Risk
8/23/2012
09:59 AM
50%
50%

DARPA Seeks 'Plan X' Cyber Warfare Tools

Defense Department looks for hardened operating systems and other new technologies for managing cyber warfare in real time on a large scale.

Defense Tech: 20 War-Fighting Innovations
Military Transformers: 20 Innovative Defense Technologies
(click image for larger view and for slideshow)
The Department of Defense is looking to develop new technologies, including hardened operating systems and other platforms, for managing cyber warfare in real time on a large scale.

The Defense Advanced Research Projects Agency has scheduled a workshop for September 27 where it will lay out requirements for the envisioned system and invite technology vendors to demonstrate capabilities that might be part of it.

Plan X, as the program is known, aims to help the Pentagon understand, plan, and manage cyber warfare "in real-time, large-scale, and dynamic network environments," according to DARPA. The program also encompasses cyber warfare strategies and tactics.

DARPA also wants to identify a system architecture team, which would oversee development of application programming interfaces, specifications for data formats, and acquisition of the required computer hardware and other infrastructure.

[ DARPA has a lot of irons in the fire. Read DARPA Demos Inexpensive, Moldable Robots. ]

Plan X entails research in four primary areas. First, DARPA is looking to develop analytics capabilities to help the military understand the "cyber battlespace" through analysis of large scale networks.

Second, DARPA wants the ability to create a mission plan and "script" that can be used by cyber personnel. That would include quantifying potential damages associated with those plans. The agency compares the sought-after capability to the auto-pilot function on an airplane.

DARPA also seeks operating systems and platforms that can operate in "dynamic, contested, and hostile network environments." It describes those components as hardened "battle units" that perform functions such as damage monitoring, communications, and weapon deployment.

Finally, the agency wants the ability to visualize what's happening in a virtual battlefield for use in planning, operations, and war gaming.

While those selected to work on Plan X are expected to have off-site development facilities, the program will be based at an on-site DARPA cyberwar facility with key contractor personnel. The program will use agile development principles, DARPA's announcement said.

Plan X is not focused on development of vulnerability analysis capabilities or cyber weapons, according to DARPA. The workshop is closed to the public and some sessions are only open to individuals with DOD "secret" clearance or higher. Following the workshop, DARPA plans to issue an industry solicitation in the form a "broad agency announcement."

Cybersecurity, continuity planning, and data records management top the list in our latest Federal IT Priorities Survey. Also in the new, all-digital Focus On The Foundation issue of InformationWeek Government: The FBI's next-gen digital case management system, Sentinel, is finally up and running.. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
trentondel
50%
50%
trentondel,
User Rank: Apprentice
8/30/2012 | 9:42:07 PM
re: DARPA Seeks 'Plan X' Cyber Warfare Tools
"Hello and welcome to the United States Air Force's Cyber Security attack hot-line. We appreciate your continued loyalty to the United States Government. If your power plant is currently experiencing a melt down please press 1. If your Water Treatment plant is now producing a form of nerve gas please press 2. If your air traffic control system is now routing all flights through Tehran please press 3. If your toaster has managed to gain sentience and is building a nuclear weapon please press 4.

For all other inquiries please wait patiently on the line and a service representative will be with you shortly.

Thank You and God Bless America."

God help us all if Microsoft is there.
Andrew Hornback
50%
50%
Andrew Hornback,
User Rank: Apprentice
8/28/2012 | 2:10:39 AM
re: DARPA Seeks 'Plan X' Cyber Warfare Tools
Ahh, it's a closed workshop - that's too bad, this sounds like it could be a LOT of fun.

Although, I do have to wonder about the idea of an auto-pilot mentality for those responding to cyber-attacks. We all know how scripted responses work - ever call large hardware manufacturer for support?

Andrew Hornback
InformationWeek Contributor
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4440
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.

CVE-2013-4442
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

CVE-2013-7401
Published: 2014-12-19
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.

CVE-2014-2026
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.

CVE-2014-2716
Published: 2014-12-19
Ekahau B4 staff badge tag 5.7 with firmware 1.4.52, Real-Time Location System (RTLS) Controller 6.0.5-FINAL, and Activator 3 reuses the RC4 cipher stream, which makes it easier for remote attackers to obtain plaintext messages via an XOR operation on two ciphertexts.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.