Date: Jan 20, 2013 Source: Company Data (
click here to go to the source)
Drones may be at the center of the U.S. campaign to take out "extremists" around the globe. But there's a "pervasive vulnerability" in the robotic aircraft, according to the Pentagon's premier science and technology division - a weakness the drones share with just about every car, medical device and power plant on the planet.
The control algorithms for these crucial machines are written in a fundamentally insecure manner, says Dr. Kathleen Fisher, a Tufts University computer scientist and a program manager at the Defense Advanced Research Projects Agency. There's simply no systematic way for programmers to check for vulnerabilities as they put together the software that runs our drones, our trucks or our pacemakers.
In our homes and our offices, this weakness is only a medium-sized deal: developers can release a patched version of Safari or Microsoft Word whenever they find a hole; anti-virus and intrusion-detection systems can handle many other threats. But updating the control software on a drone means practically re-certifying the entire aircraft. And those security programs often introduce all sorts of new vulnerabilities. "The traditional approaches to security won't work," Fisher tells Danger Room.
Fisher is spearheading a far-flung, $60 million, four-year effort to try to develop a new, secure way of coding - and then run that software on a series of drones and ground robots. It's called High-Assurance Cyber Military Systems, or HACMS.
Drones and other important systems were once considered relatively safe from hack attacks. (They weren't directly connected to the internet, after all.) But that was before viruses started infecting drone cockpits; before the robotic planes began leaking their classified video streams; before malware ordered nuclear centrifuges to self-destruct; before hackers figured out how to remotely access pacemakers and insulin pumps; and before academics figured out how to hijack a car without ever touching the vehicle.
"Many of these systems share a common structure: They have an insecure cyber perimeter, constructed from standard software components, surrounding control systems designed for safety but not for security," Fisher told a group of researchers earlier this year.
It'd be great if someone could simply write some sort of universal software checker that sniffs out any program's potential flaws. One small problem: Such a checker can't exist. As the computer science pioneer Alan Turing showed in 1936, it's impossible to write a program that can tell if another will run forever, given a particular input. That's asking the checker to make a logical contradiction: Stop if you're supposed to run for eternity.
Fisher became fascinated by this so-called "Halting Problem" as soon as she heard about it, in an introduction to programming class at Stanford. "The fact that you can prove something is impossible is such an amazing thing that I wanted to learn more about that domain. That's actually why I became a computer scientist," she says. The instructor for the class was a guy named Steve Fisher. She was interested enough in him that she wound up marrying him after school, and taking his last name.
But while a universal checker is impossible, verifying that a particular program will always work as promised is merely an exceedingly-freakin'-difficult task. One group of researchers in Australia, for example, checked the core of their "microkernel" - the heart of an operating system. It took about 11 person-years to verify the 8,000 lines of code. Fisher is funding researchers at MIT and Yale who hope to speed that process up, as part of one of HACMS' five research pushes.
Once the software is proven to work as advertised, it'll be loaded onto a number of vehicles: Rockwell Collins will supply the drones - namely, small, robotic Arducopters; Boeing will provide a helicopter; Black-I-Robotics will supply a robotic ground vehicle; another firm will provide an SUV.
In another phase of the program, Fisher is bankrolling research into software that can write near-flawless code on its own. The idea is to give the software synthesizer a set of instructions about what a particular program is supposed to do, and then let it come up with the best code for that purpose. Software that writes more software may sound crazy, Fisher says. But Darpa actually has some history of doing it.
"There was a project led here at Darpa a few years ago [to write software for] synthetic aperture radar. They had a non-expert specify [what should go into a synthetic aperture] radar program," Fisher adds. "It took the system about 24 hours to produce an implementation…instead of three months [for the traditional version] and it ran twice as fast. So - better, faster and a lower level of expertise. We hope to see things like that."
You couldn't ask a program to write the equivalent of PowerPoint - it does too many different things. "By the time you've finished the specifications, you might as well have written the implementation," Fisher says. But the software that controls drones and the like? Ironically, that's way more straight-forward. "The control theory about how you do things with brakes and steering wheels, how you take sensor input and convert it to actions is described by very concise laws of mathematics." So synthesized (and secure) software should be possible to produce.
The goal at the end of HACMS is to have the robotic Arducopter running only fully verified or synthesized software. (The other vehicles will have some, but not all, of their "security-critical code" produced this way, Fisher promises.) And if the project works out as Fisher hopes, it could not only help secure today's largely remote-controlled drones. It could make tomorrow's drones fly on their own - without being hacked.
In the remaining component of HACMS, researchers from Galois, Inc. will work on a fully-verified, hack-proof software monitor that can watch a drone's autonomous systems. If those systems operate the robotic aircraft in a normal fashion, the monitor will sit back and do nothing. But if the drone suddenly starts flying itself in some weird way, the monitor will take over, perhaps passing control back to a flesh-and-blood operator.
In other words, a drone won't just be protected from an outside attacker. It'll be protected from itself.
