tag:blogger.com,1999:blog-7575061201749703300.post253509312501140915..comments2024-02-28T20:56:23.768-06:00Comments on Sipsey Street Irregulars: Praxis: WSJ -- "Insurgents Hack U.S. Drones"Dutchman6http://www.blogger.com/profile/09935420042995679958noreply@blogger.comBlogger18125tag:blogger.com,1999:blog-7575061201749703300.post-58224783165725003972009-12-21T13:53:00.273-06:002009-12-21T13:53:00.273-06:00Looks like Predator isn't the only platform th...Looks like Predator isn't the only platform that has (or had) this problem...<br /><br />http://www.boston.com/business/technology/articles/2009/12/19/battlefield_robot_had_security_hole/Charliehttps://www.blogger.com/profile/17081364248443667122noreply@blogger.comtag:blogger.com,1999:blog-7575061201749703300.post-40765607877479058342009-12-21T07:09:07.664-06:002009-12-21T07:09:07.664-06:00The rotax 914 that powers the predator/warrior/rea...The rotax 914 that powers the predator/warrior/reaper family uses an 18A integral alternator, similar to a motorcycle. That, obviously is likely only used to power the ignition, and charge the battery. Now, there are, in my opinion, two ways to provide the several hundred watts that the rest of the systems require. <br /><br />First, An AC generator, powered through a constant-speed drive. Unlikely, as this would be completely at odds with the off-the-shelf design philosophy of the drone family. CSDs and AC generators for such a small engine simply do not exist in any other platform that I am aware of. If the drone were turbine powered, this would be it's electrical system design, as most turbines already run this form of electrical generation, in one way or another.<br /><br />More likely is a dual-alternator, dual-bus electrical system, supplying either DC, or AC through a rectifier. The majority of this system already exists, as it is common in the newest single-engine FADEC equipped general aviation aircraft. <br /><br />With dual alternators, you're likely looking at 100A at 18vDC, when both alternators are functioning, and the ability to limp home, running only the flight critical systems, in the event of electrical failure. <br /><br />If encryption was thrown out of the design for any reason, it is more likely that the designers of the mission systems had to do so for weight concerns, than any other reason. Even a few pounds for a hardware-based encryption system would likely have been hard to find. This is no excuse to have not done the encryption in software, however.Anonymoushttps://www.blogger.com/profile/13069270249172433158noreply@blogger.comtag:blogger.com,1999:blog-7575061201749703300.post-11557468781750663272009-12-20T09:56:42.293-06:002009-12-20T09:56:42.293-06:00Carl -
"Tried pricing satellite gear for ama...Carl -<br /><br />"Tried pricing satellite gear for amateur radio? Relatively affordable; especially if you only want eavesdropping capability."<br /><br />Conceded. I guess all I was trying to say was that this capability required more than just $29 Russian software, unlike the WSJ article suggested.<br /><br />"These systems should have been designed as encrypted spread-spectrum from the start."<br /><br />Definitely!<br /><br />IIICharliehttps://www.blogger.com/profile/17081364248443667122noreply@blogger.comtag:blogger.com,1999:blog-7575061201749703300.post-79865386716184022142009-12-20T09:56:23.923-06:002009-12-20T09:56:23.923-06:00TJP -
"the choices of reliable stream cipher...TJP -<br /><br />"the choices of reliable stream ciphers considering the requirements are bound to be slim;"<br /><br />While it's true that streaming encryption is more difficult than fixed-state encryption (e.g. email), and there are relatively few (publicly-known) cryptosystems that can handle streaming data, knowing the encryption algorithm (or cipher) won't help you much if you don't have the encryption key as well. And the number of unique encryption keys for each cryptosystem is (virtually) limitless.<br /><br />"the devices are expendable so using a more powerful cipher would give the enemy an opportunity to capture it;"<br /><br />Each drone would have its own unique key. So, even if insurgents were able to recover the encryption key from the wreckage of a downed drone, it wouldn't help them decipher the stream transmitted by others.<br /><br />"...it has a generator with a fixed capacity."<br /><br />Of course, but the encryption would be implemented mostly in software (possibly with the addition of a "dongle" or some other small piece of hardware), and a few extra cycles on one of the many CPUs on board surely wouldn't push the load over the limit.<br /><br />"A significant portion of its power budget must be dedicated to flight and weapon controls, and the second largest drain is likely the output stages of its transmitters and the servos for its adjustable, directional antennas."<br /><br />Absolutely, and I wasn't disputing that at all. My point was that these drains dwarf the (CPU-based) signal processing system, and that I doubt adding encryption to the signal processing would significantly increase the power requirements.<br /><br />IIICharliehttps://www.blogger.com/profile/17081364248443667122noreply@blogger.comtag:blogger.com,1999:blog-7575061201749703300.post-11019027987482522032009-12-19T12:46:09.640-06:002009-12-19T12:46:09.640-06:00I'm sorry, as is my habit, I got hung up on te...I'm sorry, as is my habit, I got hung up on technical minutia and neglected to actually conclude my argument.<br /><br />I don't think this is an example of government blundering because: the choices of reliable stream ciphers considering the requirements are bound to be slim; the available ones are weak enough that their vulnerabilities are known and exploitable through available software; the devices are expendable so using a more powerful cipher would give the enemy an opportunity to capture it; and the video feed is of limited utility considering the angle of radiation from the antenna.<br /><br />I realize that device is capable of long flights, but it has a generator with a fixed capacity.<br /><br />Thanks for reading.TJPnoreply@blogger.comtag:blogger.com,1999:blog-7575061201749703300.post-13901809036382066992009-12-19T12:31:10.118-06:002009-12-19T12:31:10.118-06:00"Not exactly. While the software & laptop..."Not exactly. While the software & laptop may be relatively inexpensive, the additional satellite & radio equipment carries a non-trivial price tag. The better-financed (read: Iranian-backed) insurgents wouldn't have too much trouble sourcing these, however."<br /><br />Tried pricing satellite gear for amateur radio? Relatively affordable; especially if you only want eavesdropping capability. Heck, I've done it (uncrypted radio news feeds). But even transmit capability is affordable by a private citizen. Or, remember "Captain Midnight" (I think he called himself), who hijacked the HBO transponder?<br /><br />But you don't even need to get the transponder. Once you know the frequencies being used, you can locally jam the drone. These systems should have been designed as encrypted spread-spectrum from the start. It isn't like this is new technology. And now retro-fitting everything already in the field is going to be far more expensive.Carl Bussjaegerhttp://www.bussjaeger.orgnoreply@blogger.comtag:blogger.com,1999:blog-7575061201749703300.post-80560695625745189762009-12-19T11:15:37.814-06:002009-12-19T11:15:37.814-06:00Charlie,
I'm sorry, but I have to respectfull...Charlie,<br /><br />I'm sorry, but I have to respectfully disagree. The drone doesn't enjoy the advantages of operating in a vacuum, constant positioning, or adequate surface area for its antenna, like the specialized communication satellite. A significant portion of its power budget must be dedicated to flight and weapon controls, and the second largest drain is likely the output stages of its transmitters and the servos for its adjustable, directional antennas.<br /><br />These drones are running on three different bands in the UHF and microwave regions over long distances, and the amount of data that video generates requires lots of bandwidth with serial communication.<br /><br />I do not have build specs for the drones, but I wouldn't be surprised if the authors put the emphasis on reliability and physical security over signal security.<br /><br />The inverse square law applies, and we're talking about a very directional signal in the 8-12 GHz range, coming from an antenna pointed upwards. The requirements of proximity to the transmitter seems to make the utility of the video feed very low. I would think that handing over sensitive technology due to loss of control would be the greater security breach.TJPnoreply@blogger.comtag:blogger.com,1999:blog-7575061201749703300.post-73083752074803706602009-12-18T23:22:51.708-06:002009-12-18T23:22:51.708-06:00TJP -
I doubt electrical/power demands are an is...TJP - <br /><br />I doubt electrical/power demands are an issue. The additional strain imposed by encryption certainly wouldn't overtax a powerplant capable of sustaining flight over 14+ hour missions.<br /><br />I would also be surprised if encryption added anything more than a negligible increase to the transmission lag. The bottleneck is the downlink, not the onboard processing.<br /><br />In any event, the article indicates the U.S. is working to encrypt all drone video feeds, which suggests the technical issues are not insurmountable.<br /><br />My suspicion is that the original designers underestimated the technological sophistication of potential OPFORs.<br /><br />IIICharliehttps://www.blogger.com/profile/17081364248443667122noreply@blogger.comtag:blogger.com,1999:blog-7575061201749703300.post-77994409354381036392009-12-18T21:22:53.996-06:002009-12-18T21:22:53.996-06:00I'd think the requirements of streaming video ...I'd think the requirements of streaming video from a remote device, with a limited electricity budget and real-time control, severely restricts the choices of encryption. It should be no surprise that the favored system is weak or optimized for efficiency. These things are packed with electronics.<br /><br />The latency is probably high enough between the control center to the unit.<br /><br />http://en.wikipedia.org/wiki/MQ-1_Predator#Command_and_sensor_systems<br /><br />(A couple of seconds, according to that entry.)TJPnoreply@blogger.comtag:blogger.com,1999:blog-7575061201749703300.post-78459263541673047232009-12-18T19:39:47.475-06:002009-12-18T19:39:47.475-06:00"That is pretty unbelievably stupid."
N..."That is pretty unbelievably stupid."<br /><br />Never underestimate the capacity for incompetence amongst federal employees and defense contractors.<br /><br />"This smells to me like a convenient and useful excuse to push for new state intrusions in cyberspace."<br /><br />Unlikely. The "hacking" (a more appropriate term would be "intercepting" or "eavesdropping") did not take place in "cyberspace" for one. Also, don't forget about Hanlon's Razor (see above).<br /><br />"Why, we need a new czar! A cyberfuhrer!"<br /><br />The administration is trying to fill the position of "Cybersecurity Czar," but nobody wants the job: http://pajamasmedia.com/instapundit/90030/<br /><br />"... once they do a little analysis to work out control codes, the opponent could theoretically take over a drone, not just listen in."<br /><br />If possible, it probably would have happened already.<br /><br />"This gives the opponent plenty of realtime aerial surveillance capability for the price of a laptop."<br /><br />Not exactly. While the software & laptop may be relatively inexpensive, the additional satellite & radio equipment carries a non-trivial price tag. The better-financed (read: Iranian-backed) insurgents wouldn't have too much trouble sourcing these, however.<br /><br />"Who the hell thought it was a good idea, decades later to abandon encryption even for mission essential combat gear?"<br /><br />A couple of possible reasons come to mind. First, the individuals responsible for making technology purchasing decisions often have far less technical expertise than the operators. This is akin to buying aircraft without consulting aircrew & maintenance personnel. Secondly, while there's plenty of time to do things "the right way" in garrison, proper TTP often fly out the window in the AOR. Yes, even in boneheaded ways like this.<br /><br />"The same mindset that cannot fathom the straightforward task of unifying technology between branches of service..."<br /><br />Such measures threaten the fiefdoms of small men in powerful positions.<br /><br />IIICharliehttps://www.blogger.com/profile/17081364248443667122noreply@blogger.comtag:blogger.com,1999:blog-7575061201749703300.post-88966876822791324152009-12-18T16:27:35.211-06:002009-12-18T16:27:35.211-06:00All this is BS. First off, the satellite feed is t...All this is BS. First off, the satellite feed is there for anyone to grab. It may be a radio wave in GHz, but it is digitally encoded and has a carrier ID (CID). All you have to do is use a dish for the right frequency to pick up enough signal and use that $30 software to decode the signal. The big news is that it is not encrypted. That is pretty unbelievably stupid. Especially when DirectTV is encrypted, although only one way communication. <br /><br />The better picture on this is that the fighters now know what frequency the com links are on and what satellites handle the coms. Now they could find a way to inject garbage in the signal or jam it. They could also overload a transponder on the satellite. Signals also could be cloned.Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-7575061201749703300.post-51756107426405762652009-12-18T16:19:08.737-06:002009-12-18T16:19:08.737-06:00Heads up, folks. This smells to me like a conveni...Heads up, folks. This smells to me like a convenient and useful excuse to push for new state intrusions in cyberspace. <br /><br />In the interest of--wait for it--<i>national security</i>, we'll just <i>have</i> to crack down on hardware and devices, local software, network activity and asset-sharing, the whole enchilada. And of course keep tabs on anyone interested in any of that. The opportunities this opens up are almost limitless.<br /><br />Also in the news at this moment is this simple revelation that allows people to avoid email snooping by <a href="http://www.wendymcelroy.com/news.php?extend.2934" rel="nofollow">not actually sending the mail</a>. ("The Russians, when faced with the same problem, used a pencil" indeed!) <br /><br />This does not seem coincidental. Why, we need a new czar! A cyberfuhrer! A <a href="http://www.examiner.com/x-8434-Anchorage-Libertarian-Examiner~y2009m11d20-w00t--The-PirateFinder-General" rel="nofollow">Pirate-Finder General</a>!<br /><br />Laugh if you want, but I'd bet minor-caliber body parts on this.Kevin Wilmethhttps://www.blogger.com/profile/18368887768008126052noreply@blogger.comtag:blogger.com,1999:blog-7575061201749703300.post-60168236058919733072009-12-18T15:47:02.489-06:002009-12-18T15:47:02.489-06:00why was this leaked? And why now? What are they tr...why was this leaked? And why now? What are they trying to hide?looking4alinehttps://www.blogger.com/profile/17766795890122842645noreply@blogger.comtag:blogger.com,1999:blog-7575061201749703300.post-44424683111827615822009-12-18T08:14:20.124-06:002009-12-18T08:14:20.124-06:00Well, Frank, it gets better. The uplinks are encry...Well, Frank, it gets better. The uplinks are encrypted either, which means once they do a little analysis to work out control codes, the opponent could theoretically take over a drone, not just listen in.<br /><br />Also, it turns out that the video broadcasts from darned near every air asset in the sky is unencrypted. This gives the opponent plenty of realtime aerial surveillance capability for the price of a laptop.<br /><br />When I first heard that all this _new_ gear was fielded without encryption, my mind boggled. What happened? More than 20 years ago I was a base Land Mobile Radio (walki-talkies, automotive mobiles, base stations) systems manager in the Air Force. We were encrypting the handhelds used by everybody from gate guards to radar techs, to gas truck drivers, for routine base support ops; not even combat. Who the hell thought it was a good idea, decades later to abandon encryption even for mission essential combat gear?Carl Bussjaegerhttp://www.bussjaeger.orgnoreply@blogger.comtag:blogger.com,1999:blog-7575061201749703300.post-35819936669377156022009-12-18T06:09:46.230-06:002009-12-18T06:09:46.230-06:00The mind set is interesting - and appalling. Ther...The mind set is interesting - and appalling. There is not bit of hesitation to take out one t with a hellfire missile - yet simple encryption could have stopped this.<br /><br />The same mindset that cannot fathom the straightforward task of unifying technology between branches of service would rather leave it open to the enemy.<br /><br />The same mindset that is so determined that the technology is dumbed down to the extent that these idiots are able to hack it - so the deeds can be shared with our "allies." Many of whom are saturated with muslim terrorists.<br /><br />Our lunch is getting eaten by cavemen - and we are led by supposed intellectual giants.Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-7575061201749703300.post-17749419614335716942009-12-18T03:06:53.712-06:002009-12-18T03:06:53.712-06:00So they like to watch Jihaddist gets missile enema...So they like to watch Jihaddist gets missile enema too? One of the best shows the Air Force makes.Happy Dnoreply@blogger.comtag:blogger.com,1999:blog-7575061201749703300.post-65453775964115708322009-12-17T20:59:17.851-06:002009-12-17T20:59:17.851-06:00Only the .gov could develop the most advanced unma...Only the .gov could develop the most advanced unmanned surveillance drones in the world, and make a mistake as simple as not encrypting the downlink... The mind boggles at what ELSE they've screwed up.Anonymoushttps://www.blogger.com/profile/13069270249172433158noreply@blogger.comtag:blogger.com,1999:blog-7575061201749703300.post-36762506957643932092009-12-17T20:17:28.203-06:002009-12-17T20:17:28.203-06:00Let this be a lesson to all -- be sure to encrypt ...Let this be a lesson to all -- be sure to encrypt your mission-critical comm!Charliehttps://www.blogger.com/profile/17081364248443667122noreply@blogger.com