Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US passes emergency waiver over fuel pipeline cyber-attack

bbc.com

Post reply on HN
Print view View original

101–110 of 479 posts

Re: US passes emergency waiver over fuel pipeline cyber-attack

#101

Post by rckoepke »

avs733 wrote: post #77
radicaldreamer wrote: post #70

Earlier quoted context omitted.

I have no idea why they would do that unless the system was not airgapped properly or it was hard to untangle the admin network from the control network (in which case, the control network is effectively not airgapped).

Flash drives. I used to work in fabs and every couple of years some tool or other would get a virus, sometimes it spread through the network.

USB ports are generally disabled in BIOS or purposefully physically damaged on most OT systems I've worked on for oil/gas/chemicals. Many places are fond of using epoxy to block the ports.

Re: US passes emergency waiver over fuel pipeline cyber-attack

#102

Post by syops »

ruskimir wrote: post #46
daxaxelrod wrote: post #41

Earlier quoted context omitted.

No we should not. We should hunt down those individuals that are responsible but if we get into this tit for tat escalation pattern it might end poorly for all parties involved.

Yes we should. There is no justification for why we meekly let them have at it cyberspace. It should be pain for pain. Russians will never learn until they feel pain.

I can think of some reasons why we should not retaliate against the Russian government. Perhaps we have more to lose in escalation. I don't know if this is true but it might be. If this is an attack at the behest/approval of the Russian government we don't know why they made the attack. It could be a response to something we did to them. We should not get riled up because what hasn't been reported is likely the real story. We just don't know and as citizens we ought not clamor for our leaders to respond. That sort of clamoring has in the past had very negative consequences.

Re: US passes emergency waiver over fuel pipeline cyber-attack

#103

Post by [deleted] »

xvector wrote: post #96
crumbshot wrote: post #93

Earlier quoted context omitted.

> We should shut down Russian infrastructure as retaliation. How about, instead of causing harm to innocent Russian people by such pointless escalation, the US makes a serious and meaningful effort to secure their critical national infrastructure. As they should have done in the first place.

Yes, let’s meekly sit back and let other countries attack us, only playing defense. Russia caused this. If we shut down Russian infrastructure and Russian civilians get caught in the crossfire, the Russian government can blame themselves. You cannot expect to engage in acts of war without endangering your own citizens to at least some degree. To engage in war is to invite it to your homeland. Hell, if we don’t retali…

[deleted]

Re: US passes emergency waiver over fuel pipeline cyber-attack

#104

Post by edholland »

bob_theslob646 wrote: post #73
boringg wrote: post #53

Earlier quoted context omitted.

Pretty sure china doesn't have the oceans - might want to check up on your stats.

Not to be rude but I'm pretty sure you need to check up on your stats. The Chinese do have the oceans. >Citing the Office of Naval Intelligence, a Congressional Research Service report from March notes that the People’s Liberation Army Navy, or PLAN, was slated to have 360 battle force ships by the end of 2020, dwarfing the U.S. fleet of 297 ships. [1]( https://www.navytimes.com/news/your-navy/2021/04/12/chinas-n...…

without significant aircraft carrier fleet i'm not sure china has dominant control of any seas, despite best efforts in south china seas

[1](https://en.wikipedia.org/wiki/Chinese_aircraft_carrier_progr...)

Re: US passes emergency waiver over fuel pipeline cyber-attack

#105

Post by rckoepke »

tru3_power wrote: post #98
SvenMarquardt wrote: post #92

Earlier quoted context omitted.

Why is the network constructed in such a way that it allows things to spread?

Super common. A lot of companies have this hard on the outside gooey on the inside model (aka flat network structure).

Most petrochemical companies have an onion structure. There are lots of layers of firewalls with what are supposed to be limited communication paths for specific applications.

We need to move to using physical layers where data can only be transmitted in one direction (and then use something like UDP)

Re: US passes emergency waiver over fuel pipeline cyber-attack

#106

Post by crumbshot »

xvector wrote: post #96
crumbshot wrote: post #93

Earlier quoted context omitted.

> We should shut down Russian infrastructure as retaliation. How about, instead of causing harm to innocent Russian people by such pointless escalation, the US makes a serious and meaningful effort to secure their critical national infrastructure. As they should have done in the first place.

Yes, let’s meekly sit back and let other countries attack us, only playing defense. Russia caused this. If we shut down Russian infrastructure and Russian civilians get caught in the crossfire, the Russian government can blame themselves. You cannot expect to engage in acts of war without endangering your own citizens to at least some degree. To engage in war is to invite it to your homeland. Hell, if we don’t retali…

This is the most "keyboard warrior" comment I've ever read.

Re: US passes emergency waiver over fuel pipeline cyber-attack

#107

Post by peteretep »

stolen_biscuit wrote: post #54
david-cako wrote: post #27

Earlier quoted context omitted.

Who was it again that has the most effective intelligence community and military in the world?

Intelligence I'd say probably Russia right? They've made America look quite incompetent the past decade or so. Military I'd say America although I don't think SEAL team 6 is going to be hunting down these attackers

> They've made America look quite incompetent the past decade or so

This itself is American propoganda; the strategy is to be absolutely all over your opponents, knowing that they can't complain about it for fear of looking weak, while complaining loudly about how their meagre attempts are the end of the world, getting public and Congressional support for more spending.

Before the Snowden leaks, someone suggesting the US had the SIGINT capacities they actually did have would have be laughed out of serious circles as a crank, and you better believe they haven't been sat still over the 8 years since.

Re: US passes emergency waiver over fuel pipeline cyber-attack

#108

Post by pamplemoose »

vmception wrote: post #6

I like how they are charging 10% more if you pay with Bitcoin than with Monero. I think commerce would greatly improve if other networks had Tor clients, especially because of the stablecoin and private stablecoin availability as of this year. All EVMs as well as Tendermint networks have no out of the box solutions for Tor nodes and connectivity. But they both have ways for ERC20 tokens to have a great degree of priv…

I recently learned of zkDai[1]. Do you have any thoughts on this or the Aztec protocol?

[1] https://medium.com/aztec-protocol/introducing-zkdai-into-the...

Re: US passes emergency waiver over fuel pipeline cyber-attack

#109

Post by rckoepke »

surround wrote: post #91
jmclnx wrote: post #4

It needs to be asked again, why are critical services on the Internet ? We all know why, companies are chasing profits at any cost, so hiring more people to monitor these systems as the did 40 years ago will lower the execs bonuses. The US Gov should make it clear, if you are a critical service and if your service drops due to items being on the internet, for each occurances 10% of your total revenue (including your…

> Digital Shadows thinks the Colonial Pipeline cyber-attack has come about due to the coronavirus pandemic - the rise of engineers remotely accessing control systems for the pipeline from home.

I would disagree with this. No petrochemical company I've worked with had OT/PLC/SCADA layers enabled for remote login. Other middle layers, like the historian, potentially. But not the control system itself.

It's possible to enable this but knowing the culture at Colonial Pipeline first-hand, I strongly doubt they did this during COVID.

Re: US passes emergency waiver over fuel pipeline cyber-attack

#110

Post by maxqin1 »

peteretep wrote: post #97
ackbar03 wrote: post #78

Earlier quoted context omitted.

Lol this was my first reaction as well, they now have a nation-state on their ass. But that being said its not impossible that this was just a cover for a Russian state-sponsored attempt on US infra

"nation-state" is not just a fancy infosec word for country, and there's some debate as to whether the USA constitutes an actual nation state, rather than a state.

> A nation state is a state in which a great majority shares the same culture and is conscious of it. It has been described as a political unit where the state and nation are congruent. It is a more precise concept than "country", since a country does not need to have a predominant ethnic group. [1]

Interesting.

[1] https://en.wikipedia.org/wiki/Nation_state

Post reply on HN