Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

U.S.'s Biggest Gasoline Pipeline Halted After Cyberattack

washingtonpost.com

Post reply on HN
Print view View original

101–110 of 218 posts

Re: U.S.'s Biggest Gasoline Pipeline Halted After Cyberattack

#101

Post by mindslight »

bourgwaletariat wrote: post #96
sky_rw wrote: post #95

Earlier quoted context omitted.

While you’re probably right on the zeitgeist aspect of this, I think you’re missing the practical aspects of what OP is talking about. We have major vulnerabilities to key infrastructure components. Publicly exposing these helps harden them. Yes 9-11 added a ton of security theater and fear, but it also resulted in armored doors on airplane cockpits. I’d like to see the armored door of the energy infrastructure imple…

That's not the society I want. I don't want stronger doors everywhere. Tougher locks everywhere. Onerous security everywhere. I prefer a society where passengers are free to chit chat with the pilots when they aren't busy. Where children who might be interested in being a pilot can see a cockpit in the air and how it's done. I remember reading about the history of security in ancient Rome. The lengths to which normal…

While I wholeheartedly agree with what you're saying for the physical world, the digital world is completely different. In the physical world, the scope of any action is inherently localized. But with digital systems it takes just one person out of seven billion (or even just the right software bug) to create a global scale problem. The Internet is best treated as a source of malicious noise.

Re: U.S.'s Biggest Gasoline Pipeline Halted After Cyberattack

#102

Post by mikewarot »

stunt wrote: post #98
jeffbee wrote: post #90

Earlier quoted context omitted.

What would be the difference between having a data diode between your control and monitoring network and external monitoring systems, versus just splitting the monitoring part off into a completely separate network with ordinary two-way traffic?

What you explained doesn't solve the problem. You still want to have an unidirectional network in place at least between your critical infrastructure to the monitoring systems. Monitoring systems are usually separate and often have their dedicated network too, but they still need some sort of network connection to your critical infrastructure to do their job (monitoring).

If you put a data diode between your infrastructure and the internet, you can see the status from anywhere, yet never compromise it from the outside.

Re: U.S.'s Biggest Gasoline Pipeline Halted After Cyberattack

#103

Post by BoorishBears »

dillondoyle wrote: post #92
BoorishBears wrote: post #43

Earlier quoted context omitted.

I've always secretly hoped warfare would move to the digital realm soley. We have some shades of that happening already, but I imagine a future where instead of sending young people to die,warring nations wreck each others economies remotely... which again isn't too far from current day. While there'd still be casualties it wouldn't be nearly as barbaric as current wars, more developed nations would finally have as m…

I'm not sure it wouldn't be as barbaric at least if that word means human suffering and death. But I agree it's the future of war.

Human suffering and death are not binary things.

War will always be a bad thing, but putting people on the ground in a foreign land with the mission to kill others has always amplified the horrors of war many many times over.

Taking out power in half the US for a day would kill thousands, but it's the equivalent of an all out attack on the US.

Compare that to if another country were to physically commit to an all out attack and it's easy to see why this would make future wars look like minor skirmishes compared to what's happened in the past

Re: U.S.'s Biggest Gasoline Pipeline Halted After Cyberattack

#104

Post by BoorishBears »

joejerryronnie wrote: post #82
BoorishBears wrote: post #43

Earlier quoted context omitted.

I've always secretly hoped warfare would move to the digital realm soley. We have some shades of that happening already, but I imagine a future where instead of sending young people to die,warring nations wreck each others economies remotely... which again isn't too far from current day. While there'd still be casualties it wouldn't be nearly as barbaric as current wars, more developed nations would finally have as m…

I think you’re going to see this more and more (at least with wealthy nations). And I think the motivation for war has always been primarily about profit.

It's been motivated by profit, but this harms the motivation

Right now it is profitable for us to go to war. Contracts are signed, jobs are created, it is good for powerful wealthy people for the country to be at war. And if you're powerful enough the risk of retaliation is so low that it's all gain and no cost (outside of human cost which is never enough apparently)

With this type of war the equation would be switched. Going to war directly harms wealthy benefactors, who as a result of their wealth hold political influence.

We're already seeing that aren't we? Espionage at companies like Boeing and Lockheed Martin. It's not harming any "normal person" but it's directly hurting the pocketbooks of powerful people. It creates incentive to avoid conflict in a way that (unfortunately) young men and women dying doesn't seem to have done in the past

Re: U.S.'s Biggest Gasoline Pipeline Halted After Cyberattack

#105

Post by yyyk »

DangitBobby wrote: post #53
randomhodler84 wrote: post #49

Earlier quoted context omitted.

It isn’t, and you might be a little misinformed. But it’s ok, you can scream into the abyss as long as you like. We don’t want to cure cancer (don’t know how). We want to free the world of the tyranny of central banking, debt-based economies and theft of savings through inflation. It is a noble endeavor. Selfishness is continuing along the old broken road. There are new, better ones.

How do cryptocurrencies save you from a debt based economy or inflation? Don't you still need to pay for goods and services in the same debt-based economy? How does the flavor of money change whether someone needs to go into debt? What would prevent cryptocurrency values from inflating or deflating?

Inflation is mostly a monetary phenomenon. They'd limit creation of new money so it very rarely happens, and then we get deflation.

Of course they'd end up printing money via some L2/L3 and we get the same deal. If we actually followed through, we'd get permanent deflation which is an obvious disaster even without accepting the Keynesian arguments against it (I find that part of Keynesian thinking to be mostly false).

Re: U.S.'s Biggest Gasoline Pipeline Halted After Cyberattack

#106

Post by procarch2019 »

rhodozelia wrote: post #77
procarch2019 wrote: post #39

Earlier quoted context omitted.

It is mind boggling the lack of basic security principles some people have. I won't just put that on the plants and their IT/OT, or lack thereof. I've seen plenty of vendors and integrators do some cringe worthy stuff too.

The whole automation industry is a security disaster but it is because security isn’t part of the deliverables for any party. It isn’t in the specs, civil, mechanical, electrical engineers it isn’t their responsibility. If the owner has an IT department they usually don’t want to be responsible for it either since locking things down leads to weird issues with legacy proprietary SCADA systems. There is no out of the…

Yea, that is correct. I typically put together the solutions for new systems, including security. I give the sales team part numbers and hours for security software and related hardware. They then add that as an option to quotes. No principal automation engineer wants to take that on and no IT want to be involved. Also, when money is tight that’s an easy target for them to pass on.

Luckily I’ve pushed enough over the years that we at least include A/V software as mandatory.

I’ve been able to carve out a nice space within my company bridging the IT/OT divide. It’s been particularly good recently since the bigger companies are dictating good cyber practices, but rely on integrators and vendors to implement.

I don’t think there will ever be an out of the box solution unless a system stands on its own, which is becoming increasingly harder with modernization and reliability efforts. Add on top of that privileged access, remote monitoring and support, automated (kind of) patching, etc. you have to interface with the IT side a bit.

Re: U.S.'s Biggest Gasoline Pipeline Halted After Cyberattack

#107

Post by rhodozelia »

procarch2019 wrote: post #106
rhodozelia wrote: post #77

Earlier quoted context omitted.

The whole automation industry is a security disaster but it is because security isn’t part of the deliverables for any party. It isn’t in the specs, civil, mechanical, electrical engineers it isn’t their responsibility. If the owner has an IT department they usually don’t want to be responsible for it either since locking things down leads to weird issues with legacy proprietary SCADA systems. There is no out of the…

Yea, that is correct. I typically put together the solutions for new systems, including security. I give the sales team part numbers and hours for security software and related hardware. They then add that as an option to quotes. No principal automation engineer wants to take that on and no IT want to be involved. Also, when money is tight that’s an easy target for them to pass on. Luckily I’ve pushed enough over the…

Sadly the OT networks are 100% trusting of any device on the network. With Schneider plcs any device on the OT network can write to any addressed memory register over modbus - it’s like direct memory access DMA.

I hope that one day every device on the OT network has a yubikey and all messages are signed so that no unauthenticated access is possible.

Re: U.S.'s Biggest Gasoline Pipeline Halted After Cyberattack

#109

Post by bourgwaletariat »

mindslight wrote: post #101
bourgwaletariat wrote: post #96

Earlier quoted context omitted.

That's not the society I want. I don't want stronger doors everywhere. Tougher locks everywhere. Onerous security everywhere. I prefer a society where passengers are free to chit chat with the pilots when they aren't busy. Where children who might be interested in being a pilot can see a cockpit in the air and how it's done. I remember reading about the history of security in ancient Rome. The lengths to which normal…

While I wholeheartedly agree with what you're saying for the physical world, the digital world is completely different. In the physical world, the scope of any action is inherently localized. But with digital systems it takes just one person out of seven billion (or even just the right software bug) to create a global scale problem. The Internet is best treated as a source of malicious noise.

The main purpose of government is to protect its citizens from foreign invaders. I don't see any difference here.

Re: U.S.'s Biggest Gasoline Pipeline Halted After Cyberattack

#110

Post by procarch2019 »

rhodozelia wrote: post #107
procarch2019 wrote: post #106

Earlier quoted context omitted.

Yea, that is correct. I typically put together the solutions for new systems, including security. I give the sales team part numbers and hours for security software and related hardware. They then add that as an option to quotes. No principal automation engineer wants to take that on and no IT want to be involved. Also, when money is tight that’s an easy target for them to pass on. Luckily I’ve pushed enough over the…

Sadly the OT networks are 100% trusting of any device on the network. With Schneider plcs any device on the OT network can write to any addressed memory register over modbus - it’s like direct memory access DMA. I hope that one day every device on the OT network has a yubikey and all messages are signed so that no unauthenticated access is possible.

Interesting, I'll have to take a look at yubikey. I just installed a Tofino firewall with the Modbus Enforcer LSM between one of our DCS and accompanying SIS systems. We have never had a system communicate process data directly up the networks except through OPC (mostly DA, which is even more problematic for firewalls). Luckily OPC UA is now natively supported on our application, so things are starting to move in that direction.

Luckily a lot of our customers use PI, so we install the PI OPC interface on the application layer and only PI ports need to be opened to the next level.

Even more so the vendor we work with, Emerson, even has IPD firewalls to go between the DCS computers (engineering, historians, operator stations) and the I/O (what we refer to as level 2). The price tag can really jump when you implement all these security features, but an argument can easily be made that it's worth it when you consider some of our customers run batches that can be worth $500K or more per batch.

Post reply on HN