Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I think the military commissary's freezers were hacked

signalandsilence.substack.com

Post reply on HN
Print view View original

211–220 of 252 posts

Re: I think the military commissary's freezers were hacked

#211

Post by Joker_vD »

Dylan16807 wrote: post #202
Joker_vD wrote: post #62

Earlier quoted context omitted.

Well, what else can it do, really? It has to boot with pretty much zero knowledge about the external world (maybe except asking the user for the current date and time). Sure, you can hardcode an outdated list of CAs (it's always outdated because the system can be booted 10/20/100 years after it was made) in but that just opens you to unexpected obsolescence, and you usually can't put too much stuff in the bootloader…

If we pretend we're revising TFTP boot in 1995, let's have it get up to 20 boot options from the server and their md5 hashes, and if it's not set to auto it waits for the user to pick one. It then verifies the hash as it downloads. Also it uses TCP for the download.

Nah, you won't sell the cow like that. You need to add more reliance on the public CA infrastructure and third-party code signing. Also, "ask user"? Ask the TPM instead — I mean, why would the computer's owner trust the computer's user, right?

Re: I think the military commissary's freezers were hacked

#212

Post by aa-jv »

CobaltFire wrote: post #67

As someone who spent over 20 years active duty, and spent a ton of my career in the IT, security, etc. side of the house: Unlikely to be a hack, more likely to be a misconfiguration or update sent incorrectly. That said, the timing of the disclosure and the issue are rather concerning. Regarding the highest value targets to hit with an attack like this, you would want to target Guam, Hawai'i, and other isolated overs…

>Unlikely to be a hack, more likely to be a misconfiguration or update sent incorrectly.

These two states are indistinguishable from each other. A good hack looks like a poorly configured maintenance update, and vice versa.

Re: I think the military commissary's freezers were hacked

#213

Post by fifilura »

nwallin wrote: post #125
nwatson wrote: post #94

Earlier quoted context omitted.

Did they airlift better supplies to a floating aircraft carrier somewhere in the northern Indian Ocean recently? No.

Aircraft carriers are not particularly well suited to be supplied by cargo aircraft. The largest cargo aircraft with the strengthened landing gear, arresting hook, and catapult attachment used to be the C-2 Greyhound. It had a range of approximately 1,500 miles with a 10,000 pound cargo. It was retired on July 28th, 2026. The C-2 has been replaced by the CMV-22B Osprey. It has a range of only 1,150 miles and a more l…

Use a ship.

Re: I think the military commissary's freezers were hacked

#214

Post by mapt »

nwatson wrote: post #94
ericmay wrote: post #70

Earlier quoted context omitted.

Generally agree with your assessment, but in the case of Guam or other more remote installations if there were catastrophic issues we'd just airlift food in. Costly but certainly manageable. Hawaii I'm not sure why that would be an issue unless the whole island was attacked or shut down. Even if the on-base shops were hacked you could just go shop at Wal-Mart or Costco or any number of other locations on the islands.…

Did they airlift better supplies to a floating aircraft carrier somewhere in the northern Indian Ocean recently? No.

Carrier resupply while underway is primarily by a sort of temporary cable tramway erected between the carrier and the resupply ship.

Supercarriers came into existence at ~70,000t and transitioned to ~100,000t. You'd need to scale another step up or three, to 140,000t, 200,000t, or 280,000t, in order to see something capable of landing and taking off a cargo-laden C-130 in regular operations.

Re: I think the military commissary's freezers were hacked

#215

Post by croon »

lostlogin wrote: post #191
croon wrote: post #188

Earlier quoted context omitted.

Not only care about; a mistake is unlikely to be repeated, a motivated attack is very likely to be attempted again.

> a mistake is unlikely to be repeated If it was a mistake, it happened at many facilities. That seems like a repeated mistake to me.

That's not what logically follows from my statement. It's a conclusion you can make if you believe my premises are false though. It could also be a third possibility of a bug/issue affecting many of these specific batches.

Re: I think the military commissary's freezers were hacked

#217

Post by DoneWithAllThat »

PeterStuer wrote: post #195

Central unanswered question in the article on wich all the speculation rests: "If this were a cyberattack, why mess with freezers?" And yes, remember you can explain everyting by adding enough dimensions to a game of chess. But in reality? Seems the upside is near zero while the dowside is sacrifising your access.

I mean you don’t have to go too many layers deep here. A military running on its stomach is a truism known for centuries, and if you wanted to use cyber warfare to attack a military’s food supplies this is one of the few avenues available to you (the other being logistics).

Re: I think the military commissary's freezers were hacked

#218

Post by pcthrowaway »

CobaltFire wrote: post #67

As someone who spent over 20 years active duty, and spent a ton of my career in the IT, security, etc. side of the house: Unlikely to be a hack, more likely to be a misconfiguration or update sent incorrectly. That said, the timing of the disclosure and the issue are rather concerning. Regarding the highest value targets to hit with an attack like this, you would want to target Guam, Hawai'i, and other isolated overs…

I'm also reminded of the HPE SSD time-bomb bug which would cause catastrophic failure after exactly 32,768 hours of use[1]. Could there be a common denominator in when these refrigerators went online?

[1] https://www.bleepingcomputer.com/news/hardware/hp-warns-that...

Re: I think the military commissary's freezers were hacked

#219

Post by trhway »

fifilura wrote: post #213
nwallin wrote: post #125

Earlier quoted context omitted.

Aircraft carriers are not particularly well suited to be supplied by cargo aircraft. The largest cargo aircraft with the strengthened landing gear, arresting hook, and catapult attachment used to be the C-2 Greyhound. It had a range of approximately 1,500 miles with a 10,000 pound cargo. It was retired on July 28th, 2026. The C-2 has been replaced by the CMV-22B Osprey. It has a range of only 1,150 miles and a more l…

Use a ship.

better the best of both worlds - flying boat like https://en.wikipedia.org/wiki/Boeing_314_Clipper

Giving how static bases (including airstrips) have become vulnerable, i think we may yet to see those flying boats coming back as a way to support Navy fleets which historically were relying on the static bases.

Re: I think the military commissary's freezers were hacked

#220

Post by Tangurena2 »

ethbr1 wrote: post #172
nwallin wrote: post #125

Earlier quoted context omitted.

Aircraft carriers are not particularly well suited to be supplied by cargo aircraft. The largest cargo aircraft with the strengthened landing gear, arresting hook, and catapult attachment used to be the C-2 Greyhound. It had a range of approximately 1,500 miles with a 10,000 pound cargo. It was retired on July 28th, 2026. The C-2 has been replaced by the CMV-22B Osprey. It has a range of only 1,150 miles and a more l…

The relevant phrase is underway replenishment (aka UNREP) https://en.wikipedia.org/wiki/Underway_replenishment It's been the basis for at-sea supply of long-endurance ships since ~1910 when refueling oil became a key blue sea naval requirement. Modern example: https://m.youtube.com/shorts/kzncvGBj-88 Mostly tensioned cables carrying hoses (liquids especially fuel being the highest volume / limiting factor), some pall…

I've watched some videos showing UNREP and they're fascinating. It takes a lot of skill to keep the ships parallel. There was a collision earlier this year between the resupply ship and the recipient.

Analysis:

https://www.youtube.com/watch?v=zSYl9y3e944

Also, the Navy is using Ospreys to resupply submarines at sea because they have the range and helicopters don't.

Post reply on HN