US weapons systems can be ‘easily hacked’

Some of the most cutting-edge weapons in the US’s military arsenal can be “easily hacked” using “basic tools”, a government report has concluded.

The Government Accountability Office (GAO) found “mission-critical” cyber-vulnerabilities in nearly all weapons systems tested between 2012 and 2017.

That includes the newest F-35 jet as well as missile systems.

Pentagon officials had no immediate response to the 50-page report from the Senate Armed Services Committee.

The committee’s members expressed concerns about how protected weapon systems were against cyber-attacks.

The report’s main findings were:

• the Pentagon did not change the default passwords on multiple weapons systems – and one changed password was guessed in nine seconds
• a team appointed by the GAO was able to easily gain control of one weapons system and watch in real time as the operators responded to the hackers
• it took another two-person team only one hour to gain initial access to a weapons system and one day to gain full control
• many of the test teams were able to copy, change or delete system data with one team downloading 100 gigabytes of information

The GAO added that the Pentagon “does not know the full scale of its weapons system vulnerabilities”.

Ken Munro, an expert at security firm Pen Test Partners, said he was “not at all surprised” by the findings.

“It takes a long time to develop a weapons system, often based on iterations of much older systems. As a result, the components and software can be based on very old, vulnerable code.

“Developers often overlook ‘hardening’ the security of systems after they’ve got them operating, with the philosophy, ‘it’s working, so don’t mess with it’.

“However, that’s no excuse. This report shows some very basic security flaws that could easily have been addressed by changing passwords and keeping software up-to-date.”