US to withhold F-35 fighter software codes
Join Date: Nov 2000
Posts: 441
Likes: 0
Received 0 Likes
on
0 Posts
as for the magic code which tells aircraft to switch off. really?......really? and how would that work then? Say, if you chose to operate with no active or passive transmission devices?
Virus which reverses control movements
Virus which removes protection from electrical generation systems, causing overheat and probably system shutdown or electrical fire
Virus which kills the FADEC
the list goes on.
The point is all you need is to know how to get around the protection systems (a back door, which almost all software developers create) and you can do what you like.
It may sound far-fetched and Clancy-esque, but it is well within the bounds of current technology.
As has been referred to it's not only not getting what you want but getting things that you don't want. It would not be the first time that hidden memory functions have been installed in warning / ESM systems so that when the hardware is returned for repair, everything you have monitored is downloaded and analysed.
Join Date: Sep 2008
Location: Edinburgh
Posts: 43
Likes: 0
Received 0 Likes
on
0 Posts
Confession - I've spent over twenty years as a software engineer; over a decade of that was developing avionics software for fighter radars.
Except that we're not talking about civilian programming environments here, we're talking about hard-real-time embedded systems programming, in a multiprocessor environment...
If one process decides to become a cycle-intensive resource hog, lower-priority tasks can suddenly find themselves starved of resource. It all depends on how close to the edge you're running; e.g. "income a pound, expenditure 99p = happiness; expenditure 101p = misery". Typically the contract specifies a healthy margin at the start, but these things can get eaten up over time.
For instance - Tranche 1 Typhoon is running software written in C and assembler, delivered late 90s / early 00s, designed early 90s, running on processors that were bleeding edge back then, but unbelievably slow now. To fit the algorithms into the space and time available meant some fairly intense optimisation (and I mean that in the sense that the difference between unoptimised and "the best the that rather good optimising C compiler could manage" got us a 3% speedup).
We tried to generate object oriented, reusable, loosely coupled, encapsulated code - but didn't always manage it.
Meanwhile, do a search on "priority inversion" and "Mars Rover"...
Wow, you must think that life's like 24, and it just takes a few keystrokes to break into a system and subvert it.
No, software developers don't "almost always" create back doors. I've certainly never done it, but then I've specialised in embedded systems for most of my twenty years. Most "back doors" are just default passwords that incompetent managers forget to change, or passwords that morons write down or give out. The rest are mostly just unpublished APIs used for test purposes; e.g. command-line options that don't get into the user documentation (e.g. a Hi-fi firm I worked for used shift-F12 to switch on debug mode in its software installation tool; it gave you more of an insight into what was going on, but was hardly "God mode"). Another example are "cheats" for games software - if you want to test a particular feature in the game by running through it multiple times, you don't want to have to force the tester to take half-an-hour of play between each run of the test.
The delights of embedded systems with cycle periods of a few milliseconds (such as EW or radar systems which sample well into the kHz, over bandwidths well into the MHz) is that the million-to-one coincidence data set generally turns up in the first few minutes. You don't program in mysterious back doors based on funny codes, because nature has the nasty habit of generating just the wrong sequence of numbers. You don't allow mysterious program update mechanisms, because you don't want the bloke on the flight line to magically uninstall radar software v1.1, and it is assumed that if you want to carry out a software update, removing the LRI and connecting to it with a damn great 50-pin connector is not unreasonable. You don't have "unpublicised user accounts with admin privilege", because there aren't any user accounts. Up until the late 1990s, it was unlikely that there was even an operating system.
So: no, I don't think that there's a magic "disable the system" back door built in to the software. If one were needed, it would have to be a contracted and specified requirement on the system - kind of hard to keep secret. One hint, and you get into all sorts of billion-dollar contractual obligations, let alone the diplomatic issues.
For instance - do you think that the US has a "back door" built into the UK strategic deterrent control software? Or not?
Originally Posted by Jofm5
Encapsulation in this manner has added benefits in that should you change anything to do with the rudder you need only perform the extensive tests on the rudder classes to check the input and output parameters. If the test harness for the rudder class passes all parameters it should not have any impact on the overall software environment however it is not uncommon for full regression tests to be performed. <nice explanation, but minor nit: try object oriented, not orientated. You'll be mentioning transportation next 
>
>If one process decides to become a cycle-intensive resource hog, lower-priority tasks can suddenly find themselves starved of resource. It all depends on how close to the edge you're running; e.g. "income a pound, expenditure 99p = happiness; expenditure 101p = misery". Typically the contract specifies a healthy margin at the start, but these things can get eaten up over time.
For instance - Tranche 1 Typhoon is running software written in C and assembler, delivered late 90s / early 00s, designed early 90s, running on processors that were bleeding edge back then, but unbelievably slow now. To fit the algorithms into the space and time available meant some fairly intense optimisation (and I mean that in the sense that the difference between unoptimised and "the best the that rather good optimising C compiler could manage" got us a 3% speedup).
We tried to generate object oriented, reusable, loosely coupled, encapsulated code - but didn't always manage it.
Meanwhile, do a search on "priority inversion" and "Mars Rover"...
Originally Posted by PTT
The point is all you need is to know how to get around the protection systems (a back door, which almost all software developers create) and you can do what you like
No, software developers don't "almost always" create back doors. I've certainly never done it, but then I've specialised in embedded systems for most of my twenty years. Most "back doors" are just default passwords that incompetent managers forget to change, or passwords that morons write down or give out. The rest are mostly just unpublished APIs used for test purposes; e.g. command-line options that don't get into the user documentation (e.g. a Hi-fi firm I worked for used shift-F12 to switch on debug mode in its software installation tool; it gave you more of an insight into what was going on, but was hardly "God mode"). Another example are "cheats" for games software - if you want to test a particular feature in the game by running through it multiple times, you don't want to have to force the tester to take half-an-hour of play between each run of the test.
The delights of embedded systems with cycle periods of a few milliseconds (such as EW or radar systems which sample well into the kHz, over bandwidths well into the MHz) is that the million-to-one coincidence data set generally turns up in the first few minutes. You don't program in mysterious back doors based on funny codes, because nature has the nasty habit of generating just the wrong sequence of numbers. You don't allow mysterious program update mechanisms, because you don't want the bloke on the flight line to magically uninstall radar software v1.1, and it is assumed that if you want to carry out a software update, removing the LRI and connecting to it with a damn great 50-pin connector is not unreasonable. You don't have "unpublicised user accounts with admin privilege", because there aren't any user accounts. Up until the late 1990s, it was unlikely that there was even an operating system.
So: no, I don't think that there's a magic "disable the system" back door built in to the software. If one were needed, it would have to be a contracted and specified requirement on the system - kind of hard to keep secret. One hint, and you get into all sorts of billion-dollar contractual obligations, let alone the diplomatic issues.
For instance - do you think that the US has a "back door" built into the UK strategic deterrent control software? Or not?
Last edited by Gravelbelly; 1st Dec 2009 at 21:59. Reason: Added links
Join Date: Nov 2000
Posts: 441
Likes: 0
Received 0 Likes
on
0 Posts
Gravelbelly - no, I don't think life's like 24 
Herc asked for the how's and I provided hypotheticals. Yes, there are other considerations, but "back door" is a generally-known public term which painted the appropriate picture. The actual method of opening said orifice will vary, and nobody suggested that sending the word "Rosebud" to the jet will shut it down. APIs were something akin to what I am talking about, and perfectly reasonable as an access method for your "God-mode".
As to whether I think such a thing exists, probably not, but I didn't suggest otherwise in my previous post, did I? Perhaps try reading a post for what it is (a hypothetical response to a hypothetical question) instead of wading in with your "I'm so well informed" size 9's and trying to out-gabble everyone present
Herc asked for the how's and I provided hypotheticals. Yes, there are other considerations, but "back door" is a generally-known public term which painted the appropriate picture. The actual method of opening said orifice will vary, and nobody suggested that sending the word "Rosebud" to the jet will shut it down. APIs were something akin to what I am talking about, and perfectly reasonable as an access method for your "God-mode".
As to whether I think such a thing exists, probably not, but I didn't suggest otherwise in my previous post, did I? Perhaps try reading a post for what it is (a hypothetical response to a hypothetical question) instead of wading in with your "I'm so well informed" size 9's and trying to out-gabble everyone present
Last edited by PTT; 1st Dec 2009 at 21:26.
Join Date: Mar 2000
Location: a state of confusion
Age: 54
Posts: 6
Likes: 0
Received 0 Likes
on
0 Posts
Thank goodness the press is always right...
I think that about says it all...there's been lots of boo-hooing based on an article that may or may not be enitreley accurate, spun to achieve a certain message, or just plain bollocks. Most of you reading this will have been in a position to "know" at some point in your career and will have read something you knew was patently false in the press but that struck great, anguish-filled chords in the editorial pages (or, dare I say, the blogosphere). At that point, you probably rolled your eyes and commented to your co-workers about the press adn those who believe them. I guess I'd just question how factual the statements we're using to castigate our allies are?
I will say it has been fun reading the thread, though...very impressive that folks have lost all credibility along the way!
I will say it has been fun reading the thread, though...very impressive that folks have lost all credibility along the way!
Join Date: Sep 2008
Location: Edinburgh
Posts: 43
Likes: 0
Received 0 Likes
on
0 Posts
Originally Posted by PTT"
Perhaps reading a post for what it is (a hypothetical response to a hypothetical question) instead of wading in with your "I'm so well informed" size 9's
Originally Posted by PTT"
The point is all you need is to know how to get around the protection systems (a back door, which almost all software developers create) andyou can do what you like
Tell you what, I'll add links to the more jargon-laced parts of the post
Join Date: Nov 2000
Posts: 441
Likes: 0
Received 0 Likes
on
0 Posts
In a spirit of fairness, I could make a slightly plausible but somewhat inaccurate assertion in a confident tone, you can knock it down comprehensively, I'll claim that I only included it as a hypothetical, and we'll be even.
Apart from that this is in danger of being both off-topic and getting personal.
Join Date: Mar 2008
Location: In the middle of the sea
Posts: 24
Likes: 0
Received 0 Likes
on
0 Posts
Erm ladies... let me interupt this "mines bigger than yours" agruement by adding, before it all ends in tears:
"JSF is progressing well and the UK currently has the JSF data needed at this stage of the programme, and is confident that in future we will continue to receive the data needed to ensure that our requirements for Operational Sovereignty will be met.
This remains the basis of the agreements reached with the US in 2006. " -
Source: UK Ministry of Defence; issued Dec. 1, 2009
"JSF is progressing well and the UK currently has the JSF data needed at this stage of the programme, and is confident that in future we will continue to receive the data needed to ensure that our requirements for Operational Sovereignty will be met.
This remains the basis of the agreements reached with the US in 2006. " -
Source: UK Ministry of Defence; issued Dec. 1, 2009
