An audit of weapon systems currently under development by the U.S. Department of Defense has found that many are easy to hack.

The finding comes via a report from the U.S. Government Accountability Office issued today. The agency, which provides nonpartisan information to Congress, based the report on systems testings of a variety of weapons systems ahead of a request to approve $1.66 trillion in DOD funding.

“Testers playing the role of adversary were able to take control of systems relatively easily and operate largely undetected,” the GOA said in a statement. “DOD’s weapons are more computerized and networked than ever before, so it’s no surprise that there are more opportunities for attacks.”

According to the full report, the testers used simple tools and techniques to take control of weapon systems while operating mostly undetected. Embarrassingly, in many cases access was gained from poor password management and unencrypted communications.

In some cases, the flaws were the result of systems running commercial or open-source software where the operators “did not change the default password when the software was installed.”

Stating what should be obvious, the GOA noted that “a successful attack on one of the systems the weapon depends on can potentially limit the weapon’s effectiveness, prevent it from achieving its mission, or even cause physical damage and loss of life.”

The report said the problem starts at the top, saying the DOD has never made security a priority for its weapon systems. As a consequence, nearly all of their mission-critical security systems suffer from vulnerabilities that could allow threat actors to take control and operate the systems while remaining undetected.

Photo: U.S. Navy