You have got to be kidding me...
10-07-2011, 08:35 PM
#1
Elite Member
Thread Starter
iTrader: (37)
Join Date: Apr 2010
Location: Very NorCal
Posts: 10,441
Total Cats: 1,899
You have got to be kidding me...
http://www.wired.com/dangerroom/2011...s-drone-fleet/
/facepalm
I really need to get DangerRoom off my RSS...
A computer virus has infected the cockpits of America’s Predator and Reaper drones, logging pilots’ every keystroke as they remotely fly missions over Afghanistan and other warzones.
The virus, first detected nearly two weeks ago by the military’s Host-Based Security System, has not prevented pilots at Creech Air Force Base in Nevada from flying their missions overseas. Nor have there been any confirmed incidents of classified information being lost or sent to an outside source. But the virus has resisted multiple efforts to remove it from Creech’s computers, network security specialists say. And the infection underscores the ongoing security risks in what has become the U.S. military’s most important weapons system.
The virus, first detected nearly two weeks ago by the military’s Host-Based Security System, has not prevented pilots at Creech Air Force Base in Nevada from flying their missions overseas. Nor have there been any confirmed incidents of classified information being lost or sent to an outside source. But the virus has resisted multiple efforts to remove it from Creech’s computers, network security specialists say. And the infection underscores the ongoing security risks in what has become the U.S. military’s most important weapons system.
/facepalm
I really need to get DangerRoom off my RSS...
Reply
0
0
10-08-2011, 04:42 AM
#3
Elite Member
Thread Starter
iTrader: (37)
Join Date: Apr 2010
Location: Very NorCal
Posts: 10,441
Total Cats: 1,899
The fact that the military has this **** connected to the public internet blows my ******* mind. I need to stop going to DefCon and reading InfoSec bullshit in my spare time.
If you really want to go for a ride, take a look at **** like nMap, WireShark and the MetaSploit project... and that's just the tip of the iceberg. The rabbit hole gets pretty damn deep.
If you really want to go for a ride, take a look at **** like nMap, WireShark and the MetaSploit project... and that's just the tip of the iceberg. The rabbit hole gets pretty damn deep.
Reply
0
0
10-08-2011, 01:10 PM
#5
Elite Member
Thread Starter
iTrader: (37)
Join Date: Apr 2010
Location: Very NorCal
Posts: 10,441
Total Cats: 1,899
Its really just a starting point. Most people don't realize this stuff is out there, how easy it is to acquire and use, and how vulnerable they really are.
Reply
0
0
10-11-2011, 04:34 PM
#8
Boost Pope
iTrader: (8)
Join Date: Sep 2005
Location: Chicago. (The less-murder part.)
Posts: 33,022
Total Cats: 6,589
Apparently the USAF isn't the only one.
This message was distributed company-wide within the Harris Corporation (whose primary business is in defense electronics, mostly encrypted comms and nav systems) today:
This message was distributed company-wide within the Harris Corporation (whose primary business is in defense electronics, mostly encrypted comms and nav systems) today:
Harris Security Advisory - Be Alert for Unsolicited USB Thumb Drives!
Several Harris employees have recently received unsolicited USB thumb drives via mail and other delivery methods. Some of the envelopes included a brief note indicating the drive was “found” and being returned; others had no message or marking of any kind. Fortunately, these employees were vigilant enough to be suspicious and notified the Service Desk, who advised them how to send in the materials for investigation by Harris information security authorities.
In an increasing number of incidents, attackers use the convenience and portability of USB drives to trick unsuspecting victims into infecting their computers. Typically, a thumb drive pre-loaded with malware is either left in a public place for a random victim to find, or sent directly to a predetermined target. If plugged into a computer, the malware installs and gives the attacker access to harvest sensitive information, gain an entry to the network, or other malicious activities.
If you find or receive an unknown USB device, NEVER PLUG IT INTO YOUR COMPUTER to view the contents or attempt to identify the owner. If you find such a device at a Harris-related event or location, or receive one in the mail at a Harris address, keep the drive and all associated packaging (note, envelope, etc.) and notify the Service Desk immediately. They will engage the Incident Response security team, who will take appropriate action.
Several Harris employees have recently received unsolicited USB thumb drives via mail and other delivery methods. Some of the envelopes included a brief note indicating the drive was “found” and being returned; others had no message or marking of any kind. Fortunately, these employees were vigilant enough to be suspicious and notified the Service Desk, who advised them how to send in the materials for investigation by Harris information security authorities.
In an increasing number of incidents, attackers use the convenience and portability of USB drives to trick unsuspecting victims into infecting their computers. Typically, a thumb drive pre-loaded with malware is either left in a public place for a random victim to find, or sent directly to a predetermined target. If plugged into a computer, the malware installs and gives the attacker access to harvest sensitive information, gain an entry to the network, or other malicious activities.
If you find or receive an unknown USB device, NEVER PLUG IT INTO YOUR COMPUTER to view the contents or attempt to identify the owner. If you find such a device at a Harris-related event or location, or receive one in the mail at a Harris address, keep the drive and all associated packaging (note, envelope, etc.) and notify the Service Desk immediately. They will engage the Incident Response security team, who will take appropriate action.
Reply
0
0
10-11-2011, 04:47 PM
#9
Elite Member
Thread Starter
iTrader: (37)
Join Date: Apr 2010
Location: Very NorCal
Posts: 10,441
Total Cats: 1,899
Hehe, we used to do this with CDR's labeled "MP3s" back in the day. There was a little autorun program on the disc that installed a program we built to call home to an IRC chatroom, just to see how effective this distribution method was. IIRC the local community college had the best reply rate.
Also: State sponsored spyware!
http://www.wired.com/threatlevel/201...n-gov-spyware/
German Minister Wants Investigation of State Authorities’ Use of Spyware
Sounds like a sample that would be REALLY fun to pull apart. Too bad its been years since I played with IDAPro
Also: State sponsored spyware!
http://www.wired.com/threatlevel/201...n-gov-spyware/
German Minister Wants Investigation of State Authorities’ Use of Spyware
Germany’s justice minister has called for an investigation after authorities in at least four German states acknowledged using computer spyware to conduct surveillance on citizens.
Authorities in the state of Bavaria admitted on Monday that a piece of spyware discovered on a citizen’s computer by the local Chaos Computer Club hacker group was designed for use by authorities to spy on suspects.
Under German law, authorities can use spyware to monitor criminals, but its use is supposed to be limited to the interception of internet telephony.
The so-called R2D2 keylogging Trojan CCC examined, however, does much more than this. In addition to monitoring Skype calls and recording keystrokes to monitor e-mail and instant messaging communications, the Trojan can take screenshots and activate a computer’s microphone and webcam to allow someone to remotely spy on activities in a room. Furthermore, the program includes a backdoor that would allow authorities to remotely update the program with additional functionality.
Authorities in the state of Bavaria admitted on Monday that a piece of spyware discovered on a citizen’s computer by the local Chaos Computer Club hacker group was designed for use by authorities to spy on suspects.
Under German law, authorities can use spyware to monitor criminals, but its use is supposed to be limited to the interception of internet telephony.
The so-called R2D2 keylogging Trojan CCC examined, however, does much more than this. In addition to monitoring Skype calls and recording keystrokes to monitor e-mail and instant messaging communications, the Trojan can take screenshots and activate a computer’s microphone and webcam to allow someone to remotely spy on activities in a room. Furthermore, the program includes a backdoor that would allow authorities to remotely update the program with additional functionality.
Reply
0
0
10-11-2011, 05:01 PM
#10
Boost Pope
iTrader: (8)
Join Date: Sep 2005
Location: Chicago. (The less-murder part.)
Posts: 33,022
Total Cats: 6,589
Anybody remember the book / film 1984? Cliffs: Everybody's apartment has a "telescreen" in it, which is basically just a television set, except that Big Brother can also use it to see and hear what you are doing.
That was written in 1949.
Reply
0
0
10-11-2011, 06:16 PM
#12
Boost Pope
iTrader: (8)
Join Date: Sep 2005
Location: Chicago. (The less-murder part.)
Posts: 33,022
Total Cats: 6,589
Google scans the contents of your email for the purposes of targeted marketing. Your employer keeps tabs on what you are doing on your PC at work (and elsewhere, if you are using a company-issued laptop and/or VPN account.) And while it may be immoral and is almost certainly illegal, it does not surprise me in the least that a school board would active the built-in surveillance features of laptop it supplied to children, not because of any grand conspiracy, but just because people in positions of minor authority are like that.
But for a government to covertly slip spyware into the privately-owned computers of its own citizens? Well, +10 for creativity, but -several million for creepiness, even if local laws permit it.
I'm honestly surprised we haven't heard of something like this happening with smartphones. They can not only hear and see you, but they know where you are, ever place you have ever been, how fast you are moving, etc. My phone knows not just how often I go to Fry's, the freaky **** store, etc., but how fast I drive on the way there and back. With a bit of data-crunching, it could even tell you what specific people I tend to meet up with at various locations and when.
So a hypothetical person is busted for, let's say, possession of heroin, or creating child pornography, or some other thing that's easy to ram through both the courts and the Court of Public Opinion on the grounds of being inherently evil. It's not that big of a stretch to imagine pulling the location history from her phone for the past year, and running it through a database which also contains the location history for every other cell phone in the system, and figuring out that this individual tended to meet in person with two or three other individuals in a certain secluded location on a regular schedule, and always at night.
Did this violate anybody's rights? Did it constitute an unlawful search? All they did was take several sets of data which were lawfully (and consensually) gathered by a commercial third-party, and comparing them together.
Last edited by Joe Perez; 10-11-2011 at 06:35 PM.
Reply
0
0
Thread
Thread Starter
Forum
Replies
Last Post
