U.S. Air Force Demonstrates How NOT to Report a Malware Attack

I just ended a phone call with Air Force Space Command Public Affairs after reading their press release "Flying operations of remotely piloted aircraft unaffected by malware". I figured that since the malware was "found routinely on computer networks and is considered more of a nuisance than an operational threat" that there would be no problem in telling me the name of the malware involved.

That didn't happen, which is too bad because the press release has some confusing language in it and conflicts with unnamed Air Force sources quoted in the two earlier Wired articles (here and here). For example, the release makes a distinction between a "credential stealer" and a "keylogger". Well, that's a distinction without a difference. What we're really talking about is a trojan that steals credentials by logging key strokes. Zeus and SpyEye are two of the largest but there are lots of trojans out there. Here's one I found on a game forum: "Trojan.KillAV.RS Steals Gamers’ Login Credentials". The other important fact to know about trojans or "credential stealers" as the Air Force likes to call them, is that they transmit their stolen credentials out to a Command & Control site. The Air Force PR statement said that their particular credential stealer wasn't designed to transmit data or video. Video? No. Data? Absolutely. That's the entire point of the malware - to capture data and send it back to the C&C.

I think that what happened here is that the Air Force is focusing on what the malware isn't instead of what it is. It's not designed to take over the controls of a remotely piloted aircraft. It is, however, designed to steal data. If the Air Force wants to put this to bed and stop the speculation, here are two tips for future briefings:

1. Have an engineer from the 24th Air Force write the press release so that the language is precise and accurate.
2. Name the malware.

The only thing that your current press release did was raise more questions.

Add to Cart View detail

U.S. Defense Dept.'s Organizational Chart for Cyber Operations

In light of today's Wired.com article about how Creech AFB failed to report its virus attack to the 24th Air Force, I thought it might be helpful to see exactly how DoD has structured its cyber operations. The above graphic is best viewed as a Prezi.

Organizations with responsibility in this case could have included USSTRATCOM which directs DOD's Global Information Grid's operations and defense, USCYBERCOM which is a dual-hatted command with the NSA who has direct responsibility for protecting the .MIL domains. And then there's the 24th Air Force which is responsible for the Air Force Enterprise Network GIG and three Wings which report to it.

24th Air Force

• Plans and conducts cyberspace operations in support of combatant commands.
• Maintains and defends the Air Force Enterprise Network GIG.

67th Network Warfare Wing

• Organizes, trains, and equips cyberspace forces to conduct network defense, attack, and exploitation.
• Executes air force network operations, training, tactics, and management for the 24th Air Force and combatant commands.

688th Information Operations Wing

• Aims to deliver proven IO and engineering infrastructure capabilities integrated across air, space, and cyberspace domains.

689th Combat Communications Wing

• Trains, deploys and delivers expeditionary and specialized communications, air traffic control, and landing systems for Humanitarian Relief Operations and dominant combat operations.
• Conducts tactical operations in austere, deployed, and joint/coalition environments.

We prepared the above graphic along with a full explanation of DOD's Cyber Operations with the help of the U.S. Government Accountability Office for use in the 2nd edition of my book Inside Cyber Warfare: Mapping the Cyber Underworld (O'Reilly Media) when it's published later this year or early 2012.

Add to Cart View detail

Cybersecurity Issues with Predators, Reapers, and Unmanned Aerial Systems

Creech Air Force Base UAV hangars

According to Wired, Creech Air Force Base has been struggling to clean its Reaper and Predator Ground Control Stations (GCS) of a persistent virus of unknown origin; perhaps something like TDL-4 which loads before the operating system, right at the beginning of the computer's boot-up sequence. This type of virus is almost impossible to get rid of. Whether its TDL-4 or something with similar behaviors, I spent the last few days researching Unmanned Aerial Systems (UAVs plus their ground control stations) and there are a few serious cybersecurity issues besides the 2009 unencrypted video feed controversy and the one Noah Shachtman reported about last Friday. Before we get to those, I think it's important to note that while there are only a few countries (U.S., Israel, Britain, France) who are using drones operationally in Afghanistan, there are over 50 who have built or bought them. I wouldn't be surprised to see this technology near the top of someone's list for targeted cyber-espionage.

Unencrypted mission control data feeds
On 20 Dec 2009, shortly after the news broke about unencrypted Predator video feeds, a security engineer using the alias "kingcope" posted an article to the Full Disclosure list entitled "Reading Mission Control Data Out Of Predator Drone Video Feeds". He pointed out that not only was the line of sight transmission unencrypted, but so was the Ku-Band satellite transmission which extends the range of interception far beyond just line-of-sight and that if the MPEG stream wasn't encrypted, then the metadata inside the stream was probably being transmitted in the clear as well. Both the mission control data and the video stream data are part of the MPEG stream and could be read using a free tool called LEADTOOLS.

According to the Air Force, they've known about the unencrypted video feeds for over 10 years, and that it'll be 2014 before that vulnerability is fixed. Presumably that'll include the unencrypted mission control data feed as well.


Internet Access
There shouldn't be any connection between the UAS network and public-facing Internet however at least one GCS that I looked at did utilize an Internet connection as part of its architecture: the Network Centric Ground System.

I assume that the above network architecture was not deployed at Creech AFB since the GCS stations would be handling classified data however it would be worth a look at how Creech AFB has connected its Ground Control Stations to the Global Information Grid. The volume of data handled is growing at an extremely rapid pace as are the number of analysts who are viewing it according to the New York Times. With the deployment of "Gorgon Stare", an incredible 1.8 gigapixel camera offering 12 simultaneous views of the target environment, the UAV firehouse must be more massive than ever. Whatever has infected the Creech GCSs could theoretically spread beyond Creech AFB via the GIG. Let's assume that the point of entry was one of the portable hard drives used to load map updates and transport mission videos. Once in the network, its infection path could include printer servers and other shared resources regardless of geography. In other words, other Air Force bases who are conducting analysis on this data may be exposed to the same virus that the Creech technicians are struggling with.  This could include Britain's Royal Air Force whose 39 Squadron use Creech AFB as ground control for their own fleet of UAVs. I assume that the Brits are conducting their own analysis of the video feeds which would stream from Creech's GCS, thus providing a means for the virus to possibly infect British networks.

Why Kaspersky?
One of the nagging questions that I had after reading Noah's article was why would the Creech AFB technicians go to Kaspersky? DISA's Host-Based Security System website references McAfee as a supporting vendor, not Kaspersky. One of my Twitter followers suggested that they might be dealing with TDL-4, a particularly nasty TDSS variant that was originally detected by Kaspersky and which they've dubbed the "most sophisticated threat today". That might explain why the technicians turned felt they needed to visit the Russian company's site even though no one has a patch for this; not even Kaspersky. Based upon its description and functionality, a TLD-4 infection would be a worst-case scenario for the U.S. Air Force because it means that their data is being exfiltrated to cybercriminals in a way that's extremely hard to detect:

TDSS uses a range of methods to evade signature, heuristic, and proactive detection, and uses encryption to facilitate communication between its bots and the botnet command and control center. TDSS also has a powerful rootkit component, which allows it to conceal the presence of any other types of malware in the system.

If it is TDL-4, no one has a way to remove it short of shit-canning the old hard drives and buying new ones. And speaking frankly, the Air Force appears to me to be a bit too relaxed about its vulnerabilities in cyberspace. It let its UAS data stream remain unencrypted for over 10 years because someone thought the enemy was too unsophisticated to know how to read it. Someone else apparently thought it was OK to make an exception on its removable media rule for UAV data transfer. And as far as its public response to this breaking story goes, a standard CYA response like the one Lt. Col. Tadd Sholtis gave - "We invest a lot in protecting and monitoring our systems to counter threats and ensure security, which includes a comprehensive response to viruses, worms, and other malware we discover" - is pretty meaningless in light of past events. Then there's the remarks of an unidentified senior Air Force official for Fox News who claimed that Wired's entire story was over-blown:

"The planes were never in any jeopardy of 'going stupid'," the source said, and the virus "is not affecting operations in any way ... it showed up on a Microsoft-based Windows system. We have a closed-loop system and heavily protected cockpits -- the planes were never in jeopardy."

I have no idea who this un-named source is or what article he thinks he read but it wasn't the article in Wired. There's not a single mention of planes being in jeopardy or "going stupid" in Noah Shachtman's article. If he can't get his facts straight about what the article said, why should anyone believe his assessment of the malware? Having met and spoken with many USAF officers involved in cyber including some General officers, I know that the Air Force is capable of better cybersecurity management. Hopefully this breach will spur some positive changes before any more damage is done.

Add to Cart View detail