It's my understanding that Dark Fail is a Russian criminal gang and that Russia does not extradite, stop, or punish these criminal gangs. To me that makes the Russian government culpable and this an act of war.
where did you get this understanding?
US passes emergency waiver over fuel pipeline cyber-attack
231–240 of 479 posts
Re: US passes emergency waiver over fuel pipeline cyber-attack
#232Earlier quoted context omitted.
Yes we should. There is no justification for why we meekly let them have at it cyberspace. It should be pain for pain. Russians will never learn until they feel pain.
I can think of some reasons why we should not retaliate against the Russian government. Perhaps we have more to lose in escalation. I don't know if this is true but it might be. If this is an attack at the behest/approval of the Russian government we don't know why they made the attack. It could be a response to something we did to them. We should not get riled up because what hasn't been reported is likely the real…
We can entirely, safely remove Russia from the global Internet and we can do it trivially. That's exactly what we should do if they press attacks too far: isolate them. They have the increasingly government controlled Runet to restrict their people's access to the outside world, we should barricade them in.
Their economy is small, close to meaningless. It's nearly a rounding error at this point in the global economy and it'll continue to shrink in that relationship. The sole thing to be concerned about with Russia is their nuclear arsenal.
Re: US passes emergency waiver over fuel pipeline cyber-attack
#233Re: US passes emergency waiver over fuel pipeline cyber-attack
#234It's my understanding that Dark Fail is a Russian criminal gang and that Russia does not extradite, stop, or punish these criminal gangs. To me that makes the Russian government culpable and this an act of war.
> and this an act of war What an absurd statement. And what do you suggest we do? Attack them and hope they don't respond with nukes?
Re: US passes emergency waiver over fuel pipeline cyber-attack
#235Earlier quoted context omitted.
Yes, let’s meekly sit back and let other countries attack us, only playing defense. Russia caused this. If we shut down Russian infrastructure and Russian civilians get caught in the crossfire, the Russian government can blame themselves. You cannot expect to engage in acts of war without endangering your own citizens to at least some degree. To engage in war is to invite it to your homeland. Hell, if we don’t retali…
I was a child when 9/11 happened but I still remember the experts on TV assuring us that Iraq had those weapons of mass destruction.
Re: US passes emergency waiver over fuel pipeline cyber-attack
#236Earlier quoted context omitted.
> US Gov should make it clear, if you are a critical service and if your service drops due to items being on the internet, for each occurances 10% of your total revenue (including your parent companies) are forfeited This sounds good in theory but suffers from the cobra effect [1]; you think you’re incentivising security. You’re actually pushing obscurity. Colonial preëmptively shut down its pipe to prevent physical…
> Attach a fine to the discovery and disclosure and you disincentivise that prudence. Sue them. Failure to disclose key documents in the discovery phase of a trial carries hefty fines and jailtime. And quadruple the fine for misrepresenting the cause. People act like the government doesn't have the power of subpoena. They can absolutely compel you to tell the truth.
These systems are RIDDLED with the WORST outdated crap you can imagine. Absolute insane hoop jumping so plenty of pressure to work around security just to get jobs done (seriously - start with the help desk if you want access - they are so used to password resets the procedures become a joke - literally - what's the username and that's it, because if you have thousands of folks on 30 day password rotations with insane complexity all you do is password resets endlessly). Password sharing can also be crazy so passwords float all over.
The govt has had it's top stuff leaked. Office of personnel management leaked insanely sensitive stuff. They contract with the WORST folks in security. It's really crazy.
Google has never asked me to rotate my password. I have non-SMS two factor authentication options, they do pretty sophisticated rate and geo monitoring so you are not annoyed but pretty secure.
Cyberattacks, mechanical failures, weather disasters, meteor strikes, terrorist bombs, stupid construction workers ALL could affect this pipeline. People on HN have no risk perspective. Make the system resilient to a proactive few day outage. Why does this system have to run 365 / 24 / 7? Have you mitigated EVERY possible issue - including disgruntled employees? No - then instead of over doing one corner, design some give in the system.
Re: US passes emergency waiver over fuel pipeline cyber-attack
#237Earlier quoted context omitted.
Air gaps didn’t save Iran. Air gaps are just one layer in the onion.
Is the argument that Iran was attacked on air-gapped network, so its not worth doing?
Re: US passes emergency waiver over fuel pipeline cyber-attack
#238Earlier quoted context omitted.
I can think of some reasons why we should not retaliate against the Russian government. Perhaps we have more to lose in escalation. I don't know if this is true but it might be. If this is an attack at the behest/approval of the Russian government we don't know why they made the attack. It could be a response to something we did to them. We should not get riled up because what hasn't been reported is likely the real…
> Perhaps we have more to lose in escalation. We can entirely, safely remove Russia from the global Internet and we can do it trivially. That's exactly what we should do if they press attacks too far: isolate them. They have the increasingly government controlled Runet to restrict their people's access to the outside world, we should barricade them in. Their economy is small, close to meaningless. It's nearly a round…
Re: US passes emergency waiver over fuel pipeline cyber-attack
#239Earlier quoted context omitted.
Is that the one when the CIA got wind of a Soviet industrial espionage operation, and seeded it with a legit-looking but subtly flawed schematic, which the Soviets ended up actually building to spec, and it exploded shortly after? That wasn't an internet trojan, fyi.
According to the story, this was some Canadian pipeline control equipment or software which the USSR purchased from some Canadians, but the CIA modified the software somehow before it was delivered. A supply-chain attack on a computer system. I understand there's nonzero doubt as to the credibility of this story.
> Rather than roll up the Line X officers and expel them, Reagan approved a secret plan to exploit the Farewell dossier for economic warfare against the Soviet Union. The plan was to secretly feed the Line X officers with technology rigged to self-destruct after a certain interval. The idea came from Weiss, who approached Casey, who took it to Reagan. The CIA worked with American industry to alter products to be slipped to the KGB, matching the KGB’s shopping list. “Contrived computer chips found their way into Soviet military equipment, flawed turbines were installed on a gas pipeline, and defective plans disturbed the output of chemical plants and a tractor factory,” Weiss said. “The Pentagon introduced misleading information pertinent to stealth aircraft, space defense, and tactical aircraft.”
> Oil and gas equipment was at the top of the Soviet wish list, and the Soviets needed sophisticated control systems to automate the valves, compressors and storage facilities for a huge new pipeline to Europe. When the pipeline technology could not be purchased in the United States, the KGB shopped it from a Canadian firm. However, tipped by Vetrov, the CIA rigged the software sold from Canada to go haywire after a while, to reset pump speeds and valve settings to create pressures far beyond those acceptable to the pipeline joints and welds. One day, the system exploded. “The result was the most monumental non-nuclear explosion and fire ever seen from space,” Reed recalled. The blast was starting to trigger worried looks in the U.S. government that day, he recalled, when, at the National Security Council, “Gus Weiss came down the hall to tell his fellow NSC staffers not to worry.” The explosion had been one of the first fruits of the Reagan confrontation.
Re: US passes emergency waiver over fuel pipeline cyber-attack
#240Earlier quoted context omitted.
> The US Gov should make it clear, if you are a critical service and if your service drops due to items being on the internet, for each occurances 10% of your total revenue (including your parent companies) are forfeited. Make it a crime to pay the ransom in a ransomware attack. Make it a crime to fail to report a ransomware attack in a timely manner. Ransomware attacks (and companies with poor security practices) wi…
Make it a crime to possess, consume, or distribute substances that are bad for people. Make it a crime for people to knowingly withhold information about such activities from the authorities. Abuse of substances, trafficking, and associated criminality will go away. But seriously... > Make it a crime to pay the ransom in a ransomware attack. Ok, so ... what should a company do? File a report with some government agen…
Paying extortionists begets more extortion. The only argument I’m seeing is a bunch of hand waving and people telling me I’m being hopelessly naive. I don’t think I am.