Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Scope of Hacks on U.S. Water Supply Widens as Evidence Points to Iran

nytimes.com

Post reply on HN
Print view View original

81–90 of 96 posts

Re: Scope of Hacks on U.S. Water Supply Widens as Evidence Points to Iran

#81

Post by mikewarot »

mindslight wrote: post #73
mikewarot wrote: post #59

>state and local officials throughout the country were on high alert for potential problems in vulnerable computers that are commonly used to monitor and adjust water quality, including chemical-treatment levels and water pressure. You don't need a full bidirectional internet connection for remote monitoring, and data diodes are a relatively cheap way to monitor them in complete safety. Completely stopping ingress of…

Please expound upon this "data diodes are a relatively cheap way to monitor them in complete safety". I'm familiar with the concept, but do not know they are in widespread use, and off-the-shelfish enough to be considered "cheap". To me, the fundamental problem is that our protocol stacks are all built on an assumption of bidirectional interaction, making "data diodes" require bespoke engineering to define the correc…

The software stack is the hassle. Let's assume you want to monitor the SCADA system doing water treatment, or some other critical task, on an air-gapped network.

You add server to the network, it's purpose is to query, the SCADA system and get the status, error logs, process parameters, whatever you need, and spool them into a directory on a drive. A second process on that server then spools them off via a one-way optical link (high speed optocoupler, specially modified fiber link, etc) using some sort of protocol that broadcasts all the collected information, along with some form of error correction, on a continuous basis. It will do this until the end of time, never knowing if the information was recieved.

The outside server then monitors the broadcast stream, using it to update it's own directory with the relevant data, and makes it available like any normal server to an internet connection.

Because the connection has only one physical link, and it CAN NOT be reversed, ingress of control is completely prevented. Yet you can monitor the system from the outside, and never have to worry about compromise of the air-gapped network.

A pair of raspberry pi's with ethernet (and not wifi/bluetooth) could do the job.

Once it works, the "outside" host could be hacked, but it won't, CAN'T influence the other host, so things remain actually safe from remote hacking.

[1] https://en.wikipedia.org/wiki/Unidirectional_network

Re: Scope of Hacks on U.S. Water Supply Widens as Evidence Points to Iran

#82

Post by ksudb »

londons_explore wrote: post #42

People use 1000x more water than they need to drink. If a water supply chain attack happened, we would just distribute bottled water for drinking, and people would go without washing for a few days whilst the issue was sorted. Bottled water production is already big enough that delivering a bottle a day per person in new York is within the scale of the current production and retail networks scope. It wouldn't cause t…

[dead]

Re: Scope of Hacks on U.S. Water Supply Widens as Evidence Points to Iran

#83

Post by danaris »

zahlman wrote: post #45
garciasn wrote: post #36

Earlier quoted context omitted.

Blacks. Homosexuals. Communists. Islamics. Hispanics. Liberals. Intellectuals. There’s always an other. That’s what the Republicans have been doing for decades.

> There’s always an other. That’s what the [group I definitely don't belong to] have been doing for decades. Please reconsider your logic. And: > Please don't use Hacker News for political or ideological battle. It tramples curiosity.

Sorry, this is just plain facts, and anyone who doesn't understand that at this point is clearly trying to avoid cognitive dissonance. Or they have their heads terminally in the sand.

Re: Scope of Hacks on U.S. Water Supply Widens as Evidence Points to Iran

#84

Post by mindslight »

mikewarot wrote: post #81
mindslight wrote: post #73

Earlier quoted context omitted.

Please expound upon this "data diodes are a relatively cheap way to monitor them in complete safety". I'm familiar with the concept, but do not know they are in widespread use, and off-the-shelfish enough to be considered "cheap". To me, the fundamental problem is that our protocol stacks are all built on an assumption of bidirectional interaction, making "data diodes" require bespoke engineering to define the correc…

The software stack is the hassle. Let's assume you want to monitor the SCADA system doing water treatment, or some other critical task, on an air-gapped network. You add server to the network, it's purpose is to query, the SCADA system and get the status, error logs, process parameters, whatever you need, and spool them into a directory on a drive. A second process on that server then spools them off via a one-way op…

What you're describing is a whole bunch of bespoke engineering. That is the opposite of cheap.

It would be interesting to go down this design path trying to make a generic product. I'd aim to dovetail into the bespoke engineering that PLCs already involve. I'd be tempted to design it as something like a modbus target (that PLC engineers would set up the system to write data to), except that modbus sucks rocks as a data format, never mind lacking the abstractions to do express multiples of the same systems. So then I guess you're left with some schema language that you're trying to appeal to PLC engineers to write securely. Maybe akin to the IEC 61131-3 Functional Block Diagram language, but with a very clear "this is the airgapped dividing line" ?

But in the general case, you still need to get control data back into most systems system. So your data link will likely still be bidirectional, but with the goal to keep the protocol small and simple, to keep the attack surface small.

The main problem is that it still only takes one PLC engineer to connect the two sides of the network for their own expedience. From what I can tell this is how the horror stories abound. PLCs generally use ethernet/IP these days, so one has to do deliberate work to segment the networks. And it just takes one too-smart-for-their-own-good person who wants to make that PLC available from their desk/home/vacation to ruin it.

Re: Scope of Hacks on U.S. Water Supply Widens as Evidence Points to Iran

#85

Post by mikewarot »

mindslight wrote: post #84
mikewarot wrote: post #81

Earlier quoted context omitted.

The software stack is the hassle. Let's assume you want to monitor the SCADA system doing water treatment, or some other critical task, on an air-gapped network. You add server to the network, it's purpose is to query, the SCADA system and get the status, error logs, process parameters, whatever you need, and spool them into a directory on a drive. A second process on that server then spools them off via a one-way op…

What you're describing is a whole bunch of bespoke engineering. That is the opposite of cheap. It would be interesting to go down this design path trying to make a generic product. I'd aim to dovetail into the bespoke engineering that PLCs already involve. I'd be tempted to design it as something like a modbus target (that PLC engineers would set up the system to write data to), except that modbus sucks rocks as a da…

There are plug and play devices that do multiple flavors of SCADA, but as you've said, they aren't trivial, thus not cheap.

Re: Scope of Hacks on U.S. Water Supply Widens as Evidence Points to Iran

#86

Post by garciasn »

krautburglar wrote: post #79
garciasn wrote: post #36

Earlier quoted context omitted.

Blacks. Homosexuals. Communists. Islamics. Hispanics. Liberals. Intellectuals. There’s always an other. That’s what the Republicans have been doing for decades.

Irrational reach. The Blacks! hacked our firewall! Those darn Hispanics! exfiltrated customer data! F\*\*ing Liberals! hijacked the PLC for pump 3! ...said no one ever.

https://www.nytimes.com/2026/07/31/us/politics/trump-minneso...

Re: Scope of Hacks on U.S. Water Supply Widens as Evidence Points to Iran

#87

Post by zahlman »

garciasn wrote: post #86
krautburglar wrote: post #79

Earlier quoted context omitted.

Irrational reach. The Blacks! hacked our firewall! Those darn Hispanics! exfiltrated customer data! F\*\*ing Liberals! hijacked the PLC for pump 3! ...said no one ever.

https://www.nytimes.com/2026/07/31/us/politics/trump-minneso...

I fail to understand how this relates to the original claim.

Re: Scope of Hacks on U.S. Water Supply Widens as Evidence Points to Iran

#88

Post by zahlman »

danaris wrote: post #83
zahlman wrote: post #45

Earlier quoted context omitted.

> There’s always an other. That’s what the [group I definitely don't belong to] have been doing for decades. Please reconsider your logic. And: > Please don't use Hacker News for political or ideological battle. It tramples curiosity.

Sorry, this is just plain facts, and anyone who doesn't understand that at this point is clearly trying to avoid cognitive dissonance. Or they have their heads terminally in the sand.

Yes; it is a fact that the post I was complaining about was in violation of HN guidelines, and a fact that it demonstrated the same behaviour it accused others of.

Re: Scope of Hacks on U.S. Water Supply Widens as Evidence Points to Iran

#89

Post by garciasn »

zahlman wrote: post #87
garciasn wrote: post #86

Earlier quoted context omitted.

https://www.nytimes.com/2026/07/31/us/politics/trump-minneso...

I fail to understand how this relates to the original claim.

That no one is blaming liberals for hacking? Not sure what else there would be to possibly understand.

Re: Scope of Hacks on U.S. Water Supply Widens as Evidence Points to Iran

#90

Post by zahlman »

garciasn wrote: post #89
zahlman wrote: post #87

Earlier quoted context omitted.

I fail to understand how this relates to the original claim.

That no one is blaming liberals for hacking? Not sure what else there would be to possibly understand.

"The Minnesota Democrats" != "liberals".
Post reply on HN