Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US passes emergency waiver over fuel pipeline cyber-attack

bbc.com

Post reply on HN
Print view View original

441–450 of 479 posts

Re: US passes emergency waiver over fuel pipeline cyber-attack

#441

Post by d0ne »

mac01021 wrote: post #317
tgsovlerkhgsel wrote: post #13

That gang may have bitten off more than they can chew. They've now gotten the US government involved officially, which means that beyond the sheer mass of resources that will go into tracking this gang, the government also has something to prove now. Being at the center of an international incident is probably not good for business.

I'm not super-knowledgable about cybersecurity, but shouldn't simply using TOR make it nearly impossible for the US government to track them down? If they want to go overkill, they can additionally use a public VPN account purchased using walmart giftcards bought on ebay using a stolen identity and then mailed overseas. They can also perform the hack using a brand new computer that they never use again afterward. It…

No - Running enough TOR entry and exit nodes allows one to unmask initial connections[1].

One can suspect a healthy percentage of Tor nodes are operated by Governments as TOR was developed and released by the US Navy[2].

[1] https://www.theregister.com/2015/05/30/researchers_claim_tra...

[2] https://www.torproject.org/about/history/

Re: US passes emergency waiver over fuel pipeline cyber-attack

#442

Post by Telemakhos »

jb775 wrote: post #357
unchocked wrote: post #10

So, a very limited state of emergency which allows fuel that is ordinarily piped to be transported by truck. Ancillarily, It's not evident this cyberattack actually compromised the industrial controls, but rather trashed the administrative system controlling the controls.

> It means drivers in 18 states can work extra or more flexible hours when transporting gasoline, diesel, jet fuel and other refined petroleum products. This means truck drivers hauling 45,500+ lbs of an extremely flammable liquid aren't required to sleep. I worked in the supply chain industry for a few years, dropping these restrictions is unheard of. My instinct tells me this issue is a lot worse than it seems now.

No, that part of the regulations (the 10 hour break requirement) specifically does not get suspended in an emergency, if I recall correctly, but federal qualifications for new drivers do, so maybe someone otherwise hauling oranges from Florida might drive a tanker while the normal driver has a day off. Plus, this is only federal law; state laws still apply, and it is state troopers who pull you over, not feds.

Re: US passes emergency waiver over fuel pipeline cyber-attack

#443

Post by rchaud »

logicchains wrote: post #391
magnusss wrote: post #278

Earlier quoted context omitted.

The US and other government wills outlaw all cryptocurrencies but the ones that they control (“Govcoin,” as The Economist refers to them). Game over.

>The US and other government wills outlaw all cryptocurrencies but the ones that they control (“Govcoin,” as The Economist refers to them). Game over. Just like how outlawing drugs ended the drug trade.

How so? The US has banned heroin, cocaine etc but it never provided a state-sanctioned alternative.

Re: US passes emergency waiver over fuel pipeline cyber-attack

#444

Post by murph-almighty »

Arcturis wrote: post #415
ackbar03 wrote: post #78

Earlier quoted context omitted.

Lol this was my first reaction as well, they now have a nation-state on their ass. But that being said its not impossible that this was just a cover for a Russian state-sponsored attempt on US infra

If I were running the Russian hacking center in charge of pwning US infrastructure, I'd be pissed as hell. This is like getting vaccinated -- all of a sudden we're going to take this seriously and patch a bunch of exploits that they've had ready to go.

Maybe this gang doesn't need to worry about the US going after it, it needs to worry about the FSB going after it for screwing up its game plan...

Re: US passes emergency waiver over fuel pipeline cyber-attack

#445

Post by that_guy_iain »

vkou wrote: post #440
that_guy_iain wrote: post #404

Earlier quoted context omitted.

Russia and China have been suspected of doing things like this for years. And who says it's just to inconvenience them? There will other things happening because of this and this could impact other nations in a postive manner.

> Russia and China have been suspected of doing things like this for years. By who? People who never provide evidence for their claims? > There will other things happening because of this and this could impact other nations in a postive manner. While it's certainly possible that the FSB is playing 59-dimensional chess, here, hoping for a true butterfly-effect sequence of causality, I think the onus is on you to demon…

> By who? People who never provide evidence for their claims?

By lots of countreies. The US charged 4 chinese military officers for hacking Equifax.

> While it's certainly possible that the FSB is playing 59-dimensional chess, here, hoping for a true butterfly-effect sequence of causality, I think the onus is on you to demonstrate that.

You seem to think that it would require multiple things to fall into place to benefit a foreign country. Say you want to manipulate the price of the fuel. Increasing the costs of transport would do that.

Re: US passes emergency waiver over fuel pipeline cyber-attack

#446

Post by murph-almighty »

duckfang wrote: post #401
NaturalPhallacy wrote: post #138

>The gang even has a website on the dark web where it brags about its work in detail, listing all the companies it has hacked and what was stolen, and an "ethics" page where it says which organisations it will not attack. And yet they don't give the URL. I wanna see this page. Does anyone have it?

Here's a list of the common malware URLs. BE VERY CAUTIOUS. Also note that DarkSide's onionsite is down and has been for a while. Babuk: http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtf... Dopple: http://hpoo4dosa3x4ognfxpqcrjwnsigvslm7kv6hvmhh2yqczaxy3j6qn... Maze: mazenews.top AKO: http://37rckgo66iydpvgpwve7b2el5q2zhjw4tv4lmyewufnpx4lhkekxk... Nefilim: http://hxt254aygrsziejn.onion/ Ragnar: http://p6o7…

It might help if you format these as "domain[dot]com" to avoid misclicks.

Re: US passes emergency waiver over fuel pipeline cyber-attack

#447

Post by mywittyname »

JohnWhigham wrote: post #403
SavantIdiot wrote: post #338

Earlier quoted context omitted.

You're getting downvoted, but how many ransomware attacks would be successful if a bank account was required?

Bitcoin's not the problem, America's shitty corporate culture around not treating cybersecurity as a priority is the problem.

Technological advancements happen because of a confluence of different events, each contributing to its eventual success.

Bitcoin is absolutely one of the components that allows for the proliferation of ransomware. The key to a ransom is the ability for the attacker to obtain payment in an way that doesn't put them at risk of being caught. BTC enabled that. In fact, anonymous payments are widely considered to be one of the major purposes of BTC.

If ransomware was a positive thing, then BTC advocates would be talking about how BTC is the key technology that enabled malware to make the transition from hobby/annoyance/weapon to a full-fledged industry.

Re: US passes emergency waiver over fuel pipeline cyber-attack

#448

Post by vkou »

that_guy_iain wrote: post #445
vkou wrote: post #440

Earlier quoted context omitted.

> Russia and China have been suspected of doing things like this for years. By who? People who never provide evidence for their claims? > There will other things happening because of this and this could impact other nations in a postive manner. While it's certainly possible that the FSB is playing 59-dimensional chess, here, hoping for a true butterfly-effect sequence of causality, I think the onus is on you to demon…

> By who? People who never provide evidence for their claims? By lots of countreies. The US charged 4 chinese military officers for hacking Equifax. > While it's certainly possible that the FSB is playing 59-dimensional chess, here, hoping for a true butterfly-effect sequence of causality, I think the onus is on you to demonstrate that. You seem to think that it would require multiple things to fall into place to ben…

Hacking Equifax[1] makes sense, because it directly useful for intelligence work. Find people of interest who have credit problems, and lean on them. [2]

This isn't even a blip on the radar of global fuel prices. It is completely lost in the noise. [3]

[1] Or the OPM, since it was kind enough to have lists of 'all spies operating abroad' on its intranet. Whoops.

[2] I mean, you could also just pose as a landlord or employer, and ask for credit checks on them, it costs ~$30 per query, but it is what it is.

[3] If the FSB really wants to increase demand for fuel, they should try stalling a junker or two on an interstate bridge... Imagine the fuel wasted from all the cars idling, or taking detours!

Re: US passes emergency waiver over fuel pipeline cyber-attack

#449

Post by duckfang »

murph-almighty wrote: post #446
duckfang wrote: post #401

Earlier quoted context omitted.

Here's a list of the common malware URLs. BE VERY CAUTIOUS. Also note that DarkSide's onionsite is down and has been for a while. Babuk: http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtf... Dopple: http://hpoo4dosa3x4ognfxpqcrjwnsigvslm7kv6hvmhh2yqczaxy3j6qn... Maze: mazenews.top AKO: http://37rckgo66iydpvgpwve7b2el5q2zhjw4tv4lmyewufnpx4lhkekxk... Nefilim: http://hxt254aygrsziejn.onion/ Ragnar: http://p6o7…

It might help if you format these as "domain[dot]com" to avoid misclicks.

Too late.

Re: US passes emergency waiver over fuel pipeline cyber-attack

#450

Post by pm90 »

Arcturis wrote: post #416
pm90 wrote: post #266

Earlier quoted context omitted.

This is exactly right. It all depends on the attention these attacks get. Now that they've had a tangible effect on the news cycle, creating concern about the safety of US energy infrastructure, there will be more incentives for the Government to hunt them down and get credit for doing so. I think I read somewhere that China based attackers have already penetrated networks of major US infrastructure systems but didn'…

I think it's 50/50 some real gang vs a branch of the NSA who sees how pwned the US infrastructure is and wants to make a (fairly harmless) splash so we take it more seriously and patch our shit.

Wouldn't the NSA branch be "disciplined" if they were found out? Seems risky.
Post reply on HN