14 janvier 2022 | International, Aérospatial
6 avril 2021 | International, Aérospatial, Naval, Terrestre, C4ISR, Sécurité
May affect politics of Canada's stimulus plan and what's considered appropriate timeline for investment in low-carbon transition
14 août 2018 | International, C4ISR
WHEN THE CYBERSECURITY industry warns about the nightmare of hackers causing blackouts, the scenario they describe typically entails an elite team of hackers breaking into the inner sanctum of a power utility to start flipping switches. But one group of researchers has imagined how an entire power grid could be taken down by hacking a less centralized and protected class of targets: home air conditioners and water heaters. Lots of them. At the Usenix Security conference this week, a group of Princeton University security researchers will present a study that considers a little-examined question in power grid cybersecurity: What if hackers attacked not the supply side of the power grid, but the demand side? In a series of simulations, the researchers imagined what might happen if hackers controlled a botnet composed of thousands of silently hacked consumer internet of things devices, particularly power-hungry ones like air conditioners, water heaters, and space heaters. Then they ran a series of software simulations to see how many of those devices an attacker would need to simultaneously hijack to disrupt the stability of the power grid. Their answers point to a disturbing, if not quite yet practical scenario: In a power network large enough to serve an area of 38 million people—a population roughly equal to Canada or California—the researchers estimate that just a one percent bump in demand might be enough to take down the majority of the grid. That demand increase could be created by a botnet as small as a few tens of thousands of hacked electric water heaters or a couple hundred thousand air conditioners. "Power grids are stable as long as supply is equal to demand," says Saleh Soltan, a researcher in Princeton's Department of Electrical Engineering, who led the study. "If you have a very large botnet of IoT devices, you can really manipulate the demand, changing it abruptly, any time you want." The result of that botnet-induced imbalance, Soltan says, could be cascading blackouts. When demand in one part of the grid rapidly increases, it can overload the current on certain power lines, damaging them or more likely triggering devices called protective relays, which turn off the power when they sense dangerous conditions. Switching off those lines puts more load on the remaining ones, potentially leading to a chain reaction. "Fewer lines need to carry the same flows and they get overloaded, so then the next one will be disconnected and the next one," says Soltan. "In the worst case, most or all of them are disconnected, and you have a blackout in most of your grid." Power utility engineers, of course, expertly forecast fluctuations in electric demand on a daily basis. They plan for everything from heat waves that predictably cause spikes in air conditioner usage to the moment at the end of British soap opera episodes when hundreds of thousands of viewers all switch on their tea kettles. But the Princeton researchers' study suggests that hackers could make those demand spikes not only unpredictable, but maliciously timed. The researchers don't actually point to any vulnerabilities in specific household devices, or suggest how exactly they might be hacked. Instead, they start from the premise that a large number of those devices could somehow be compromised and silently controlled by a hacker. That's arguably a realistic assumption, given the myriad vulnerabilities other security researchers and hackers have found in the internet of things. One talk at the Kaspersky Analyst Summit in 2016 described security flaws in air conditioners that could be used to pull off the sort of grid disturbance that the Princeton researchers describe. And real-world malicious hackers have compromised everything from refrigerators to fish tanks. Given that assumption, the researchers ran simulations in power grid software MATPOWER and Power World to determine what sort of botnet would could disrupt what size grid. They ran most of their simulations on models of the Polish power grid from 2004 and 2008, a rare country-sized electrical system whose architecture is described in publicly available records. They found they could cause a cascading blackout of 86 percent of the power lines in the 2008 Poland grid model with just a one percent increase in demand. That would require the equivalent of 210,000 hacked air conditioners, or 42,000 electric water heaters. The notion of an internet of things botnet large enough to pull off one of those attacks isn't entirely farfetched. The Princeton researchers point to the Mirai botnet of 600,000 hacked IoT devices, including security cameras and home routers. That zombie horde hit DNS provider Dyn with an unprecedented denial of service attack in late 2016, taking down a broad collection of websites. Building a botnet of the same size out of more power-hungry IoT devices is probably impossible today, says Ben Miller, a former cybersecurity engineer at electric utility Constellation Energy and now the director of the threat operations center at industrial security firm Dragos. There simply aren't enough high-power smart devices in homes, he says, especially since the entire botnet would have to be within the geographic area of the target electrical grid, not distributed across the world like the Mirai botnet. But as internet-connected air conditioners, heaters, and the smart thermostats that control them increasingly show up in homes for convenience and efficiency, a demand-based attack like the one the Princeton researchers describes could become more practical than one that targets grid operators. "It's as simple as running a botnet. When a botnet is successful, it can scale by itself. That makes the attack easier," Miller says. "It's really hard to attack all the generation sites on a grid all at once. But with a botnet you could attack all these end user devices at once and have some sort of impact." The Princeton researchers modeled more devious techniques their imaginary IoT botnet might use to mess with power grids, too. They found it was possible to increase demand in one area while decreasing it in another, so that the total load on a system's generators remains constant while the attack overloads certain lines. That could make it even harder for utility operators to figure out the source of the disruption. If a botnet did succeed in taking down a grid, the researchers' models showed it would be even easier to keepit down as operators attempted to bring it back online, triggering smaller scale versions of their attack in the sections or "islands" of the grid that recover first. And smaller scale attacks could force utility operators to pay for expensive backup power supplies, even if they fall short of causing actual blackouts. And the researchers point out that since the source of the demand spikes would be largely hidden from utilities, attackers could simply try them again and again, experimenting until they had the desired effect. The owners of the actual air conditioners and water heaters might notice that their equipment was suddenly behaving strangely. But that still wouldn't immediately be apparent to the target energy utility. "Where do the consumers report it?" asks Princeton's Soltan. "They don't report it to Con Edison, they report it to the manufacturer of the smart device. But the real impact is on the power system that doesn't have any of this data." That disconnect represents the root of the security vulnerability that utility operators need to fix, Soltan argues. Just as utilities carefully model heat waves and British tea times and keep a stock of energy in reserve to cover those demands, they now need to account for the number of potentially hackable high-powered devices on their grids, too. As high-power smart-home gadgets multiply, the consequences of IoT insecurity could someday be more than just a haywire thermostat, but entire portions of a country going dark. https://www.wired.com/story/water-heaters-power-grid-hack-blackout/
25 janvier 2021 | International, Aérospatial
The future of the U.S. Air Force's tactical aircraft fleet is under review, with some radical ideas under discussion. BY THE WAR ZONE STAFF JANUARY 22, 2021 The U.S. Air Force is in the midst of a major review of its tactical aircraft fleets. This includes investigating the possibility of using drones equipped with the artificial intelligence-driven systems being developed under the Skyborg program as red air adversaries during training, and potentially in the light attack role. The service is also exploring a potential purchase of new F-16 fighter jets, likely based on the Block 70/72 variant, two decades after the service ordered its last Vipers as it shifted focus to the F-35A Joint Strike Fighter. In an interview with Steve Trimble, Aviation Week's Defense Editor and good friend of The War Zone, earlier this month, which you can find here, now-former Assistant Secretary of the Air Force for Acquisition, Technology, and Logistics, Will Roper, provided insight into the ongoing tactical aircraft review, including particularly intriguing comments about forthcoming unmanned aircraft system programs and buying additional F-16s. These and other ideas are being scrutinized as the service looks toward its Fiscal Year 2023 budget request, which, barring any complications, would be unveiled in the spring of 2022. Roper had been the chief architect and advocate of the Air Force's Skyborg program, which the service revealed in 2019, and is developing a suite of new autonomous capabilities for unmanned aircraft with a heavy focus on artificial intelligence (AI) and machine learning. The service has said that the goal is to first integrate these technologies into lower-cost loyal wingman type drones designed to work together with manned aircraft, but that this new “computer brain” might eventually control fully-autonomous unmanned combat air vehicles, or UCAVs. The Skyborg effort has been heavily linked to other Air Force programs that are exploring unmanned aircraft designs that are “attritable.” This means that they would be cheap enough for commanders to be more willing to operate these drones in riskier scenarios where there might be a higher than average probability of them not coming back. With this in mind, Skyborg technology has previously been seen as ideal for unmanned aircraft operating in higher-threat combat environments. However, in the interview with Aviation Week, Roper suggested that they might also first serve in an adversary role. In this way, these unmanned aggressors would test combat aircrew, either standing in for swarms of enemy drones or conducting the kinds of mission profiles for which an autonomous control system would be better suited. As the proliferation of advanced drone capabilities continues, adversary drone training systems will become a pressing capability. Even using drones to stand in for or augment manned adversary platforms is one of the potential solutions to the problem of needing far more targets in the air at one time to stress fleet pilots. Operating huge fleets of manned adversaries is highly cost-prohibitive. For example, Air Combat Command shortlisted seven companies for a combined total of $6.4 billion of potential aggressor contract work in 2019; details of the first five bases to receive this support were revealed last year, as The War Zone reported at the time. Other solutions, including augmented reality, are being looked at to solve this problem, as well. You can read more about this issue in this past exclusive of ours. “I think, at a minimum, attritables ought to take on the adversary air mission as the first objective,” Roper said. “We pay a lot of money to have people and planes to train against that do not go into conflict with us. We can offload the adversary air mission to an artificially intelligent system that can learn and get better as it's doing its mission.” Roper's specific mention here of attritable drones is interesting and could perhaps hint that the manned aircraft they would battle with might, at least on some occasions, also shoot them down. If that were to become a reality, it would provide pilots with a highly realistic element to their training that would potentially be far more valuable than the relatively “canned” type of live-fire gunnery or missile firing that they are exposed to today. The Air Force Research Laboratory (AFRL) is already in the midst of an effort, separate from Skyborg, to develop an autonomous unmanned aircraft that uses AI-driven systems with the goal of having it duel with a human pilot in an actual fighter jet by 2024. Roper also clearly sees the use of drones equipped with the Skyborg suite of systems as a potential way to bring down the cost of the entire red air training enterprise, reducing the requirement to procure more expensive manned aircraft and teach the instructors required to fly them. Beyond cost-saving, however, there is still a demand for higher-end red air capabilities, especially stealthy ones, that contractors can't really provide. This is one of the reasons why early-model F-35s have been chosen to equip a future aggressor squadron. While this will go some way to meeting the demand for advanced threat simulation, it is likely to be a limited and costly fleet. Stealthy, but attritable drones, such as the XQ-58 Valkyrie, would certainly be a possibility for adding additional capacity here at a lower cost. As well as training the human elements, introducing Skyborg-enabled drones into large-force exercises would also help train them, enhancing their own AI algorithms, and building up their capabilities before going into battle for real. Essentially, algorithms need to be tested repeatedly to make sure they are functioning as intended, as well as for the system itself to build up a library of sorts of known responses to inputs. Furthermore, “training” Skyborg-equipped drones in this way in red air engagements inherently points to training them for real air-to-air combat. Air-to-air combat isn't the only frontline role the Air Force is eying for drones carrying the Skyborg suite. “I think there are low-end missions that can be done against violent extremists that should be explored,” Roper said. This opens up the possibility that lower-cost unmanned aircraft using AI-driven systems could help the Air Force finally adopt a light attack platform after more than a decade of abortive efforts in this regard. Despite initial plans to buy hundreds of aircraft, the service dramatically scaled back its most recent attempt, known as the Light Attack Aircraft program, in 2019. U.S. Special Operations Command (SOCOM) subsequently tried to revive the project, but Congress blocked that effort in its annual defense policy bill, or National Defense Authorization Act (NDAA), for the 2021 Fiscal Year. So, there remains a requirement for a light attack platform that could potentially be filled by an advanced unmanned alternative. In the meantime, the Air Force had also attempted to cease buying MQ-9 Reaper drones, which currently undertake many of these types of lower-end combat missions, but this was ultimately blocked by Congress, too. Still, close air support (CAS) is a mission that still benefits hugely from a human in the cockpit. As such, the exact capability set of a semi-autonomous drone, in this regard, may be limited. One could imagine giving the targeting control directly to those the drone is tasked with supporting on the ground though. This could compress the kill-chain and help with providing CAS in contested environments where a stealthy and attritable airframe may be overtly beneficial. Just such a concept was floated by the then Air Force Chief of Staff General Mark Welsh, who described it as “a flying Coke machine.” You can read all about that in this past article of ours. Roper had also indicated in his interview that perhaps the cost-savings from using drones in the adversary role might free up funds to otherwise address the light attack issue, as well as other needs the Air Force might have. Replacing “adversary air [with attritable unmanned aircraft] would save us money up front,” Roper explained. With regards to manned tactical aircraft, Roper also revealed in the interview that the Air Force is looking at new purchases of F-16s. “As you look at the new F-16 production line in South Carolina, that system has some wonderful upgraded capabilities that are worth thinking about as part of our capacity solution,” he said. Roper was almost certainly referring to the latest Block 70/72 variants of the F-16C/D that Lockheed Martin has been successfully selling on the export market in recent years. The company also offers an upgrade package to bring existing Vipers up to a similar configuration, known as the F-16V. In September 2020, the defense giant announced plans to standardize its F-16 offerings around a base model derived from the Block 70/72 configuration, which you can read about more in this past War Zone piece. New Vipers based on this standardized model are what the Air Force would likely be looking to buy in Fiscal Year 2023 or beyond. The latest Block 70/72 jets are already highly capable, featuring sophisticated avionics, mission systems, active electronically scanned array radar, extended range, and a digital electronic warfare suite. In the meantime, the Air Force is working hard to wring the most out of existing F-16 inventory, updating many with the Scalable Agile Beam Radar (SABR) and the new electronic warfare package from the Block 70/72. Full article : https://www.thedrive.com/the-war-zone/38847/air-force-eyes-drones-for-adversary-and-light-attack-roles-as-it-mulls-buying-new-f-16s