Categories
software security

Droning on about computer security

Good grief.

The US military’s unmanned Predator and Reaper drones are continuing to fly remote missions overseas despite a computer virus that has infected their US-based cockpits.
Government officials are still investigating whether the virus is benign, and how it managed to infect the heavily protected computer systems at Creech Air Force Base in Nevada, where US military pilots remotely fly the planes on their missions over Iraq, Afghanistan and elsewhere.
“Something is going on, but it has not had any impact on the missions overseas,” said a source, who was not authorized to speak publicly.
Armed tactical unmanned planes have become an increasingly valuable tool used by the US military to track and attack individuals and small groups overseas, but the virus underscores the vulnerability of such systems to attacks on the computer networks used to fly them from great distances.
Rob Densmore, former US navy airman, told Al Jazeera that the infection was a common keystroke logging virus – which registers the keystrokes pilots use to control the unmanned drones from afar.
“It has to have a point of access, so we know that thumb drives – basically USB drives – are used to upload navigational information, guidance information to Predator and Reaper drones.
“And if there’s a way somehow that that information, or that thumb drive, can come into contact with a network or with the internet, that’s where the danger is because that basically means that information can be carried across from the Reaper drones.”

http://english.aljazeera.net/news/americas/2011/10/201110816388104988.html

Government approach to security can be described as designing an unsinkable boat that has no doors between compartments and then, to make it usable, cutting a random and increasing number of undocumented holes between compartments.

 

Categories
Uncategorized

Boeing security

So the court said Matthew Neumann and Nicholas Tides were properly fired in 2008 for violating company policy of disclosing company information to the media, in this case the Seattle Post-Intelligencer, without company authorization.

In 2007, the PI wrote: “Boeing and its external auditors have rated the company’s inability to patch database and software development security holes as a ’significant deficiency’ with the computer infrastructure since 2004 — the first year it had to comply with the 2002 law. The failure has been deemed serious enough that for three years in a row, finance teams have spent the last 45 days of each year testing whether financial numbers are correct.

from Wired.

Categories
software security

Security news

The lesson of this story is that even (particularly?) computer security companies cannot put up with the inconvenience of standard security precautions.

Greg Hoglund’s nightmare began on Super Bowl Sunday. On Feb. 6 the high-tech entrepreneur was sitting in his home office, trying to get to the bottom of some unusual traffic he was seeing on the Internet. Two days earlier he’d noticed troubling activity hitting the website of HBGary Federal, the Sacramento startup he helped launch in 2009. He suspected some kind of hacker assault and had spent the weekend helping to shore up the company’s systems. A few hours before Green Bay kicked off to Pittsburgh, Hoglund logged into his corporate account on Google (GOOG)—and confirmed his fears.

He couldn’t get in. Someone had changed the password and locked him out of his own e-mail system.

He used Google mail – and several people had the administrator password.

Categories
Uncategorized

Boeing’s clever idea

(Update – great link in John Regehr’s comment)

Apparently, passenger, admin, and air control computers are all connected. Here’s a reassuring comment (emphasis added)

Boeing spokeswoman Lori Gunter said the wording of the FAA document is misleading, and that the plane’s networks don’t completely connect.

The FAA is concerned.

The proposed architecture of the 787 is different from that of
existing production (and retrofitted) airplanes. It allows new kinds of
passenger connectivity to previously isolated data networks connected
to systems that perform functions required for the safe operation of
the airplane. Because of this new passenger connectivity, the proposed
data network design and integration may result in security
vulnerabilities from intentional or unintentional corruption of data
and systems critical to the safety and maintenance of the airplane. The
existing regulations and guidance material did not anticipate this type
of system architecture or electronic access to aircraft systems that
provide flight critical functions.

So we are closer to the first DRM induced fatality!