Comment Re:Does it matter though? (Score 1) 70
You can bet the UK is making sure that they can't get on the public net now. I'm fairly sure whether the pings got through or not would be a state secret.
Now there are a lot of ways to implement a ping of sorts.
- Advanced ones use an API to send back some telemetry. This could literally be anything in the payload. This is by far the most dangerous.
- A subset would be some sort of REST API on a web service. This has a lot of advantages as you can do geo location tricks to place listeners all over the planet. This is basic http infra type stuff. So China could have receivers outside of the great wall.
- And actual dedicated service with a proprietary interface. Highly unlikely as this poses no advantage over the first and would be handcuffed with missing features that http protocols/implementations offer.
- Using some sort of exfil technique. Such as a structure DNS request to a specific DNS server. ( This is a common exfil technique of nation states. ) This can often work. I would hope however that a DoD environment blocks this. There are a lot of other ways to exfil data through normal basic services. But the article did not mention anything that would imply obfuscated exfil for a ping.
- A simple TCP open socket request. A fairly primitive. This is old school not really used by IoT devices much.
- ICMP ping. An actual ping. But this would likely not be the case as it is a component that was calling home so the odds are that the mac address would not match the component in the end. And ICMP is generally locked down these days.
So I lean to a rest API call. Pure guess but it's by far the easiest to implement. and like you said I would hope this is blocked by the UK DoD. That said drones are evolving very rapidly. So it's highly unlikely they are as security tested as the DoD would like before hitting operational status.
As usual these little "announcements" have a lot more that isn't said than said. The threat board is growing in length for a lot of orgs with this sort of announcement.