Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cyber Security: A pre-war reality check

berthub.eu

Post reply on HN
Print view View original

121–130 of 286 posts

Re: Cyber Security: A pre-war reality check

#121

Post by pixl97 »

nickpeterson wrote: post #14

As an outsider on most IT security so take the rest of this with a grain of salt, but I think reliability is a good way to view this topic. Complexity is the enemy of reliability and security. Most organizations seem to operate under the delusion that you can brute force your way to security through audits and policy. They're trying to 'test the quality in' so to speak. Think of the legion of security admins who dili…

Looking at the XZ attack from last month, a lot of people that write software have no idea of the depth their software is being used in secure systems.

Re: Cyber Security: A pre-war reality check

#122

Post by dralley »

sublimefire wrote: post #55
ahubert wrote: post #3

Author here - if you have any questions, please do let me know!

As an SWE I do agree somewhat with what you say but this story is not complete. If you look at the attacks on Ukraine and the cybersecurity damage done it was fairly small in the grand scheme of things. Another important thing is that Microsoft helped them to fight back as well, so it was not a terrible investment. Was there any quantifiable risk assessment done to understand the potential damages if Russians carried…

> As an SWE I do agree somewhat with what you say but this story is not complete. If you look at the attacks on Ukraine and the cybersecurity damage done it was fairly small in the grand scheme of things.

It's worth mentioning that the most expensive and extensive malware attack in history was caused by one of such Russian cyberattacks hitting systems which (at the time) they weren't intended to. Causing severe shipping delays and billions of dollars in damage.

https://www.wired.com/story/notpetya-cyberattack-ukraine-rus...

If such attacks were intentional, you could cause much worse problems.

For example, doing this

https://www.cisa.gov/news-events/news/attack-colonial-pipeli...

except without offering a ransom fee to undo the damage, and doing it in parallel across more industries.

Re: Cyber Security: A pre-war reality check

#123

Post by adrianN »

crocal wrote: post #84
adrianN wrote: post #76

Earlier quoted context omitted.

Trains use a variety of sensors for odometry. Losing one of them is not catastrophic.

Except the stated goal here is to replace these sensors with GPS.

It has been a couple of years since I worked in the area, but back then that wasn’t the plan and would’ve been deemed impossible both for safety and for accuracy reasons. Do you maybe have a source?

Re: Cyber Security: A pre-war reality check

#124

Post by Animats »

crocal wrote: post #9

I cannot agree more with the author’s point of view. As an illustration, many people want to use GPS for the safe positioning of trains in the European Train Control Systems. This makes the space sector happy because it justifies the expenditures incurred for putting things like Galileo in orbit. However, in a pre-war check exercise, one immediately come to the conclusion that all European trains would crawl to a sto…

Railroads...

Railroads can now outsource train control. Wabtec's "Wabtec Cloud Positive Train Control Communication Solution" - "A complete turnkey hosted office solution for I-ETMS-based Positive Train Control (PTC) systems"[1] (Wabtec used to be Westinghouse Air Brake.)

Wabtec has had break-ins, but claims they only involved employee info, not control systems.[2]

[1] https://www.wabteccorp.com/digital-intelligence/signaling-an...

[2] https://industrialcyber.co/ransomware/wabtec-suffers-data-br...

Re: Cyber Security: A pre-war reality check

#126

Post by crocal »

adrianN wrote: post #123
crocal wrote: post #84

Earlier quoted context omitted.

Except the stated goal here is to replace these sensors with GPS.

It has been a couple of years since I worked in the area, but back then that wasn’t the plan and would’ve been deemed impossible both for safety and for accuracy reasons. Do you maybe have a source?

Sure thing: http://clugproject.eu/en (Edit: they even have a 2.0, see my sibbling comment)

Re: Cyber Security: A pre-war reality check

#127

Post by crocal »

adrianN wrote: post #123
crocal wrote: post #84

Earlier quoted context omitted.

Except the stated goal here is to replace these sensors with GPS.

It has been a couple of years since I worked in the area, but back then that wasn’t the plan and would’ve been deemed impossible both for safety and for accuracy reasons. Do you maybe have a source?

The sequel: https://www.clug2.eu/

Re: Cyber Security: A pre-war reality check

#128

Post by plq »

hughesjj wrote: post #103
killjoywashere wrote: post #71

Earlier quoted context omitted.

Not sure I entirely agree? #1 > Or disable a hospital. The entire Ascension Healthcare system of hospitals (142 hospitals, 2600 total facilities) in on divert since 8 May because they had to switch back to paper records. Change Healthcare has lost $872M since it was attacked in February. Maybe it's more like the pandemic: seems like nothing, unless it affects you . https://en.wikipedia.org/wiki/Ascension_(healthcare_…

The back of my head is screaming "defense in depth! Redundant systems!" The whole idea of the internet (and even some of our infra, like suburbs or highways/rail) is that there's no one single point of failure. Like designed-to-survive-nuclear-war redundant. Definitely incorporate the most advanced tech you can for when things are going smoothly to get that efficency gain, but there's a reason all branches of the mil…

> The whole idea of the internet (and even some of our infra, like suburbs or highways/rail) is that there's no one single point of failure. Like designed-to-survive-nuclear-war redundant.

Sure, the routing algorithms can quickly adapt to changes in network topology, but they assume infinite bandwidth, which hasn't been the case since a long time now.

In other words, if a couple of important pipes disappear between tier1 peers, alternate routes will certainly have trouble handling all the new traffic, which would make everything grind to a halt, and will only be solved by pissed network admins null-routing that additional load.

Re: Cyber Security: A pre-war reality check

#129

Post by hyperman1 »

openasocket wrote: post #79

I agree with the overall thesis, but I do need to quibble about Stuxnet. Yes, Stuxnet was very interesting, and it did disrupt Irans nuclear program. However, its impact is often overblown. It likely delayed Irans nuclear program by only a few weeks. Cyber attacks can absolutely cause a lot of damage and harm, but Stuxnet is not the best example of that.

Stuxnet was a very graphical demonstration of the possibilities. Even if the results weren't that great, it demonstrates to nontechies the expensive real-world consequences of 1 usb stick with malware.

I understood the hole in the ozon layer was similar. Even if the actual danger of it was probably overrated, it made people imagine how we broke earths radiation shield and would be hit by all kinds of nasty space radiation. This resulted in real world policy changes.

Post reply on HN