{"id":16342,"date":"2019-09-17T10:45:31","date_gmt":"2019-09-17T18:45:31","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2019\/09\/17\/news-10083\/"},"modified":"2019-09-17T10:45:31","modified_gmt":"2019-09-17T18:45:31","slug":"news-10083","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2019\/09\/17\/news-10083\/","title":{"rendered":"The Air Force Will Let Hackers Try to Hijack an Orbiting Satellite"},"content":{"rendered":"

<\/p>\n

Credit to Author: Brian Barrett| Date: Tue, 17 Sep 2019 11:00:00 +0000<\/strong><\/p>\n

At the Defcon hacking conference next year, the Air Force will bring a satellite for fun and glory.<\/p>\n

When the Air Force showed up at the Defcon hacker conference<\/a> in Las Vegas last month, it didn\u2019t come empty-handed. It brought along an F-15 fighter-jet data system\u2014one that security researchers thoroughly dismantled<\/a>, finding serious vulnerabilities along the way. The USAF was so pleased with the result that it has decided to up the ante. Next year, it\u2019s bringing a satellite.<\/p>\n

That\u2019s a promise from Will Roper, assistant secretary of the Air Force for acquisition, technology, and logistics. While sending elite hackers after an orbiting satellite\u2014and its ground station\u2014might sound ambitious, it\u2019s in keeping with Roper\u2019s commitment to fundamentally changing how his branch of the military attacks its cybersecurity challenges.<\/p>\n

\u201cWe have to get over our fear of embracing external experts to help us be secure. We are still carrying cybersecurity procedures from the 1990s,\u201d says Roper. \u201cWe have a very closed model. We presume that if we build things behind closed doors and no one touches them, they\u2019ll be secure. That might be true to some degree in an analog world. But in the increasingly digital world, everything has software in it.\u201d<\/p>\n

"What they\u2019re going to do is try to take over the satellite by any means they find."<\/p>\n

Will Roper, Air Force<\/p>\n

Software inevitably has bugs that could be exploited, whether in a smart microwave<\/a> or a complex flight system. Roper knows this from experience: The Hack the Air Force initiative, a bug bounty that sprang from a partnership between HackerOne and the Pentagon\u2019s Defense Digital Service<\/a>, paid out $130,000 to hackers who collectively found<\/a> over 120 vulnerabilities last December.<\/p>\n

It was DDS that connected the Air Force to the organizers of Defcon\u2019s Aviation Village, a corner of the hacking conference dedicated to all things aerial that debuted this year. There, a group of seven vetted hackers, under the USAF\u2019s watchful eyes, attacked a Trusted Aircraft Information Download Station, which transfers data back and forth on an F-15. With the vulnerabilities they found, they could have shut it down. And that\u2019s just one of the countless components that the Air Force sources. The Air Force has its own internal cybersecurity team, of course, but its resources are finite. It needs a little help.<\/p>\n

\u201cYou would expect really high security procedures for the F-15, and it has them. But what about this humble data translator,\u201d says Roper. \u201cYou might overlook it, but those kinds of things tend to be built by smaller companies. And you can imagine that smaller companies without the resources of a Lockheed Martin or Northrop Grumman or Boeing are not able to think about cyber resiliency and security at a level that can contend with a peer competitor like China.\u201d<\/p>\n

Once the Air Force sees what common security pitfalls plague its third-party parts, it can start writing stronger security requirements into its contracts. That hardens the entire supply chain\u2014which in turn makes everyone\u2019s aircraft more secure.<\/p>\n

More still needs to be done, though, to address the opacity of the broader aviation community. Airplane parts are difficult for independent researchers to come by, and the big manufacturers have bristled at any suggestion<\/a> that their products might have vulnerabilities like anything else that runs on millions of lines of code. It\u2019s especially glaring at a time when similar tensions with the automotive and medical device communities have largely thawed, says Pete Cooper, director of the Aviation Village. \u201cI couldn\u2019t see the same collaboration in the aviation sector,\u201d says Cooper. \u201cThere wasn\u2019t really much in the way of productive and positive relationships in that area.\u201d<\/p>\n

Roper hopes that the Air Force\u2019s involvement can help build that bridge. After all, who wouldn\u2019t want to hack a satellite?<\/p>\n

Here\u2019s how it\u2019s going to work: Sometime soon, the Air Force will put out a call for submissions. Think you know how to hack a satellite or its ground station? Let them know. A select number of researchers whose pitches seem viable will be invited to try out their ideas during a \u201cflat-sat\u201d phase\u2014essentially a test build comprising all the eventual components\u2014six months before Defcon. That group will once again be culled; the Air Force will fly the winners out to Defcon for a live hacking competition.<\/p>\n

\u201cWhat we\u2019re planning on doing is taking a satellite with a camera, have it pointing at the Earth, and then have the teams try to take over control of the camera gimbals and turn toward the moon,\u201d says Roper. \u201cSo, a literal moon shot.\u201d<\/p>\n

Some specifics are still in the offing, like which satellite will be involved\u2014regardless, it will likely be flying in low Earth orbit\u2014how many teams will be selected in each round, and the size of the final cash award. But still, it\u2019s not every day that you get to hack a celestial body, much less legally so.<\/p>\n

\u201cIf you want to get into a satellite, you can either go through the ground station or you can try to find a way into the satellite directly, with your own emitter. We will have opportunities for contestants to do both,\u201d says Roper. \u201cBut what they\u2019re going to do is try to take over the satellite by any means they find.\u201d<\/p>\n

\ufffc\ufffc<\/p>\n

Security researchers will have to go through a vetting process; this is military equipment, after all. But ideally the opportunity is worth the hassle. And the earlier in the process the security community comes in, the better. \u201cWe want to hack in design, not after we\u2019ve built,\u201d says Roper. \u201cThe right place to do it is when that flat-sat equivalent exists for every system. Let the best and brightest come tear it up, because the vulnerabilities are less sensitive then. It\u2019s not an operational system. It\u2019s easier to fix. There\u2019s no reason not to do it other than the historical fear that we have letting people external to the Air Force in.\u201d<\/p>\n

If the Air Force is willing to let people look under the hood, then maybe the commercial aerospace industry will as well. \u201cWhat we\u2019re trying to achieve is to help industry see that, actually, there is value in learning about potential risks, that good-faith research can be something really helpful,\u201d says Cooper, who applauds the Air Force for its relative openness to the security community. \u201cThe difficulty is linking up those doing good-faith research with the actual risk-owner of the system.\u201d<\/p>\n

Sure, the satellite-hacking contest may be a bit of a public relations stunt. But it\u2019s one with both practical value\u2014it\u2019ll make at least one satellite more secure\u2014and relevance. Cooper says that space has become such a vital part of aircraft cybersecurity that the Aviation Village will next year be the Aerospace Village. And the event will also convey a critical message: The Air Force has cool toys, and it\u2019ll let you break them. For the security community, that\u2019s quite an olive branch.<\/p>\n

And if satellites aren\u2019t your thing? Don\u2019t fret. Roper says he\u2019s doing his best to bring an entire plane to Defcon. They\u2019re just having a little trouble finding room.<\/p>\n

https:\/\/www.wired.com\/category\/security\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

<\/p>\n

Credit to Author: Brian Barrett| Date: Tue, 17 Sep 2019 11:00:00 +0000<\/strong><\/p>\n

At the Defcon hacking conference next year, the Air Force will bring a satellite for fun and glory.<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10378,10607],"tags":[714,21357],"class_list":["post-16342","post","type-post","status-publish","format-standard","hentry","category-security","category-wired","tag-security","tag-security-security-news"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/16342","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=16342"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/16342\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=16342"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=16342"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=16342"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}