Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cyber Security: A pre-war reality check

berthub.eu

Post reply on HN
Print view View original

71–80 of 286 posts

Re: Cyber Security: A pre-war reality check

#71

Post by killjoywashere »

crocal wrote: post #9

I cannot agree more with the author’s point of view. As an illustration, many people want to use GPS for the safe positioning of trains in the European Train Control Systems. This makes the space sector happy because it justifies the expenditures incurred for putting things like Galileo in orbit. However, in a pre-war check exercise, one immediately come to the conclusion that all European trains would crawl to a sto…

Not sure I entirely agree?

#1 > Or disable a hospital.

The entire Ascension Healthcare system of hospitals (142 hospitals, 2600 total facilities) in on divert since 8 May because they had to switch back to paper records. Change Healthcare has lost $872M since it was attacked in February.

Maybe it's more like the pandemic: seems like nothing, unless it affects you.

https://en.wikipedia.org/wiki/Ascension_(healthcare_system)

https://www.wired.com/story/change-healthcare-admits-it-paid...

#2 > Does your stuff need computers working 5,000 kilometers away? [implying that's bad]

What if you live on the Gulf Coast, exposed to hurricanes? You want compute resources warm and ready far away from that region. After Katrina, the Tulane medical school was able to re-form quickly because the noteservice was running a bulletin board forum on a VM in Romania. Everything else was underwater.

#3 > This is the sound-powered phone

Have you used a sound-powered phone? I managed damage control in a ship. Sound powered phones barely works. And the coordination system to actually fight that fire requires radios and making overhead announcements that definitely depend on electrical power.

#4 > They tried to sort of renew this emergency telephone network

When the entire San Diego region lost power during rush hour for 4 hours in 2011, the cell phone system still worked. I was able to email documents to Tokyo from a car despite no traffic lights.

#5 > Because if the cable to the US is down

Sure, but there are a lot of disasters where the cables are fine. Graceful degradation is all about having widely distributed options. Lots of people have What. Signal is even better for people with more serious responsibilities, IMHO. And, friends, if you think IP networks are vulnerable, get yourself a starlink terminal and a HAM radio license.

https://en.wikipedia.org/wiki/SpaceX_Starshield

Re: Cyber Security: A pre-war reality check

#72

Post by hyping9 »

rightbyte wrote: post #11

Who cares? In the case of some sort of big war why would you care about "cyber security" when the day to day problem is not dying from starvation, being drafted, radiation posioning or what ever the problem is. These kind of "we need to prepare" are silly since they implicitly downplay the severity of war and bring us closer to it.

[flagged]

Re: Cyber Security: A pre-war reality check

#73

Post by softsound »

ahubert wrote: post #18
auct wrote: post #17

Earlier quoted context omitted.

What were the vulnerabilities in your 1600 lines imgur alternative?

https://github.com/berthubert/trifecta/blob/main/README.md#k... has a list. The most painful one for me is that I did not know .svg files can contain javascript that gets executed in the site context if you can get someone to click on a link to your .svg file!

That's one of the reasons SVG is often a third party plug-in with WordPress it's because of all the security involved.

Re: Cyber Security: A pre-war reality check

#74

Post by nickpeterson »

rustcleaner wrote: post #64
nickpeterson wrote: post #14

As an outsider on most IT security so take the rest of this with a grain of salt, but I think reliability is a good way to view this topic. Complexity is the enemy of reliability and security. Most organizations seem to operate under the delusion that you can brute force your way to security through audits and policy. They're trying to 'test the quality in' so to speak. Think of the legion of security admins who dili…

Knowing how frail software out there really can be, I made moves to Qubes OS and GrapheneOS as my primary operating system distributions over a year ago. Haven't looked back since the first month! PC users should be using some kind of segregation like VMs these days; you most likely don't have a MAC policy protecting your files from your porn site bunker-busted browser, so your data is likely going up the pipe to Nor…

Those are neat projects to look into, thanks. That said, I feel like wrapping everything in vms/container is actually an example of the complexity I’m fighting against. I want less code that does less with more eyes on it.

Re: Cyber Security: A pre-war reality check

#76

Post by adrianN »

crocal wrote: post #9

I cannot agree more with the author’s point of view. As an illustration, many people want to use GPS for the safe positioning of trains in the European Train Control Systems. This makes the space sector happy because it justifies the expenditures incurred for putting things like Galileo in orbit. However, in a pre-war check exercise, one immediately come to the conclusion that all European trains would crawl to a sto…

Trains use a variety of sensors for odometry. Losing one of them is not catastrophic.

Re: Cyber Security: A pre-war reality check

#77

Post by kjkjadksj »

Dalewyn wrote: post #39
gds44 wrote: post #21

Earlier quoted context omitted.

Well US is not dependent on anyone for her Energy needs. Unlike China. Its quite vulnerable on that front if a few pipelines blow up ala nord stream. This is also why the US has such a large presence in the middle east.

>Well US is not dependent on anyone for her Energy needs. China's strength is they have the means of production (and maintenance) of everyone today, including the US. All the energy in the world means jack squat when all the means of using that energy rely on China. Could the west regain our own means of production? Certainly, but it's going to take far too long at the point China starts pursuing Bigger Gun Diplomacy…

China makes consumer crap not our guns and bombs. In a wartime situation maybe people can’t get iphone cases from temu, big whoop. Not the first time the american population rationed consumer products in wartime. We will still have power and air, sea, and space superiority which is what really matters.

Re: Cyber Security: A pre-war reality check

#79

Post by openasocket »

I agree with the overall thesis, but I do need to quibble about Stuxnet. Yes, Stuxnet was very interesting, and it did disrupt Irans nuclear program. However, its impact is often overblown. It likely delayed Irans nuclear program by only a few weeks. Cyber attacks can absolutely cause a lot of damage and harm, but Stuxnet is not the best example of that.

Re: Cyber Security: A pre-war reality check

#80

Post by kjkjadksj »

hollerith wrote: post #54
CJefferson wrote: post #49

I wonder if we, in secret, have “mutually assured destruction” of cyber-warfare. It seems like a reasonable assumption to me that major world powers probably have enough 0-days at any one time that they could use them together to format a significant proportion of the world’s computers and phones. It would be not be that hard to make these worms intelligently use IP to target particular countries. It’s hard for me to…

>It seems like a reasonable assumption to me that major world powers probably have enough 0-days at any one time that they could use them together to format a significant proportion of the world’s computers and phones. If that is true, then how come we have not heard much about erasure of data on phones and computers in Ukraine by Russian hackers? Please don't say that the Kremlin is holding its 0-days in reserve for…

Probably for the same reason why they aren’t using their nuclear weaponry.
Post reply on HN