Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DDoS attack halts heating in Finland amidst winter

metropolitan.fi

Post reply on HN
Print view View original

11–20 of 81 posts

Re: DDoS attack halts heating in Finland amidst winter

#11

Post by na85 »

ge0rg wrote: post #7

That sounds like either clueless reporting or an attempt at blame shifting. The heating system of a building is not a typical DDoS target, and it's improbable that somebody living outside of that building had a take against the inhabitants, knew of the right IP(s) for that building, and the effect a DDoS would have. It's more plausible that the control system was designed so badly that exposing it to the Internet (an…

Perhaps. I wouldn't discount actual ddos, though.

Sounds like exactly the sort of thing I'd have done in my youth (if I had had the skills) if I would've discovered lax security in my own building's systems and it pissed me off.

IOT companies don't tend to have bug bounties et al, and shutting off the heat to some buildings seems like a mostly harmless way to get some publicity for the issue.

Re: DDoS attack halts heating in Finland amidst winter

#12

Post by zmb_ »

ge0rg wrote: post #7

That sounds like either clueless reporting or an attempt at blame shifting. The heating system of a building is not a typical DDoS target, and it's improbable that somebody living outside of that building had a take against the inhabitants, knew of the right IP(s) for that building, and the effect a DDoS would have. It's more plausible that the control system was designed so badly that exposing it to the Internet (an…

It is bad reporting. The systems in question were used as a part of launching a DDoS attack, they were not the target of the attack. The high load then caused the systems to crash repeatedly.

Re: DDoS attack halts heating in Finland amidst winter

#13

Post by cesarb »

In my experience, embedded systems tend to behave poorly when faced with large amounts of traffic (normal traffic to these systems is tiny). I have once been locked out of work due to an errant workstation flooding the network with broadcast DHCP packets, which overloaded the embedded system which validates the key cards and unlocks the door (later permanently solved by moving the embedded system to its own firewalled VLAN).

As an aside: lovely Netscape favicon on that site.

Re: DDoS attack halts heating in Finland amidst winter

#14

Post by ge0rg »

zmb_ wrote: post #12
ge0rg wrote: post #7

That sounds like either clueless reporting or an attempt at blame shifting. The heating system of a building is not a typical DDoS target, and it's improbable that somebody living outside of that building had a take against the inhabitants, knew of the right IP(s) for that building, and the effect a DDoS would have. It's more plausible that the control system was designed so badly that exposing it to the Internet (an…

It is bad reporting. The systems in question were used as a part of launching a DDoS attack, they were not the target of the attack. The high load then caused the systems to crash repeatedly.

Do you have a better source for that? In the article it rather reads like the control system was at the receiving end:

The systems that were attacked tried to respond to the attack by rebooting the main control circuit.

Re: DDoS attack halts heating in Finland amidst winter

#15

Post by sfifs »

ge0rg wrote: post #7

That sounds like either clueless reporting or an attempt at blame shifting. The heating system of a building is not a typical DDoS target, and it's improbable that somebody living outside of that building had a take against the inhabitants, knew of the right IP(s) for that building, and the effect a DDoS would have. It's more plausible that the control system was designed so badly that exposing it to the Internet (an…

Could very well be a prank by teenagers who spot a hole in a nearby buildings systems. Not necessary to assume reporter has it wrong unless you have a contradictory source.

Re: DDoS attack halts heating in Finland amidst winter

#16

Post by SixSigma »

ryanlol wrote: post #9

This was almost certainly a case of outgoing DoS, not incoming DDoS. Terrible reporting. Remote management hardware got infected with Mirai or the like.

I'm calling: Local newspaper, written in English by Finnish speaking Finns who are not computer specialists.

Re: DDoS attack halts heating in Finland amidst winter

#17

Post by mrweasel »

Regardless of the reason, deliberate targetting, accidental "drive by DDoS" or bad configuration, the question that remains is "Why is the heating dependent on being online?"

It is completely reasonable if the heat system every so often "phones home", so report on usage, but it shouldn't actually stop working, if the network connection isn't available.

You can blame, DDoS, hackers, network outages, the Russians, I don't care, it doesn't cover up the fact that your system has a stupid design.

Re: DDoS attack halts heating in Finland amidst winter

#18

Post by ComteDeLaFere »

mrweasel wrote: post #17

Regardless of the reason, deliberate targetting, accidental "drive by DDoS" or bad configuration, the question that remains is "Why is the heating dependent on being online?" It is completely reasonable if the heat system every so often "phones home", so report on usage, but it shouldn't actually stop working, if the network connection isn't available. You can blame, DDoS, hackers, network outages, the Russians, I do…

Not sure why this is controversial. Boilers have an on/off switch, and when your company manages a large number of buildings, you automate and centralize on/off for efficiency's sake, no?

Re: DDoS attack halts heating in Finland amidst winter

#19

Post by sesqu »

ge0rg wrote: post #14
zmb_ wrote: post #12

Earlier quoted context omitted.

It is bad reporting. The systems in question were used as a part of launching a DDoS attack, they were not the target of the attack. The high load then caused the systems to crash repeatedly.

Do you have a better source for that? In the article it rather reads like the control system was at the receiving end: The systems that were attacked tried to respond to the attack by rebooting the main control circuit.

The service provider says it was a DDOS but the device manufacturer says it was probably an aftershock of the Mirai botnet that uses IoT to launch attacks.
Post reply on HN