Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US passes emergency waiver over fuel pipeline cyber-attack

bbc.com

Post reply on HN
Print view View original

471–479 of 479 posts

Re: US passes emergency waiver over fuel pipeline cyber-attack

#471

Post by enchiridion »

ShroudedNight wrote: post #312
mbreese wrote: post #123

Earlier quoted context omitted.

I’m curious — how would something like a data-diode work in real life? It makes sense, but what about something like TCP where the sending side needs the ability to receive ACK messages? Is a firewall (dedicated, if need be) enough? Or would this be some other kind of physical interface that took some kind of read-only data (serial?) and sent it up the layers using TCP/IP, where only this box would be at risk? Edit:…

> how would something like a data-diode work in real life? A webcam? Second hand, but that's what I was told a dam operator was using as a "grass-roots" solution a while back

Not sure, but seems like literal diodes on the data line would work? Probably packaged to make it plug and play.

Re: US passes emergency waiver over fuel pipeline cyber-attack

#472

Post by mikewarot »

mbreese wrote: post #123
rckoepke wrote: post #81

Earlier quoted context omitted.

I built some of the SCADA and IT systems for Colonial Pipeline. Many industrial SCADA systems (nearly all) send data from their "OT" systems (PLC/DCS/SCADA) to their "IT" and business layers (Historians/Timeseries Databases, Dashboards, Power BI/etc). This almost always happens through a two-way link (think TCP/IP, HTTP). While the software should not allow data flow backwards, the hardware absolutely does. So how mu…

I’m curious — how would something like a data-diode work in real life? It makes sense, but what about something like TCP where the sending side needs the ability to receive ACK messages? Is a firewall (dedicated, if need be) enough? Or would this be some other kind of physical interface that took some kind of read-only data (serial?) and sent it up the layers using TCP/IP, where only this box would be at risk? Edit:…

A data diode doesn't have to be just a one way ethernet port, it can include a pair of dedicated servers.

The inside (isolated) server would poll everything, store it into a buffer, and send that buffer (plus error correction) out through an optoisolator to other server.

The outside (internet facing) server would then keep up with the ring buffer, and serve requests, and do any outbound push of data via any protocol required.

A system to do this could be made with a pair of raspberry pi computers and a little bit of discrete components for less than $150 in hardware costs.

Re: US passes emergency waiver over fuel pipeline cyber-attack

#473

Post by Can_Not »

panarky wrote: post #323
magnusss wrote: post #233

The reason that cyberattacks are proliferating is because it has only recently become easy for the threat actors to receive massive payments quickly and anonymously. Remove that ability and the entire cyberattack ecosystem shuts down instantly. It is only a matter of time before this happens.

The reason cyberattacks are proliferating is because many enterprises refuse to learn from the mistakes of others. They continue to connect ancient, unpatched Windows and Exchange servers to the public internet, they don't segment their networks, they don't secure TeamViewer and RDP, they don't use FIDO U2F, they don't have an IDS, they don't monitor logs, they don't execute email links and attachments in a sandbox,…

Meanwhile Microsoft and "app" developers are training normal users to avoid updates by continuing to push anti-user updates...

Re: US passes emergency waiver over fuel pipeline cyber-attack

#474

Post by d110af5ccf »

jacksonkmarley wrote: post #470
d110af5ccf wrote: post #468

Earlier quoted context omitted.

It's a good point but that's a particularly bad analogy. Brewing and distilling are strongly culturally ingrained, at least in the west. I live in a state where (last I checked) no legal method exists to distill ethanol for personal use. Nonetheless, a surprising number of acquaintances over the years have had stills and offered me samples.

Do you think your local circumstances are broadly generalisable? I would be surprised.

In the US, honestly, yes. I've had the same experience in two different states at this point and friends who relocated from other places have reported similar. I mean, you can literally order a small still that you use on your stove top from Amazon!

I think it just depends on the sort of people you choose to spend time with.

Re: US passes emergency waiver over fuel pipeline cyber-attack

#475

Post by jacksonkmarley »

d110af5ccf wrote: post #474
jacksonkmarley wrote: post #470

Earlier quoted context omitted.

Do you think your local circumstances are broadly generalisable? I would be surprised.

In the US, honestly, yes. I've had the same experience in two different states at this point and friends who relocated from other places have reported similar. I mean, you can literally order a small still that you use on your stove top from Amazon! I think it just depends on the sort of people you choose to spend time with.

Well mark me down as dubious but not invested enough to research it. However, I do wonder if you/they test or filter for poisonous impurities like methanol? Seems like a bit of a risk?

Re: US passes emergency waiver over fuel pipeline cyber-attack

#476

Post by d110af5ccf »

jacksonkmarley wrote: post #475
d110af5ccf wrote: post #474

Earlier quoted context omitted.

In the US, honestly, yes. I've had the same experience in two different states at this point and friends who relocated from other places have reported similar. I mean, you can literally order a small still that you use on your stove top from Amazon! I think it just depends on the sort of people you choose to spend time with.

Well mark me down as dubious but not invested enough to research it. However, I do wonder if you/they test or filter for poisonous impurities like methanol? Seems like a bit of a risk?

Testing and filtering is accomplished by the distillation itself. A very basic understanding of what comes out when is more than enough for a simple pot still and only one or two passes. Humans have been doing that since long before the concept of a molecule even existed.

If you decide to mess around with a large fractionating column though, do read up and make sure you have a full conceptual understanding of how the chemistry works. Even seemingly benign chemicals can be extremely dangerous to ingest or handle once concentrated. (For example, vinegar. Dilute acetic acid makes for a good salad dressing. Above 90%, contact will leave you with severe burns and scarring.)

Re: US passes emergency waiver over fuel pipeline cyber-attack

#477

Post by numair »

yourapostasy wrote: post #394
numair wrote: post #248

Earlier quoted context omitted.

Dan Kaminsky spent an enormous amount of time and effort on creating a secure hardware framework 10 years ago. It went nowhere for a lot of the same reasons you discuss in this comment. The government and industry are all talk. Until we see actual enforcement / incentives for secure hardware, just assume everything (and I mean everything ) can get shut down at any time. The only people who think this is an exaggerati…

> Dan Kaminsky spent an enormous amount of time and effort on creating a secure hardware framework 10 years ago. Can someone please link me to a page that goes into more detail about this secure hardware framework? Not a month from his passing, and we get a national-security-level attack that might have been prevented if US business took more seriously software engineering and security engineering from back then. Als…

There were a bunch of people who worked with him on this in Taiwan. I don't think anything ever got released publicly, and I think Dan found the whole episode to be so frustrating that he never commented on it much in public.

Re: US passes emergency waiver over fuel pipeline cyber-attack

#478

Post by aginter »

mbreese wrote: post #123
rckoepke wrote: post #81

Earlier quoted context omitted.

I built some of the SCADA and IT systems for Colonial Pipeline. Many industrial SCADA systems (nearly all) send data from their "OT" systems (PLC/DCS/SCADA) to their "IT" and business layers (Historians/Timeseries Databases, Dashboards, Power BI/etc). This almost always happens through a two-way link (think TCP/IP, HTTP). While the software should not allow data flow backwards, the hardware absolutely does. So how mu…

I’m curious — how would something like a data-diode work in real life? It makes sense, but what about something like TCP where the sending side needs the ability to receive ACK messages? Is a firewall (dedicated, if need be) enough? Or would this be some other kind of physical interface that took some kind of read-only data (serial?) and sent it up the layers using TCP/IP, where only this box would be at risk? Edit:…

Industrial applications use unidirectional gateways (See NIST 800-82r2). The gateways have diode-like hardware at their core, but add software. The software acquires snapshots of industrial state, converts those snapshots to proprietary unidirectional protocols & formats, and on the external enterprise network makes the data available to enterprise users.

A common example is a SQLServer database of all industrial data that is authorized to share with the enterprise. Grab new and changed data as it arrives on the industrial side. Push unidirectionally to the enterprise side. Insert/update the data in an identical SQLServer. Enterprise users & applications interact normally and bi-directionally with the replica database.

The technology is used routinely to provide access to industrial data that enables business efficiencies, without providing access to the industrial systems that produce the data.

For more info see: https://waterfall-security.com

Re: US passes emergency waiver over fuel pipeline cyber-attack

#479

Post by breakyerself »

kingsuper20 wrote: post #425
breakyerself wrote: post #224

I'm a fan of pipeline shutdowns personally

I've always wondered about that theory. Is the point to move liquid shipments to trucks/ships because it's safer somehow? or simply to make it so difficult to transport liquid fuels that people quit using them? I suspect that pipeline activism mostly results in the former.

Constrained supply or higher cost of transportation = higher prices = incentive to consume less.

I'd prefer to see this dynamic produced by carbon taxes so the price difference isn't going back to the fossil fuel companies, but I'll take what I can get.

Also installation of new fossil fuel infrastructure like pipelines implies a long term commitment to the status quo or even increased production which I find unacceptable.

If the neccessary changes were underway there would be zero demand for new pipelines.

Post reply on HN