Live data from Hacker News

US passes emergency waiver over fuel pipeline cyber-attack

bbc.com

31–40 of 479 posts

Re: US passes emergency waiver over fuel pipeline cyber-attack

#31

Something doesn't quite add up. I feel like we don't have the full story: >After seizing the data, the hackers locked the data on some computers and servers, demanding a ransom on Friday. If it is not paid, they are threatening to leak it onto the internet. So... that constitutes a state of emergency? What data would they have that would be so sensitive? More likely they have hooks deep into the operation of the pipe…

> Or, rather, they may be having trouble restoring operations without paying the ransom.

Usually your only option with a ransomware attack is restoration from backups. So no backups or bad backups means no system.

It certainly sounds like this may be the case given that it’s triggering emergency orders. If so, it is being omitted from official accounts.

Re: US passes emergency waiver over fuel pipeline cyber-attack

#32
post #8

Colonial Pipeline precisely does keep it's control network disconnected from the internet - the only thing that was ransomwared is their corporate network. They shut the pipelines down voluntarily to prevent further spread.

Please explain why shutting down the pipeline will contain the hack?

Re: US passes emergency waiver over fuel pipeline cyber-attack

#34

I like how they are charging 10% more if you pay with Bitcoin than with Monero. I think commerce would greatly improve if other networks had Tor clients, especially because of the stablecoin and private stablecoin availability as of this year. All EVMs as well as Tendermint networks have no out of the box solutions for Tor nodes and connectivity. But they both have ways for ERC20 tokens to have a great degree of priv…

What are EVMs, ERC2, and sDAI? I do not believe your objective is to confuse or obstruct, but additional context would help understand the unique value of your contribution. This is coming from someone with a recent BSc in Computer Engineering yet still completely unaware of these acronyms & references.

Only a few universities are teaching this stuff right now. In any case:

EVM is "Ethereum Virtual Machine", a similar concept to the JVM "Java Virtual Machine". EVMs are one the most common technology for deployment of arbitrary execution within distributed networks. These kinds of functions and applications are colloquially called smart contracts. The biggest distributed network with this technology being simply called "Ethereum" or "Ethereum mainnet". But any code deployed on Ethereum mainnet is deployable on any other EVM environment, such as Polygon, Avalanche, Binance Smart Chain, Tron, Ethereum Classic, Hashgraph, or Quorum which was stewarded by JP Morgan for a few years for internal enterprise use.

With the other common smart contract network being Tendermint also colloquially referred to as Cosmos.

There are a couple of standard classes with a certain protocol of functions on all these networks. One standardized class is called ERC20, which is a fungible token standard. Deploying this kind of class ensures that you have created an asset with a name, ticker symbol, quantity, and a transfer function. Therefore ERC20 just is a quick way to refer to an additional asset. Assets that represent something the market wants or is familiar with or is redeemable for something the market likes therefore have certain monetary values associated with them. Some communities representing other networks have different protocol names for the same concept, for example, the Binance Smart Chain community has a token standard called BEP20 which is mostly contrived marketing but it could also have tweaks to the ERC20 standard, you have to read them. No different than reading the IETF's REST protocol standard for each function, and then seeing how it is implemented slightly differently across different browsers, devices and frameworks.

DAI is an ERC20 asset that maintains convertibility with $1 US Dollar. It is collateralized by a basket of assets, some completely digital assets and some that are backed by real world assets from centralized issuers.

When it comes to ERC20 naming styles, the market has resorted to prefixes for now.

So on the Secret Network (which uses Tendermint/Cosmos technology instead of EVM), assets that enter it from bridges are called sAssets. So DAI that enters the Secret Network would be sDAI. Where it will inherit the private nature of the network. Specifically the current state of the functions such as quantity, transfer(to, from) would all be unknown from looking at the blockchain.

Re: US passes emergency waiver over fuel pipeline cyber-attack

#36
post #8

Colonial Pipeline precisely does keep it's control network disconnected from the internet - the only thing that was ransomwared is their corporate network. They shut the pipelines down voluntarily to prevent further spread.

If we define critical system as "necessary to the operation of the business" then the corporate system is absolutely critical. It doesn't matter if the SCADA system is airgapped if you can shut down the capability by crashing the corporate systems.

Re: US passes emergency waiver over fuel pipeline cyber-attack

#37
Breaking: U.S. government is inept at carrying out procedures which are standard in the technology industry, including the proper safeguarding of important tools & data, despite a budget larger than any other entity on earth.

Not Breaking: Citizens’ disappointment in the aforementioned, particularly given their direct contribution to said budget.

The Unsaid: Much of this will not change, unless incentives are realigned.

Re: US passes emergency waiver over fuel pipeline cyber-attack

#38
post #4

It needs to be asked again, why are critical services on the Internet ? We all know why, companies are chasing profits at any cost, so hiring more people to monitor these systems as the did 40 years ago will lower the execs bonuses. The US Gov should make it clear, if you are a critical service and if your service drops due to items being on the internet, for each occurances 10% of your total revenue (including your…

We should also shut down Russian infrastructure through cyberattacks. The Russian government supports DarkSide.

Re: US passes emergency waiver over fuel pipeline cyber-attack

#39
post #25

The government is incompetent, especially when it comes to cybersecurity. It will be interesting to see how this plays out.

Who was it again that has the most effective intelligence community and military in the world?

Pound for pound I'd say Israel.

In absolute terms I'm pretty sure China has us at sea and in cyber so...

Not the US

Post reply on HN