New air defences needed in wake of Iran attack, Canadian Army says

Sur le même sujet

• 

  5 août 2019 | Local, Sécurité

  Hacker Community to Take on DARPA Hardware Defenses at DEF CON 2019

  This month, DARPA will bring a demonstration version of a secure voting ballot box equipped with hardware defenses in development on the System Security Integrated Through Hardware and Firmware (SSITH) program to the DEF CON 2019 Voting Machine Hacking Village (Voting Village). The SSITH program is developing methodologies and design tools that enable the use of hardware advances to protect systems against software exploitation of hardware vulnerabilities. To evaluate progress on the program, DARPA is incorporating the secure processors researchers are developing into a secure voting ballot box and turning the system loose for public assessment by thousands of hackers and DEF CON community members. Many of today's hardware defenses cover very specific instances or vulnerabilities, leaving much open to attack or compromise. Instead of tackling individual instances, SSITH researchers are building defenses that address classes of vulnerabilities. In particular, SSITH is tackling seven vulnerabilities classes identified by the NIST Common Weakness Enumeration Specification (CWE), which span exploitation of permissions and privilege in the system architectures, memory errors, information leakage, and code injection. “There are a whole set of cyber vulnerabilities that happen in electronic systems that are at their core due to hardware vulnerabilities – or vulnerabilities that hardware could block,” said Dr. Linton Salmon, the program manager leading SSITH. “Current efforts to provide electronic security largely rely on robust software development and integration, utilizing an endless cycle of developing and deploying patches to the software firewall without addressing the underlying hardware vulnerability. The basic concept around SSITH is to make hardware a more significant participant in cybersecurity, rather than relegating system security only to software.” Under the SSITH program, researchers are exploring a number of different design approaches that go well beyond patching. These include using metadata tagging to detect unauthorized system access; employing formal methods to reason about integrated circuit systems and guarantee the accuracy of security characteristics; and combining hardware performance counters (HPCs) with machine learning to detect attacks and establish protective fences within the hardware. One team from the University of Michigan is developing a novel security approach that changes the unspecified semantics of a system every 50 milliseconds. Currently, attackers continuously probe a system to locate these undefined sections and, over time, are able to create a system map to identify possible hacks. By changing the construct every 50 milliseconds, attackers do not have enough time to find those weaknesses or develop an accurate representation of the system as a whole. To evaluate the hardware security concepts in development on the SSITH program, DARPA – working with Galois – is pursuing a voting system evaluation effort to provide a demonstration system that facilitates open challenges. The program elected to use a voting system as its demonstration platform to provide researchers with an accessible application that can be evaluated in an open forum. Further, the topic of election system security has become an increasingly critical area of concern for the hacker and security community, as well as the United States more broadly. “DARPA focuses on creating technologies to enhance national defense, and election system security falls within that remit. Eroding trust in the election process is a threat to the very fabric of our democracy,” noted Salmon. While protecting democracy is a critical national defense issue, SSITH is not trying to solve all issues with election system security nor is it working to provide a specific solution to use during elections. “We expect the voting booth demonstrator to provide tools, concepts, and ideas that the election enterprise can use to increase security, however, our true aim is to improve security for all electronic systems. This includes election equipment, but also defense systems, commercial devices, and beyond,” said Salmon. During DEF CON 2019, the SSITH voting system demonstrator will consist of a set of RISC-V processors that the research teams will modify to include their SSITH security features. These processors will be mounted on field programmable gate arrays (FPGAs) and incorporated into a secure ballot box. Hackers will have access to the system via an Ethernet port as well as a USB port, through which they can load software or other attacks to challenge the SSITH hardware. Since SSITH's research is still in the early stages, only two prototype versions of the 15 processors in development will be available for evaluation. “At this year's Voting Village, hackers may find issues with the processors and quite frankly we would consider that a success. We want to be transparent about the technologies we are creating and find any problems in these venues before the technology is placed in another venue where a compromise could be more dangerous,” said Salmon. Following DEF CON 2019, the voting system evaluation effort will go on a university roadshow where additional cybersecurity experts will have an opportunity to further analyze and hack the technology. In 2020, DARPA plans to return to DEF CON with an entire voting system, which will incorporate fixes to the issues discovered during the previous year's evaluation efforts. The 2020 demonstrator will use the STAR-Vote system architecture, which is a documented, open source architecture that includes a system of microprocessors for the voting booth, ballot box, and other components. It also includes a verifiable paper ballot, providing both digital and physical representations of the votes cast within the booth. “While the 2020 demonstrator will provide a better representation of the full attack surface, the exercise will not result in a deployable voting system. To aid in the advancement of secure election equipment as well as electronic systems more broadly, the hardware design approaches and techniques developed during the SSITH program will be made available to the community as open-source items,” concluded Salmon. https://www.darpa.mil/news-events/2019-08-01

• 

  27 décembre 2018 | Local, Naval

  Feds, Irving ask trade tribunal to toss challenge to warship contract

  By Lee Berthiaume, The Canadian Press — Dec 25 2018 OTTAWA — The federal government and Halifax-based Irving Shipbuilding are asking a trade tribunal to throw out a challenge to their handling of a high-stakes competition to design the navy's new $60-billion fleet of warships. In separate submissions to the Canadian International Trade Tribunal, the federal procurement department and Irving say the challenge filed by Alion Science and Technology of Virginia does not meet the requirements for a tribunal hearing. Alion was one of three companies, along with U.S. defence giant Lockheed Martin and Spanish firm Navantia, vying to design the new warships, which are to be built by Irving and serve as the navy's backbone for most of this century. While Lockheed was selected as the preferred bidder and is negotiating a final design contract with the government and Irving, Alion alleges the company's design did not meet the navy's requirements and should have been disqualified. Two of those requirements related to the ship's speed, Alion alleged, while the third related to the number of crew berths. Alion has asked both the trade tribunal and the Federal Court to stop any deal with Lockheed. But the government and Irving say the contract is exempt from normal trade laws, which the tribunal is charged with enforcing, because of a special "national security exception," meaning there is "no jurisdiction for the tribunal to conduct an inquiry." Another reason the challenge should be quashed, they argue, is that Alion is not a Canadian company, which is a requirement for being able to ask the tribunal to consider a complaint. Alion's challenge has been formally filed by its Canadian subsidiary, but the government and Irving say that subsidiary was never actually qualified to be a bidder in the competition — only its American parent. The responses from the government and Irving are the latest twist in the largest military purchase in Canadian history, which will see 15 new warships built to replace the navy's 12 aging Halifax-class frigates and three already-retired Iroquois-class destroyers. The trade tribunal ordered the government last month not to award a final contract to Lockheed until it had investigated Alion's complaint, but rescinded the order after a senior procurement official warned that the deal was "urgent." The procurement department has not explained why the deal is urgent. Lockheed's bid was contentious from the moment the design competition was launched in October 2016. The federal government had originally said it wanted a "mature design" for its new warship fleet, which was widely interpreted as meaning a vessel that has already been built and used by another navy. But the first Type 26 frigates, upon which Lockheed's proposal was based, are only now being built by the British government and the design has not yet been tested in full operation. There were also complaints from industry that the deck was stacked in the Type 26's favour because of Irving's connections with British shipbuilder BAE, which originally designed the Type 26 and partnered with Lockheed to offer the ship to Canada. Irving, which worked with the federal government to pick the top design, also partnered with BAE in 2016 on an ultimately unsuccessful bid to maintain the navy's new Arctic patrol vessels and supply ships. That 35-year contract ended up going to another company. Irving and the federal government have repeatedly rejected such complaints, saying they conducted numerous consultations with industry and used a variety of firewalls and safeguards to ensure the choice was completely fair. But industry insiders had long warned that Lockheed's selection as the top bidder, combined with numerous changes to the requirements and competition terms after it was launched — including a number of deadline extensions — would spark lawsuits. Government officials acknowledged last month the threat of legal action, which has become a favourite tactic for companies that lose defence contracts, but expressed confidence that they would be able to defend against such an attack. —Follow @leeberthiaume on Twitter. Lee Berthiaume, The Canadian Press https://www.nationalnewswatch.com/2018/12/25/feds-irving-ask-trade-tribunal-to-toss-challenge-to-warship-contract-2/#.XCT7OFxKjIU

• 

  26 novembre 2019 | Local, Aérospatial

  First delivery of RCAF CC-295 could be delayed

  by Chris Thatcher Complications with the technical manuals for the Royal Canadian Air Force (RCAF) CC-295 search and rescue (SAR) aircraft could delay delivery of the first plane. Manufacturer Airbus Defence and Space unveiled the first C295W (CC-295 is its Canadian designation) in its distinctive RCAF search and rescue paint scheme in mid-October at its production facility in Seville, Spain, and was anticipating handover by the end of the year. While members of the SAR test and evaluation flight of 434 Operational Test and Evaluation Squadron have been in Seville since early fall to assess the aircraft and complete various flight and technical manuals, the Air Force has yet to accept the aircraft. “There have been challenges in the completion of the required technical manuals, which are required for all aspects of safe aircraft operation — from flying to maintenance,” the RCAF and assistant deputy minister (materiel), the military's acquisition branch, said in a statement. “Technical manuals are a critical component when it comes to the safe operation of any fleet. The safety of our aviators is simply not something we are willing to compromise on. We continue to collaborate with Airbus, prioritizing the work required in order to deliver the new search and rescue aircraft safely and effectively.” In a statement to CTV News, an Airbus spokesperson said, “Work on operational technical publications is under review to ensure these are tailored to the customer's requirements and additional time is required.” Airbus will deliver 16 of the twin-propeller CC-295 aircraft to replace the de Havilland CC-115 Buffalo and Lockheed Martin CC-130 Hercules used in a search and rescue role. Despite the delay, the RCAF is still expecting to bring the first aircraft to 19 Wing Comox. B.C., by April 2020. “While it is not yet known if this will cause a delay in final delivery, we remain optimistic that the supplier can work towards an acceptable solution so that our on-site testing and evaluations can be done prior to flying the first aircraft to Canada next spring, as previously planned,” said a spokesperson. In its statement to CTV, Airbus said it had been working “tirelessly to meet the demanding delivery milestones of the Canadian [fixed-wing search and rescue] FWSAR program and to date the company has successfully completed design, development, certification and manufacture of the aircraft, as well as the first stages establishing the program's support operations in Canada.” In addition to the first aircraft, six more CC-295s are in final assembly or completing flight test. Aircrew and maintainers with 418 Search and Rescue Operational Training Squadron, reactivated on July 11, 2019, began initial cadre training on the CC-295 at Airbus' facility in Spain in September. The aircraft will operate from four main bases in Comox, Winnipeg, Man., Trenton, Ont., and Greenwood, N.S. https://www.skiesmag.com/news/first-delivery-of-airbus-c295w-to-rcaf-could-be-delayed