August 10, 2014
Hacker Shows How To Break Into Military Communications Systems
The use of satellite communications is ubiquitous throughout the U.S. military — in both strategic and tactical environments. Patrick Tucker, writing in the August 7, 2014 DefenseOne.com, notes that a “a well-known hacker claim’s he’s found some major flaws in the communication equipment that U.S. ground troops use to coordinate movements. The equipment is also common on a variety of commercial ships and aircraft rely on to give pilots vital information. In other words, you can hack planes,” Mr. Tucker writes.
Speaking at the annual gathering of cyber security geeks — The Black Hat Conference — in Las Vegas, Nevada last week, cyber security analyst Ruben Santamarta of IOActive, presented a “much anticipated paper showing that communications devices from Harris, Hughes, Cobham, Thuraya, JRC, and Iridium — are all highly vulnerable to [cyber] attack,” wrote Mr. Tucker. “The security flaws are numerous; but, the most important one — the one that’s most consistent across the systems — is back doors,” Mr. Santamarta contends. “Another common security flaw,” he observed was hardcoded credentials, which allows multiple users access to a system — via a single login identity.”
Santamarta argued that “a satellite communications system that’s common in military aviation, the Cobham Aviator 700D, could be hacked in a way that could affect devices that interact with critical systems — possibly resulting in “catastrophic failure.” Mr. Tucker adds that “in conversations with reporters, Santamarta was careful to point out that none of the vulnerabilities he found could directly cause a plane to crash, or override pilot commands. But, the security gaps were significant enough,” he argued, — “that a hacker could make it much harder to fly.”
“The most serious vulnerability, Santamarta found on Cobham’s equipment,” writes Mr. Tucker, “allowed a hacker access to systems swift broadband unit, or SBU, and the satellite data unit, SDU.” “Any of the systems connected to these elements, such as the Multifunction Control Display Unit (MDCU), could be impacted by a successful attack,” Mr. Santamarta wrote in his paper. “The SBU contains a wireless access point.”
“The MDCU provides information on such vital areas as the amount of fuel left in a plane,” writes Mr. Tucker. “A hacker could give the pilot a lot of bad information that could imperil the aircraft, as happened in 2001 aboard Transat Flight 236, when a mechanical error did not inform the pilots that fuel was being diverted to a leaky tank. The pilots did not know the severity of the mechanical problem — until there was a massive power failure in mid-air,” noted Mr. Tucker.
“IOActive found vulnerabilities an attacker could use to bypass authorization mechanisms — in order to access interfaces that may allow control of the SBU, or SDU. Any of these systems connected to these elements, such as the MCDU, could be impacted by a successful attack,” Mr. Santamarta wrote.
Cobham spokesman Greg Caires, told DefenseOne, “that the back door was a “feature” that helps ensure ease of maintenance. “We determined that you have to be physically present at the terminal to use the maintenance port,” he said. “Santamarta disputed that,” notes Mr. Tucker, and “reiterated that while you need physical access to pull off certain attacks, other vulnerabilities within the SBU, “can be attacked through the Wifi.”
“The seas aren’t safe either,” Mr. Santamarta argued. Indeed, Santamarta ‘showed that he could access the SAILOR 6000 satellite communications device, also manufactured by Cobham, which is used in naval settings by countries, including the United States, participating in the Global Maritime Distress and Safety System — an international framework to allow for better communication among maritime actors.” “This system, which the world’s maritime nations — including the United States — have implemented, is based upon a combination of satellite and terrestrial radio services; and, has changed international distress communications from being primarily ship-to-ship-based, to primarily shore-to-shore-based (Rescue Coordination Center),” according to the Department of Homeland Security.
“In a dramatic portion of his presentation,” Mr. Tucker writes, “Mr. Santamarta live-hacked a SAILOR 6000 operating system (firmware) on stage. When he uploaded new software and then attempted to send a distress, rather than a show a message received, the system showed a slot machine,” Mr. Tucker wrote. “Because we’re in Las Vegas,” Mr. Santamarta said.
“A would-be enemy could exploit design flaws in some very common pieces of military communications equipment used by soldiers on the front lines….to block calls for help; or, potentially reveal troop positions,” to the adversary, Mr. Tucker observed.
“The SATCOMS in question,” Mr. Tucker writes, “were the Harris Broadband Global Area Network, or BGAN (specifically the RF-7800-VU024), and the several BGANs from Hughes. These are in wide use among the U.S and NATO militaries,” he notes. “Troops use BGANs to communicate with units beyond the line of sight. Traffic over these systems is encrypted; and, Santamarta did not claim that he could intercept or decrypt the data…so, there’s no threat of enemies listening in on restricted calls. But, Santamarta’s paper does show that it’s possible not only to disrupt the communication; but, also discover troop locations, which could lead soldiers open to ambush.”
Mr. Tucker writes that representatives from Harris and Hughes did not immediately respond to a request for comment from DefenseOne.
“Santamarta said that he relayed his findings to all of the vendors; and, sarcastically referred to their responses as “awesome.” “Hughes officials told him that the flaws did not “pose a security risk,” and called back doors a “common practice in electronic products,” because vendors and technicians sometimes forget passwords. “At this point, there are no patches. We don’t expect any,” Santamarta said.
“Caires told DefenseOne that they became aware of Santamarta’s research in April; and that, it’s an issue that the company is taking very seriously.”
“It is also an issue that’s unlikely to go away anytime soon,” concludes Mr. Tucker. “If Cobham says that its equipment can’t be hacked remotely, then it’s not going to take any steps to address vulnerabilities that can be exploited over WiFi. The company is defending its use of back doors, which Caires called a “feature” that makes maintaining a system much easier.”
“It’s a consideration that Santamarta dismisses,” Mr. Tucker wrote, “unequivocally.” “I can’t recommend a back door — ever. It’s a security risk. It’s not a good idea.”
Not really surprised by this revelation; and, shame on us if we didn’t already know this. Our systems aren’t safe and are riven with vulnerabilities and weaknesses. But, so too are our adversaries — systems. They also have substantial vulnerabilities and weaknesses throughout their IT network ecosystems. Perhaps this is one reason in the unclassified Chinese literature on Total War, that Beijing’s military often train for a “disconnected” battlefield.” It is better to assume that many of your systems may already be breached — before a combat engagement — rather than expect them to perform and shoot without software/network problems. What about military robots and autonomous systems? V/R, RCP
No comments:
Post a Comment