Hacker News Reader

Comment by nl | Hacker News Reader

Geeze - I'm all for freely discussing engineering but wow I'm not sure I've ever seen a more directly dangerous piece of work.

For those who haven't read what this is about: The system is designed to stop weapon systems working outside specific geographic areas. This is so (for example) the US can arm a specific group in a conflict and if (when?) those arms fall into the wrong hands they are useless outside the area of that conflict.

This work discusses weaknesses in the lockdown system. It's pretty advanced work, so it isn't like a script-kiddie is going to work this out themselves.

View on HN

Dangerous? Yes. At the same time, he built this presentation using two things; Google-fu for open source intelligence, and a background in microcontrollers. "Untrustworthy third parties", as described in the talk, also possess these skills (look up the sophistication of IEDs used in Iraq and Afghanistan if you don't believe me). This guy invested his spare time over a few weeks or months to do the research on this. Again, this is entirely doable by most people. The purpose of doing this kind of security research is to push organizations (the CIA obviously watches the CCC presentations every year) to fix prior security mistakes before they are misused, and to refine better security practices in the future.

> It's pretty advanced work, so it isn't like a script-kiddie is going to work this out themselves.

Why not? Not sure what script kiddie would be motivated and have the necessary access to hack into abandoned weapons systems, whereas some motivated terrorist with an EE degree in an internet-connected cave structure would certainly have access to the same publicly available information these researchers did. They're not supplying a PoC to wannabe warlords here, on the other hand they provide an interesting new perspective on how these, already leaked, technologies were intended to be used.

Perhaps the presenter views it as hampering a dangerous foreign power in its attempts to meddle with other nations. The CIA doesn't exactly have a clean record.

Yes, this. Why do people think the CIA should have a right to do this, but other nations' intelligence agencies shouldn't?

The CIA are not the good guys here. This kind of duplicity just causes more war.

I agree with this argument completely.

No one is claiming the CIA doesn't also have responsibility here.

I still don't think publishing a roadmap to disable this is anything like responsible disclosure.

One of broader societies' big problems with technology proponents is the disclaiming of responsibility. I see this as a perfect example:

  - We know these weapons have fallen into the wrong hands
  - We know this is one of the techniques used to disable them
  - We know the groups who have them now want to use them in terrorist acts
  - The justification is "Well the CIA shouldn't have given them out/someone else might work out these techniques anyway"

Both of these these things given as justifications may be true and yet it is still wrong to do this.

An analogy is that someone leaves some cash at home while they go out. If someone posts on Twitter "hey person X has left cash at home and they have gone out and their address is XXX and here is how to bypass the model lock they have" is that defensible?

If you think the person with the cash is the bad guy, maybe yes?

The "person with the cash" is the families on the civilian airliners that are more likely to be shot down.

I agree. Presenting on Protego doesn't seem like a good idea – the information given in this talk could aid terrorists.

Toyota trucks are often used by terrorists. I don't think they should stop making them, though.

I had a vague idea that perhaps there is a difference between a Toyota truck and a Stinger Anti-aircraft missile.

But yes, I see we can't possible make that distinction.

It could also aid the CIA in making a more secure virtual fencing solution. It's similar to the debate about full disclosure vs coordinated disclosure. Some companies pay for bug bounties.

Additionally it could convince the CIA to distribute less weapons.

This is a good point! However, the CIA surely has sufficient internal incentives to fix privately disclosed vulnerabilities. There is no need for "bad publicity" to motivate them to become more secure. The CIA may even have already started working on fixes after Vault 7. Who knows?

The only thing this action serves to do is allow less than trusted third parties abuse the weapons given to them (a possibility that the speaker clearly recognizes).

> the CIA surely has sufficient internal incentives to fix privately disclosed vulnerabilities.

Do they? Also various people could have different definitions of "sufficient". They might previously have had 3 people spending half their time on it, and this might cause them to increase it to 5 people working full time on it.

Do major tech companies (Apple, Google, Microsoft) have less internal incentives than the CIA?

This XSS vulnerability apparently took a year to be fixed: https://www.openbugbounty.org/reports/164180/

Reply on news.ycombinator.com