On Wednesday, Kenneth Lipp, a contributor to the Daily Beast, was doing what amounts to a random search on the security search engine Shodan when he discovered what appears to be a Web console for full-motion video feeds from two Predator drones.
The website Lipp found bears the logos of the National Reconnaissance Office, the National Geospatial-Intelligence Agency’s (NGA’s) Aerospace Data Facility-East, and the Washington University Cortex Innovation Center—an incubator that has partnered with NGA. The site displayed streaming video from drones named “Ranger1” and “Bonker,” apparently flying somewhere over the Gulf of Mexico along the coast of Florida. So he tweeted and blogged about it. Soon, many were watching the same thing: aerial surveillance video of boats speeding across the Gulf’s waters.
Ars found another instance of the same Web video interface with the same Shodan search. And that instance of the FMV stream was configured to present seven video sources. One of those streams was named “DPSCaravan,” apparently in reference to the Cessna Caravan used by the FBI and other law enforcement agencies for surveillance flights, as well as by units of the Air Force’s 1st Special Operations Group based at Elgin Air Force Base in Florida. The Air Force uses the Cessnas for for counterterrorism and intelligence collection.
The site’s header includes a “(U)” marker to indicate that it is unclassified. Based on latitude and longitude coordinates from the video display, the video appears to be a drone or other aircraft flying off the Gulf Coast of Florida, east of Pensacola. Google Earth KML data feeds from the site purport to provide both live location data for each full-motion video platform and “DGS2 Generated Tracks.” [DGS-2 (Distributed Ground System-2) is an Air Force site for the Air Force’s implementation of the Distributed Common Ground System (DCGS), an geospatial intelligence information sharing network.] There’s even an RSS feed for drone telemetry data.
But something is particularly dodgy about the whole thing. An analysis of the site and another similar source found independently by Ars indicate the video is likely video from a military exercise staged in February by Elgin Air Force Base. The Internet Protocol addresses associated with the first site are for a Cox Internet customer in Omaha, Nebraska. The site found by Ars with the same Shodan search was at an IP address associated with “Cosentry.net LLC,” an Omaha-based data center operator acquired by the Bellevue, Nebraska-based cloud provider TierPoint. And there are pointers in the code for the site to a host named “fmv.aviture.ninja.”
As Ars and Lipp probed further into the data around the site, Lipp’s original assessment began to unravel. Following the URLs, and a little creative Google searching, revealed that the video sites were running on servers owned by Aviture, a company that provided geospatial intelligence software to the Department of Defense and other government and commercial customers.
One of Aviture’s products is SIRIS (Surveillance Intelligence Reconnaissance Information System), a Web-based console that “ensures data discovery for mission planning, for mission execution, and for post-mission analysis, supporting near real-time collaboration of friendly and enemy force locations across the battlefield.drone operations,” the company’s website explains. SIRIS came out of a program from the Air Force’s Intelligence, Surveillance and Reconnaissance Innovations Directorate, and it won a US Geospatial Intelligence Foundation Achievement Award in 2015.
The “FMV” sites, then, are apparently prototype or demo pages set up by Aviture on public servers without explicit Web addresses. While they’re clearly unclassified, they’re not intended for public viewing. They may have been part of a collaboration with the NGA and the Washington University CiC incubator.
Ars reached out to Aviture, as well as to the NGA, for comment on the sites. If and when they reply, we’ll update this story.
Source: SANS ISC SecNewsFeed @ May 5, 2017 at 06:24AM