Hacker News Reader

Comment by qubex | Hacker News Reader

It's a bit disingenuous to say that a ship is ’running’ an OS. It isn't like a computer that is entirely managed by a given software system. Here computers are but one component of an integrated system, and I'm presuming these systems are air-gapped and not connected to public networks. I'd be very surprised if these machines were reachable by public networks, or indeed any network at all that originates beyond the confines of the ship itself.

And by God doesn't it irk me to hear mentions of ’cyber’ as if it were an object.

View on HN

Just because they're only a part of a system doesn't mean they're not crucial[1]. Also its alarming how many systems you would presume are air-gapped but actually aren't, and air-gapping doesn't prevent PEBKAC errors (eg stuxnet being spread by flashdrive)

[1] See https://en.wikipedia.org/wiki/USS_Yorktown_(CG-48) where a divide-by-zero error brought down the ships propulsion for almost 3 hours.

You've got it backwards. That situation happened because a "more technology because computers and buzzwords and shit" resulted in political pressure to get stuff done and the end result was an OS jammed into a place it shouldn't have been without more testing and 3hr of downtime. That's why we run software that's been verified to work even if it's old.

Not easily accessible doesn't mean inaccessible and invulnerable. Having a vulnerable OS means if it can be accessed even for a short time then you're done. Also in integrated systems Computers form an integral part where most of the automatic stuff happens. Most of the monitoring of all the dials you see in movies is done by computers. Screw that up and you have a big problem in your hands. Your ship may start sinking and you may not even know because the OS misinterpreted the input from a sensor responsible for this because of data corruption.

As systems become more sophisticated, manual intervention becomes that much more difficult and vulnerable systems create that much more weak spots. So screw up a system to sink a ship may one day become a reality.

In other words if your ship is vulnerable to an enemy agent / spy / frogman sticking a USB key into any computer onboard, you've got problems.

If you have foreign combatants on your ship you have a problem, generally, whether they're armed with a USB stick or a plastic explosive.

You don't need foreign combatants on your ship.

Something similar to the stuxnet approach (sprinkle infected USB drives around employees hoping they'll bring it into the facility) or spearphishing will easily work on sailors whenever they bring "reading material" from shore to the ship; and from there it's just a matter of some sloppiness (which is likely to happen) and the malware will spread from the personal devices to the ship's systems.

The really devious approach would be to embed malware in the billions of USB keys manufactured in China every year. Not too hard if you make USB flash controllers.

In fact I'd be surprised if $large_nation_states aren't doing this already.

That would burn the vulnerabilities/exploits you use in this malware (e.g. stuxnet used 4 zero-days that weren't discovered for years after it had been first deployed), causing them to be detected, the particular holes fixed, and the signature of that particular malware added to detection lists.

No, you most likely want a targeted attack - manufacture such USB keys, distribute them only where you want them to be, and implement various triggers for the malware to delete itself (expiry date, IP ranges, regional settings) so that it doesn't spread worldwide beyond where you want it. Infecting millions of non-target systems is undesirable, that's how Stuxnet got discovered.

Wasn't there some news of NSA etc intercepting shipments and doing exactly that?

Seriously, I doubt that sailors and officers could be so clueless as to plug random USB drives into their embedded computers. Indeed I'd be really surprised if these machine's ports were exposed and their USB mass storage device drivers not disabled.

You'd be surprised what sex-starved crew are capable of to get their fix of "reading material"...

Never assume that a large organisation has a sane computer policy. For example the computers in voting machines and cars both have the least sane design you could think up. I don't see why the navy would be any more competent.

Presumably there must be some connectivity from onboard networks - even if only while in port?

[NB I meant to watch as HMSQNLZ sailed down the Forth last night - but was later than I was expecting. The MarineTraffic app currently has her doing circuits out in the North Sea past the mouth of the Forth]

On the other hand naval ships are increasingly designed around onboard distributed datacenters, where IT is grabbing the power: everything runs in virtualized, HA environments.

Just like the rest of the world, eaten by software.

relevant: https://cyber.equipment/

Reply on news.ycombinator.com