US military weapons systems found to have vulnerabilities

Department of Defence "did not prioritise weapon system security", claims report

Armed fighter jet

The trillion-dollar arsenal of advanced weaponry the United States Military owns has been found to have "mission-critical cyber vulnerabilities", according to a report.

Published by the US Government Accountability Office (GOA) the report claims that the US Department of Defence (DOD) had not prioritised cybersecurity when building its advanced weapon systems.

Graphic of an automated weapon - courtesy of the GOA

Advertisement - Article continues below

"Automation and connectivity are fundamental enablers of DOD's modern military capabilities," the report said. "However, they make weapon systems more vulnerable to cyber attacks.

"Although GAO and others have warned of cyber risks for decades, until recently, DOD did not prioritise weapon systems cybersecurity. Finally, DOD is still determining how best to address weapon systems cybersecurity."

The DOD is said to be planning to spend an estimated $1.66 trillion to further develop its current portfolio of major weapons and the GOA had been asked to review the state its current weapons system security.

In operational testing, the GOA found mission-critical cyber vulnerabilities in systems that were under development that program official believed were secure - some even discounted the test results as "unrealistic".

Worryingly, very simple tools and techniques were used to take control of the systems and went largely undetected. Basic issues such as poor password management and unencrypted communications were just some of the vulnerabilities found.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

According to the report, the DOD is taking steps to improve its weapon system cybersecurity, which includes issuing and revising policy and guidance, but its remedial work will need to be swift as cyber threats are becoming more advanced.

In August, researchers at Rutgers University revealed that a normal Wi-Fi network could be used to detect weapons, such as firearms, bombs and explosive chemicals and in July, it was revealed that a hacker infiltrated the Air Force and stole files pertaining to a lethal drone, which later leaked onto the dark web.

"It is shocking to find out critical systems especially weapons systems are still using default vendor passwords," said Joseph Carson, chief security scientist at Thycotic. "This report's findings reveal that anyone in the world with sufficient cybersecurity skills could be in control of the worlds most advanced weapon systems within hours."  

Featured Resources

Navigating the new normal: A fast guide to remote working

A smooth transition will support operations for years to come

Download now

Putting a spotlight on cyber security

An examination of the current cyber security landscape

Download now

The economics of infrastructure scalability

Find the most cost-effective and least risky way to scale

Download now

IT operations overload hinders digital transformation

Clearing the path towards a modernised system of agreement

Download now
Advertisement

Recommended

Visit/security/ransomware/356292/university-of-california-gets-fleeced-by-hackers-for-114-million
ransomware

University of California gets fleeced by hackers for $1.14 million

30 Jun 2020
Visit/security/cyber-security/356289/australia-announces-135b-investment-in-cybersecurity
cyber security

Australia announces $1.35 billion investment in cyber security

30 Jun 2020
Visit/cloud/cloud-security/356288/csa-and-issa-form-cybersecurity-partnership
cloud security

CSA and ISSA form cyber security partnership

30 Jun 2020
Visit/security/ethical-hacking/356252/poorly-secured-banking-apps-lead-to-cyber-threats
ethical hacking

Mobile banking apps are exposing user data to attackers

26 Jun 2020

Most Popular

Visit/laptops/29190/how-to-find-ram-speed-size-and-type
Laptops

How to find RAM speed, size and type

24 Jun 2020
Visit/policy-legislation/data-protection/356344/eu-institutions-warned-against-purchasing-any-further
data protection

EU institutions told to avoid Microsoft software after licence spat

3 Jul 2020
Visit/mobile/mobile-phones/356335/the-man-has-ruined-my-huawei-p40
Mobile Phones

The Man has ruined my Huawei P40

3 Jul 2020