Live data from Hacker News

US passes emergency waiver over fuel pipeline cyber-attack

bbc.com

421–430 of 479 posts

Re: US passes emergency waiver over fuel pipeline cyber-attack

#421

Earlier quoted context omitted.

I'm not sure how that would work-- each section would still need to send its petroleum products to the next section, making it effectively still one pipeline. Unless I misunderstand your statement?

Consider cars on a freeway. There is no central control. Each car controls itself, cooperating with its neighbors. If one car goes berserk, it doesn't take down the whole freeway. With a pipeline, if sections operated autonomously but cooperated with each other, and one goes berserk, its neighbors will shut down, but they won't be damaged. The repair work only has to repair the one section.

Ah, I see. Not segmented pipeline, segmented pipeline control. That makes a little more sense. However it might make it significantly more difficult to make coordination between segments possible: The self organizing behavior at work with car driving may be significantly different than what is required for a pipeline.

People driving cars are essentially doing what is best for themselves individually (within the bounds of the law), and that ends up translating to something that works for the whole. With a pipeline, that might not work: If pressure gets too high in one area, it might take highly coordinated control across thousands of miles to bleed off contents into buffer tanks & ease pressure a dozen segments away.

I'm not saying that couldn't be done, I'm sure the SCADA systems could be isolated from each other in this way, it just seems like it would require a lot more difficulty with explicit coordination between technicians, not a self-organizing system such with driving on a highway.

Re: US passes emergency waiver over fuel pipeline cyber-attack

#422
post #357

Earlier quoted context omitted.

> It means drivers in 18 states can work extra or more flexible hours when transporting gasoline, diesel, jet fuel and other refined petroleum products. This means truck drivers hauling 45,500+ lbs of an extremely flammable liquid aren't required to sleep. I worked in the supply chain industry for a few years, dropping these restrictions is unheard of. My instinct tells me this issue is a lot worse than it seems now.

Armchair take: The pipelines handle a lot of fuel, and the US needs / uses a lot of fuel; to move the same amount, you need a lot of trucks. And if that need is not met, the economy etc will be disrupted heavily, price of fuel will go up, and the price of fuel going up has caused massive issues in the past.

Last time I checked the amount of sleep I need doesn't go down when an oil pipeline stops flowing.

It's offloading the risk to drivers to benefit these companies first and foremost, which is ridiculous. The cherry on top is the article pointing out even with the extra hours they won't be anywhere near meeting demand...

Re: US passes emergency waiver over fuel pipeline cyber-attack

#423

Earlier quoted context omitted.

You're assuming the US and other government are not using cryptocurrencies for their own covert transactions.

So what? Many governments have nuclear weapons arsenals but they don't make it legal for everyone to buy or manufacture atomic bombs.

I would expect that the drug production and export business is a more apt analogy.

Re: US passes emergency waiver over fuel pipeline cyber-attack

#424

Earlier quoted context omitted.

I was an adult, and I remember the experts on TV (and print and other media) debunking the “experts” you refer to, often in near real time. And, unlike the latter, the former often had the receipts (fairly literally, in the case of the debunking of the “Winnebagos of Mass Destruction”.)

I was also an adult, and the fervor over WMD was unreal . And not just WMDs, but stupid shit like "Freedom Fries" and "These colors don't run". The spike in nationalism was awful to behold.

> I was also an adult, and the fervor over WMD was unreal

Sure, the fervor was, as were lots of emotional aspects of the post-9/11 wave of Islamophobic hysteria. And certainly the opinion and commentary programs of the major TV news networks were often engaged in that (Fox, of course, but also MSNBC and CNN, both of whom reacted to Fox in the early 00’s even before 9/11 by chasing the bias in Fox opinion/commentary — not so much actual news — which definitely contributed to their slant and the reinforced the national post-9/11 mood well pay the beginning of the Iraq War.) This effect was smaller in the print media (but even greater in blogs, which were taking off as the new distinctly online media and didn’t tend to segregate fact and commentary or otherwise act like traditional media.)

That’s why the widely disseminated debunkings of the WMD propaganda in news coverage were also widely disregarded, but there has since become a revisionist narrative which pretends that the WMD propaganda was generally presented as unquestioned fact and contrary information suppressed by the news media.

Re: US passes emergency waiver over fuel pipeline cyber-attack

#425

I'm a fan of pipeline shutdowns personally

I've always wondered about that theory.

Is the point to move liquid shipments to trucks/ships because it's safer somehow? or simply to make it so difficult to transport liquid fuels that people quit using them?

I suspect that pipeline activism mostly results in the former.

Re: US passes emergency waiver over fuel pipeline cyber-attack

#426
post #4

It needs to be asked again, why are critical services on the Internet ? We all know why, companies are chasing profits at any cost, so hiring more people to monitor these systems as the did 40 years ago will lower the execs bonuses. The US Gov should make it clear, if you are a critical service and if your service drops due to items being on the internet, for each occurances 10% of your total revenue (including your…

>We all know why, companies are chasing profits at any cost,

I wonder if that's even true 100% of the time.

It could simply be programmers + feature creep, bolting great wads of software to systems with small value on the margin.

It would be interesting to talk to software people in the gambling business, you'd think that would be Ground Zero for nefarious attacks.

Re: US passes emergency waiver over fuel pipeline cyber-attack

#427
post #277

Earlier quoted context omitted.

Given that this is preventing them from moving liquids from A to B they should realize that protecting their system isn't a secondary concern.

Would be interested in seeing if this does result in a change in their processes, or if they will just accept the risk of this happening as a "risk of doing business".

If things go wrong, they receive millions in resources from the FBI/Federal Law Enforcement. Unless they get a bill, it's likely that they will continue their lax practices.

Re: US passes emergency waiver over fuel pipeline cyber-attack

#428

Earlier quoted context omitted.

Yes, but this is not new. Cryptocurrency is. Also blaming the victim can only go so far

My guess is that there are many factors. - More infrastructure than ever has some exposure to the internet - Outsourcing at massive scale (probably) makes consistent security screening harder - There are more programmers in the world than ever and so (probably) there are more black hats, malicious hackers, etc - As time goes on, there are more and more aging computer systems, thus (probably) there are more and more v…

The whole thing is very asymmetric:

Your own jurisdiction and law enforcement have no power on foreign territory; but foreign organizations (state sponsored or not) located there have freedom to penetrate your society and economy. Moreover, foreign governments may deliberately ignore your requests to investigate.

Thanks to technologies and to chaotic reactions to modern day problems (including covid-19 pandemic) it looks like modern forms of independent sovereign states are very archaic.

Re: US passes emergency waiver over fuel pipeline cyber-attack

#429

Earlier quoted context omitted.

This is what the financial industry does. There's a secured "extranet" that everyone runs FIX on top of. For the most part, it works.

There's an entire parallel internet for the DoD and it's contractors. It's not like there isn't precedent that critical industries can emulate if they ever became concerned about the common good.

That's interesting. Is it physically separate? I would assume so but don't know.

I'd love to read an article on it. Maybe there are others that are geographically dispersed.

Post reply on HN