Navy takes delivery on super-destroyer, pushes up schedule for LCS “frigate”

With order slashed, last 14 LCS ships will be “stretch” versions.

On May 20, the US Navy took delivery of the USS Zumwalt (DDG-1000), the first of a class of destroyers designed to take on the role once served by battleships. As the Navy prepares to commission the $22 billion Zumwalt, the service is accelerating its plans to produce 14 smaller ships—frigates that were ordered to be built by the Pentagon instead of the last set of the Navy's Littoral Combat Ships.

The LCS program has experienced a number of glitches over its lifetime—canceled weapons systems, mine-hunting systems that can't pass acceptance tests, failures of gears aboard two ships that left them stranded, and the realization that no one asked for hull corrosion protection on one variant.

The biggest problem the LCS faces, however, is that its capabilities that do work match up against a very specific class of adversary: something on the level of 1990s-era Iranian Revolutionary Guard Navy patrol boats and suicide speedboats. And with the rise of China's blue-water navy and the growing tensions over claims in the South China Sea, the LCS is facing missions where the threat will be beyond its current capabilities.

Read 9 remaining paragraphs | Comments

Dronebuster will let you point and shoot command hacks at pesky drones

Not exactly a jammer, the “gun” exploits library of drone control protocols.

NATIONAL HARBOR, Maryland—Anti-drone technology has been high on the shopping list of public safety and military organizations at least since a drunken federal employee crashed a drone onto the White House lawn. Two companies on hand at the Navy League Sea Air Space Exposition here this week had two slightly different approaches to the problem. One anti-drone device has already been deployed in the hands of federal law enforcement and the military, and a "street legal" version may be coming soon.

The drone "killer" getting the most attention at Sea Air Space was the DroneDefender, a system developed by researchers at the nonprofit research and development organization Battelle. DroneDefender is a two-pronged drone jammer—it can disrupt command-and-control signals from a remote operator or disrupt automatic GPS or GLONASS guidance, depending on which of the devices' two triggers is pulled.

Powered by a small backpack, DroneDefender looks like some futuristic over-under, radio-frequency shotgun-grenade launcher. Targeted through a simple optical sight, the device has a range of about 400 meters. Battelle calls it a "directed RF energy weapon"—it sends out a jamming signal in the Industrial, Scientific and Medical (ISM) bands or global positioning bands in a 30-degree cone around the point of aim.

Read 4 remaining paragraphs | Comments

Ars climbs aboard the Stiletto, DOD’s stealthy, high-speed lab at sea

Run by the Navy, the Stiletto now gives companies a place to test their gear at sea.

NATIONAL HARBOR, Md.—At this week's Navy League Sea-Air-Space exposition (an annual seapower conference and trade show for the Navy, Marines, and Coast Guard) Ars got a chance to board and tour a craft called the Stiletto. The Stilleto is prototype boat built for the Navy in 2006 that has become the military's on-call floating laboratory for rapid research and development of new sensors, weapons systems, and communications. With a carbon fiber hull, the Stiletto is light enough (45 tons, unloaded) to be craned onto a cargo ship for transport—but it can also carry 20 tons of cargo and tear through most sea states at high speeds.

Now operating from Joint Expeditionary Base Little Creek near Norfolk, Virginia, the Stiletto was originally intended to be part of a new Navy combat concept—groups of small, highly networked boats carrying sensors and weapons and working as a group to take on enemies in coastal, river, and shallow ocean waters. Built with special operations in mind, the Stiletto has a stealthy profile and a unique pentamaran hull that essentially acts as a surface effect hull at high speeds, allowing the craft to rise out of the water and reach speeds of 60 knots (69 miles an hour, or 110 kilometers per hour).

After being used in several exercises in the mid-2000s, the Stiletto was deployed to the Caribbean for counter-narcotics operations in 2008 with a joint Navy-Coast Guard team. Since then, it has served as a "maritime demonstration craft" operated by the Naval Surface Warfare Center Carderock, Combatant Craft Division. But it is funded directly by the Department of Defense's Office of Research, Test, Development and Evaluation (RDT&E). (Full disclosure: my last tour of service in the Navy was with "special boats," so the Stiletto is my 1990 self's technological dream.)

Read 1 remaining paragraphs | Comments

Who put this JavaScript in my COBOL? Node.cobol, that’s who

Developer of COBOL plugin for Node.js completes the circle.

An example of Node.js code that launches a Web server and creates ASCII art from a JPEG image being executed from within COBOL code. Because we can. (credit: Bizău Ionică)

Last August, we told you about a project posted on GitHub by Romanian software developer Bizău Ionică that makes it possible for snips of legacy COBOL code to run within the JavaScript code of the popular Node.js interpreter. There's more than a little irony in this project. COBOL, the mother of all cross-platform programming languages, is still in use 62 years after it was first published, mostly in legacy applications that no one cares about or dares to retire. Grabbing snippets of code to run in Node.js—one of the most popular languages to develop networked software today—could be seen as a way to pull old code into the 21st century.

Ionică has now completed the circle with a software bridge that can execute Node.js script from within COBOL programs. It’s called node.cobol, and it compiles with GNU COBOL, though it still requires Node.js be installed on the same machine the code runs on. This is really helpful if you want to, say, run a Web server from within COBOL code.

Would you really want to run a Web server within COBOL? I don't know. But now you can:

Read 2 remaining paragraphs | Comments

Space Belt promises to solve all your cloud security problems with space lasers

Want a really secure cloud? Cloud Constellation is putting one in space.

An artist's rendering of the orbital rings of Space Belt—a private data network built on laser-linked satellites set to start launching next year.

Cloud service providers frequently tout the physical security of their data centers. But Scott Sobhani's company is getting ready to launch what is perhaps the most physically secure cloud platform ever (literally). Sobhani is CEO and co-founder of Cloud Constellation Corporation, the company behind Space Belt—a network of communication, compute, and data storage satellites that is aiming to provide more than an exabyte of storage in orbit by 2025.

Led by a team of satellite industry and cloud computing veterans, Cloud Constellation launched three years ago in "stealth mode" to find a way to provide customers—particularly government and international enterprises—with a really secure and highly available global cloud.

"You can clearly see that today's Internet and other systems that are supporting cloud operations and cloud storage are very leaky and very prone to cyber attack at every junction as well as delays," Sobhani told Ars. "The information superhighway is very enabling, but it is also very risky, and IT directors and CIOs are subject to a lot of pressure and loss of sleep at night over all the issues that can happen, because what they buy today to [secure their systems] may not be adequate for the future."

Read 16 remaining paragraphs | Comments

Hacker fans give Mr. Robot website free security checkup

Days after USA Network patches XSS bug, hacker finds a way to inject SQL code.

Some of the code behind the new Mr. Robot website. (credit: NBC Universal)

The USA Network show Mr. Robot has drawn a good deal of praise for its accurate (relative to other TV shows) portrayal of hacking and computer security. So, naturally, the site for the show has drawn a slightly different sort of adoring fan—"white hat" hackers looking for security holes.

On May 10, USA Network launched a new site for Mr. Robot promoting the July debut of the series' second season—a JavaScript-powered page that uses text input and mimics a Linux shell (complete with a GRUB bootup message). On the same day, as Forbes' Thomas Fox-Brewster reported, a hacker operating under the name Zemnmez reported a cross-site scripting (XSS) vulnerability in the Mr. Robot site that could have been used to trick visitors to the site into giving up their Facebook profile data. Zenmez sent an e-mail about the vulnerability to Mr. Robot writer Sam Esmail; within a few hours, according to NBC Universal (USA Network's corporate parent), the vulnerability was removed.

News of the vulnerability apparently piqued the interest of other hackers in the show's fanbase. On May 13, another "white hat" hacker who calls himself corenumb poked around the site's e-mail registration code and found that the PHP code behind it was vulnerable to a type of attack called blind SQL injection—an attack that embeds SQL commands into text sent to a website, bypassing error messages that would normally block those attacks. The vulnerability would have allowed a malicious attacker to execute SQL commands against the database used for the show's e-mail list. Corenumb was able to retrieve information about the backend database and the server it runs on using SQLmap, an open source penetration testing toolkit used specifically for checking for SQL injection vulnerabilities.

Read 1 remaining paragraphs | Comments

By mapping the skies, AirMap app paves the way to a drone-filled future

Amazon pushes for federated skies; AirMap gives drone owners a direct line to the tower.

The problem with being a safety-conscious, responsible drone operator is that it's much easier to actually fly the drone than it is to comply with Federal Aviation Administration (FAA) rules. If we're ever going to have instant Amazon Prime Air deliveries, Domino's Pizza drones, and other flying robot helpers, complying with those rules needs to get easier—it also needs to get automated.

At the recent Association for Unmanned Vehicle Systems International (AUVSI) Xponential conference in New Orleans, Amazon Prime Air Vice President Gur Kimchi outlined Amazon's vision for how that might look. Kimchi and Amazon propose an approach that uses "federated" traffic control—the sharing of information between air traffic control systems, operators, and drones themselves to enable a safer yet more crowded sky. The groundwork for such a system is already being laid—in part thanks to software developed by a Santa Monica, California, company called AirMap.

AirMap has released an application for Apple iOS that could make drone operations safer by directly connecting drone operators to airport operators and air traffic controllers. The app is built atop an Internet application interface that is also being used by drone manufacturers like DJI, 3D Robotics, Yuneec, and the commercial and military small UAS manufacturer Aeryon Labs. This setup allows users to integrate the same services directly into the software used to fly drones.

AirMap has already brought 75 airports onboard with the application, which gives airport managers a "dashboard" from which they can grant or withhold permission to fly and set specific automated policies for certain areas near their airports. Eventually, the software will let drone operators see each other as well as data about crewed aircraft on courses that might conflict.

The drone phone tree

Today, if you want to fly a drone in compliance with FAA rules, it's relatively easy—that is, as long as you're flying far from civilization, in visual line of sight, below controlled airspace, and nowhere above people or cars. Fly one anywhere else, and things get complicated.

Odds are that there's an FAA-designated airfield near you, whether it's an actual airport or the helipad at a local hospital. "In 2012," explained AirMap CEO and co-founder Ben Marcus, "congress passed a law—Section 336 of the FAA Modernization and Reform Act—which requires recreational operators of drones to give notice to airports and air traffic control when flying within five miles of an airport. So to give notice, you would pick up a telephone or knock on the airport manager's door and say, 'Hey, I'm going to fly over the 7-Eleven down the street.'"

Technically, the regulations apply even if you're flying a kite. (By the way, if you're flying your kite more than 150 feet up without proper lighting, this is also an FAA rule violation). At the park near my house, that means contacting 10 different entities—seven hospitals, a city water filtration plant, city police headquarters, and a hotel that occasionally allows helicopters to land on the roof of its parking garage. I know this mostly because of an "app" released by the FAA earlier this year called B4UFLY, intended to help drone owners become aware of things like temporary flight restrictions and the restricted airspace near airports. But B4UFLY doesn’t provide any way for would-be drone pilots to reach airports to get permission (not even phone numbers). All the app gives is a latitude and longitude for the location of the airports nearby.

The current system of contacting airports also ignores another important part of drone safety. While the FAA's air traffic control system may eventually provide data to other organizations, "in the interim there's a whole lot of other public safety entities that have an interest in drone safety," Marcus explained. He's not just referring to airports, but local police and other organizations need to be aware of what's in the air, who's flying it, and where it's flying. Currently there's also no easy way for drone operators to know when there's a change in the situation while they're flying—such as an emergency service helicopter barreling into their flight path.

So while the FAA's B4UFLY app and the collaborative program with AUVSI and the Academy of Model Aeronautics (AMA) that spawned it are giving drone operators some very basic information, they're not exactly making the skies safe on their own. Drone safety, Marcus said, "starts with awareness for operators—giving them something that's easy to understand about where they can and can't fly safely, that's dynamic. It's similar to the B4UFLY concept, but we asked, 'How do we make that really useful?' That's how we started… we decided to look at how we go about building a safe and efficient operating environment for drones. The first element of that is awareness. And it's not just about how you display things on a map, but how you get that information into the hands of the operator."

There's an app (and an API) for that

The AirMap iOS application is available on iPhones and also has an Apple Watch add-on. It allows a drone pilot to create a profile, including a "library" of aircraft and contact information, to be used to send notifications of flights. The app collects geolocation data, gives a color-coded message about flight restrictions, and offers the drone pilot the ability to notify airports within five miles of flight plans simply through a tap on the screen.

more images in gallery

Everything that's in AirMap's iOS app is also available in the AirMap application programming interface and software developer kit. The goal, Marcus said, is that "you don't need to open another app—you can see the information with the app you're already using to fly your drone. So if you attempt to take off within five miles of an airport, you get a pop-up message asking if you'd like to provide notice."

AirMap's app for iOS.

On the other end, airport operations centers can plug into the AirMap system, called the Digital Notice and Awareness System (D-NAS). These groups will use a "dashboard" application that allows them to see all of the notifications within their operating area. "We launched that program with the American Association of Airport Executives recently," Marcus said. In total, 75 airports signed up as of the first week of May—and more are in the pipeline. The airports already using the system include Los Angeles International, Houston George Bush Intercontinental, Denver International, and a host of regional and small airports. "We're also trying to figure out how to make the dashboard useful for heliports as well—more for the helicopter pilots who are landing than for a tower," Marcus added.

more images in gallery

The dashboard gives airport operators "a realtime map of where notices have been provided" by drone pilots, Marcus explained. "They can also, as the airport operator, click on any of those flights to get information on the type of drone and the altitude it's flying at, and [they] can send an SMS message to the operator from the dash." That SMS message can be manually typed in or automated.

Additionally, the dashboard allows airport managers to set geo-fence-based rules that can automatically set an area as more permissive of drone flights or explicitly exclude drones from flying in the area (such as the approach paths being used for landing aircraft). On the drone operator side, that means the SMS messages approving flying can be used as a handy way to show police that, yes, they have permission to be flying.

Within the next month, AirMap will add traffic alerts to the iOS app and the API. These alerts are based on aircraft transponder data and other sources, and they will warn drone operators of aircraft that are coming into the airspace they're using. For airports and helipads currently not enrolled in the service, AirMap pulls contact data (including phone numbers) from the FAA's database—ironically, something the FAA neglected to do with its own app.

While AirMap has partnered with specific drone manufacturers, the API is available to anyone building their own drone. The iOS application (which will be followed shortly by an Android app) is intended largely to demonstrate the features of the API—which includes map tiling and other geo-spatial data independent of what's built into iOS or Android, Marcus said. "The second reason is so that we can allow people who do not have a drone built by one of these manufacturers to also participate in the system—if you're building a drone in your garage or flying something rudimentary, maybe even without GPS—you can still participate with the digital notice."

In robots we trust

While the AirMap app addresses operations within line of sight, future drones flying autonomously will need a whole additional layer of communication to operate safely. In particular, these devices will need drone-to-drone communication to help "deconflict" any potential collisions in more crowded skies. Again, Kimchi outlined Amazon's proposal for how this would work—a system in which services like AirMap would be part of a larger "federated" traffic control system, providing both rules for general drone traffic flow and automated alerts and responses to potentially dangerous situations.

These sorts of federated services are something Internet service developers like Amazon are already familiar with. But such setups are currently far outside the FAA's comfort zone, and this would require a cultural change in how the aviation industry views automation.

Kimchi remarked on the irony of how the aviation industry currently uses autopilots to land aircraft in foggy conditions when pilots can't see the runway, yet they don't trust the systems in good weather when the risk is lower. "We already trust the automation in the worst possible conditions, why don’t we trust it the rest of the time?” he told the AUVSI conference crowd. So when drones can both sense and avoid hazards and share data amongst themselves about such hazards, organizations like AirMap and Amazon believe UAVs will be able to fly safely in public airspace—doing so in much greater numbers.

Chinese ARM vendor left developer backdoor in kernel for Android, “Pi” devices

Allwinner’s ARM Linux kernel includes “rootmydevice” code that gives apps root.

(credit: Blakegripling ph)

Allwinner, a Chinese system-on-a-chip company that makes the processor used in many low-cost Android tablets, set-top boxes, ARM-based PCs, and other devices, apparently shipped a version of its Linux kernel with a ridiculously easy-to-use backdoor built in. All any code needs to do to gain root access is send the text "rootmydevice" to an undocumented debugging process.

The backdoor code may have inadvertently been left in the kernel after developers completed debugging. But the company has been less than transparent about it: information about the backdoor was released and then apparently deleted through Allwinner's own Github account. The kernel, linux-3.4-sunxi, which was originally developed to support Android on Allwinner's ARM processors for tablets, has also been used to develop a community version. The kernel was also the basis for porting over various versions of Linux to Allwinner's processors, which are used in the Orange Pi and Banana Pi micro-PCs (developer boards compatible with Raspberry Pi) along with a number of other devices.

The way Allwinner has distributed its Linux kernel has been frustrating to many developers. The company has not encouraged or participated in community development and has been accused of numerous violations of the GPL license for the Linux kernel. The kernel "drops" by Allwinner include a number of binaries that are essentially closed source, as well as code released under other licenses—largely to support the graphics engines of its processors.

Read on Ars Technica | Comments

Checking in with spear phishing, criminals check out with hotel credit card data

Criminals specializing in hacking hotel point-of-sale systems breeze past security.

You can check out any time you want, and so can card-data stealing criminals. (credit: Novotel Century Hong Kong Hotel)

Hotel chains focus on hospitality, but their security practices have made them entirely too hospitable a target for data theft. Hotels have been brutalized over the past year by a wave of point-of-sale system breaches that have exposed hundreds of thousands of guests' credit card accounts. And those attacks, as a recent episode described by Panda Security's Luis Corrons demonstrates, have become increasingly targeted—in some cases using "spear-phishing" e-mails and malware crafted specifically for the target to gain access to hotels' networks.

In one incident that was uncovered recently, the target "was a small luxury hotel chain," Corrons told Ars. "We discovered the attack, and it was really customized for the specific hotel. This was 100 percent tailored to the specific target."

The attackers used a Word document from the hotel itself—one frequently used by the hotel to allow customers to authorize credit card charges in advance of a stay. The document was actually enclosed as part of a self-extracting file, which also installed two other files on the target machine—one of them an installer for backdoor malware named "adobeUpd.dll" to disguise it and the other a Windows .cmd batch script that both opens the Word document and launches the backdoor.

Read 5 remaining paragraphs | Comments

The internet of flying, floating, and rolling things takes center ring at “unmanned” expo

At the “drone prom,” robots that fly, roll, and swim get a chance to dance.

NEW ORLEANS—If you need evidence that drones are big business, the Association for Unmanned Vehicle Systems International (AUVSI) XPonential conference is a good start. The event, in its previous incarnation, filled a much more modest space in Washington DC three years ago, and was much more defense-focused. But this week's event, filling four of the vast halls of the Ernest N. Morial Convention Center here on the bank of the Mississippi River, had the trappings of a big tech conference. Keynotes were supplied by Amazon vice president Gur Kimchi and Cisco's retired CEO John Chambers (complete with the requisite "hockey stick" growth slides), while vendors hawked cloud platforms and professional services alongside the expected collection of flying, swimming, rolling, and crawling robots.

The cloud connection to drones is gaining increasing attention because of the massive amount of data that uncrewed vehicles collect. Optical and multi-spectral imagery, 3D laser mapping, and any number of other geospatial datapoints acquired in ever-increasing resolution have to be stored, processed, and routed to the people who need them. Representatives from oil and gas companies, utilities, insurers, civil engineers, and a host of other industries stalked the floor at Xponential in search of systems that would let them inspect assets from a distance.

But because of current Federal Aviation Administration regulations, only a few of those industries have begun using uncrewed vehicles. One of the most well-established applications of drones outside the military is "precision agriculture," in which UAVs equipped with near-infrared and other sensors detect problems with crop health in high resolution. This data is subsequently used by automated, GPS-controlled chemical applicators. But while drones have been used in precision agriculture in Japan and other countries for over a decade, many US farmers who currently use drones to pinpoint where crops need to be fed or sprayed are "cowboys," as one drone manufacturer described them—not because they raise cattle, but because they flaunt the FAA's rules.

Read 2 remaining paragraphs | Comments