US weapons systems can be 'easily hacked'

Most weapons systems, including the F-35 jet, were found to be vulnerable to cyber-attack

Some of the most cutting-edge weapons in the US's military arsenal can be "easily hacked" using "basic tools", a government report has concluded.

The Government Accountability Office (GAO) found "mission-critical" cyber-vulnerabilities in nearly all weapons systems tested between 2012 and 2017.

That includes the newest F-35 jet as well as missile systems.

In the report, Pentagon officials said they "believed their systems were secure", NPR reported.

The committee's members expressed concerns about how protected weapon systems were against cyber-attacks.

The report's main findings were:

• the Pentagon did not change the default passwords on multiple weapons systems - and one changed password was guessed in nine seconds

• a team appointed by the GAO was able to easily gain control of one weapons system and watch in real time as the operators responded to the hackers

• it took another two-person team only one hour to gain initial access to a weapons system and one day to gain full control

• many of the test teams were able to copy, change or delete system data with one team downloading 100 gigabytes of information

The GAO added that the Pentagon "does not know the full scale of its weapons system vulnerabilities".

The Pentagon has not issued a detailed response to the 50-page report but the document quoted officials as saying that some of the security test results "were unrealistic".

Ken Munro, an expert at security firm Pen Test Partners, said he was "not at all surprised" by the findings.

"It takes a long time to develop a weapons system, often based on iterations of much older systems. As a result, the components and software can be based on very old, vulnerable code.

"Developers often overlook 'hardening' the security of systems after they've got them operating, with the philosophy, 'it's working, so don't mess with it'.

"However, that's no excuse. This report shows some very basic security flaws that could easily have been addressed by changing passwords and keeping software up-to-date."