US weapons systems can be 'easily hacked'
Government’s recent report concluded, some of the most cutting-edge weapons in the US military arsenal can be “easily hacked” using ‘basic tools”.
The Government Accountability Office (GAO) found "mission-critical” vulnerable to cyber attack in nearly all weapons systems tested between 2012 and 2017.
That includes the newest F-35 jet, as well as missile systems, were vulnerable to cyber-attack.
Pentagon Officials said in their report they “believed their systems were secure”, NPR reported.
The Committee’s members expressed their concerns about how protected weapon systems were against cyber-attacks.
The report's main findings were:
- The Pentagon did not change the default passwords on multiple weapons systems - and one changed password was guessed in nine seconds.
- A team appointed by the Government Accountability Office (GAO) was able to easily gain control of one weapons system and watch in real time as the operators responded to the hackers.
- It took another two-person team only one hour to gain initial access to a weapons system and one day to gain full control.
- Many of the test teams were able to copy, change or delete system data with one team downloading 100 gigabytes of information.
The Government Accountability Office (GAO) added that the Pentagon "does not know the full scale of its weapons system vulnerabilities".
The Pentagon has not issued a detailed response to the report. But some of the security tests “were unrealistic “officials said about the documents.
Ken Munro, an expert at security firm Pen Test Partners, said he was "not at all surprised" by the findings.
"It takes a long time to develop a weapons system, often based on iterations of much older systems. As a result, the components and software can be based on very old, vulnerable code.
"Developers often overlook 'hardening' the security of systems after they've got them operating, with the philosophy, 'it's working, so don't mess with it'.
"However, that's no excuse. This report shows some very basic security flaws that could easily have been addressed by changing passwords and keeping software up-to-date."