How hackers breached an Air Force system

At DEFCON 2019, held in Las Vegas in August, the Air Force allowed ethical hackers to try to intrude into actual operational equipment — a data transfer system for the F-15 tactical fighter aircraft. It was not surprising that the hackers succeeded. What surprised the Air Force’s top weapons buyer was exactly how they got in.

“What they told me was the ways we got in were not the things you’ve told industry to design. They were the things industry doesn’t know is in their supply chain — it’s the ports that weren’t cut off, the dry functions that weren’t cut off,” Will Roper, assistant secretary of the Air Force for acquisition, technology and logistics, said Dec. 11 at an event hosted by the Atlantic Council.

“These are the thing you need to tell industry don’t do … Our defense companies are assemblers from the supply chains that they don’t require the suppliers to tell them what code, what software functionality is running on components because we don’t tell industry to do that.”