US Drone Fleet full of virus.

[SirNitram]

Link

A computer virus has infected the cockpits of America’s Predator and Reaper drones, logging pilots’ every keystroke as they remotely fly missions over Afghanistan and other warzones.

The virus, first detected nearly two weeks ago by the military’s Host-Based Security System, has not prevented pilots at Creech Air Force Base in Nevada from flying their missions overseas. Nor have there been any confirmed incidents of classified information being lost or sent to an outside source. But the virus has resisted multiple efforts to remove it from Creech’s computers, network security specialists say. And the infection underscores the ongoing security risks in what has become the U.S. military’s most important weapons system.

“We keep wiping it off, and it keeps coming back,” says a source familiar with the network infection, one of three that told Danger Room about the virus. “We think it’s benign. But we just don’t know.”

Military network security specialists aren’t sure whether the virus and its so-called “keylogger” payload were introduced intentionally or by accident; it may be a common piece of malware that just happened to make its way into these sensitive networks. The specialists don’t know exactly how far the virus has spread. But they’re sure that the infection has hit both classified and unclassified machines at Creech. That raises the possibility, at least, that secret data may have been captured by the keylogger, and then transmitted over the public internet to someone outside the military chain of command.

Drones have become America’s tool of choice in both its conventional and shadow wars, allowing U.S. forces to attack targets and spy on its foes without risking American lives. Since President Obama assumed office, a fleet of approximately 30 CIA-directed drones have hit targets in Pakistan more than 230 times; all told, these drones have killed more than 2,000 suspected militants and civilians, according to the Washington Post. More than 150 additional Predator and Reaper drones, under U.S. Air Force control, watch over the fighting in Afghanistan and Iraq. American military drones struck 92 times in Libya between mid-April and late August. And late last month, an American drone killed top terrorist Anwar al-Awlaki — part of an escalating unmanned air assault in the Horn of Africa and southern Arabian peninsula.

But despite their widespread use, the drone systems are known to have security flaws. Many Reapers and Predators don’t encrypt the video they transmit to American troops on the ground. In the summer of 2009, U.S. forces discovered “days and days and hours and hours” of the drone footage on the laptops of Iraqi insurgents. A $26 piece of software allowed the militants to capture the video.

The lion’s share of U.S. drone missions are flown by Air Force pilots stationed at Creech, a tiny outpost in the barren Nevada desert, 20 miles north of a state prison and adjacent to a one-story casino. In a nondescript building, down a largely unmarked hallway, is a series of rooms, each with a rack of servers and a “ground control station,” or GCS. There, a drone pilot and a sensor operator sit in their flight suits in front of a series of screens. In the pilot’s hand is the joystick, guiding the drone as it soars above Afghanistan, Iraq, or some other battlefield.

Some of the GCSs are classified secret, and used for conventional warzone surveillance duty. The GCSs handling more exotic operations are top secret. None of the remote cockpits are supposed to be connected to the public internet. Which means they are supposed to be largely immune to viruses and other network security threats.

But time and time again, the so-called “air gaps” between classified and public networks have been bridged, largely through the use of discs and removable drives. In late 2008, for example, the drives helped introduce the agent.btz worm to hundreds of thousands of Defense Department computers. The Pentagon is still disinfecting machines, three years later.

Use of the drives is now severely restricted throughout the military. But the base at Creech was one of the exceptions, until the virus hit. Predator and Reaper crews use removable hard drives to load map updates and transport mission videos from one computer to another. The virus is believed to have spread through these removable drives. Drone units at other Air Force bases worldwide have now been ordered to stop their use.

In the meantime, technicians at Creech are trying to get the virus off the GCS machines. It has not been easy. At first, they followed removal instructions posted on the website of the Kaspersky security firm. “But the virus kept coming back,” a source familiar with the infection says. Eventually, the technicians had to use a software tool called BCWipe to completely erase the GCS’ internal hard drives. “That meant rebuilding them from scratch” — a time-consuming effort.

The Air Force declined to comment directly on the virus. “We generally do not discuss specific vulnerabilities, threats, or responses to our computer networks, since that helps people looking to exploit or attack our systems to refine their approach,” says Lt. Col. Tadd Sholtis, a spokesman for Air Combat Command, which oversees the drones and all other Air Force tactical aircraft. “We invest a lot in protecting and monitoring our systems to counter threats and ensure security, which includes a comprehensive response to viruses, worms, and other malware we discover.”

However, insiders say that senior officers at Creech are being briefed daily on the virus.

“It’s getting a lot of attention,” the source says. “But no one’s panicking. Yet.”

Unsettling, but if it's really just a keylogger, not to worry about. Of course, it raises nasty questions about just how ready the US is for serious cyber-warfare.

[Crateria]

Unsettling, but if it's really just a keylogger, not to worry about. Of course, it raises nasty questions about just how ready the US is for serious cyber-warfare.

Who is the likely culprit for this? An islamic fundamentalist? Someone who wished to prevent more civilian deaths in Pakistan? Another nation?

Given the US's security in general is utter shit anyway, this was only a matter of time. I suspect the MSS obviously "Chinese civilian hackers" are behind this.

[Stravo]

It would be tragically funny if the US, which prides itself on having the highest tech military in the world, suffered a horrible setback because the users treated their high end multi million dollar equipment as sloppily as office workers treat their work PCs. It is a weakness others obviously see but I don't know if the military is reacting to it.

[Crateria]

It would be tragically funny if the US, which prides itself on having the highest tech military in the world, suffered a horrible setback because the users treated their high end multi million dollar equipment as sloppily as office workers treat their work PCs. It is a weakness others obviously see but I don't know if the military is reacting to it.

http://www.youtube.com/watch?v=HtTUsOKjWyQ

They'll do some changes but the problem will still remain. Bandaging up a gunshot, so to speak.

[Block]

Unsettling, but if it's really just a keylogger, not to worry about. Of course, it raises nasty questions about just how ready the US is for serious cyber-warfare.

More and more ready. Cybercommand is a relatively new entity within the Army, so it's still getting its legs under it, but they're growing and getting better, it'll just take time.

[Gil Hamilton]

Have they tried Malwarebytes?

[Kodiak]

Have they tried Malwarebytes?

While I cannot confirm the presence of this virus anywhere outside of Creech, I can say that it has spooked the Airforce enough that they are no longer allowing ANY removable storage in their GCS units for any purpose including software testing. The article is spot-on that there is no particular risk other than the fact that it's unknown how the virus got in there in the first place.

[Kodiak]

Have they tried Malwarebytes?

While I cannot confirm the presence of this virus anywhere outside of Creech, I can say that it has spooked the Airforce enough that they are no longer allowing ANY removable storage in their GCS units for any purpose including software testing. The article is spot-on that there is no particular risk other than the fact that it's unknown how the virus got in there in the first place.

edit:

The joke at work now is "Did you hear about the drone virus? One of the planes flew to Africa to pick up $10million from a Nigerian prince"

[Thanas]

I am pretty sure that the great competence on display here is very reassuring to those brown people elsewhere that the drones will not malfunction and that the operators are well-trained competent guys.

[Crateria]

I am pretty sure that the great competence on display here is very reassuring to those brown people elsewhere that the drones will not malfunction and that the operators are well-trained competent guys.

/tinfoilhaton/ Who says they're malfunctioning? Everybody knows the USA would like nothing better than to wipe all the mohammedian brown savages off the globe. They're just ridding the universe of Pakistanis one village at a time. /tinfoilhatoff/

[weemadando]

How the fuck are drone terminals not white boxes with their only networking being the uplink to the drone?

[TheHammer]

Use of the drives is now severely restricted throughout the military. But the base at Creech was one of the exceptions, until the virus hit. Predator and Reaper crews use removable hard drives to load map updates and transport mission videos from one computer to another. The virus is believed to have spread through these removable drives. Drone units at other Air Force bases worldwide have now been ordered to stop their use.

In the meantime, technicians at Creech are trying to get the virus off the GCS machines. It has not been easy. At first, they followed removal instructions posted on the website of the Kaspersky security firm. “But the virus kept coming back,” a source familiar with the infection says. Eventually, the technicians had to use a software tool called BCWipe to completely erase the GCS’ internal hard drives. “That meant rebuilding them from scratch” — a time-consuming effort.

I find it a bit ironic that they were following the instructions from a russian based company to combat this .

Assuming they are running windows based machines, it is possible with someone with admin creds has an infected machine and is thus reinfecting machines after they are cleaned. Had to deal with a similar infection myself, it was like a game of whack-a-mole on the network and our lower level techs weren't able to clean it up. So then I got the idea of using PSEXEC to simultaneously run a removal tool on every machine on the domain. Squashed it like a bug.

But yeah if its only a key logger and the machines in fact do not have internet access as stated there would be no way for it to transmit data out, so makes it a pointless exercise. On the other hand, if there is a spy on the inside...

[Kodiak]

How the fuck are drone terminals not white boxes with their only networking being the uplink to the drone?

I'm not sure what you mean by "drone terminals". The GCS is a large suite of systems and computers for controlling the drone which requires data (missions, flight paths, etc) from an external source. You can either upload the data through an FTP or through a thumb drive or removable storage.

[Kodiak]

Ghetto edit:

Here's a thread explaining where I work

[Chirios]

How the fuck are drone terminals not white boxes with their only networking being the uplink to the drone?

Who the fuck knows.

Hold on, that guy who wrote The Salvation War might know; dude who wrote The Salvation War, is there a reason for these people being retarded or are they just generally so?

[Kodiak]

Here's an article from [url=http://www.foxnews.com/scitech/2011/10/ ... -virus/Fox[/url] that does NOT sensationalize the story or blow things out of proportion. These are windows machines infected with a windows virus, nothing more.

A fleet of U.S. military drones on a Nevada Air Force base has been infected by a keylogger virus that tracks every key and button their pilots press, Wired.com reported Friday -- and top Air Force sources strongly contested.
The virus was first noticed by officials at Creech Air Force Base nearly two weeks ago using the base's security system. It logged every keystroke of the pilots in the control room on the base as they remotely flew Predator and Reaper drones on missions over Afghanistan and other battle zones.

There has been no confirmation of information being lost or sent to an outside source, but the virus has been resistant to military efforts to clear it from the system.
"We keep wiping it off, and it keeps coming back," a source told Wired.
It's not immediately clear whether the virus hit the system intentionally or by accident. But the existence of ordinary-seeming computer viruses on what should be the most extraordinarily secure of military systems is far from shocking, said Anup Ghosh, a former scientist with the Defense Advanced Research Projects Agency (DARPA) and chief scientist with security company Invincea.
They're just computers, after all.
"[The drones] are controlled by standard PCs," Ghosh told FoxNews.com. "None of this should be surprising." The system should be replaced or "re-imaged" with a virus-free, bit-for-bit copy of the data on the drive in order to get rid of the infection, he said..
"If they are connected to a larger network they will be infected again," he said.
A senior Air Force source with knowledge of the drone program and familiar with the virus that was caught in recent weeks told FoxNews.com that Wired's story is "blown out of proportion" and "vastly overwritten."
"The planes were never in any jeopardy of 'going stupid'," the source said, and the virus "is not affecting operations in any way ... it showed up on a Microsoft-based Windows system. We have a closed-loop system and heavily protected cockpits -- the planes were never in jeopardy."
The virus was introduced when the Air Force was transferring data maps between systems using external hard drives, he said. Very quickly the Air Force protective network tracked the virus.
"The system worked," the Air Force official said.
In the last 12 hours the Air Force ran some clearing software to make sure the viral agents weren't lying dormant in the system. They found some non-descript viral agents at what was described as a "third- or fourth-level function" and dealt with them.
The U.S. military has increasingly been relying upon drones to conduct surveillance and air strikes on enemy targets. The Air force currently uses 150 MQ1 Predator drones and 50 MQ9 Reaper drones over Afghanistan and Iraq.
Drone planes similar to the ones infected were recently used in a CIA-directed strike against American-born terrorist Anwar al-Awlaki in Yemen on September 30.
This is not the first time that U.S. drones have been infected. In 2009, U.S. troops discovered drone footage on the laptops of Iraqi insurgents. The insurgents had stolen the video with easy to access software that cost $26, Wired reported.
In the fall of 2008, a cyberworm inched its way through military networks as well. The effort to erase it was dubbed Operation Buckshot Yankee.
"It may have to be determined if this new threat was an original attack or a residual from Buckshot Yankee," Ghosh told FoxNews.com.
Representatives from both Creech Air Force Base and General Atomics Aeronautical Systems, the maker of the predator and Reaper drones, declined to comment.

As a note- the 2009 "infection" was not a virus but rather a product of the fact that the video transmissions at that time were not encrypted. Now they are.

[Broomstick]

There is a twofold problem here and it centers around human beings.

First, these drones still require a skilled human to operate. That would make theft of a drone or its components, including software and data, less problematic than some other things that don't require a skilled operator. It's not that some "brown people" couldn't acquire those skills (in fact, I would be very surprised if there aren't brown people among the Air Force pilots operating these things) it's just that you have to acquire the entire suite of hardware/software/people skills to utilize the devices. Unless they get all three legs of the stool the stool doesn't function properly.

Second, because people are involved you get issues with them treating things carelessly, ignoring security procedures and so forth which, as anyone who has ever dealt with a virus infestation at work can tell you, leads to a game of whack-a-mole, as someone else mentioned. Short of redesigning people to be other than they are, you'll never completely eliminate this problem.

As long as someone in the field can't snatch control away from the drone owner I'm not overly concerned. It's not good and it needs to be cleaned up, but near as my (limited) information can tell, no one can hijack these drones out of the sky, which would be much more worrisome to me than what seems to be the case right now.

[folti78]

Second, because people are involved you get issues with them treating things carelessly, ignoring security procedures and so forth which, as anyone who has ever dealt with a virus infestation at work can tell you, leads to a game of whack-a-mole, as someone else mentioned. Short of redesigning people to be other than they are, you'll never completely eliminate this problem.

As usual, there are multiple problems with computer security, to make things worse:
1. These are windows machines, meaning they are a rather homogeneous platform regarding security. Viruses written to exploit newly discovered vulnerabilities (or older then dirt, but unpatched ones) work on all machines.
2. Since they are part of an expert system, with limited network access, depending on the various policies, it's most likely that they will get critical security upgrades weeks or months later than they are available to normal users, leaving them vulnerable for longer. (Because the vendor who made the windows computers part of their product, might not allow installing of security fixes, without testing them first, to make sure it doesn't break something.)

[BrooklynRedLeg]

I am pretty sure that the great competence on display here is very reassuring to those brown people elsewhere that the drones will not malfunction and that the operators are well-trained competent guys.

Hehe, fantastic snark and pretty much sums up my thoughts.

[Kodiak]

I am pretty sure that the great competence on display here is very reassuring to those brown people elsewhere that the drones will not malfunction and that the operators are well-trained competent guys.

The only "malfunction" here is in the ground stations, not the drones themselves. Right now the only problem is the GCS computers freezing from a malaware infection which would mean the drones wouldn't be able to fly at all. Once a drone stops receiving commands from a ground station it's not much of a danger except to itself.