attack
There has been talks in the Star Wars community about how the engineer of the DS-1 Orbital Battle Station or more fondly known as the “Death Star” failed miserably in keeping the station operational. From the get go, the organization known as the Empire a.k.a. Dark Side had invested in a project that was cursed and doomed. And this time around, I don’t think the engineers are the only ones to be blamed for the failure, I believe it’s the entire Empire’s fault for the targeted attack on its Ultimate Weapon.
- The DS-1 Orbital Battle Station
Better known as the Death Star or Death Star I, and known to the public as the Imperial Planetary Ore Extractor by the propaganda department, it was a massive Imperial battle station/superweapon with a diameter of 120 kilometres designed to enforce law and order throughout the Empire with the threat of planetary destruction.
Death Star, was divided into two hemispheres, each subdivided into 12 bridge-controlled zones. The northern hemisphere held the main armament of the station, a fearsome superlaser. This weapon had the external appearance of a bowl several kilometres wide. The Death Star was said to comprise eighty-four separate internal levels, stacked south to north. Each level was separated into 257 sub-levels. A nominal number of sub-levels were then to be stacked around the surface of the sphere, encompassing the inner stacked levels. Facilities included parks, shops, and other amenities for the Human crew, as well as numerous maintenance necessities such as trash compactors. The entire hull of the planetoid was covered in quadanium steel.
The Death Star’s design included a small but significant flaw: an exposed thermal exhaust port. Also, a downside to the instalment of the super laser was that the Death Star had to remove all but the most rudimentary shielding capabilities in order to achieve such destructive power. However, its surface-to-air defences were sufficient to make up for its lack of efficient shielding. [1]
From this point of view alone, the Death star was a failed project from the start. But let us for the sake of argument disregard it’s exhaust port & shielding flaws and look at the infrastructure’s security.
- Security Flaws of DS-1
The empire was really bad at cybersecurity of its greatest infrastructure, despite the resources and power. The destruction was brought by a sheer negligence of the commanding force and lax cybersecurity measures. And, of course, one of the apparent reasons was the fact that troopers were abysmally undertrained (including their incredibly low shooting skills) and susceptive toward social engineering.
The Empire discovered its greatest vulnerability only after it was attacked, while the rebels, having spent mere hours on analyzing the plans, managed to find a vulnerability and develop a functional exploit. It’s especially striking since the Empire enjoys much more resources to have executed a security audit and pentested the station during its development.
Image source: https://business.kaspersky.com/star-wars-cybersecurity-problems/6392/
- Cybersecurity Parallels in Star Wars
1)Attack on the Death Star was an APT Attack.
The rebel forces had detailed insider knowledge of the DS-1 (Thanks to R2D2 – more on that later). They studied their opponents and used stolen plans to design an attack vector which could evade the strong perimeter defence and used the main vulnerability which was the exhaust ports.
2)Not much training and certification required
Where most experienced fighter pilots failed to hit the target, amateur fighter pilot Luke Skywalker was able to harness the power of the force to help him hit the target spot on!
3)Millennium Falcon as a Trojan Horse
Luke, Han, Chewbacca and Obi-Wan infiltrated the Death Star by hiding themselves inside smuggling compartments in the Millennium Falcon. Using this kind of Trojan horse attack, they were able to disable the tractor beam, free Princess Leia and take off.
4)R2D2 – Ultimate Hacker
R2D2 was a droid that was well over 30 years old, and without any hassle gets access to the station’ systems and finds the list of prisoners kept in the on-board isolator. R2 Could also plug itself into any computer or any ports and easily gain access to the main control systems. He was able to find Princess Leia, locate the tractor beam controls and shut down all the garbage mashers on the detention level.
5)C3PO – Ultimate Social Engineer
Being a bumbling protocol droid that panics at the drop of a pin, and acts like he doesn’t know what’s happening, C3PO was able to look harmless and slip past security. C3PO was always a great distraction while the rest of our “heroes” go on about their heroic business.
6)Why can’t the Empire learn from previous mistakes
The Empire built another Death Star after DS-1, and that too was destroyed by another attack from small ships. Maybe they patched the vulnerable exhaust port, but they still didn’t develop a strong defence against fighters (or the Millennium Falcon and even R2D2).
According to Alex Grisby, Assistant Director for Digital & Cyberspace Policy Program at the Council on Foreign Relations, three critical cybersecurity improvements would have made it much more difficult–if not impossible–for the Rebel Alliance to defeat the Death Star[2]:
1)Limiting Access Controls:
This is probably the Empire’s biggest vulnerability. Based on what we know from R2-D2 plugging himself into every foreign computer imaginable, the Empire didn’t employ basic access controls. Anyone plugging into an Empire-controlled network could find out anything they wanted to know. Good access controls allow people to only have access to computer functions that are necessary for them to do their jobs and should prevent anyone that connects to a network from accessing the whole thing.
2)Two Factor Authentication:
The lack of two factor authentication is also a huge problem for the Empire. Two factor authentication essentially requires someone to use two credentials to access a system or device, like a password and security token, instead of a simple password. Had the Empire actually deployed two factor authentication throughout the Death Star, it would have been impossible for Ben Kenobi to deactivate the tractor beam.
3)Encrypting Sensitive Data:
The Empire has a patchy record with encryption. In Episode 5, they actually seem to use it. When the Rebels discover an unknown transmission on Hoth early in the movie, they can’t decipher its contents. C-3PO, whose primary function is translation and protocol, admits to the Rebel radio operator that it could be an imperial code but doesn’t provide any more information, leading us to believe that the message is encrypted. If only the Empire had used encryption with all of their sensitive data, like the blueprints for the Death Star. It’s also pretty appalling that they didn’t encrypt the fact that they had deactivated the hyperdrive on the Falcon in Episode 5. Even with sloppy access permissions, encrypting that fact meant it would have taken longer for R2D2, Chewie and Lando to figure out what was wrong with the Falcon as they escaped Cloud City.
With proper cybersecurity protocols in place, the Death Star would have not been blown up and would have been the ultimate weapon ever created in the galaxy. While the Star Wars universe is science fiction, let’s not forget that in reality, critical infrastructures in our country share the same vulnerabilities as the Death Star as well. It’s time for us to rise up and practice cybersafety and be steps ahead of cyber criminals. May the force be with you!
Notes:
1.DS-1 Orbital Battle Station – Wookiepedia
2.What Star Wars can teach us about cyber security – National interest
Tips