[Scotland] Navy battle software unsafe

Risks Digest (original source: Sunday Herald, Peter MacKay) ^ | October 12, 2004 | Peter G. Neumann

[George Smiley]

Navy battle software unsafe

<"Peter G. Neumann" <Redacted for his sake...GS>>

Tue, 12 Oct 2004 09:02:47 -0400

[Source: Article by Neil Mackay, Investigations Editor, *Sunday Herald* (Scotland), 10 Oct 2004]

The Royal Navy's new, state-of-the-art destroyer has been fitted with combat management software that can be hacked into, crashes easily and is vulnerable to viruses, according to one of the system's designers who was fired after raising his concerns.

Gerald Wilson, who has 25 years' experience designing naval software, worked for Alenia Marconi Systems (AMS) in a joint venture with Bae Systems and the Italian company Finmeccanica on the combat system for the Type 45 destroyer, which will rely on Microsoft Windows 2000. System failure in action, he says, would leave the ship blind, defenceless, and as good as sunk.

Dismissed after voicing his fears to the Ministry of Defence and the Defence Procurement Agency (DPA), Wilson wants to give evidence to the parliamentary defence select committee about the software.

Last night he told Channel 4 news that "the use of Windows For Warships puts the ship and her crew at risk, and the defence of the realm".

There are also plans to install a similar Microsoft Windows-based computerised command system on Britain's nuclear submarines. Wilson said: "It is inconceivable that we could allow the possible accidental release of nuclear missiles. The people who survived such an exchange, if any, would certainly regard such a thing as a crime against humanity. And I can't help feeling that even planning to deploy such systems on Windows, with its unreliability and lack of security, is itself some sort of crime in international law."

Windows was chosen by AMS in order to cut costs, as the DPA has been encouraging a switch to off-the-shelf systems. Wilson says the Navy should stick to its current operating system, Unix, which is said to be more reliable. Designers can also customise Unix, which would allow unnecessary components to be removed to reduce risk.

A navy spokesman said: "Bae Systems, as the prime contractor for the Type 45, is responsible for ensuring that the warship meets the requirements placed on it by the DPA. Using Microsoft Windows within combat management systems was the subject of an independent review commissioned some while ago by the DPA. "The review found a proper engineering approach had been taken, both from a security perspective, as the system middleware isolated Windows from the remainder of the mission-critical systems, and from a safety perspective.

Comprehensive hardware mechanisms will be put in place where necessary to avoid any potential Windows-derived compromises. "We are satisfied that the solution recommended by the contractor will meet our requirements, as it has been subject to an independent review. This review was conducted by a team at the DPA who are independent of the Type 45 team."

[null and void]

Windows.

*sigh*

Don't our Aegis class destroyers use Windows NT?

[Knitebane]

Yep. The USS Gettysburg became stranded and had to be towed in when a database error crashed the Windows OS, bringing down the entire network.

When will they learn? You want a hardened real-time OS for mission critial work, and Windows aint it.

[ProudVet77]

NT 4.0 Workstation SP6(?) would be a good candidate. Quite stable, no more updates to cause problems, and used a lot less memory and had a lot less overhead.

[Castlebar]

How well will any operating system survive a torpedo or mine hit (or cruise missile strike?) That's what matters.

[Knitebane]

And no longer supported by Microsoft.

Ask them for a patch and they will tell you to upgrade to XP Pro.

[ProudVet77]

It's more like how well will any operating system help prevent torpedo or mine hit (or cruise missile strike?).

[Senior Disinterested Observer]

Winner of the 2001 Bulwer-Lytton Contest:

Winner: Science Fiction

Kirk's mind raced as he quickly assessed his situation: the shields were down, the warp drive and impulse engines were dead, life support was failing fast, and the Enterprise was plummeting out of control toward the surface of Epsilon VI and, as Scotty and Spock searched frantically through the manuals trying to find a way to save them all, Kirk vowed, as he stared at the solid blue image filling the main view screen, that never again would he allow a Microsoft operating system to control his ship. Mike Rottmann Reno, Nevada

[amigatec]

There are also plans to install a similar Microsoft Windows-based computerised command system on Britain's nuclear submarines. Wilson said: "It is inconceivable that we could allow the possible accidental release of nuclear missiles. The people who survived such an exchange, if any, would certainly regard such a thing as a crime against humanity. And I can't help feeling that even planning to deploy such systems on Windows, with its unreliability and lack of security, is itself some sort of crime in international law."

Gee I feel safer already....

[George Smiley]

How about an airborne 20-node cluster?

Here is an example of a leading-edge application based on an operating system that's over 25 eyars old:

Why?

1. it's secure, and

2. it works (It would really suck to get a Blue Screen of Death at 20,000 feet...)

[ProudVet77]

That's why I mentioned it was safe from any upgrades :)
Actually someone should buy the source for NT and trim the garbage in it out, and improve heap memory control and garbage collection and you'd have a nice little operating system.
I've had and worked with everything from windows 98 on, both as developer and operations engineer, and XP is their biggest failure in my book (well except maybe for Windows ME). Huge disappointment to me. I prefer W2003 to it. Much more stable.

[Knitebane]

OpenVMS and the DEC...er....Compaq....er....HP Alpha are both no longer available.

I was thinking more along the lines of QNX or WindRiverOS.

I particularly like WR. Hey, if it can run a vehicle 100 million miles away, it's probably good enough for one you're riding on.

[Knitebane]

Actually someone should buy the source for NT and trim the garbage in it out,...

Great. That should only take a few dozen years.

No version of Windows is ready for mission critical operations. A real-time OS is a better bet.

[detsaoT]

I think they switched to Solaris after the first cruise went bad. ;)

[lelio]

Windows was chosen by AMS in order to cut costs, as the DPA has been encouraging a switch to off-the-shelf systems.

First off, is that such a good idea to cut cost in your central nervous system?

Secondly, is it really cheaper in a monetary sense? How much money have they wasted debugging their crashes? (re: the recent LA airport problem was due to someone not manually rebooting their IIS servers after a month of uptime).

And thirdly, linux is free and is easily extendable. But for the military they should probably stick with Solaris and have the backing of a billion dollar company behind the OS.

[ProudVet77]

You have no idea how sad that makes me. I spent 12 years in Hudson MA working for Digital at the semi conductor plant there. The Alpha was years ahead of everything. It was 64 bits, with 128 bit registers and quad piplelines, when Intel was barely 32 bits. And OpenVMS was running on Alphas on the biggest Cray computers at the time. 1024 Alphas cranking it up. Not only fast but VMS was virtually bulletproof. I heard of a server in spitbrook that had kind of been forgotten about and it was still running version 4.x of VMS after 12 years of uptime. They had UPS and it just kept on ticking.
Now Intel owns the plant in Hudson and have recently gotten all the Alpha engineers back from HP. Intel should never have been allowed to buy Digital Semi. Talk about a constraint of trade. They wanted the Alpha gone ASAP.

[ProudVet77]

That should only take a few dozen years.
Not so sure about that. I'm old school software, not so much internet and web based. Done OS design and support as well as compiler design and support. My guess would be 4 or 5 engineers who knew the innards of NT could do it in a year or less. But, and this is a big but, you'd have to standardize some of the hardware, and control what software was placed on the machine, as well as standardize the compilers
At DEC when we compiled 'C' code it created areas of memory for read only (executable only) and read or write (but non executable). This seems to be a big part of the problems with windows.
No adding drivers or apps that have not been certified. No regedit, no system manager for the user. A huge number of problems come from the user shooting themselves in the foot. Adding tools that "clean the registry" :)

[George Smiley]

OpenVMS and the DEC...er....Compaq....er....HP Alpha are both no longer available.

You're completely wrong about all of the above.

However, your confusion about who owns the potato this year is understandable.

While the last flavor of Alpha processor has been released (EV7z), HP will still sell you anything from a DS15 (1 processor) to a GS1280 (64 processors).

HP is porting VMS to the Itanium processor; VMS 8.1 (Itamium only) was released more for testing than anything else, VMS 8.2 (Itanium and Alpha) SDK came out fairly recently).

I'm really excited as the rx1600 will be the least expensive VMS system sold in quite some time, although it's not orderable with VMS as yet.

There's also an OpenVMS hobbyist program that's free for noncommercial use.

If you want to browse the Web without worrying about viruses, there's Mozilla, Mosaic or Lynx browsers available; if webservers are what you want there's WASD, Apache and OSU.

You can pick a used VMS system up on eBay very reasonably...

I have a DS10L, Personal Workstastion 433au and a few VAXstations and MicroVAXes around which I use less frequently.

[AFreeBird]

There are also plans to install a similar Microsoft Windows-based computerised command system on Britain's nuclear submarines. Wilson said: "It is inconceivable that we could allow the possible accidental release of nuclear missiles. The people who survived such an exchange, if any, would certainly regard such a thing as a crime against humanity.

But if you read Micro$oft's EULA, they are not responsible. Mr. Bill will offer free patches to the surviving systems though.

[LTCJ]

It would really suck to get a Blue Screen of Death at 20,000 feet...

Yep. The BSOD at FL200 could lead to the Ultimate BUMP at 0 AGL.