Sponsor Message:
Military Aviation & Space Forum
My Starred Topics | Profile | New Topic | Forum Index | Help | Search 
Spies Get Terabytes Of Info. On F-35  
User currently offlineGreaser From Bahamas, joined Jan 2004, 1092 posts, RR: 4
Posted (5 years 22 hours ago) and read 6395 times:

Just what the fighter needs.

"Computer spies have broken into the Pentagon's $300 billion Joint Strike Fighter project -- the Defense Department's costliest weapons program ever -- according to current and former government officials familiar with the attacks"

"the intruders were able to copy and siphon off several terabytes of data related to design and electronics systems"

"Former U.S. officials say the attacks appear to have originated in China"

http://online.wsj.com/article/SB124027491029837401.html


Now you're really flying
25 replies: All unread, showing first 25:
 
User currently offlineUH60FtRucker From , joined Dec 1969, posts, RR:
Reply 1, posted (5 years 14 hours ago) and read 6216 times:

Mistake #1 made by the US military: using window based programs and operating systems. Windows: most worthless pieces of shit.... ever.

User currently offlineOsiris30 From Barbados, joined Sep 2006, 3186 posts, RR: 26
Reply 2, posted (5 years 13 hours ago) and read 6192 times:

Quoting UH60FtRucker (Reply 1):
Mistake #1 made by the US military: using window based programs and operating systems. Windows: most worthless pieces of shit.... ever.

Mistake #1 made by people who think they have a clue about computer security... blame Windows.

No system with critical data on it should be interconnected without decent firewalls, port filtering, IP obfuscation, stateful inspection, trusted hosts, etc. Furthermore you have no proof that any of the data came via a Windows system as it's not stated in the article.

[Edited 2009-04-21 06:50:33]


I don't care what you think of my opinion. It's my opinion, so have a nice day :)
User currently offlineRedFlyer From United States of America, joined Feb 2005, 4252 posts, RR: 29
Reply 3, posted (5 years 12 hours ago) and read 6144 times:



Quoting UH60FtRucker (Reply 1):
Windows: most worthless pieces of shit.... ever.

I agree with this statement entirely (I use Linux exclusively). However, I would not go so far as to blame MS-Windows for the breach. It could have been any OS that was breached. The perpetrators were after the information on the servers and they would have tried to get it, and probably would have been just as successful, regardless of the OS that was running those servers. The problem was with the fact that the servers were not on a closed loop and were accessible via the Internet.



I'm not a racist...I hate Biden, too.
User currently offlineAirRyan From United States of America, joined Mar 2005, 2532 posts, RR: 5
Reply 4, posted (5 years 12 hours ago) and read 6101 times:



Quoting RedFlyer (Reply 3):
The problem was with the fact that the servers were not on a closed loop and were accessible via the Internet.

And that is what just boggles the mind - I don't know how many more keys are on a Chinese keyboard but come on, letting them steal states secrets that could result in the lost lives of many Allied F-35 operators is like letting Cuba beat the US in baseball: that coach needs to be fired.


User currently offlineAcheron From Spain, joined Sep 2005, 1529 posts, RR: 2
Reply 5, posted (5 years 10 hours ago) and read 6019 times:

So, the export countries will not only get a downgraded plane, but will also get a plane with its systems compromised.

Yep, the plane sounds even more atractive by the minute...


User currently offline474218 From United States of America, joined Oct 2005, 6340 posts, RR: 9
Reply 6, posted (5 years 9 hours ago) and read 5997 times:

Seems like a typical anti-military news report, as both Lockheed Martin and the Defense Department have said the story is not true. Lockheed did say they are under constant attack but they have the means to identify and stop these attacks.

User currently offlineOroka From Canada, joined Dec 2006, 900 posts, RR: 0
Reply 7, posted (5 years 9 hours ago) and read 5962 times:



Quoting UH60FtRucker (Reply 1):
Windows: most worthless pieces of shit.... ever

Oh come on. Any OS is vulnerable to hackers, even OSX and Linux. Only difference is that 90% of the world uses Windows, so what OS are hackers going to target the most? Most security holes are discovered by Microsoft and a patch made available before the flaw is even revealed to the public. Also, I bet they were still using Windows XP... a 8 year old OS?

Just because (nearly) no one is bothering to attack OSX or Linux, doesn't mean the flaws are not there. If a skilled hacker wants into the network, it is only a matter of time. That is why you need a equally skilled system admin who knows what to watch for and how to combat such attacks (former hackers make the best anti-hackers).


Anyways, such sensitive info should never be on a network connected to the internet. It should be a closed network with no hard lines to the outside world. Any e-mails and communicationa should be done on separate computers (laptops) on a separate wireless network (with proper encryption of course).

I think you will see some significant beefing up of network security in all sensitive networks soon, This attack is not an isolated occurrence in the last month from China.


User currently offlineTugger From United States of America, joined Apr 2006, 5254 posts, RR: 8
Reply 8, posted (5 years 5 hours ago) and read 5868 times:

Now here is an interesting thought:
If I were keeper of this type of information, I would keep it separate on an isolated system. Then I would also maintain, for defensive and intelligence purposes, files that seemed good but were in fact infected and corrupt on an available system. A "Honey Trap" so to speak. In fact, if I were the USA this would be an integral part of my overall security plan.

The purpose of this honey data would be three fold: 1. to get my spy programs into my competitors systems, 2. to get tracking programs into competitors systems to be able to know who is after my stuff, and 3. to get my competitor to waste as much time as possible going down blind alleys or better yet build systems that don't work and have critical flaws in them thereby wasting even more time and resources.

And for those who think this is nonsensical, know that this is already done with pirated songs. I wonder how many Honey Traps in general are out there on the internet, probably more than we know.

Tugg



I don’t know that I am unafraid to be myself, but it is hard to be somebody else. -W. Shatner
User currently offlineRedFlyer From United States of America, joined Feb 2005, 4252 posts, RR: 29
Reply 9, posted (5 years 5 hours ago) and read 5853 times:



Quoting Tugger (Reply 8):
If I were keeper of this type of information, I would keep it separate on an isolated system. Then I would also maintain, for defensive and intelligence purposes, files that seemed good but were in fact infected and corrupt on an available system. A "Honey Trap" so to speak. In fact, if I were the USA this would be an integral part of my overall security plan.

For all we know, this may have already been done and this story is just a ruse to let the Chinese (or whoever stole the data) think they got their hands on the legitimate goods.

Personally, I found the story to be a little shocking, if true. Even if they didn't get their hands on the really critical data, it nevertheless points to very sloppy data security. So now I'm thinking maybe this is all part of a larger story, the majority of which we can't and never will see.



I'm not a racist...I hate Biden, too.
User currently offlineUH60FtRucker From , joined Dec 1969, posts, RR:
Reply 10, posted (5 years 3 hours ago) and read 5779 times:



Quoting Osiris30 (Reply 2):
Mistake #1 made by people who think they have a clue about computer security... blame Windows.

Oh don't get sore in your crotch.

I invite you to come see how the military has established its internal computer networks, and its reliance on windows based programs. I kid you not, I have 7 different programs running, acting as patches for potential security risks.

The US military has become extremely dependent on computers and the internet, while computer security has lagged far behind. Internet teleconferencing, millions of emails (vast majority on outlook) sent a day, thousands of pdfs and misc files sent. It's funny, because when it comes to paperwork, we've pretty much got it down, when it comes to handling and disposing of it properly. But not electronic information, there is a serious lack in proper training to teach electronic security.

And you want proof that the G6/J6 is not doing his job? This story.


User currently offlineConnies4ever From Canada, joined Feb 2006, 4066 posts, RR: 13
Reply 11, posted (5 years 3 hours ago) and read 5760 times:



Quoting UH60FtRucker (Reply 10):
Quoting Osiris30 (Reply 2):
Mistake #1 made by people who think they have a clue about computer security... blame Windows.

Oh don't get sore in your crotch.

I invite you to come see how the military has established its internal computer networks, and its reliance on windows based programs. I kid you not, I have 7 different programs running, acting as patches for potential security risks.

If you want computer security, switch to OpenVMS. That's what the missile defense system is being built on. This is the final evolution of Digital Equipmment's VAX/VMS architecture, whichwas considered by many to be essentially unhackable.



Nostalgia isn't what it used to be.
User currently offlineOsiris30 From Barbados, joined Sep 2006, 3186 posts, RR: 26
Reply 12, posted (5 years 2 hours ago) and read 5735 times:



Quoting UH60FtRucker (Reply 10):
Oh don't get sore in your crotch.

Sorry, but I hear that hogwash on a daily basis in my professional career. Often it's from people who should know far better. So, while I admit my comment was a bit harsh, I also stand by the fact it's 100% true.

Quoting UH60FtRucker (Reply 10):

I invite you to come see how the military has established its internal computer networks, and its reliance on windows based programs. I kid you not, I have 7 different programs running, acting as patches for potential security risks.

That just proves poor *network security* design. The operating system on a network can be anything on the face of the planet if you secure the edge correctly. Sounds to me like the military has no idea how to secure the border. The odd thing is how much this parallels physical security.

Quoting UH60FtRucker (Reply 10):
Internet teleconferencing, millions of emails (vast majority on outlook) sent a day, thousands of pdfs and misc files sent. It's funny, because when it comes to paperwork, we've pretty much got it down, when it comes to handling and disposing of it properly. But not electronic information, there is a serious lack in proper training to teach electronic security.

We agree > 100% on this point. However, I will point out that the issues you raise here, it wouldn't matter *what* OS you are running. You could write a custom, purpose built OS where every single line is audited by a billion programmers and if a stupid user emails 'F35_BluePrints.pdf' to 'ChineseSpy@yahoo.com' you're right back where you started.

Quoting Connies4ever (Reply 11):
If you want computer security, switch to OpenVMS. That's what the missile defense system is being built on. This is the final evolution of Digital Equipmment's VAX/VMS architecture, whichwas considered by many to be essentially unhackable.

Unhackable only until it's hacked. I've seen so many unhackable things ripped apart by teenagers my mind boggles. The single *biggest* mistake people make with security (apart from stupid users) is assuming; 'Hey, I am secure against all current threats' and then they forget about it, meanwhile the threats evolve. Computer security is *not* a one-time undertaking. Just like physical security it's a constantly evolving situation.

I remember the days when DES encryption was unbreakable... until it was broken (Hell single DES can be broken by a single person in a matter of weeks on a modern processor.. minutes on a farm of 100s). Certain hash algorithms were invulnerable to attack, only that changed too. As computers and networks get faster and faster things are unbreakable for less and less time. In the days when you could only hack into a system via a 2400 baud modem using an 8bit computer, brute force attacks were too slow to be viable. Now with gigabit connections, 64 bit processors (running several thousand more cycles a second, and doing 20 times more in a single cycle), gigs of ram, terabytes of disk space, etc. the rules have changed.



I don't care what you think of my opinion. It's my opinion, so have a nice day :)
User currently offlineUH60FtRucker From , joined Dec 1969, posts, RR:
Reply 13, posted (5 years 2 hours ago) and read 5724 times:



Quoting Osiris30 (Reply 12):

I still don't buy the windows is an appropriate operating system for computers handling sensitive, and secret, data.

The US Military is overhauling all of its computers to the VISTA operating system, and it's just another step, in a long series of steps, that were ill conceived. I'm not under any delusions of the military suddenly finding a better solution. What I'm saying is that it was a bad step, in the first place, to go with windows.

And yes, you're right... I am not as qualified in computers, as you are. But I don't think it takes a degree to identify that there is a problem, when you need a host of programs to patch security holes, and those programs dramatically degrade computer performance. This isn't Bob's Paper Sales... this is the top global military, we're talking about. There is a lot of incredibly vital information being stored on these systems, and a lot of it is being unnecessarily made vulnerable.


User currently offlineOsiris30 From Barbados, joined Sep 2006, 3186 posts, RR: 26
Reply 14, posted (5 years 2 hours ago) and read 5712 times:



Quoting UH60FtRucker (Reply 13):
The US Military is overhauling all of its computers to the VISTA operating system, and it's just another step, in a long series of steps, that were ill conceived.

Here's where we disagree. The OS doesn't matter. The edge matters. Window has some benefits and disadvantages (both are serious and noteworthy), but the same is true for Linux, OSX, QNX, BSD, VMS, Solaris, etc., etc., etc. Now I won't get into an OS debate here, but Vista, XP, WIndows 2000, etc. are all not inherently more or less secure than other OSes. The only security 'advantage' many of the above have is obscurity (albeit relative obscurity). But as anyone with an electronic security background will tell you, security through obscurity isn't security at all.

Quoting UH60FtRucker (Reply 13):
And yes, you're right... I am not as qualified in computers, as you are.

Didn't mean it that way at all, and I apologize (sincerely) if that's how you took my comments.

Quoting UH60FtRucker (Reply 13):
But I don't think it takes a degree to identify that there is a problem, when you need a host of programs to patch security holes, and those programs dramatically degrade computer performance.

That's because they are patches and not a FIX. The FIX for the DOD computer systems is network design and edge defense. The fix is NOT on the desktop. By trying to apply the fix at the desktop they are *doomed* to fail (regardless of OS). Obviously the desktop patches are addressing known issues. Instead of addressing these issues at the edge, they are chosing to address them at the pc level. Recipie for disaster. The *entire* system is now vulnerable to one renegade piece of hardware. One patch improperly applied and blamo.. the whole thing is f***ed.

It would be like doing immigration control on the streets of Manhattan. Stopping everyone passing through Times Square to check passports. It would be assinine, and no one would do it. But the DOD has taken this same mentality.

Using Windows has saved the military likely billions of dollars in training and custom software development. Those billions could *easily* secure your networks to the point where the OS is irrelevant. However, short-sighted military brass who know nothing of cyber security are running the show and you get a cluster f*** instead.

If I was given the task of fixing your cyber security issues tomorrow I would do three things:

1) Edge security - fix it, monitor it, be anal retentive about it.
2) Physical security - sensative computers are only accessed by people with the appropriate clearance physically. This includes janitors, visitors, etc. Pat down searches, screened emails, etc., etc., etc. (The same thing you do with your paper information).
3) Network segmentation - split common use equipment from secure equipment. No email from my PC with the radar cross section information of an F35. No Web access either. Or at the very least *heavily* filtered web access. Stateful packet inspection is a must here and it sounds like you do none (or none meaningful anyway).



I don't care what you think of my opinion. It's my opinion, so have a nice day :)
User currently offlineFlighty From United States of America, joined Apr 2007, 8205 posts, RR: 3
Reply 15, posted (4 years 12 months 4 days 23 hours ago) and read 5633 times:

Well, that's basically a tragic military defeat. I feel really bad for our forces to have their colleagues let them down like this!!

Sloppy work like this loses wars.

Quoting Tugger (Reply 8):
A "Honey Trap" so to speak. In fact, if I were the USA this would be an integral part of my overall security plan.

Hopefully that is exactly what occurred here. But I have a feeling it wasn't.

Quoting Oroka (Reply 7):
This attack is not an isolated occurrence in the last month from China.

Of course not; China conducts huge intelligence operations on US soil, and virtually, on a continual basis. If they didn't get these files electronically, they would actually go inside the Pentagon to get them. Perhaps they do that as well.


User currently offlineTheCol From Canada, joined Jan 2007, 2032 posts, RR: 6
Reply 16, posted (4 years 12 months 4 days ago) and read 5315 times:

Great... banghead 

I hope DND takes this into serious consideration.



No matter how random things may appear, there's always a plan.
User currently offlineTugger From United States of America, joined Apr 2006, 5254 posts, RR: 8
Reply 17, posted (4 years 12 months 3 days 21 hours ago) and read 5256 times:

Well apparently the Pentagon is now looking at creating a new "Cyber Command":

Quote:
Defense Secretary Robert Gates plans to announce the creation of a new military "cyber command" after the rollout of the White House review, according to military officials familiar with the plan.
....

Former President George W. Bush's top intelligence adviser, Mike McConnell, first proposed the creation of a unified cyber command last fall. The military's cybersecurity efforts are currently divided between entities like the NSA and the Defense Information Systems Agency, which is responsible for ensuring secure and reliable communications for the military. The Air Force also runs a significant cybersecurity effort.

http://online.wsj.com/article/SB1240...8674441033.html?mod=googlenews_wsj

Tugg



I don’t know that I am unafraid to be myself, but it is hard to be somebody else. -W. Shatner
User currently offlineOsiris30 From Barbados, joined Sep 2006, 3186 posts, RR: 26
Reply 18, posted (4 years 12 months 3 days 13 hours ago) and read 5172 times:



Quoting Tugger (Reply 17):
Well apparently the Pentagon is now looking at creating a new "Cyber Command":

Wow.. and only about 10 years too late! Seriously though, the best types of people to deal with network security issues are the ones least likely to get security clearance, so it will be interesting to see what happens.



I don't care what you think of my opinion. It's my opinion, so have a nice day :)
User currently offlineJoeCanuck From Canada, joined Dec 2005, 5320 posts, RR: 30
Reply 19, posted (4 years 12 months 3 days 6 hours ago) and read 5011 times:

This situation gives the US another reason to keep the F-22 exclusively to themselves. It's a lot easier to control the information if it isn't scattered around the globe.


What the...?
User currently offlineOroka From Canada, joined Dec 2006, 900 posts, RR: 0
Reply 20, posted (4 years 12 months 2 days 23 hours ago) and read 4934 times:



Quoting JoeCanuck (Reply 19):
This situation gives the US another reason to keep the F-22 exclusively to themselves. It's a lot easier to control the information if it isn't scattered around the globe.

What is the point if the US can't protect the data themselfs? If China gets just 1TB of F-35 data (the article says 'several'), that is better than having a month with a real F-35. Assuming all that data is not high def video of the mini F-35 at the mall... a lot of this data is internal design and testing info spilling the capacities and secrets of the F-35. Don't be surprised if you see a Chinese J-35 flying around in 10 years.


User currently offlineMD11Engineer From Germany, joined Oct 2003, 13801 posts, RR: 63
Reply 21, posted (4 years 12 months 2 days 7 hours ago) and read 4798 times:

I remember having heard a few weeks ago that backdoor trojans and viruses have been found in the computer systems of many US electricity providers, again with a link to China. Apparently they were installed to allow another power to basically shut down the electricity networks in the US in case of a conflict.
Remember how a few years ago the Baltic states were targeted by Russian hackers, from what I remember either Estonia or Latvia were pretty much shut down internetwise during a period of conflict with Russia. The same happened to georgia during the recent conflicrt with Russia.
We are getting too dependent on the internet!

Jan


User currently offlineConnies4ever From Canada, joined Feb 2006, 4066 posts, RR: 13
Reply 22, posted (4 years 12 months 2 days 4 hours ago) and read 4753 times:



Quoting MD11Engineer (Reply 21):
I remember having heard a few weeks ago that backdoor trojans and viruses have been found in the computer systems of many US electricity providers, again with a link to China. Apparently they were installed to allow another power to basically shut down the electricity networks in the US in case of a conflict.

I have had a couple of discussions with people in my organisation, who are in a position to know, that China has been sending bogus Cisco routers to the US (and I guess other Western nations, but primarily the US) that have 'backdoors' that permit reading of data streaming through the router and also remote control of the beastie, presumably on orders from Peking.

Any opinions out there ?



Nostalgia isn't what it used to be.
User currently offlineOsiris30 From Barbados, joined Sep 2006, 3186 posts, RR: 26
Reply 23, posted (4 years 12 months 2 days 3 hours ago) and read 4751 times:



Quoting MD11Engineer (Reply 21):
We are getting too dependent on the internet!

I suppose that's fair if you think you can be too dependant on information :/ It's not that we are too dependent on the inernet, rather, we are lazy idiots who think we can get a free lunch from the internet.

Nothing wrong with the internet, as long as you don't treat it as more (or less) than it is. The reality of the situation with security is simple (and I've had this fight *alot* in my professional security)... if it's not a bank or insurance company most companies don't spend *jack* on security. You can scream, bitch, propose, strategize, synergize or any other 'ize' you want, and the 800 year old board of directors doesn't see a reason to spend a dime protecting their networks from that new fangled intarweb.



I don't care what you think of my opinion. It's my opinion, so have a nice day :)
User currently offlineRwessel From United States of America, joined Jan 2007, 2238 posts, RR: 2
Reply 24, posted (4 years 12 months 1 day 21 hours ago) and read 4678 times:
Support Airliners.net - become a First Class Member!

Quoting Connies4ever (Reply 22):
I have had a couple of discussions with people in my organisation, who are in a position to know, that China has been sending bogus Cisco routers to the US (and I guess other Western nations, but primarily the US) that have 'backdoors' that permit reading of data streaming through the router and also remote control of the beastie, presumably on orders from Peking.

Any opinions out there ?

Being able to capture and copy packets and being remotely controlled are basic functions of pretty much any routing gear of any sophistication.

If you know the password for getting in, and are not otherwise blocked by network security measures, you can reconfigure the router, or start capturing packets with a minimum amount of skill.

Plus "fake" Cisco routers are clearly made-up. They do too much, and have too much software to be duplicatable in a meaningful way (not that you can’t build your own router – it just isn’t going to run a version of IOS from Cisco). A hacked version of IOS (the OS in Cisco routers), might well exist, and might allow some backdoor access to the management and diagnostic functions. Of course that presents a problem as soon as anyone tries to apply an IOS update from Cisco (as would an actual "fake" box).

edit: clearly with sufficient funds you could duplicate the hardware, but that only makes you a supplied of Cisco router clones. And while you might be able to build some hacking functions into some of the hardware, you won't accomplish much, and for a very high cost.

But other than a denial of service attack, this buys an attacker little that they're not assumed to have anyway - packets crossing the public Internet are can be intercepted and copied at dozens or hundreds of points, and cannot be assumed to be secure. Which is why you need to encrypt important traffic. Not to say there aren't any flaws in the certificate/encryption infrastructure that need to be fixed. The reliance on DNS is a big worry at the moment, for example.

And that's not to dismiss the value of a DOS attack. Being able to take down significant parts of your infrastructure, even temporarily, is obviously of value to your adversary.

[Edited 2009-04-24 23:28:43]

User currently offlineFlighty From United States of America, joined Apr 2007, 8205 posts, RR: 3
Reply 25, posted (4 years 12 months 8 hours ago) and read 4510 times:

Interesting stuff. They intend to take a strong lead in programming brainpower. That is combined with a superlative human intelligence system on the ground level inside the USA. Using this system, they can effectively enjoy information superiority over the USA. We did it to the Germans, which proved useful in WWII. Today, still true. It is a winning strategy. Indeed, they can build F-35 from blueprints. Electrical engineering and materials fabrication are both high points of native Chinese tech.

Moral of the story, our government should be recruiting every single talented hacker they come across. As you all point out, a network that is not secure can be spied on and then disabled. This is an engineering race, just like all the old ones.


Top Of Page
Forum Index

Reply To This Topic Spies Get Terabytes Of Info. On F-35
Username:
No username? Sign up now!
Password: 


Forgot Password? Be reminded.
Remember me on this computer (uses cookies)
  • Military aviation related posts only!
  • Not military related? Use the other forums
  • No adverts of any kind. This includes web pages.
  • No hostile language or criticizing of others.
  • Do not post copyright protected material.
  • Use relevant and describing topics.
  • Check if your post already been discussed.
  • Check your spelling!
  • DETAILED RULES
Add Images Add SmiliesPosting Help

Please check your spelling (press "Check Spelling" above)


Similar topics:More similar topics...
Israel Wants Own Technology On F-35's posted Fri Oct 3 2008 17:29:59 by Blackbird
Canada To Get A Fleet Of UAVs posted Sun Oct 28 2007 12:26:17 by FighterPilot
Info On The F-15N posted Tue Apr 24 2007 01:10:56 by 747400sp
Need Info On (closed) Presque Isle AFB posted Fri Jun 2 2006 21:35:38 by Scintx
Bush, Blair Agree On F-35 Technology Transfer posted Sat May 27 2006 21:35:17 by Lumberton
Info On This Please posted Sun May 7 2006 20:24:58 by CYEGsTankers
USAF Seeks Info On Subsidies From Tanker Bidders posted Wed Apr 26 2006 11:48:04 by Lumberton
Any Info On NAWC/NADC Johnsville. Warminster, PA posted Sun May 15 2005 01:29:30 by Jetjack74
Info On VS-30 "Diamondcutters" posted Wed May 4 2005 18:56:13 by Spartan13
Some Info On That Wet-Leased Lauda B736 (USN) posted Sun Jan 30 2005 19:30:53 by Flynavy

Sponsor Message:
Printer friendly format