The report was put together by the US Government Accountability Office (GAO), an agency that provides auditing, evaluation, and investigative services for Congress. GAO was asked by Congress to check the numbers for DOD funding of over $1.66 trillion, so the Pentagon could expand its weapons portfolio with new toys of doom.
GAO testers found a slew of vulnerabilities of all sort of types affecting these new weapons systems. Using relatively simple tools and techniques, testers were able to take control of systems and largely operate undetected, due in part to basic issues such as poor password management and unencrypted communications, GAO officials said.
In one case, it took a two-person test team just one hour to gain initial access to a weapon system and one day to gain full control of the system they were testing.
Some programmes fared better than others.One assessment found that the weapon system satisfactorily prevented unauthorised access by remote users, but not insiders and near-siders. Once they gained initial access, test teams could move throughout a system, escalating their privileges until they had taken full or partial control of a system.
The test team took control of the operators' terminals and could see, in real-time, what the operators were seeing on their screens and could manipulate the system. They were able to disrupt the system and observe how the operators responded.
Another test team reported that it caused a pop-up message to appear on users' terminals instructing them to insert two quarters to continue operating.
Multiple test teams reported that they were able to copy, change, or delete system data including one team that downloaded 100 gigabytes, approximately 142 compact disks, of data.
The report claims the DOD documented many of these "mission-critical cyber vulnerabilities" but Pentagon officials who met with GAO testers claimed their systems were secure, and "discounted some test results as unrealistic".
GAO said all tests were performed on computerised weapons systems that are still under development. GAO officials highlighted that hackers can't yet take control over current weapons systems and turn them against the US.
But if these new weapons systems go live, the threat is more than real, GAO said.
Christina Chaplin, one of the GAO employees who participated in putting together the report said that one of the reasons these new computerized weapons systems are so vulnerable to hacks is because, until recently, the DOD didn't prioritise "cyber" as part of the development process, "but it has begun to grasp the magnitude of the problem and taken a way of action".
One way was by instituting better testing procedures, and the second was by setting "cyber" as a focus during the acquisition process of the many components part of these new systems.
The GAO report warns that if the DOD doesn't act on its findings to patch the vulnerabilities its employees discover in their software, then all their internal testing procedures are useless.
The DOD is pretty pants at addressing these flaws, the report said.
For example, one test report indicated that only one of 20 cyber vulnerabilities identified in a previous assessment had been corrected. The test team exploited the same vulnerabilities to gain control of the system. When asked why vulnerabilities had not been addressed, programme officials said they had identified a solution, but for some reason, it had not been implemented. They attributed it to contractor error.
Still, it means that if Russia goes to war with America, Putin does not need more advanced weaponry. He needs hackers who can turn the advanced weaponry back on the Americans.
