US Air Force moves to fortify F-35 weak points against hacking

copy and pasted title, sorry.

link


it looks like someone has found a way into the F35 via the external ground equipment, or so it seems.

my guess is it was being pen tested by our own forces, black hats if you will, have found vulnerabilities in the hardware and software that supports the aircraft and not the aircraft itself.

also mentioned was they were worried about someone getting their hands or eyes into a simulator, for obvious reasons. I had never really considered that before, there is allot of physical security on airfields and data centers but simulators have allot more 'normal' traffic and would definitely be a weak point to exploit if you wanted to learn about intimate details of the f35

a reply to: penroc3

it looks like someone has found a way into the F35 via the external ground equipment, or so it seems.

What gives you that impression? Because they announce the hardening? I could not find anything that would suggest that someone hacked/cracked the F-35.

It´s the same if you would change your front door lock cylinder and your neighbor starts telling everyone, that it seems, someone must have broken into your house. Or you got raided by police. Or you´re paranoid.

It´s as far fetched as it can get.

a reply to: verschickter

its just a strange announcement.

usually stuff linked to op-sec is a closely guarded secret.


ill use your front door lock analogy

if you lost your key or that the key for you lock was duplicated many many times by lazy workers, would you leave the lock on your house and hope for the best? i wouldn't.

a sense of paranoia can be healthy

usually announcements like these are in response to something happening to show 'see, we fixed it'. or lay honey traps.

and friendly black hats, or pen testers are paid by the people they work for to break into there security systems and degrade it, so it is 100% plausible to me someone found a way or they were made aware of a way in by a not so friendly attempt.

I don´t find it strange (the announcement). Maybe you are on to something, but as of now, I don´t have enough information to come to the same conclusion as you.

About the analogy.

Of course I would not. But in that analogy, you are the neighbor that begins to interpret into it. Maybe I found out my lock isn´t secure anymore, so I change it before something bad happens.

The lock analogy is not good, I see that. Because locks don´t prevent anyone determined to get in. It just acts as a deterent for the normal joe. A professional will pull that lock in a few seconds. The next guy just smashes a window.

The result is the same.

a reply to: penroc3

They're not getting into the aircraft, they might be able to get into the support systems for the aircraft. In one case that can lead to bad data being loaded into the aircraft but not access to the aircraft itself.

a reply to: Zaphod58

To be fair, that´s how injection attacks work. But for that level of intrusion and escalating execution rights, through many layers, it takes an insider and attack vectors that no other developer saw before.

The chances are very narrow.

a reply to: verschickter

The Pentagon has suddenly realized they've been idiots about cybersecurity and are working to change that. They recently made some serious changes to contractor rules about security. This is just part of that initiative.

Like I wrote, I don´t think that the F35´s software has been compromised. Wit the info I have (from the article) it does not look suspicious. See my first post on this thread.

These concerns aren't new.

a reply to: Zaphod58

right, i said the support equipment.

if you could mess with mission data loading or other setting look what happened with the f22 recently(granted not a perfect example)

i just find it interesting cyber security issues have been known about for years but now are just getting pushed past the finish line? could be just natural timing but i think our guys demonstrated an exploit that scared someone to get on it and finish it now

originally posted by: Zaphod58
a reply to: verschickter

The Pentagon has suddenly realized they've been idiots about cybersecurity and are working to change that. They recently made some serious changes to contractor rules about security. This is just part of that initiative.

I'M ACTUALLY REALLY HAPPY TO SEE THAT.

Sorry 'bout the caps, I'm a bit giddy at that info.

a reply to: verschickter

plugging cybersecurity holes in the F-35's external b]support systems

They found security issues in the hardware (servers) that bird is uploading all dat data too.

a reply to: cenpuppie