Forget EMP - A New Simpler Danger

[raptor]

There have been recent reports of chips in critical hardware that could potentially allow spying in the data going through and/or have a "kill switch' capabilities for the hardware. These components are then incorporated into everything from routers to weapons components.

Thus potentially any equipment that had this component in it could potentially be killed remotely through a transmitted signal sent via a variety of means.

https://www.bloomberg.com/news/articles ... -s-telecom

[quoteA major U.S. telecommunications company discovered manipulated hardware from Super Micro Computer Inc. in its network and removed it in August, fresh evidence of tampering in China of critical technology components bound for the U.S., according to a security expert working for the telecom company.

The security expert, Yossi Appleboum, provided documents, analysis and other evidence of the discovery following the publication of an investigative report in Bloomberg Businessweek that detailed how China’s intelligence services had ordered subcontractors to plant malicious chips in Supermicro server motherboards over a two-year period ending in 2015.][/quote]

This brings up the question when almost everything today has some sort of chip in it why bother with EMP and its complexities. Sell cheap chips with a kill switch unknown to the installer.

If you think about it almost everything uses digital technology to keep costs down. Simple mechanical devices like thermostats, lock sets and even light bulbs (LED bulbs) now have a chip in them. Potentially everything from HVAC systems to access doors to lighting could have a kill switch installed. This obviously assumes that a kill message could be transmitted and received by these devices. Never mind the impact on telecommunications,commerce and weapon systems.

We recently saw a nationwide warning message. If that messaging system could be harnessed to send a "kill" signal there would be assurance of the a wide area of coverage.

Now obviously this not a present day risk but could be a real risk in the near future.

Also note the bad guy does not have to be a nation state, it could be one that is carried out by a wide variety of players.

I am curious to see what other ZS seem to think of this issue.

[jor-el]

You should not depend on a foe to make your swords, arrows, or armor.

[jor-el]

Nor, for that matter, your bread, butter, or water.

[raptor]

You should not depend on a foe to make your swords, arrows, or armor.

That is the brilliance of the plan. To use your analogy they are not making the swords but rather a tainted component that is then used to make the sword.
A component so in significant that it may not be noticed.

[MPMalloy]

From NPR: Cyber Tests Showed 'Nearly All' New Pentagon Weapons Vulnerable To Attack, GAO Says
Not quite a kill switch, but if you don't lock up to begin with....

[Stercutus]

Now obviously this not a present day risk but could be a real risk in the near future.

Maybe it is and maybe it isn't. Maybe it depends upon who you are, where you bought your hardware and from whom. At least on the military side of things. I am not so sure on the civilian side.

[MPMalloy]

How easily an adversary couold target and talior an attack instead of blanketing an entire country with EMP.

[majorhavoc]

This is basically a major plot point in the reboot of Battlestar Galactica. The Galactica was a decrepit, obsolete, outdated old battle wagon. It also wasn't networked and used a lot of old school analog technology. Therefore the Chinese Cylons couldn't disable it via the backdoor technology they incorporated all of humanity's newer ships with. Granted, Galactica was basically a floating museum at the time of the Chinese Cylon (sorry) attack, and one of it's hangers had been converted into a gift shop. But it was still commanded by an equally old-fashioned, non-digital, old school commander who lacked the good sense to give up when the odds were clearly hopeless. The rest, as they say, is f*cking outstanding sci-fi television.

Sorry, my inner geek has this annoying habit of asserting itself even in very serious discussions.

The thing that gets me is this whole real world situation was so blindingly predictable. If we were going to leave ourselves this moronically dependent on a global competitor's technology, you really can't blame the Chinese for doing this.

[raptor]

That is also the other brilliant part of the plan...picture PRC planners talking ( bad chinese accent)...
So not only do these morons actually install this chip in everything...but they actually buy them from us and pay for our plan...so even if it is unsuccessful it will not cost us a cent....and if they discover this they will have to buy new components that we will also make and sell them...at a profit and potentially with a newer version of the kill switch....

Loud laughter ensues.

[NT2C]

The thing that gets me is this whole real world situation was so blindingly predictable. If we were going to leave ourselves this moronically dependent on a global competitor's technology, you really can't blame the Chinese for doing this.

Not just predictable, but an ongoing concern for at least the past 20 years. There were reports in the 90s of chips with backdoors getting used in military hardware. The problem is even more insidious though because it can affect even domestically produced chips if the software used to design the chip is corrupted. That particular problem has been talked about in the industry since at least the early 1980s when I was getting my degrees because the advances we've made in CAD and CAM are ripe for such abuse. We now rely a great deal on the computers and software we currently have to build the next generation of themselves. If that software and those computers are compromised by a bad player they could design in such kill switches, bypasses and other nefarious possibilities even in 100% domestically designed and produced products, and this likely has already happened many times over the past three or four decades. We didn't really start taking what is now termed "cybersecurity" seriously until Y2K became a concern, and by then it was already possibly too late to lock the barn doors.

If the balloon should go up and we find ourselves in a major war with China or Russia I would not count on too much modern technology to continue functioning. Our Internet of Things will likely become an Internet of Useless Things, and in a lot of cases, our Internet of Enemy Things. I can only hope that we've been just as busy as our enemies have been and that we have some surprises of our own in store for them.

[Stercutus]

I think such a war would end terribly scorched Earth. Each side would think that they had an advantage over the other and each would be mistaken. It could end up like the burning of the Library of Alexandria, 9/11 and The Fall of Rome all in one.

[NT2C]

I think such a war would end terribly scorched Earth. Each side would think that they had an advantage over the other and each would be mistaken. It could end up like the burning of the Library of Alexandria, 9/11 and The Fall of Rome all in one.

I agree with you. I wish I had a good and rational reason not to, but I don't.

[majorhavoc]

The thing that gets me is this whole real world situation was so blindingly predictable. If we were going to leave ourselves this moronically dependent on a global competitor's technology, you really can't blame the Chinese for doing this.

Not just predictable, but an ongoing concern for at least the past 20 years. There were reports in the 90s of chips with backdoors getting used in military hardware. The problem is even more insidious though because it can affect even domestically produced chips if the software used to design the chip is corrupted.

That's even more appalling. So we knew this could happen, saw it beginning to happen 20 years ago, and let it happen anyway. Even the Trojans had ignorance as an excuse.

[raptor]

I think such a war would end terribly scorched Earth. Each side would think that they had an advantage over the other and each would be mistaken. It could end up like the burning of the Library of Alexandria, 9/11 and The Fall of Rome all in one.

I agree with you. I wish I had a good and rational reason not to, but I don't.

I also agree.

That said it is possible that by limited strike using these "kill switches" sufficient damage could be caused to achieve the desired goals. If the attack was limited to this it would place the US in the awkward spot of deciding how to retaliate. The US doctrine is clear in that any any attack using nuclear or chemical weapons can result in nuclear retaliation. Since most know EMP type weapons employ nuclear devices they fall under this doctrine.

Cyber attacks though are whole different animal. Would this warrant a nuclear exchange? It is hypothetical so there is no way of knowing right now.

In terms of preps you should keep this fact in mind when replacing analog devices with digital devices on critical preparations. For instance a new diesel generator I purchased for an application has an electronic FADEC which is used to reduce emissions. It is possible that these chips are built into the FADEC. Perhaps in the future for such applications it would make sense to simply rebuild the generator engine and have the generator rewound.

[absinthe beginner]

when I see all the shuffling zombies staring down at their cell phone screens, I sometimes think an EMP would be the best thing that could happen to us to restore normal human social interactions and interdependency.

[Stercutus]

The US doctrine is clear in that any any attack using nuclear or chemical weapons can result in nuclear retaliation. Since most know EMP type weapons employ nuclear devices they fall under this doctrine.

Cyber attacks though are whole different animal. Would this warrant a nuclear exchange? It is hypothetical so there is no way of knowing right now.

Officially the US does not engage in cyberwarfare. After some idiot got a hold of some classified info about the Stuxnet that cat was out of the bag. During the Cold War the US did a much better job of retaining information then it does to today. You can blame technology if you want for that but it is good old fashioned human intelligence operations that result in most of the incidents.


I am guessing they have some kind of response planned. What, how bad are the questions. Cyber attacks have been going on for a while.

http://time.com/4270728/iran-cyber-attack-dam-fbi/

[raptor]

During the Cold War the US did a much better job of retaining information then it does to today. You can blame technology if you want for that but it is good old fashioned human intelligence operations that result in most of the incidents.

Spying in the Cold war meant using a camera, microfilm, dead drops and couriers. Today a simple smartphone can send live pictures, email 25mb of zipped files and Drop Box GBs of data in minutes. I am frankly surprised any secrets are maintained.

[NT2C]

During the Cold War the US did a much better job of retaining information then it does to today. You can blame technology if you want for that but it is good old fashioned human intelligence operations that result in most of the incidents.

Spying in the Cold war meant using a camera, microfilm, dead drops and couriers. Today a simple smartphone can send live pictures, email 25mb of zipped files and Drop Box GBs of data in minutes. I am frankly surprised any secrets are maintained.

Considering the lengths to which my wife has to go through to discuss classified material with others in her organization, I see what secrets that do leak out as being such an infinitesimally small percentage of secrets retained as to be statistically insignificant. Not that they aren't damaging, just that they aren't much considering the whole.

[Stercutus]

Yeah, but one government official with loose lips can expose a whole program like Stuxnet. Sure it was blown already but nobody knew who did it till somebody wanted to look important taking credit for someone else's work. That hasn't changed the Revolutionary War.


The best operatives you will never know about till long after they are dead. Anyone who talks about their intelligence work is automatically not an important guy.

[NT2C]

Yeah, but one government official with loose lips can expose a whole program like Stuxnet. Sure it was blown already but nobody knew who did it till somebody wanted to look important taking credit for someone else's work. That hasn't changed the Revolutionary War.


The best operatives you will never know about till long after they are dead. Anyone who talks about their intelligence work is automatically not an important guy.

The only reason I know about my wife's work is because it's part of the job title. DHS USCIS FOD FDNS.

[Stercutus]

Yeah, but one government official with loose lips can expose a whole program like Stuxnet. Sure it was blown already but nobody knew who did it till somebody wanted to look important taking credit for someone else's work. That hasn't changed the Revolutionary War.


The best operatives you will never know about till long after they are dead. Anyone who talks about their intelligence work is automatically not an important guy.

The only reason I know about my wife's work is because it's part of the job title. DHS USCIS FOD FDNS.

That's different. Although there are some work things I never discussed with the spouse. It was simply irrelevant.

[majorhavoc]

On a related note:
https://www.nytimes.com/2018/10/10/us/p ... e=Homepage

This would be sad if it weren't so infuriating. Or maybe it would be infuriating if it weren't so sad.

They say the military is always preparing for the last war rather than the one that's yet to come, but this is seriously an embarrassing lack of foresight.

WASHINGTON — Authorized hackers were quickly able to seize control of weapons systems being acquired by the American military in a test of the Pentagon’s digital vulnerabilities, according to a new and blistering government review.

The report by the Government Accountability Office concluded that many of the weapons, or the systems that control them, could be neutralized within hours. In many cases, the military teams developing or testing the systems were oblivious to the hacking.

A public version of the study, published on Tuesday, deleted all names and descriptions of which systems were attacked so the report could be published without tipping off American adversaries about the vulnerabilities. Congress is receiving the classified version of the report, which specifies which among the $1.6 trillion in weapons systems that the Pentagon is acquiring from defense contractors were affected.

But even the declassified review painted a terrifying picture of weaknesses in a range of emerging weapons, from new generations of missiles and aircraft to prototypes of new delivery systems for nuclear weapons.

[MPMalloy]

Battleshort

[Stercutus]

That is not how battleshort works. Battleshort won't keep something running if gets internal commands to shut down.

Examples of battleshort:

A generator that is sending the wrong voltage to equipment. If it were out of tolerance (say 90v when expected is 110V) it would normally stop sending power to protect the equipment being powered. With battleshort on it will keep sending power no matter what the voltage is, even if it burns the equipment up.

Equipment that is EMP protected with a surge arrestor that shuts down the equipment is placed in battleshort. IF EMP strikes everything gets fried instead of shutdown protected.