Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cyber Attackers Crash Muni Computer System Across SF

sanfrancisco.cbslocal.com

Post reply on HN
Print view View original

21–30 of 43 posts

Re: Cyber Attackers Crash Muni Computer System Across SF

#21

Post by ZanyProgrammer »

pdx6 wrote: post #12

I am on the Citizen's Advisory Council for the SFMTA. I also happen to be specialize in computer security! I have asked SFMTA staff to have this item put on a committee agenda so we can get a full post mortem of what happened. It will likely be a few months before we get any real details. Since people are asking... The ticket kiosks run Win2k, the subway display screens run Flash (on Win2k I imagine), and the SFMuniC…

As another random fact, the screens in BART stations showing upcoming departures are ASP.Net websites. I once saw the generic error config page (At least I hope I am remembering correctly that it was the generic user facing error page).

Re: Cyber Attackers Crash Muni Computer System Across SF

#22

Post by mikeash »

cft wrote: post #18
dkarapetyan wrote: post #16

Earlier quoted context omitted.

Why is the response so slow? I mean why can't they just replace everything in the ticket kiosks and then restore the central system from a backup on new machines? 100% secure systems I understand are pipe dreams but at least the mitigation and response in case of failures and hacks should not be so long.

>Why is the response so slow? Socialism. Not Swedish post capitalism, but the Soviet style, intolerant to dissent. Do you know that San Francisco has 10 billion dollar budget and over 30,000 city employees? And they want more.

Perhaps technically correct, but totally lacking in any explanatory power. It's one step short of explaining it as "because of physics." True, but not useful.

Re: Cyber Attackers Crash Muni Computer System Across SF

#23

Post by s_q_b »

eridius wrote: post #13
s_q_b wrote: post #7

Earlier quoted context omitted.

From the text, it is pretty clear he wants people to think he's from Russia. From this I conclude two things: 1. He's not Russian. 2. This a good hacker but an amateur at OPSEC.

Just because you think the message looks like it suggestions a Russian hacker doesn't mean that it isn't in fact Russian. Sometimes a cigar is just a cigar.

This is a personal opinion based on experience, speaking for myself alone, made with access only to public information.

Take it for what you will.

Re: Cyber Attackers Crash Muni Computer System Across SF

#24

Post by pdx6 »

dkarapetyan wrote: post #16
pdx6 wrote: post #12

I am on the Citizen's Advisory Council for the SFMTA. I also happen to be specialize in computer security! I have asked SFMTA staff to have this item put on a committee agenda so we can get a full post mortem of what happened. It will likely be a few months before we get any real details. Since people are asking... The ticket kiosks run Win2k, the subway display screens run Flash (on Win2k I imagine), and the SFMuniC…

Why is the response so slow? I mean why can't they just replace everything in the ticket kiosks and then restore the central system from a backup on new machines? 100% secure systems I understand are pipe dreams but at least the mitigation and response in case of failures and hacks should not be so long.

The response is only slow from my side because this is a public meeting that has notification requirements. I have to set agendas about a month in advance and allow time for staff to create a presentation.

Internally, the SFMTA staff will do whatever their immediate work is to fix the hack.

Re: Cyber Attackers Crash Muni Computer System Across SF

#25

Post by [deleted] »

cft wrote: post #18
dkarapetyan wrote: post #16

Earlier quoted context omitted.

Why is the response so slow? I mean why can't they just replace everything in the ticket kiosks and then restore the central system from a backup on new machines? 100% secure systems I understand are pipe dreams but at least the mitigation and response in case of failures and hacks should not be so long.

>Why is the response so slow? Socialism. Not Swedish post capitalism, but the Soviet style, intolerant to dissent. Do you know that San Francisco has 10 billion dollar budget and over 30,000 city employees? And they want more.

[deleted]

Re: Cyber Attackers Crash Muni Computer System Across SF

#26

Post by [deleted] »

dkarapetyan wrote: post #16
pdx6 wrote: post #12

I am on the Citizen's Advisory Council for the SFMTA. I also happen to be specialize in computer security! I have asked SFMTA staff to have this item put on a committee agenda so we can get a full post mortem of what happened. It will likely be a few months before we get any real details. Since people are asking... The ticket kiosks run Win2k, the subway display screens run Flash (on Win2k I imagine), and the SFMuniC…

Why is the response so slow? I mean why can't they just replace everything in the ticket kiosks and then restore the central system from a backup on new machines? 100% secure systems I understand are pipe dreams but at least the mitigation and response in case of failures and hacks should not be so long.

[deleted]

Re: Cyber Attackers Crash Muni Computer System Across SF

#27

Post by nickthemagicman »

cft wrote: post #18
dkarapetyan wrote: post #16

Earlier quoted context omitted.

Why is the response so slow? I mean why can't they just replace everything in the ticket kiosks and then restore the central system from a backup on new machines? 100% secure systems I understand are pipe dreams but at least the mitigation and response in case of failures and hacks should not be so long.

>Why is the response so slow? Socialism. Not Swedish post capitalism, but the Soviet style, intolerant to dissent. Do you know that San Francisco has 10 billion dollar budget and over 30,000 city employees? And they want more.

It's fixed. It took the Red Army one day. Not bad.

http://www.sfchronicle.com/news/article/Muni-back-to-normal-...

Re: Cyber Attackers Crash Muni Computer System Across SF

#28

Post by grogenaut »

dkarapetyan wrote: post #16
pdx6 wrote: post #12

I am on the Citizen's Advisory Council for the SFMTA. I also happen to be specialize in computer security! I have asked SFMTA staff to have this item put on a committee agenda so we can get a full post mortem of what happened. It will likely be a few months before we get any real details. Since people are asking... The ticket kiosks run Win2k, the subway display screens run Flash (on Win2k I imagine), and the SFMuniC…

Why is the response so slow? I mean why can't they just replace everything in the ticket kiosks and then restore the central system from a backup on new machines? 100% secure systems I understand are pipe dreams but at least the mitigation and response in case of failures and hacks should not be so long.

It's been what, 2 days, over a holiday weekend? Where do they get that many new computers and what does it cost, is that in the budget? Are they insured? Do they have the staff on hand to fix it? Do they even know what the fix actually is? If they rolled out a bunch of new hardware how would they know it wouldn't just get re-infected?

Are you going to stomach a fare hike or increased taxes for a computer system swap over to do an emergency computer replacement for the whole system (if it was even possible)?

You really expect MUNI to handle a breach better and faster than tech savvy organizations like Yahoo, LinkedIn, etc (in comparison to MUNI) who had breaches and didn't even let us know for months or years.

Sony, for example, had PSN down for almost 2 MONTHS while they determined the extent of the hack and fixed it back in 2011.

Re: Cyber Attackers Crash Muni Computer System Across SF

#29

Post by pdx6 »

grogenaut wrote: post #28
dkarapetyan wrote: post #16

Earlier quoted context omitted.

Why is the response so slow? I mean why can't they just replace everything in the ticket kiosks and then restore the central system from a backup on new machines? 100% secure systems I understand are pipe dreams but at least the mitigation and response in case of failures and hacks should not be so long.

It's been what, 2 days, over a holiday weekend? Where do they get that many new computers and what does it cost, is that in the budget? Are they insured? Do they have the staff on hand to fix it? Do they even know what the fix actually is? If they rolled out a bunch of new hardware how would they know it wouldn't just get re-infected? Are you going to stomach a fare hike or increased taxes for a computer system swap…

My understanding is that the SFMTA has contractors on call to fix this. The machines are probably contracted out to a third party. I'll get to find out soon enough for sure!

Re: Cyber Attackers Crash Muni Computer System Across SF

#30

Post by grogenaut »

pdx6 wrote: post #29
grogenaut wrote: post #28

Earlier quoted context omitted.

It's been what, 2 days, over a holiday weekend? Where do they get that many new computers and what does it cost, is that in the budget? Are they insured? Do they have the staff on hand to fix it? Do they even know what the fix actually is? If they rolled out a bunch of new hardware how would they know it wouldn't just get re-infected? Are you going to stomach a fare hike or increased taxes for a computer system swap…

My understanding is that the SFMTA has contractors on call to fix this. The machines are probably contracted out to a third party. I'll get to find out soon enough for sure!

My point is that none of this is instant. I'd be very impressed if it was all back up by Monday, next Monday if it required the hardware to all be swapped. We're dealing with real physical items here, not spinning up cloud instances.
Post reply on HN