Suter - How does one defend against it?

[Juubi Karakuchi]

I don't know if this has been done before. I apologise if it has.

It's been nearly three months since the Israeli air-strike into Syria, known as Operation Orchard. One of the most persistent rumours about this incident is that the Israelis made use of a computer attack programme, similar or perhaps identical to the US military's SUTER programme, to disrupt Syrian air defences. Supposedly this system would have allowed the Israelis to hack into the Syrian C&C and operate it as if they themselves were in control. Some of these rumours claim that SUTER can enter a system via any emitter, not just a broadband uplink.
Ordinarily I don't believe in a 'perfect' weapon, or in clean-sweep victories. But if SUTER is anything like as capable as is made out (and it might not be), then it would seem to be impossible to effectively counter it.

What do you think? How might one defend against such a system? Is it even this good?

[Darth Wong]

That sounds like a massive exaggeration to me. That kind of electronic warfare is something that people are always working on, but what you describe sounds almost cartoonishly effective.

[Admiral Valdemar]

Suter 3 is theorised to be able to invade and control all such air defence such systems, whereas previous incarnations where only ELINT systems or a more basic level of control. I don't know how effective the system really is, since something that powerful would be kept at the highest level of top secret by BAE Systems and the USAF, but if the IAF is as close to the US as the rest of Israel, there's no reason to believe they wouldn't have had a sneak peak in case they needed such a system or knew enough to develop something similar parallel to the original project.

It does remind me a bit of an episode of Spooks just shown, whereby a back door was found in the US satellite networks that could allow a logic bomb to go in and crash them all, nullifying any potential air strikes on Iran.

To be honest, I don't know how this would be achieved by an EW aircraft when any competent air defence network would be hard wired and not allowing itself to have the equivalent of a WEP key being broadcast on a high power antenna for a transceiver that, just so happens, to control the network. It could easily be that what "Suter" is, is in fact a cover for other areas of research that are even more secretive and more plausible than something sounding like Culture grade effectors or a quantum computer.

[Phantasee]

Valdemar, from what you said, would it be reasonable to assume that Israel gets to play with USAF toys to test them out? Considering that Israel performs a lot more of these sorts of things against "interesting" targets, vs the US just bombing Iraqi or Afghani targets, which don't seem to be nearly as sophisticated. A nation still has a huge advantage over a stateless organization in terms of hardware they can field, including hardware the US would be interested in neutralizing.

[Admiral Valdemar]

The Israelis would probably be able to acquire certain technology and methods should they smooth it over with the Pentagon and give a legit reason for requiring it. If Syria was starting to get into nuclear research, then I'm sure the US would be more than happy to let the IAF take charge and also field test their new toys. It's not like the Israelis are pariahs, far from it.

If it's in their best interests, I expect more test data from such systems in future coming from that area.

[ArchMage]

I dont see how it could enter a computer system through any emitter, networks and computer systems arent made like that. Though maby Caprica 6 was involved

[MKSheppard]

Same claim has also been made repeatedly in JANES et al about US phased array radars of the kind in the F-22 and F-18E/F.

I think how this works, is that the Sewer Horror/F-22 use ELINT to analyze the outgoing pulses from the enemy radar, and match them to a database of known radars and then reprorgram their radar's emitter to transmit back "fake echoes" on the same frequency and pulsing that a return echo would have.

So in effect, you're putting "fake" aircraft on the bad guy's screen.

[Jadeite]

I figure I should post an article so other people might know what the hell the topic is about. I've seen it discussed on other forums.
Anyway, this could give newcomers a decent idea about what Suter may do (if it exists).

From here. I've seen several variations of the same story posted around, so at this point, one is just as good as another to me.

BLACK SURPRISES

New data on classified U.S. Air Force programs track the service's changing emphasis from manned aircraft to unmanned stealth vehicles to algorithms that penetrate enemy defenses with even less notice but with equal, and perhaps even more, destructive power.

There are many classified programs, stretching back to the Cold War, that remain blank spots to the white world. But two projects, still-classified and closely held by Lockheed Martin Skunk Works, can now be associated with a picture and a mission. They also can lay down addition markers in the Air Force's transition to the clandestine digital package that can prowl the information corridors and data storage site of an enemy communications network.

THE FIRST, SENIOR PROM, is an F-117-like design that has been identified both as a stealthy cruise missile prototype and an unmanned reconnaissance aircraft, roles that aren't mutually exclusive and show the Air Force's interest 25 years ago--even before the F-117 flew--in stealthy, unmanned aircraft that could penetrate even the most sophisticated air defenses.

The Senior Prom design was flight tested as part of a competition that was won by the General Dynamics/McDonnell Douglas (now Raytheon/Boeing) AGM-129 advanced cruise missile. A second Lockheed project is called Senior Peg, which is thought to have been a candidate for the advanced tactical bomber competition that was eventually won by what is now Northrop Grumman and fielded as the B-2 bomber. Its faceted design resembles that of the F-117 and the wing's trailing edges bring to mind the saw-tooth design of the B-2 that helps the stealth bomber control its radar reflection by segmenting it and directing it, very precisely, away from the aircraft. It also was designed to penetrate the foe's best defenses.

A series of Senior Prom pictures shows the design's evolution. Early in the flight-testing phase, it appeared with high-visibility orange stripes and a large ventral fin. Later pictures have the ventral fin removed and the aircraft painted black. The wings look like they are designed to fold against the wide, flat body for compressed carriage. Little information is available on the Senior Peg demonstrator, but according to one account the photo is a model that did not fly. There are some indications, based on a number of sightings in the Western U.S., that the design may have served as the basis for other, still-classified aircraft.

Thirteen Senior Prom launches were made from DC-130 drone carriers and all were considered successful, according to one researcher. Some were allowed to deliberately hit the ground, while others were recovered by parachute. First flight was in late 1979 or early 1980 and the test program was over by the time of the first YF-117 flight in 1981. The sorties were flown from the secret Groom Lake air base located on the Nevada Test Ranges northwest of Las Vegas.

Senior Prom and Senior Peg are among a number of programs with the "Senior" designation that include Senior Bowl (the supersonic D-21 drone launched by the SR-71/M-21 mother ship), Senior Crown (the SR-71 and YF-12 programs), Senior Trend (F-117 Nighthawk), Senior Sky (F-22 development) and Senior Needle (support for advanced cruise missile special access program).

William M. Arkin's new book, Code Names, gives a quick survey of many of the "Senior" appellations, which he says were reconnaissance-related U.S. Air Force special-access-programs. Senior Book signified Taiwanese U-2 operations over China. Senior Look referred to U-2 operations in Europe. Reconnaissance programs, under which he lists Senior Prom, also include Senior Blade (ground station for exploiting U-2R digital imagery), Senior Mace (signals intelligence exploitation), Senior Year (the current U-2 satellite data link) and Senior Citizen (which Arkin says included "Aurora"-type high-speed reconnaissance aircraft or other low-observable systems).

Other, more contemporary Senior programs named by Arkin reveal and track the Air Force's growing interest in and development of the new field of computer network warfare and electronic attack, which include Senior Keystone (related to classified information warfare) and Senior Suter. However, the Air Force's theme remains the same--penetrating the enemy's defenses.

Senior Suter is a Big Safari-managed special access program. Big Safari itself is a shadowy Air Force unit that has developed small numbers of specialized reconnaissance systems, including drones, in what are often classified programs. The Suter technology was developed during the last several years by BAE Systems and involves invading enemy communications networks and computer systems, particularly those associated with integrated air defense systems (AW&ST Aug. 16, 2004, p. 24; Nov. 4, 2002, p. 30). Suter 1 allowed U.S. operators to monitor what enemy radars could see. The capability enables U.S. forces to assess the effectiveness of their stealth systems or terrain-masking tactics. Suter 2 permits U.S. operators to take control of enemy networks as system managers and actually manipulate the sensors, steering them away from penetrating U.S. aircraft. Suter 3 was tested last summer to add the ability to invade the links to time-critical targets, such as battlefield ballistic missile launchers or mobile surface-to-air missile launchers. Aircraft involved in the Suter programs include the EC-130 Compass Call, RC-135 Rivet Joint and F-16CJ strike aircraft specialized for suppression of enemy air defenses.

Information operations and computer network attack programs are now considered the military's most closely guarded projects, surpassing even new stealth advances. Some of the info ops code names listed by Arkin's book include Space 7 (Air Intelligence Agency's advanced programs division, directorate of information operations), Quick Draw (AIA information operations center), Midnight Stand (Strategic Command offensive information operations advanced concept technology demonstration), Iron Hare 99 (first demonstration of offensive computer warfare capabilities), Evident Surprise (to deconflict and execute offensive info war), Crucial Player (predictive analysis of info war and terrorist threats to emerging technologies), Constant Web (Air Force database for adversary military command, control and communications structures), Adversary (USAF command-and-control analysis for info war targeting), Arena (info war analyses, evaluation and decision-making to create country studies of electronic infrastructure) and Black Demon (USAF cyber-warfare exercise to develop network operations warfighting capabilities from the tactical level through full-scale warfare).

If such a thing exists, particularly Suter 2 and/or 3, then the USAF has a massive advantage against any potential enemies such as Iran, in addition to known capabilities.

[MKSheppard]

I think it's probably massive misinformation; in much the same way that Stuart and the others spent most of the 1980s spending money as fast as it could be printed in a misdirection effort against the Soviet Union.

[Androsphinx]

I think it's probably massive misinformation; in much the same way that Stuart and the others spent most of the 1980s spending money as fast as it could be printed in a misdirection effort against the Soviet Union.

With the exception that the Israelis certainly used -something- against Syrian air defence...

[Admiral Valdemar]

I think it's probably massive misinformation; in much the same way that Stuart and the others spent most of the 1980s spending money as fast as it could be printed in a misdirection effort against the Soviet Union.

Or the RAF's night fighter pilots having a special carrot diet, rather than mention radar prototypes and better fire control from the ground control.

What you said about the phased array trick sounds plausible. Certainly more so than hacking and cracking their C3I systems and hijacking the whole air defence network. Not unless those radars can also manipulate electronic signals within the computers and remotely control them. Which would be awesome.

[Pelranius]

I tend to be personally skeptical of such wonderweapons. But since I've heard so much of those China Threat claims of PLA hackers taking over the Pentagon that I've become generally suspicious about the utility of electronic or cyber warfare.

[Resinence]

But since I've heard so much of those China Threat claims of PLA hackers taking over the Pentagon that I've become generally suspicious about the utility of electronic or cyber warfare.

PLA hacker's taking over th pentagon is closer to Cyberwar/Computer Warfare, when most people talk about electronic warfare they mean stuff like... Suter, it doesn't really hack into any code at all, but tricks the electronic device itself, just like missile jamming and ECM/ECCM.

[Resinence]

ghetto edit:

And the idea of hacker's taking over the pentagon remotely is laughable on it's face, the military network is not on the internet, the web servers are not on the same network.

[Pelranius]

ghetto edit:

And the idea of hacker's taking over the pentagon remotely is laughable on it's face, the military network is not on the internet, the web servers are not on the same network.

I always wondered about that. But the enemy still could theoretically entire into military networks, can't they?

[Stuart]

I think it's probably massive misinformation; in much the same way that Stuart and the others spent most of the 1980s spending money as fast as it could be printed in a misdirection effort against the Soviet Union.

That was fun. It worked too.

What you said about the phased array trick sounds plausible. Certainly more so than hacking and cracking their C3I systems and hijacking the whole air defence network. Not unless those radars can also manipulate electronic signals within the computers and remotely control them. Which would be awesome.

Without commenting in specifics on any current U.S. program; as far back as the 1970s there was a lot of discussion about how to disable thing like communications intelligence systems and electronic surveillance systems. One idea (which worked) was to bury a computer virus in the underlying cryptography of a message or other electronic transmission. As long as that transmission was picked up by a friendly receiver, the virus remained inactive. If, however, it was picked up by a hostile receiver and sent to a computer for analysis, the inihibiting code would not present and the virus would become active. It would then do things like (for example) insert all one's electronic data into the threat libraries as "friendly" radars and mess around with IDD codes so that "friendly responses were indentified as hostile and vice versa. In the communications intelligence systems it would fool around with the intercepts so that all the information was corrupted. Even better, if the systems in question were datalinked, the virus would spread via the datalinks - and it was possible to insert coding that would re-route or corrupt those datalinks.

All that was possible 40 years ago using the computers that existed then. It was so scary what could be done that there was a lot of pressure to shut up and say nothing about it.

[Stuart]

And the idea of hacker's taking over the pentagon remotely is laughable on it's face, the military network is not on the internet, the web servers are not on the same network.

That's not how an attacker would get into the system.

[Raj Ahten]

Without commenting in specifics on any current U.S. program; as far back as the 1970s there was a lot of discussion about how to disable thing like communications intelligence systems and electronic surveillance systems. One idea (which worked) was to bury a computer virus in the underlying cryptography of a message or other electronic transmission. As long as that transmission was picked up by a friendly receiver, the virus remained inactive. If, however, it was picked up by a hostile receiver and sent to a computer for analysis, the inihibiting code would not present and the virus would become active. It would then do things like (for example) insert all one's electronic data into the threat libraries as "friendly" radars and mess around with IDD codes so that "friendly responses were indentified as hostile and vice versa. In the communications intelligence systems it would fool around with the intercepts so that all the information was corrupted. Even better, if the systems in question were datalinked, the virus would spread via the datalinks - and it was possible to insert coding that would re-route or corrupt those datalinks.

To be able to pull of such a sophisticated attack on an enemy system, wouldn't you have to know it intimately? If you don't know how thier software and such works, how could you get your virus to mess with the threat registries and so forth?
My only knowledge of this sort of thing is working with my PC, and I know that crackers often design viruses by looking at the code of a program for flaws that they could exploit .

It would seem to my untrained eyes that unless you had examples of the enemy system to work with, viruses you could make to seriously affect their systems wouldn't be able to work. Is SIGINT just that different from normal computer operations?

(Got to admit all I know about the practicalities of SIGINT is that its very complicated, changes every ten minutes, and even most people in the military and intelligence communities know next to nothing about it.)

[Raj Ahten]

Ghetto edit:
For infiltrating enemy networks I could see that perhaps all one has to do is make educated gueses about the system given what you can analze (such as how a system sends out signals, etc), and design an electronic attack based on that. Then it could be a trial and error process until you try something that works. Is that anyhting like close?

[phongn]

You would need relatively sophisticated knowledge of the target architecture and software to pull it off, yes. And hope that the enemy hasn't properly filtered their systems for general-purpose analysis. On principle, I get the general idea (it seems akin to the classic buffer-overflow attack).

[MKSheppard]

To be able to pull of such a sophisticated attack on an enemy system, wouldn't you have to know it intimately? If you don't know how thier software and such works, how could you get your virus to mess with the threat registries and so forth?

Thinking about this. Let's see.

In the 1970s, we had a lot of Soviet hardware easily available to us, from the Israelis; while the Soviets never gave the Egyptians, etc their most advanced SAM systems, we got enough of the basic models through the Israelis to take a close look at them after the 1973 Yom Kippur War.

So it's quite possible that we can affect the basic Soviet SAMs that were widely exported across the world, and still form the basics of most "threat nations" air defenses; since they got them for virtually free during the Cold War and are just too cheap to widely upgrade their networks.

There also might be a small marginal capability against more modern systems, because the general basics might remain the same, because the Russians might rewrite some code here and there to accomodate the new complex or missiles, etc etc; but keep the basics in place -- if it works, why change it?

[Phantasee]

There also might be a small marginal capability against more modern systems, because the general basics might remain the same, because the Russians might rewrite some code here and there to accomodate the new complex or missiles, etc etc; but keep the basics in place -- if it works, why change it?

But if they know the US has taken a look at their systems, they ought to know that it might not work when needed anymore. Which would mean they would change it.

[Stuart]

To be able to pull of such a sophisticated attack on an enemy system, wouldn't you have to know it intimately? If you don't know how thier software and such works, how could you get your virus to mess with the threat registries and so forth? My only knowledge of this sort of thing is working with my PC, and I know that crackers often design viruses by looking at the code of a program for flaws that they could exploit.

I honestly don't know. I do know that some viruses and worms are portable and that they can work on a number of different systems (akin to a civilian virus being able to infect both Apple and IBM-class machines) but the details of how these things work is way beyond my area of expertise. I do know that in the 1980s when we were working on RTADS and IUKADGE, the vulnerability of the datalinks was a very serious consideration.

For a very old version of how this may work, take the battle of Leyte Gulf in 1944. Halsey was heading north to engage what he thought was the man Japanese fleet. Nimitz sent him a message that read "Where is Task Force 34?" A simple query. However, the officer encrypting the message added padding to make decrypting it harder. The post-script padding read "the world wonders". By an error, the padding got added to the real message, making it read "Where is Task Force 34, the world wonders." Turning a simple query into a stinging rebuke. Halsey turned his ships around and Ozawa escaped.

Now, for the sake of illustration, assume the comms officer was really a Japanese spy trying to save Ozawa and we have a picture of how this might work. The message is a datalinked communication, the padding becomes the underlying cryptography. The underlying code contains a message that disables a large part of the system. So, for example, it might be "and all aircraft bearing this IFF code are friendly and can be filtered from the operational display".

It would seem to my untrained eyes that unless you had examples of the enemy system to work with, viruses you could make to seriously affect their systems wouldn't be able to work. Is SIGINT just that different from normal computer operations? (Got to admit all I know about the practicalities of SIGINT is that its very complicated, changes every ten minutes, and even most people in the military and intelligence communities know next to nothing about it.)

Not really because of the way data is handled. Take ESM. We pick up a signal, say a radar transmission. The first thing we do is process that signal and feed it into our threat library. The threat library is a computer archive of radars and the transmission characteristics of those radars. The signal is compared to that archive and a match found, thus identifying the radar (or so the operator hopes; with software controlled radars it isn't that easy). Now, look at what's happened; the signal is in the computer being processed; the two have to be compatible. Now, if there is something very nasty buried in that signal, its in and being worked on, thus the system working on it is vulnerable. That worm or virus might, for example, hijack the threat library and add a whole series of new radars to it labelled as being "friendly". So, our IDF F-15 can fly across hostile airspace with its radar banging away because the F-15s IFF codes are being interpreted as friendly and its radar is also listed as friendly - and we have two complementary sources saying the contact is friendly. Until it drops its bombs.

COMINT could easily work the same way. To decrypt a message it gets fed into a computer (modern computer-based decrypts are very good, they can even break conventional one-time pads). The computer is now working on a message and if there is something nasty buried in that message, the computer is vulnerable. Another way the thing is open is using frequency-agility. Most modern tactical radios are frequency-agile, they hop from frequency to frequency to avoid eavesdropping. The problem is that the network has to be coordinated so everybody hops to the same place - that needs coding buried in the message. If a signal is intercepted that interferes with that coding, the network stops working.

In the case of the raid on Syria, ****my guess**** is that the Israelies played with the IFF codes - probably instructing the air surveillance system that the IDF aircraft were commercial airliners or Syrian Air Force flights. If that's correct, then it was a very simple, small-league operation.

[Einhander Sn0m4n]

Without commenting in specifics on any current U.S. program; as far back as the 1970s there was a lot of discussion about how to disable thing like communications intelligence systems and electronic surveillance systems. One idea (which worked) was to bury a computer virus in the underlying cryptography of a message or other electronic transmission. As long as that transmission was picked up by a friendly receiver, the virus remained inactive. If, however, it was picked up by a hostile receiver and sent to a computer for analysis, the inihibiting code would not present and the virus would become active. It would then do things like (for example) insert all one's electronic data into the threat libraries as "friendly" radars and mess around with IDD codes so that "friendly responses were indentified as hostile and vice versa. In the communications intelligence systems it would fool around with the intercepts so that all the information was corrupted. Even better, if the systems in question were datalinked, the virus would spread via the datalinks - and it was possible to insert coding that would re-route or corrupt those datalinks.

All that was possible 40 years ago using the computers that existed then. It was so scary what could be done that there was a lot of pressure to shut up and say nothing about it.

That sounds precisely exactly like the Cylon Virus from New BSG in both effect and overall transmission mechanism. Really interesting.

[Admiral Valdemar]

That's pretty much how I expected the system to work, by piggybacking hostile code that way, you can potentially toy with any number of otherwise non-networked systems, so long as they aren't in an autistic mode and being silent.

I expect it'd be harder to do once quantum encryption takes off and if a system is so well connected and run that they can cross-reference any friendly or hostile contacts with a central database, so if you want to fool the air defence guys, you have to also fool the computers detailing what flights are active in that area. Anyone picking up a civvie 737 where no airliner should be and where no military craft are will smell a rat.

Being able to remotely alter actual electronic signals in hardware at a fundamental level would be the ultimate in ECM/ECCM, but alas, science fiction for now. You could end a war without firing a single shot, just by telling all hardware to shut down or turn over control to friendlies. I suppose a microwave based EMP weapon would be similar in results, albeit, not as useful.