Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I think the military commissary's freezers were hacked

signalandsilence.substack.com

Post reply on HN
Print view View original

121–130 of 252 posts

Re: I think the military commissary's freezers were hacked

#121

Post by crote »

lenerdenator wrote: post #83
peterabbitcook wrote: post #29

A couple years ago I worked on a service that had to communicate with a Siemens S7-1500 PLC. Based on my experience with that project, none of what I’ve read recently about unsecured industrial PLCs is surprising. I opened Siemens TIA Portal and PLCSIM for the first time and thought “wow, I didn’t think the Windows 95 GUI library was still supported.” None of the PLC contractors we had hired knew how to enable TLS on…

> In all fairness, the people who are experts in the field of Siemens PLC programming are usually mechanical-ish engineers and security is not in their skill set or on their mind. Stuxnet was over a decade ago. There should be a simple rule that everyone with the ability to understand things like PLCs should be able to grasp: your equipment does not touch the internet or external storage, period. Those who can't gras…

The Stuxnet PLCs weren't touching either, though.

The worm was designed to jump across network air gaps via USB flash drives, and spread across isolated networks to other hosts. Finally, it targeted what was likely going to be a service technician laptop, which had to connect to the PLC via a data cable to update and adjust its configuration.

An attack like this can only be avoided if you never transfer any data from the outside to the inside. But that means you won't ever be able to install any form of software update or upload new config files without manually typing them in - or even reinstall the OS on any machine...

Re: I think the military commissary's freezers were hacked

#122

Post by wongarsu »

ceejayoz wrote: post #113
nkrisc wrote: post #111

Earlier quoted context omitted.

Surely airlifting supplies to a carrier in a war zone is not totally comparable to airlifting supplies to a base in a US territory?

There was supposed to be a base there. The Fifth Fleet base in Bahrain got flattened.

That explains why resupply doesn't work as well as in peace time

But at the same time, it's not like that came out of nowhere. If you attack a country, that country shooting back at any military installations in missile range has to be one of the expected outcomes. Given the US had all the initiative in starting the conflict I would have hoped there was a logistics plan that involved not relying on those bases to continue to exist

Re: I think the military commissary's freezers were hacked

#123

Post by mulmen »

wongarsu wrote: post #122
ceejayoz wrote: post #113

Earlier quoted context omitted.

There was supposed to be a base there. The Fifth Fleet base in Bahrain got flattened.

That explains why resupply doesn't work as well as in peace time But at the same time, it's not like that came out of nowhere. If you attack a country, that country shooting back at any military installations in missile range has to be one of the expected outcomes. Given the US had all the initiative in starting the conflict I would have hoped there was a logistics plan that involved not relying on those bases to con…

> Given the US had all the initiative in starting the conflict I would have hoped there was a logistics plan that involved not relying on those bases to continue to exist.

Anyone with the capability to plan for the Iran war never would have started it because the costs would have been obvious. In other words the only way to start a war with Iran is to have no plan for it.

Re: I think the military commissary's freezers were hacked

#124

Post by solid_fuel »

wongarsu wrote: post #122
ceejayoz wrote: post #113

Earlier quoted context omitted.

There was supposed to be a base there. The Fifth Fleet base in Bahrain got flattened.

That explains why resupply doesn't work as well as in peace time But at the same time, it's not like that came out of nowhere. If you attack a country, that country shooting back at any military installations in missile range has to be one of the expected outcomes. Given the US had all the initiative in starting the conflict I would have hoped there was a logistics plan that involved not relying on those bases to con…

> Given the US had all the initiative in starting the conflict I would have hoped there was a logistics plan that involved not relying on those bases to continue to exist

Have you seen the people responsible for planning right now? They're more concerned with posting AI generated memes on twitter and scoring bigotry points than managing a foreign conflict.

Re: I think the military commissary's freezers were hacked

#125

Post by nwallin »

nwatson wrote: post #94
ericmay wrote: post #70

Earlier quoted context omitted.

Generally agree with your assessment, but in the case of Guam or other more remote installations if there were catastrophic issues we'd just airlift food in. Costly but certainly manageable. Hawaii I'm not sure why that would be an issue unless the whole island was attacked or shut down. Even if the on-base shops were hacked you could just go shop at Wal-Mart or Costco or any number of other locations on the islands.…

Did they airlift better supplies to a floating aircraft carrier somewhere in the northern Indian Ocean recently? No.

Aircraft carriers are not particularly well suited to be supplied by cargo aircraft.

The largest cargo aircraft with the strengthened landing gear, arresting hook, and catapult attachment used to be the C-2 Greyhound. It had a range of approximately 1,500 miles with a 10,000 pound cargo. It was retired on July 28th, 2026. The C-2 has been replaced by the CMV-22B Osprey. It has a range of only 1,150 miles and a more limited cargo capacity of only 6,000 pounds. 6,000 pounds isn't nothing, but it's not a lot either.

There's not a lot of stuff within 1,150mi of the Arabian Sea. Your two options are one of the US bases in the southern Persian Gulf (Kuwait is too far) and Diego Garcia. Neither are ideal. In both cases you're doing a transfer out in the field.

On the other hand, the C-5 Galaxy can carry 120,000 pounds to a range of 4,800 miles. You can fill it with food in the continental US, fly to Hickam AFB in Hawaii, refuel, and fly the rest of the way to Guam. On the return leg, an unladen C-5 can fly directly to the 22nd Airlift Squadron's home base California without a layover.

The C-17B Globemaster is smaller than the C-5, although it's nearly as capable. With a 160,000 pound cargo, it has a range of 3,200 miles, (the C-17A has a shorter range) which is just short of the 3,800 miles to get from Hawaii to Guam. I don't know how much cargo it's capable of carrying 3,800 miles, but on the order of 100,000 pounds is a reasonable guess. It is also capable of an empty flight back to the US without a layover.

Re: I think the military commissary's freezers were hacked

#126

Post by meliz242 »

mnicky wrote: post #95
Hovertruck wrote: post #74

Earlier quoted context omitted.

Weirdly I felt like it got more LLM-y the further I got in. Then I hit the part with: But the thing I can’t get past is Fort Huachuca’s failure mode. Not: the freezer compressor died. Not: the power went out. Not even: the refrigeration system stopped cooling. Every freezer went into active defrost.

Well, definitely some LLM use :) At least in the second half... Confirmed with Pangram detector as well, which has pretty good precision.

Hey, author here!

No LLM use while writing, except for my grammar/phrasing plugin which I think (?) uses AI. I detailed my explicit usage cases for gpt in an earlier comment above.

Is there anything you, as a skeptical reader, would like to disclaimed/posted/footnoted when it comes to disclosing gpt usage during research questions, etc?

Wasn’t planning to have to address this early on but I would love to moving forward, especially time listener, first time caller to the online writing publication world, especially in the era of rampant AI usage.

(Keeping in mind that this is my personal substack meant to be an anthology series of my thoughts and rabbit-holed interest write ups, not exactly intended for such wide scrutiny but, I guess, could be potentially disseminated widely in a rare instance such as this first post, lol)

Re: I think the military commissary's freezers were hacked

#127

Post by detourdog »

peterabbitcook wrote: post #49
sidewndr46 wrote: post #33

Earlier quoted context omitted.

Isn't this the industry expectation in that kind of equipment? If it was signed by a real CA the cert. could expire and render the equipment unable to communicate.

That’s a tough question. If your PLC is on an airgapped LAN, admin/admin is not great security hygiene but you’ve reduced most of the risk by airgapping. On my project the service I wrote was doing bidirectional communication with the PLC over OPCUA. The server running this pod was connected to the internet, so it was critical to have proper TLS for the OPCUA client/server. Rotating LetsEncrypt certs on the system ev…

Just my opinion but I believe a self-signed is more secure than Let’s encrypt. When a self-signed cert changes and no one in the org knows why that is alarming. Getting certificate error messages every month and half every numbs the org to the alarm.

Re: I think the military commissary's freezers were hacked

#128

Post by CobaltFire »

nwallin wrote: post #125
nwatson wrote: post #94

Earlier quoted context omitted.

Did they airlift better supplies to a floating aircraft carrier somewhere in the northern Indian Ocean recently? No.

Aircraft carriers are not particularly well suited to be supplied by cargo aircraft. The largest cargo aircraft with the strengthened landing gear, arresting hook, and catapult attachment used to be the C-2 Greyhound. It had a range of approximately 1,500 miles with a 10,000 pound cargo. It was retired on July 28th, 2026. The C-2 has been replaced by the CMV-22B Osprey. It has a range of only 1,150 miles and a more l…

Not really relevant but a fun anecdote:

I can't speak to how much cargo was on board, but I did a Hawai'i to Guam leg on a C-17B that was carrying palletized cargo.

One of my better Space-A experiences. Crew was great, flight was smooth. I preferred it over the KC-135 leg, despite the more spartan conditions. The aircrew let us toss out sleeping bags and packs in the aisles between cargo and get some sleep.

Re: I think the military commissary's freezers were hacked

#129

Post by 0xWTF »

ericmay wrote: post #70
CobaltFire wrote: post #67

As someone who spent over 20 years active duty, and spent a ton of my career in the IT, security, etc. side of the house: Unlikely to be a hack, more likely to be a misconfiguration or update sent incorrectly. That said, the timing of the disclosure and the issue are rather concerning. Regarding the highest value targets to hit with an attack like this, you would want to target Guam, Hawai'i, and other isolated overs…

Generally agree with your assessment, but in the case of Guam or other more remote installations if there were catastrophic issues we'd just airlift food in. Costly but certainly manageable. Hawaii I'm not sure why that would be an issue unless the whole island was attacked or shut down. Even if the on-base shops were hacked you could just go shop at Wal-Mart or Costco or any number of other locations on the islands.…

Guam freezers and chillers were offline several times the years when I was there. You just didn't get milk, butter, eggs, ice cream, meat, etc those weeks.

Re: I think the military commissary's freezers were hacked

#130

Post by 0xWTF »

This is eerily suggestive of a vulnerability Hank Paulson hinted at in his 2014 book "Dealing with China"

"Every nonelectric cooler comes with 25 years of free real-time monitoring. On a visit to the company in the spring of 2012, I watched as technicians in Broad Air’s space-age control room checked on the performance of its units in locations as diverse as the Adolfo Suárez Madrid–Barajas Airport in Spain; Qualcomm headquarters in San Diego, California; and Fort Stewart, the U.S. Army base in Georgia [emphasis added].

"Zhang says that 80 percent of his clients are repeaters. “If you bring long-term benefits for your clients, they will choose you.”"

Post reply on HN