Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror
×
Security Government News

DARPA Cyber Range Project Doomed to Failure 41

Posted by ScuttleMonkey from the long-way-behind-the-power-curve dept.
carusoj writes "Former black-hat hacker Noah Schiffman details why DARPA's National Cyber Range project is bound to fail. The NCR is proposed as a simulation of the Internet, including replicating 'human behavior and frailties.' Schiffman argues that if the Defense Department is really building something of this scope, it might as well use the actual Internet."
This discussion has been archived. No new comments can be posted.

DARPA Cyber Range Project Doomed to Failure More

DARPA Cyber Range Project Doomed to Failure

Comments Filter:

  • What does "failure" mean though? (Score:5, Insightful)

    by biolysis ( 1303409 ) on Friday June 06, 2008 @06:23PM (#23688509)
    Won't they be learning valuable lessons even if they fail to meet their mission objectives?

    • Re: (Score:2)

      by Xyrus ( 755017 )
      Or to paraphrase from Contact:

      "Why build one internet when you can build two for twice the price."

      ~X~
  • This is the sort of thing for which DARPA built arpanet in the first place. They're probably pretty miffed that they can't use their own testbed because it proved so useful after the fact

    • Re: (Score:1, Funny)

      by Anonymous Coward
      I beg to differ with you on that.

      I took the lead, and went ahead and created the Internet. Now DARPA is trying to rip me off. Luckily the Earth is going to self-combust here in a matter of 12-18 months, so DARPA probably won't have enough time to pull off this dastardly deed.

      - Al

      • Al Gore never said that and Quayle spelt potato according to an archaic, but accepted, variant. I have no clue why this stupid lie makes me angry, except it cost me hundreds of thousands of dollars.

    • DARPA built it to test defending against it? If they hadn't built it, would they still have to test defending against it? And if so, what would they use?
      • I'm sorry, my post was vague. They built it as a testbed to experiment with wide-area networking generally, including discovering vulnerabilities.
  • If I had a simulation of the entire Internet, it'd be all over for me. I mean, there would then be absolutely no reason for me to leave my house. I'd just sit inside all day playing with this simulation of the Internet.

  • By using the actual internet.... (Score:5, Insightful)

    by Hankapobe ( 1290722 ) on Friday June 06, 2008 @06:31PM (#23688597)
    you can't run 'what-if' scenarios and keep certain variables constant.

    On the other hand, by using the internet, the powers that be wouldn't be able to rig or dumb down any tests so that they succeed. Like they did with some of the Star Wars tests. Useful when justifying budgets to Congress.

  • sigh (Score:3, Interesting)

    by wizardforce ( 1005805 ) on Friday June 06, 2008 @06:35PM (#23688637) Journal
    30 billion dollars = 60 million PCs with decent processors to take care of pretty mcuh any cyber war they want.

    • Re: (Score:1)

      by Ox0065 ( 1085977 )
      60,000,000 * 93% = 55,800,000 Windows boxes each groaning under the strain of hundreds of spam bots, virus & spywear.

      They're building a bot-net!

  • I disagree (Score:4, Insightful)

    by WarJolt ( 990309 ) on Friday June 06, 2008 @06:40PM (#23688691)

    In the end, the underlying necessity of this project is an impossibility-the simulation of true human behavior. If this was possible, and one could accurately know and predict online behavior, the acceleration of these calculations would border the lines of predeterminism and precognition. This type of "sci-fi success" would render the creation of the NCR unnecessary, since it would create the ability to anticipate, know, and adequately prepare for all future cyber attacks.
    I don't think the goal is to reproduce human behavior, but reproduce the environment and basic human input. I'd argue that the user is not the cause of most vulernerabilities. Most vulernabilities are flaws with the applications, architectures, systems and protocols themselves. The human factor for most vulnerabilities has already been compiled into applications distributed and is ready for testing. There is already AI that searches for vulnerabilities in systems. This is just looking for it on a massive scale.
    • > Most vulernabilities are flaws with the applications, architectures, systems and protocols themselves.

      Considering that the social engineering attack has been around since society started, as opposed to software and protocol vulnerabilities which are rather recent developments, I'd have to say that I think you're dead wrong (I assume, based on context, that your use of "system" didn't include society).

      This is in addition to the added argument that fixing software or protocol vulnerabilities on a society
  • They (DARPA) Can't test for every outcome at once, but they could and most likely will get valuable information when they test for well defined attacks.

  • I disagree... (Score:5, Interesting)

    by religious freak ( 1005821 ) on Friday June 06, 2008 @06:46PM (#23688759)
    Saying that a simulated Internet for cyberwaarfare (note the new meme!) has no point is like saying a simulated Earth has no point for studying global warming. To effectively study you need controls and variables. Having real controls on the actual Internet is impossible, not to mention the fact you'd be vulnerable to surveillance.

    I also find it interesting to find that people say a realistic simulation is impossible, while in the same breath complaining this project costs too much. $30 Billion obviously won't get you 100% there, but I'll bet it'll get you there with 95% confidence. Yeah, I suppose you could argue that because that 5% exists, the project has no meaning, but any engineering effort has a little slack in it. If history is any indication DARPA should do a fairly good job at managing that risk.

    • Re:Exactly (Score:1, Flamebait)

      by arthurpaliden ( 939626 )
      With a simulation you can always try out various senarios from the same starting condition. Which on the real Internet would be impossible. As to the cost of building said simulator being as the net itself is 'well' documented and is in essence all software then building a simulator should be no problem. It is certianly not a $30B project. Unless of course the Government and its favorite contractors are involved.

  • Bogus analysis - not 30 billion. (Score:5, Insightful)

    by Animats ( 122034 ) on Friday June 06, 2008 @07:21PM (#23689051) Homepage

    Nothing in the solicitation has a $30 billion price tag on it. No idea where that number came from. There are no dollar amounts at this stage; DARPA is soliciting bids.

    What DARPA is asking for is a 10,000 node Internet simulator, and that's in the final phase. The whole system can be started, stopped, and flushed to a clean state for new tests. Users are simulated: "Replicants will simulate physical interaction with device peripherals, such as keyboard and mice. Replicants will drive all common applications on a desktop environments." Attacks on the network are supported; the vendor even has to provide a "malware library".

    The simulated machines have to be simulated at a fine level of detail. "The NCR must be capable of taking a physical computer and rapidly creating a functionally equivalent, logical instance of that machine that can be replicated repeatedly and injected into a testbed. Given a never-before-seen physical computing device, create logical instantiations of the physical native machine that accurately replicates, not only the software on the machine, but hardware to the interrupt level, chipset, and peripheral cards and devices.". That's going to be hard. They may end up with real computers hooked up to peripherals that simulate human inputs. (DoD does this all the time; it's how flight control software is debugged. Serious flight simulators use the real "black boxes" of real aircraft with simulated inputs and outputs.) They need that level of fidelity because they want to observe virus and attack behavior.

    This is going to be a useful asset.

    • Excellent excerpts for us that are too lazy to read for ourselves! Now I'm 100% behind the idea. It's dumb NOT to have this
    • "Replicants will simulate physical interaction with device peripherals, such as keyboard and mice. Replicants will drive all common applications on a desktop environments."

      Replicants are a really bad idea. I mean seriously? Why don't they just activate skynet while they're at it?

  • Chat Attack (Score:3, Funny)

    by vigmeister ( 1112659 ) on Friday June 06, 2008 @07:32PM (#23689145)
    The fundamental cyber attack:

    1) get enemy's AIM s/n and post it on a public chat room with a cute profile picture.
    2) Soon enough all of enemy's supercomputers will be flooded with trillian windows with "a/s/l" and "wanna cyber?" messages
    3) ???
    4) Profit!!!

    Cheers!
  • Other than a stupid name -- both an overlap with NCR (that was supposed to be National Cash Register) company name, and the use of a word "cyber" in a way that suggests a sister project National Yiff Range, and the fact that military and not computer scientists are running it, of course.

    Something has to provide an environment where potential damage from various existing kinds of malware and attacks, and effectiveness of various countermeasures, can be evaluated without waiting for those things to happen in

    • Re: (Score:2)

      by db32 ( 862117 )
      Besides the horrible logical fallicies I don't have a problem with your post...

      "that military and not computer scientists are running it" Since when the hell did military mean not smart...or is this another one of those braindead ultraliberal repeated lies. The military as a whole has never been more educated and has been responsible for some pretty impressive things in the past. Do you understand how utterly moronic it is to say "Well those stupid DARPA guys aren't computer scientists and can't possib

      • "that military and not computer scientists are running it" Since when the hell did military mean not smart...or is this another one of those braindead ultraliberal repeated lies. The military as a whole has never been more educated and has been responsible for some pretty impressive things in the past. Do you understand how utterly moronic it is to say "Well those stupid DARPA guys aren't computer scientists and can't possibly do this". Uhm...they did it once already...remember that real internet thing?

        Actually I am against military running it because military is not the right organization to provide protection against criminals and crooks in the time of peace. "by its nature malware can not specifically target people in particular organizations". Ok...you are obviously not clear as to how the internet came to be or exists today. By all means...go poke around with RIPE and ARIN and tell me if you can't target particular organizations. For fucks sake there are lists all over the net that show specific US

        • The P and GP points of view are not mutualy exclusive, on either major point.
          While I agree with the point of view that law enforcement is a civilian function, the military still need to train for cyberwar, and much of the hardware in use by law enforcement today is a direct result of military reasarch. It seems reasonable to me to conclude that in time this research will provide benefits to law enforcement.
          Also, I think it would be less inflammatory to simply state that in a given attack, as network selec

          • the military still need to train for cyberwar

            There is no "cyberwar". There never was a "cyberwar". There never will be a "cyberwar". What we have now is a bunch of assholes and crooks exploiting idiotic vulnerabilities in systems and procedures that should be never in any way related to anything military, or in any way safety-critical.

            Also, I think it would be less inflammatory to simply state that in a given attack, as network selectivity increases, total population decreases. With experience and various models, a commander should be able to dial in with relative accuracy the impact of a given attack.

            More like, the only way to keep a self-propagating attack running is including systems with lowest of the lowest level of security and users' competence. Exclude them, and you can just as well ping -f your "enemies" fr

            • Re: (Score:2)

              by db32 ( 862117 )
              Right...because the headline stories over the last few months of chinese government sponsored attacks against a multitude of governments is all imaginary right?

      • "that military and not computer scientists are running it" Since when the hell did military mean not smart...or is this another one of those braindead ultraliberal repeated lies. The military as a whole has never been more educated and has been responsible for some pretty impressive things in the past. Do you understand how utterly moronic it is to say "Well those stupid DARPA guys aren't computer scientists and can't possibly do this". Uhm...they did it once already...remember that real internet thing?

        Actually I am against military running it because military is not the right organization to provide protection against criminals and crooks in the time of peace.

        "by its nature malware can not specifically target people in particular organizations". Ok...you are obviously not clear as to how the internet came to be or exists today. By all means...go poke around with RIPE and ARIN and tell me if you can't target particular organizations. For fucks sake there are lists all over the net that show specific US military installations IP ranges.

        Any piece of malware needs hordes of personal computers to run on. So if you write one you have to make it use every opportunity to infect a vulnerable computer, or it will fail to survive. This means, no "but we won't let it run on AMERICAN computers!" stupidity. Not that it would be any less illegal.

        When it comes to targets of DDoS, targeting a

  • Missing the point of DARPA altogether (Score:3, Interesting)

    by Shoten ( 260439 ) on Saturday June 07, 2008 @11:01AM (#23693401)
    The point of research...and that's what DARPA is all about...is pushing the envelope. I was at the DARPA event where potential respondents learned about the desired features and overall nature of the program, and it was extremely ambitious, yes. But in conversations with my peers, it turns out that an enormous amount of the technology to make it happen already exists. Sure, they may not get everything they want, but so what? If they only get half of it...and the lesser half at that...they'll still have something that our country desperately needs, which is a place to test and practice information warfare tactics. The components that exist today, if put together to form an "NCR lite," would still provide immense value, and for that alone, the NCR is bound to be a success. And let me tell you, with the people that were in that room, I would be profoundly surprised if a great deal of innovation did not take place as well.

Slashdot Top Deals

Two can Live as Cheaply as One for Half as Long. -- Howard Kandel

Close