U.S. Navy Asked You to “Hack Our Ship,” Strengthens Cyber Defense | Hacker News Reader

U.S. Navy Asked You to “Hack Our Ship,” Strengthens Cyber Defense

edgylabs.com

23 pointsParbeyjr11 comments

"a simulated system built ... to resemble fleet systems"

Is hacking against a simulated system that merely "resembles" the original rather than exactly duplicates it the same as hacking against the actual real system?

Probably not, and if so, is there much real value to such an exercise.

It's probably the real software control system for the ship they probably just don't have an actual rail gun at the end of the FireRailGun() function. At least I hope they don't.

The way they phrase it is suspect though. It's not "the system deployed in a test environment", it's "a simulated system built ... to resemble fleet systems""

You're talking about the same Navy that ran Millenium Challenge 2002, where after the Blue team had their collective asses handed to them on a plate by the "Middle Eastern Rogue State (coughIrancough)" Red team using WW2 equipment and asymmetric tactics (literally tens of thousands of simulated US casualties), they refloated all the lost Blue team ships, and ordered the Red team to follow predescribed plans written to ensure Blue team success, including turning on their AA radars so they could be found and shot, and not shooting at Blue team landing craft.

https://en.wikipedia.org/wiki/Millennium_Challenge_2002#Exer...

It's definitely not... but I'm sure there is still something to be gained from it.

I assume this will leave out the most vulnerable element of any system, which is humans.

Is this the same ship they purchased the super-extended Windows XP support for?

cringe I hope this is a joke and that they are running something like OpenBSD.

It's not a joke.

I can beat anyone at chess. Just agree to play on my chessboard, with my rules, and only the pieces I allow you to have.

These sorts of contests are often more about generating marketing material for the developer than they are about actual pen-testing.

I suppose it's interesting that the event was held. But what about an outcome? Surely a tally of exploits found can't be a secret, can it? Can someone at least disclose whether it was nonzero?

I am almost certain the details of the specific vulnerabilities would be classified. You probably had to sign some kind of NDA to even participate if I had to guess.

Reply on news.ycombinator.com