Virus infects killer US air drone fleet Computers controlling the US Air Force's killer Predator and Reaper drones have been infected by a key-logging virus, according to a mole who spoke to Wired. And the malware is not going away despite serious efforts to nuke it. The remote-controlled bomb planes have flown in missions since the discovery of the virus two weeks …
"It is believed that the malware won't be able to transmit the information it collects beyond the classified military network hosting the equipment; the network is insulated from the public internet."
This isn't some two-bit home network NAS we're talking about here ffs! How can they be so relaxed about it? It got in to an isolated (allegedly) network, until you can PROVE otherwise, you have to assume it can get out, not go, "well, we'll probably be ok, so bollocks to it".
What if it got there via an infected USB stick? Is it plausible to think that maybe the stick captures info from the virus the next time its attached to the network?
I heard about this in the US press last week. I saw some analysis that showed a strict ACL-set firewall that controlled access to the drone-managing subnet. I would have expected that. We do that with our Intensive Care ward for patients. I certainly hope that they do it with their most sensitive areas, too.
If it is as the analysis (and common sense) dictates. Then the firewall should insulate the key machines.
No, I thought that action was accomplished through the use of the "Destroy" key (aka "Delete").
Ah, yes, WindoZE for reconnaissance aircraft, (ad tag line: "Where do we want to crash today?") or,
WindoZE for drones (ad tag line: "Who do we nuke today?")
Perhaps the reason they are using WindoZE is because the vendor modded M$ Flight Simulator into a control system for those drones.
Seems to me they're looking in the wrong place, then.
It could be that the malware had the capability to attach itself to the system firmware via a BIOS (or EFI) flash operation. Case in point: Trojan.Mebromi, which was recently discovered running around China:
-- -- The Register: Malware burrows deep into computer BIOS to escape AV
-- -- -- -- http://www.theregister.co.uk/2011/09/14/bios_rootkit_discovered/
Personally, I've always thought that PCs, Laptops, Servers,and other BIOS/EFI-based devices should come with a "flash inhibit" switch or jumper that disables BIOS/EFI updates at the hardware level. Granted, this is something that Joe Average Non-Techie User would likely never use, but could be a boon for system admins and technicians trying to secure company assets...
They don't operate on "Windows" so this was tailer made. They can't possibly know what this thing does. Hell, the "users" have to log in to operate it, so. There's the authentication. Obviously someone has the software because they were able to right the virus.
So I can see it now, someone logs in with correct credentials, takes over, does whatever they want remotely.
Wasn't this drone or something like it reported as sending video unencrypted not too long ago?
What do you mean they 'don't operate on Windows' ? Their host based detection system found at (http://www.disa.mil/Services/Information-Assurance/HBSS) is reported to have "Numerous program enhancements and a new baseline on the Windows Server 2008 R2 platform are now available". Also strange how the worms affecting their networks are all related to:
• %windir%\system32\muxbde40.dll
• %windir%\system32\winview.ocx
• %temp%\6D73776D706461742E746C62FA.tmp
• %windir%\system32\mswmpdat.tlb
This can be found at http://www.wired.com/dangerroom/2008/11/army-bans-usb-d/
Now, in my world, if that is not Windows then I have no hope in hell of being safe
Demand that those computers connecting to the drone are built using computers not allowed on network or remove the nic card or build computers without any nic cards in them and do not use any USB thumb drives. Burn programs onto DVD.
Use a computer with no hard drive that boots from DVD(WIN PE)
That pc can have 2 DVD drives. Lets DVD drive 1 scan and confirm DRIVE 2 DVD is clean then allow programs onto computers that dircetly communicate with the drones.
Of course now you must flash wipe the drones that are infected.
Then once the above is done and any future infection happens then put those troopers in jail for not following directions and mark them as foreign agents and remove their US CITIZENSHIP.
Can't you read. Its not the drones. They are not affected. Only the machines that control the drones appear to have some sort of key logger.
Note that these systems don't appear to be attached to anything external.
Its quite possible that they picked up the bug from some hardware and that its the virus acting normally. Meaning that the virus wasn't targeting the US systems per se but any machine. Corporate or Home.
So while *this virus* is *trapped* on their systems, what does that mean for the rest of us?
Apparently there is a possibility that the logger has been deliberately installed by the US government, presumably on a need to know basis with the local admins left out of the loop...
http://techzwn.com/2011/10/predator-drone-virus-could-be-internal-monitoring-system-analyst/
That's the problem with unofficial anonymous guys talking to the press. You don't know who they are, what rank they hold, if they are privvy to all the information, or just some junior who is kacking himself silly because he doesn't have all the facts. Of course, sometimes what they say is true, there is just no way to tell.
Can't find the link at the moment but their was a report that the "Virus" / "Key Logger" is actually part of a Department of Defence Security Package installed in some DoD machines.
It was just not supposed to be in the UAV Control machines, but when equipment was shared between internal departments in cost cutting exorcise, it spread.
This sort of console is usually dedicated to showing the application and nothing else. You don't need icons or desktop environments for that. All you need is a system scriptable enough to boot the app and restart it should it crap out. Then why run something that can catch such a wide variety of malware offering itself to every host on the public internet with regularity?
Probably the same reason they run too many ATMs on the same sort of vulnerable system. The lowest bidder did it. How's that for an epitaph?
ATMs run on Windows because it works, if it didn't the banks would run something else. In fact, they used to run OS/2, they when a new OS was needed because OS/2 went out of support the OS adopted was Win NT, because it does the job and does it well. It doesn't phone home if you don't want it to and appropriately installed on a secured network it's just fine. If it wasn't the banks would be losing money through ATMs and you know that they wouldn't tolerate that. What would you rather? Your bank runs its ATMs on Solaris or Red Hat and you incur the extra costs for licensing? (Oh, and yes, Red Hat does cost as much, if not more to license than Windows.)
And that's why I've been ever more wary about ATMs in general. At least the OS/2 ones were trustworthy; now I fear for the Windows brethren of those. Especially considering how I know they run Windows .... the "ATM" app crashed, leaving the woman in front of me in shock as she watched a Windows NT desktop on the screen.
Then that other one showing some app error message ... which mentioned some kind of spyware/malware.
I know of at least a couple of DoD, prime contractors, who have made use of keyloggers on their internal machines, for "security purposes". Since at least one component in this system makes use of Windows, it's very plausable that an infection could have come from a laptop or other piece of sub-contractor gear.
hard to tell if its something thats supposed to be there or not, but you'd expect the maintainers to have some idea, surely it would be an action against a direct order to remove software that mr 3 star general said had to be installed..
i just laugh thinking that they are sure its not phoning home yet don't know where its coming from.
'we dont know where you came from but you're surely not phoning back to that unknown place'
on second thought it sounds terrible and scary, hopefully it doesn't escalate.
I wonder if anyone has looked at the requirements.
You know, audit trails? "And just to make sure we know who bombed the wrong guy we'll have the proof - but we don't have to own up"
There's been enough 'friendly fire' losses already.
Then again.........Closed system, unwanted software, cleansed, reappears. Oops!
Here is my question. What is UNCLE SAM doing spending our hard-earned tax dollars on non-US gear? Especially for something as important and sensitive as the Drone/UAV programs? The person or persons responsible for this asinine screw-up should be drawn and quartered in hell. Not only is such an act insecure, it is completely irresponsible and liken to treason. And as for the violating such a public trust, I would have thought UNCLE SAM would have learned something from the fiasco involving the purchase on non-US manufactured military vehicles a few short decades ago.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
