Hacker News Reader

Comment by rdl | Hacker News Reader

There are hundreds of thousands of machines and millions of removable drives. Tracking down every last instance of a piece of malware and then dealing with it is quite hard at that scale. Usually they fall back on policy ("no usb/removable drives")

They're handicapped by a need AND compulsion to use contractors for everything. Actual government employees didn't build drones; they were all developed and in many cases largely maintained and even operated by private contractors, working to government requirements (which themselves are structured to make the contractors inefficient, compared to normal commercial companies). Same thing with networks.

View on HN

If I'm ever in charge of a PC capable of firing guns at people, then at a bare minimum I would disable the USB bus entirely, I probably wouldn't fit a NIC either. I'd also definitely install some of that software that makes the HDD read only and transparently passes through all writes to RAM. Fuckit, if I'm the US military I'd develop such a device in hardware. Send the recorded video/telemetry data to a write-only volume.

It's not that hard.

But anyway, my point was that I don't for a second believe that they're this incompetent, there must be other factors at play.

>It's not that hard.

eye roll

It's hard (in an engineering sense) at that scale, but certainly not impossible, and easier than a lot of engineering problems the world has solved. It's harder because DoD is actively being attacked, but easier because they have a near-infinite budget.

The thing which makes it hard is humans, politics, and economics -- there is a huge amount of CYA with respect to vendor choice (hence, they're a huge Microsoft/Cisco shop), lots of little fiefdoms, an "up or out" promotion policy combined with people being in leadership roles for short periods (with minimal prior background), and lack of real accountability.

The Microsoft-ness isn't enough to kill them on its own; look at the Israeli military, which is also heavily Microsoft based, and has world-class computer security.

It's not that hard if you have a top notch engineer in charge and give him whatever he needs to get the job done.

If you have a good engineer or a great engineer but any kind of bureaucracy, yes, it's near impossible.

google - top notch engineers, given whatever they need to get the job done, no bureaucracy, still get owned?

If you're talking about the China hacks, they were using ie6. I'd argue that would preclude the "top notch engineer" label.

Nope.

Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1, and SP2; Windows Server 2008 Gold, SP2, and R2; and Windows 7

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0...

yup.

"Microsoft thanks the following companies for working with us and for providing details of limited, targeted attacks against customers of Internet Explorer 6:

Google Inc. and MANDIANT; Adobe; McAfee; French government CSIRT (CERTA)"

http://technet.microsoft.com/en-us/security/bulletin/MS10-00...

also needed: no users.

Bespoke hardware for government agencies with unlimited budgets is nothing new.

I think for single-purpose machines (like "control a UAV"), custom hardware makes a lot of sense, even for commercial operations. Unfortunately custom hardware usually ends up being a Windows box in a weird case, with some buttons connected over...USB.

A requirement that all components of the TCB be FIPS 140-2 level 3+ for anything which is routinely used in combat operations would please me, I think. Right now that's just for the crypto modules themselves.

then the general will tell you "y'know the boys tell me that their job would be easier if they could listen to pandora on this puppy. i order you to connect it to the internet. if you don't comply, i'll have you arrested."

have fun!

Despite being as fucked up as it is, that's not how the military works.

no not entirely, but a lot of assed up things (especially with compusec) can happen because a 4-star wills it so.

The difference between the military and the neighborhood computers you used to assist with are the military has to deal with a plethora of entry points for viruses, and can't scrub every USB thumb drive that is at home rather than at the office. I get the feeling that you've not been doing this for 10-12 years yet. Am I right?

It seems pretty trivial to me just to string the cabling into a lockbox with the computer inside to prevent people from screwing around with your ports.

That said, i'm not in charge of physical security of anything. I'm sure the guys with missile launching computers figure anybody that can get to the secure terminal is trustworthy.

The hospital my dad works at, and all other hospitals in this area of the UK, all the machines have the USB ports disabled. All laptops issued by the local Health Authority have the USB ports/bus disabled. They had issues with worms, twice back in the early 00s, and after that all removable storage was banned.

If it's good enough for the NHS, it's good enough for uncle sam.

"I would disable the USB bus entirely" So how would you support Mice, Keyboards and Joysticks? And how long would it take you to retrofit all of the some 100K+ PCs rated "secret" or above in the Government?

I'd attach them to the PCIe bus somehow, or otherwise wire them straight into the motherboard.

Let me remind you that this computer can fire missiles at people, and has a potentially unlimited budget.

It does not have a potentially unlimited budget. As was mentioned above, these are often contracted third parties who develop the systems. They put in bids on government jobs and undoubtedly have their own margins to look after. Once the job is awarded, my understanding is that you can't change the price-tag it was awarded at. (At least, not easily)

The individual contracts have limited budgets, but if there were a DoD or Government-wide instruction that all systems meet a specific security standard, all contracts would be amended (cost increased along with scope) to comply with that standard. There's very little external pressure to constrain the maximum possible IT and IT security spending within government, especially the military.

The costs of good vs. bad IT security are actually not terribly significant in the context of the overall defense budget, either.

It's really a failure of process and vision, not resource constraint. Government IT and IT security used to lead industry; now consumers especially and even enterprises are more advanced than government.

you can disable any removable device, except the drone itself which seems talking back to the base using [non-encrypted] regular TCP/Ethernet and thus is a very plausible vector of continuous re-infection. The problem is well known and dates several years back:

http://online.wsj.com/article/SB126102247889095011.html

I remembered that article and it was the first thing I thought of too, and also why it hadn't been fixed. It's all about steak and strippers man.

Seriously? Have you ever worked on a PCIe bus device? They are hard to design, hard to test, and in general quite expensive. You're not going to build PCIe keyboards and mice that cost 10,000x COTS. That would at the very least cost someone their political career. (And the people who are making the decisions think about it that way, whether you want them to or not.)

How does the PC make the drone 10,000 miles away fire the missiles once you take the NIC out?

I'd phone up the people who'd designed me my multimillion dollar bespoke unmanned laser-accurate weapons delivery platform, and ask them if they fancied whipping me up a quick encrypted serial protocol for a couple of extra million dollars on top.

(Shrug) I just wouldn't use Windows. What's wrong with VxWorks for this type of thing?

> Tracking down every last instance of a piece of malware and then dealing with it is quite hard at that scale.

Sure, it's hard. But it's the fucking military. Figure it out.

Reply on news.ycombinator.com