Security *Facepalm*

It seems that someone has hacked the Air Force's Predator Drone fleet, and has malware installed on them that the Air Force can't get rid of:

A computer virus has infected the cockpits of America’s Predator and Reaper drones, logging pilots’ every keystroke as they remotely fly missions over Afghanistan and other warzones.

The virus, first detected nearly two weeks ago by the military’s Host-Based Security System, has not prevented pilots at Creech Air Force Base in Nevada from flying their missions overseas. Nor have there been any confirmed incidents of classified information being lost or sent to an outside source. But the virus has resisted multiple efforts to remove it from Creech’s computers, network security specialists say. And the infection underscores the ongoing security risks in what has become the U.S. military’s most important weapons system.

“We keep wiping it off, and it keeps coming back,” says a source familiar with the network infection, one of three that told Danger Room about the virus. “We think it’s benign. But we just don’t know.”

We think it’s benign. But we just don’t know.  What could possibly go wrong?

Sigh.

Kx59 says I've been warning and warning them. As if it helps.

Internet Security guys like me tell you that when you have malware you can't get rid of, you wipe the system and reinstall everything from original media.  Nuke it from Orbit.  Nothing less ensures you that you're not still pwn3d.

And just to emphasize what's happening, the entire US Air Force Predator Drone fleet has been pwn3d.  It's not at all clear that we still control it.  And they're still flying, with Hellfire missiles.

I mean, what could possibly go wrong?

We think it's benign.

You keep using that word.  I do not think it means what you think it means.

Oh, and one more thing: if you click through that Host-Based Security System link in the article above, you know what you find?  McAfee antivirus.  That means that the Predators all run on Windows.

Think about that design, and what the people who made that architecture decision, and what it means.  You'll know that you understand the situation correctly when the hair on the back of your neck stands up.

Stalin would have had them all shot.  However this plays out, this will not end well.

UPDATE 7 October 2011 19:25: To clarify, the malware isn't running on the drones themselves, but on the (ground based) "cockpit" computers that the pilots use to fly the birds.

And it doesn't make one whit of difference.  All of the commands that the pilots use to fly the drones are being recorded.  It's hard to see how Joe H4X0r couldn't reconstruct the "left" "right" "up" "down" and "fire missile" commands from the log.  If he's smart enough to hack the Air Force, he's plenty smart enough to do that.

And the threat scenario isn't that a person or persons unknown fly one to Bagram - we'd shoot it down.  The threat scenario is that some of Our Guys stuck in a tight spot might eat one of the Hellfires, not the Bad Guys.

This will not end well, and people should be fired for this.