensure it got to the right people, make sure the damage was undone, make sure the effort at supporting the troops wasn't compromised, etc. Doing all of that may have made them late for their kids soccer game or - heaven forbid - late for happy hour at the club. Jeesh guys, ain't like they are downrange and can just go off station when the sun comes up.

[mugwump]

Originally Posted by JJ_BPK

BUT,, If their transmit/receive technology is of a robust nature,, recording the transmission is of little concern. Properly encoded streaming binary is not going to compromise anything.

The video streams used to be unencoded, hopefully that's changed and the command stream is encoded. But even if it is, I guess it depends on where we bought the chips used in the hardware encoding.

[Ret10Echo]

Final determinations aside...several potential issues.

1. Supply chain security... (What's in the soup...?)

2. Application of new technologies as "plug-ins" to native networks.

3. Rapid advancement and slow/non-existent certification requirements


Conflict of IA trying to lock-down networks poised against technologies and users who want free access to everything. If nobody notices, nobody mentions it...until there is an issue.

As pointed out in the article, the paradigm has been siloed capabilities...which were more secure based upon architecture. The "cloud" or National/Global WAN architecture poses multiple layers of issues and you end up "flying blind" (pun intended) trying to figure out the issue.

[greenberetTFS]

Originally Posted by Richard

This is the kind of thing that makes me go, "W...T...F!!???!!"

Reminds me of this old poster.

And so it goes...

Richard

Get Hacked, Don’t Tell: Drone Base Didn’t Report Virus
Wired, 11 Oct 2011

Officials at Creech Air Force Base in Nevada knew for two weeks about a virus infecting the drone “cockpits” there. But they kept the information about the infection to themselves — leaving the unit that’s supposed to serve as the Air Force’s cybersecurity specialists in the dark. The network defenders at the 24th Air Force learned of the virus by reading about it in Danger Room.

The virus, which records the keystrokes of remote pilots as their drones fly over places like Afghanistan, is now receiving attention at the highest levels; the four-star general who oversees the Air Force’s networks was briefed on the infection this morning. But for weeks, it stayed (you will pardon the expression) below the radar: a local problem that local network administrators were determined to fix on their own.

“It was not highlighted to us,” says a source involved with Air Force network operations. “When your article came out, it was like, ‘What is this?’”

The drones are still flying over warzones from Afghanistan to Pakistan to Yemen. There’s no sign, yet, that the virus either damaged any of the systems associated with the remotely piloted aircraft or transmitted sensitive information outside the military chain of command — although three military insiders caution that a full-blown, high-level investigation into the virus is only now getting underway.

Nevertheless, the virus has sparked a bit of a firestorm in military circles. Not only were officials in charge kept out of the loop about an infection in America’s weapon and surveillance system of choice, but the surprise surrounding that infection highlights a flaw in the way the U.S. military secures its information infrastructure: There’s no one in the Defense Department with his hand on the network switch. In fact, there is no one switch to speak of.


The four branches of the U.S. armed forces each has a dedicated unit that, in theory, is supposed to handle cyber defense for the entire service. The 24th Air Force, for example, “is the operational warfighting organization that establishes, operates, maintains and defends Air Force networks,” according to a military fact sheet. These units are then supposed to provide personnel and information to U.S. Cyber Command, which is supposed to oversee the military’s overall network defense.

In practice, it’s not that simple. Unlike most big private enterprises, the 24th doesn’t have a centralized system for managing and monitoring its networks. There’s no place at the 24th’s San Antonio headquarters where someone could see all the digital traffic hurtling through the service’s pipes. In fact, most of the major commands within the Air Force don’t have formal agreements to carry the other’s network traffic. (The 24th Air Force did not immediately respond to requests to comment for this article.)

“We’d never managed the entire Air Force network as a single enterprise,” Vince Ross, the program manager of the Air Force Electronic Systems Center’s Cyber Integration Division, said in March. “That meant there was no centralized management of the network, that systems and hardware weren’t standardized, and that top-level commanders didn’t have complete situational awareness.”

The plan is to one day integrate all that infrastructure into a single Air Force network. But for now, it’s largely cybersecurity by the honor system. Each base and each unit in the Air Force has its own geek squad. They only call for help if there’s a broader network problem, or if they’re truly stumped.

That didn’t happen when a so-called “keylogger” virus hit Creech more than two weeks ago.

“Nothing was ever reported anywhere. They just didn’t think it was important enough,” says a second source involved with operating the Air Force’s networks. “The incentive to share weaknesses is just not there.”

Not even when that weakness hits the robotic weapons that have become the lynchpin for American military operations around the planet.

http://www.wired.com/dangerroom/2011...tories+2%29%29

Stupid is as stupid does!.......

Big Teddy