Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US passes emergency waiver over fuel pipeline cyber-attack

bbc.com

Post reply on HN
Print view View original

131–140 of 479 posts

Re: US passes emergency waiver over fuel pipeline cyber-attack

#131

Post by QuarterReptile »

darkerside wrote: post #65
jmclnx wrote: post #4

It needs to be asked again, why are critical services on the Internet ? We all know why, companies are chasing profits at any cost, so hiring more people to monitor these systems as the did 40 years ago will lower the execs bonuses. The US Gov should make it clear, if you are a critical service and if your service drops due to items being on the internet, for each occurances 10% of your total revenue (including your…

> companies are chasing profits at any cost What does that mean? This was addressed in the article. Critical services are on the internet because remote workers need access to them. I don't see how profits factor into it.

Without the overhead of reaching many locations, fewer engineers/technicians can more efficiently operate the whole thing remotely.

Re: US passes emergency waiver over fuel pipeline cyber-attack

#132

Post by mensetmanusman »

rhodozelia wrote: post #120
mensetmanusman wrote: post #83

Earlier quoted context omitted.

Those remote workers wouldn’t have to be ‘remote’ if there were other workers hired on site.

Many sites are in the middle of nowhere so it is inconvenient to go to them, so accessing them over a network saves a lot of travel time and cost.

This is true for nuclear weapons infrastructure. Paying for commutes and lodging are used there, might be useful to consider?

Re: US passes emergency waiver over fuel pipeline cyber-attack

#133

Post by JackFr »

jmclnx wrote: post #4

It needs to be asked again, why are critical services on the Internet ? We all know why, companies are chasing profits at any cost, so hiring more people to monitor these systems as the did 40 years ago will lower the execs bonuses. The US Gov should make it clear, if you are a critical service and if your service drops due to items being on the internet, for each occurances 10% of your total revenue (including your…

> The US Gov should make it clear, if you are a critical service and if your service drops due to items being on the internet, for each occurances 10% of your total revenue (including your parent companies) are forfeited.

Make it a crime to pay the ransom in a ransomware attack.

Make it a crime to fail to report a ransomware attack in a timely manner.

Ransomware attacks (and companies with poor security practices) will go away.

Re: US passes emergency waiver over fuel pipeline cyber-attack

#134

Post by rckoepke »

mbreese wrote: post #123
rckoepke wrote: post #81

Earlier quoted context omitted.

I built some of the SCADA and IT systems for Colonial Pipeline. Many industrial SCADA systems (nearly all) send data from their "OT" systems (PLC/DCS/SCADA) to their "IT" and business layers (Historians/Timeseries Databases, Dashboards, Power BI/etc). This almost always happens through a two-way link (think TCP/IP, HTTP). While the software should not allow data flow backwards, the hardware absolutely does. So how mu…

I’m curious — how would something like a data-diode work in real life? It makes sense, but what about something like TCP where the sending side needs the ability to receive ACK messages? Is a firewall (dedicated, if need be) enough? Or would this be some other kind of physical interface that took some kind of read-only data (serial?) and sent it up the layers using TCP/IP, where only this box would be at risk? Edit:…

TCP would not be possible if your physical layer doesn't support two-way communication. I think UDP would.

Firewalls are currently used, and probably generally configured well. Petrochemical companies have a many-layered onion security strategy with minimal communication paths through the firewalls. Generally you might have 4-8 layers of firewalls from public facing internet to the PLC/DCS/SCADA. Administrative people might VPN 1-2 layers deep and engineers would at worst get remote access to the historian, 1-2 firewall layers above the PLC/DCS/SCADA.

It's my professional opinion that firewalls are not good enough for critical infrastructure. Even a completely air-gapped system was hacked thoroughly over a decade ago in Iran (See Stuxnet).

Your suggestion would suffice, if that box ("gateway", in the IoT parlance) was connected with a one way physical connection to the SCADA system over serial or what-have-you. Then it could communicate with TCP using existing application stacks.

I am designing a system like this at my current job, where luckily we are a small enough team so people have genuinely listened to my suggestions about this.

However, good engineers often disagree with me. I may be overly zealous on this particular issue and I take a lot of criticism about how dogmatic I am at times. I'm not a senior engineer by any stretch.

Re: US passes emergency waiver over fuel pipeline cyber-attack

#135

Post by hanniabu »

JackFr wrote: post #133
jmclnx wrote: post #4

It needs to be asked again, why are critical services on the Internet ? We all know why, companies are chasing profits at any cost, so hiring more people to monitor these systems as the did 40 years ago will lower the execs bonuses. The US Gov should make it clear, if you are a critical service and if your service drops due to items being on the internet, for each occurances 10% of your total revenue (including your…

> The US Gov should make it clear, if you are a critical service and if your service drops due to items being on the internet, for each occurances 10% of your total revenue (including your parent companies) are forfeited. Make it a crime to pay the ransom in a ransomware attack. Make it a crime to fail to report a ransomware attack in a timely manner. Ransomware attacks (and companies with poor security practices) wi…

Just like all other laws that companies break, they'll just get a slap on the wrist and continue their ways

Re: US passes emergency waiver over fuel pipeline cyber-attack

#136

Post by wutXthree »

JackFr wrote: post #133
jmclnx wrote: post #4

It needs to be asked again, why are critical services on the Internet ? We all know why, companies are chasing profits at any cost, so hiring more people to monitor these systems as the did 40 years ago will lower the execs bonuses. The US Gov should make it clear, if you are a critical service and if your service drops due to items being on the internet, for each occurances 10% of your total revenue (including your…

> The US Gov should make it clear, if you are a critical service and if your service drops due to items being on the internet, for each occurances 10% of your total revenue (including your parent companies) are forfeited. Make it a crime to pay the ransom in a ransomware attack. Make it a crime to fail to report a ransomware attack in a timely manner. Ransomware attacks (and companies with poor security practices) wi…

>Make it a crime to fail to report a ransomware attack in a timely manner.

You mean like "18 U.S. Code § 4 - Misprision of felony" [0]?

[0] https://www.law.cornell.edu/uscode/text/18/4

Re: US passes emergency waiver over fuel pipeline cyber-attack

#137

Post by vmception »

jay_kyburz wrote: post #82
vmception wrote: post #6

I like how they are charging 10% more if you pay with Bitcoin than with Monero. I think commerce would greatly improve if other networks had Tor clients, especially because of the stablecoin and private stablecoin availability as of this year. All EVMs as well as Tendermint networks have no out of the box solutions for Tor nodes and connectivity. But they both have ways for ERC20 tokens to have a great degree of priv…

Is it illegal to pay the ransom?

There is an argument for that. Haven't heard of prosecutions for doing so.

Re: US passes emergency waiver over fuel pipeline cyber-attack

#138

Post by NaturalPhallacy »

>The gang even has a website on the dark web where it brags about its work in detail, listing all the companies it has hacked and what was stolen, and an "ethics" page where it says which organisations it will not attack.

And yet they don't give the URL.

I wanna see this page. Does anyone have it?

Re: US passes emergency waiver over fuel pipeline cyber-attack

#139

Post by lathiat »

mbreese wrote: post #123
rckoepke wrote: post #81

Earlier quoted context omitted.

I built some of the SCADA and IT systems for Colonial Pipeline. Many industrial SCADA systems (nearly all) send data from their "OT" systems (PLC/DCS/SCADA) to their "IT" and business layers (Historians/Timeseries Databases, Dashboards, Power BI/etc). This almost always happens through a two-way link (think TCP/IP, HTTP). While the software should not allow data flow backwards, the hardware absolutely does. So how mu…

I’m curious — how would something like a data-diode work in real life? It makes sense, but what about something like TCP where the sending side needs the ability to receive ACK messages? Is a firewall (dedicated, if need be) enough? Or would this be some other kind of physical interface that took some kind of read-only data (serial?) and sent it up the layers using TCP/IP, where only this box would be at risk? Edit:…

I have heard some plane infotainment systems use a 1-way optical link to solve this problem to get the speed/altitude/etc to the displays. It just receives the data as a downlink (no 2-way communications) and being optical its electrically isolated as well as impossible to transmit or even interfere the other way.

Re: US passes emergency waiver over fuel pipeline cyber-attack

#140

Post by SvenMarquardt »

sidlls wrote: post #67
daxaxelrod wrote: post #41

Earlier quoted context omitted.

No we should not. We should hunt down those individuals that are responsible but if we get into this tit for tat escalation pattern it might end poorly for all parties involved.

And if “the individuals” turn out to be operatives of the Russian government? I find as world events unfold these last few years I have drifted away from my isolationist/non-interventionist views. I wouldn’t say I’d advocate for a military response (either electronic or physically destructive) at this point, but I wouldn’t think badly of our government if they did something like that. Americans have become a rather s…

They've already succeeded. America is already unprecedentedly divided and demoralised.

“One need not destroy one's enemy. One need only destroy his willingness to engage.”

― Sun Tzu

Post reply on HN