Live data from Hacker News

U.S.'s Biggest Gasoline Pipeline Halted After Cyberattack

washingtonpost.com

71–80 of 218 posts

Re: U.S.'s Biggest Gasoline Pipeline Halted After Cyberattack

#71

Perhaps we should pass a law that no utilities / infrastructure should be attached to the internet. Private networks are fine for this purpose.

I think the issue there is data, even on critical infra. Modernization, reliability and the such require data analysis. There are definitely ‘strong’ ways of protecting the assets and mitigating attack vectors, but almost no way to eliminate them entirely. For example, event if you isolate the process computers you’ll typically have an interface node that presents the data up a level (hopefully to a DMZ). Obviously y…

They can gather the data on the infrastructure network and then carry across an air gap on a USB or tape to do their analysis. I don't see the upside of allowing any connectivity to the internet given the danger other than some mechanism for sending an alert. I'm sure creative people can air gap that too (camera on the internet side and some image recognition for example).

Re: U.S.'s Biggest Gasoline Pipeline Halted After Cyberattack

#72

Earlier quoted context omitted.

I work in control systems OT space. A lot of distributed control systems and scada systems interface with the business layer in some fashion to provide access to time series and event data and to allow for alerts via email/mobile. Some people do this properly with good network segmentation, firewalls, A/V and patching, etc (there are several standards that dictate best practice). That said, even when doing it properl…

The reason I'm going for firmware is while the HMIs could have had a solarwinds style exposure, but that's just any generically wormable OS vulnerability, and not something that should cause a physical shutdown. To shutdown a pipeline, it's not a management console issue, hence why I'd speculate it's in the ICS devices themselves, which probably use uClinux toolchains on SoCs from one or two large vendors. I did some…

If the management console has a button or controls that would allow the person sitting at the management console to shut down the pipeline, which systems usually do have an emergency stop button in case there is an accident, then all you need is access to the management console to write one bit to the controller that says “operator pressed estop”

No need for firmware vulnerabilities in VxWorks when there are internet connected windows pcs.

Re: U.S.'s Biggest Gasoline Pipeline Halted After Cyberattack

#73

Earlier quoted context omitted.

I think the issue there is data, even on critical infra. Modernization, reliability and the such require data analysis. There are definitely ‘strong’ ways of protecting the assets and mitigating attack vectors, but almost no way to eliminate them entirely. For example, event if you isolate the process computers you’ll typically have an interface node that presents the data up a level (hopefully to a DMZ). Obviously y…

They can gather the data on the infrastructure network and then carry across an air gap on a USB or tape to do their analysis. I don't see the upside of allowing any connectivity to the internet given the danger other than some mechanism for sending an alert. I'm sure creative people can air gap that too (camera on the internet side and some image recognition for example).

That's massively inconvenient, although I'm sure necessary in some cases. Some businesses actually perform analysis in 'real time' so they can adjust the process accordingly, witch requires that data be accessible. This may actually be such a case as I'm sure they have to interface with customers (tank farms) to react to supply/demand on the branches. For all I know Colonial does have a private network for that purpose though. Usually PAT is really for chemical processes where you are looking for a particular yield and those analytical services are located closer to the process (in terms of networks).

There are devices called data diodes that provide unidirectional network topology, but not all time series data interfaces can work with them.

All in all, I agree that total air gap is obviously the best way to mitigate network attack vectors, but sometimes not practical. No controlling device should be at level 3 or 4 though (business or enterprise level).

Re: U.S.'s Biggest Gasoline Pipeline Halted After Cyberattack

#74
post #51

In a twisted sort of way I am happy to see these types of ransomware attacks making headlines. Before it was much harder to quantify how much a breach might cost but with ransomeware you get a fuzzy lower bound. Also the prevalence of these attacks might actually make us all safer in the long run.

This one in particular is good because, it's public, it's not that scary, but it's easy to make the jump to scary attacks.

Re: U.S.'s Biggest Gasoline Pipeline Halted After Cyberattack

#75
post #62

Earlier quoted context omitted.

I work in control systems OT space. A lot of distributed control systems and scada systems interface with the business layer in some fashion to provide access to time series and event data and to allow for alerts via email/mobile. Some people do this properly with good network segmentation, firewalls, A/V and patching, etc (there are several standards that dictate best practice). That said, even when doing it properl…

Why wouldn't you use a unidirectional connection for time series and event data? I understand why you might want to send things out to the rest of the world, I can't fathom why you wouldn't require physical access to have write access.

Some time series data interfaces only work with tcp comms, which means you can’t always rely on unidirectional networks. I agree you should use them where possible though.

I replied to a comment on a dupe post regarding PAT, in which analysis is done on process data and fed back into the process to increase efficiency or yield. Obviously there are varying levels of criticality where the risk vs the business reward might not be worth it though.

Re: U.S.'s Biggest Gasoline Pipeline Halted After Cyberattack

#76
post #28

Earlier quoted context omitted.

It's like 100x more expensive. Would be nice to have separate data lines, running fiber optics sealed in pressurized conduits for double tamper detection. The military actually does this for their critical infra.

> Would be nice to have separate data lines, running fiber optics sealed in pressurized conduits for double tamper detection. At least German Telekom has been doing this for ages for the trunk cables serving entire areas with analog phone service - although not for tamper detection as an anti-spionage measure, but rather to detect and pinpoint damage to the cables, e.g. from excavators, tree growth or splice seals de…

Pressurizing conduits also helps prevent water ingress.

Re: U.S.'s Biggest Gasoline Pipeline Halted After Cyberattack

#77
post #37

Earlier quoted context omitted.

This. I've said it a thousand times, all the security in the world will not defend a SCADA system if someone left TeamViewer running somewhere. Don't mean to pick on TeamViewer. It could be any number of packages, but I think security minded people get an idea of the type of attack vectors I'm talking about.

It is mind boggling the lack of basic security principles some people have. I won't just put that on the plants and their IT/OT, or lack thereof. I've seen plenty of vendors and integrators do some cringe worthy stuff too.

The whole automation industry is a security disaster but it is because security isn’t part of the deliverables for any party. It isn’t in the specs, civil, mechanical, electrical engineers it isn’t their responsibility.

If the owner has an IT department they usually don’t want to be responsible for it either since locking things down leads to weird issues with legacy proprietary SCADA systems.

There is no out of the box secure solution available yet. Rockwell certainly makes an attempt with their factory talk directory but I highly doubt that isn’t easily worked around somehow.

Re: U.S.'s Biggest Gasoline Pipeline Halted After Cyberattack

#78

Given Government inaction on climate change, could we begin to see motivated individuals or groups taking matters into their own hands and targeting fossil fuel infrastructure in this manner?

That would be domestic terrorism and is an easy way to turn the entire population against the cause

It could do more harm than good, but it remains possible that someone will do it anyway. It's a legitimate scenario for these types of companies to consider in their cyber-security planning and preparation (assuming they have any).

Re: U.S.'s Biggest Gasoline Pipeline Halted After Cyberattack

#80

Earlier quoted context omitted.

It isn’t, and you might be a little misinformed. But it’s ok, you can scream into the abyss as long as you like. We don’t want to cure cancer (don’t know how). We want to free the world of the tyranny of central banking, debt-based economies and theft of savings through inflation. It is a noble endeavor. Selfishness is continuing along the old broken road. There are new, better ones.

How do cryptocurrencies save you from a debt based economy or inflation? Don't you still need to pay for goods and services in the same debt-based economy? How does the flavor of money change whether someone needs to go into debt? What would prevent cryptocurrency values from inflating or deflating?

A large cryptocurrency like Bitcoin is entirely capable of functioning like gold as a hedge against fiat inflation.

I'm not much of a crypto cultist (which is the latest trend here on HN, to tag anybody that defends crypto with that to shut down conversation), however it's extraordinarily obvious at this point how cryptocurrencies can help you evade inflation in eg USD or evade the debt damage to the US economy. Bitcoin for its part is global and not primarily dependent on the condition of the US economy, and it's likely to become increasingly global and even less dependent on the US over time.

> Don't you still need to pay for goods and services in the same debt-based economy

Of course. This is a case where crypto is even better than gold. It's particularly trivial to convert in and out of traditional fiat.

Surely you understand enough about cryptocurrencies at this point to know how easy that is. And it appears likely to keep getting easier, given the effort companies like Coinbase, Robinhood and Square are putting into it (check out what Square did in its latest quarter courtesy crypto).

> How does the flavor of money change whether someone needs to go into debt?

The parent said debt based economies. The US has an economy and government system that is increasingly drowning in debt (check out the corporate balance sheets in the US; nationally it's horrific; that situation has been spurred on by the Fed's forever low interest rates, which encourages corporations to take on ever greater sums of debt because it's artificially cheap, which will ultimately lead to zombies ala Japan). The Federal answer to that is to print ever increasing sums of fiat USD, because there are no foreign buyers left that can absorb tens of trillions in new US government debt. The Fed unavoidably becomes the primary buyer of the US Government's debt (this is where a nation begins eating itself; that began for the US over a decade ago now as a trickle, that trickle is picking up pace). Once upon a time not so long ago it was a huge deal that China held a trillion dollars of US government debt, now that sum is a joke, a mere portion of one spending program this week or next. That's how quickly the US is imploding fiscally.

How does Bitcoin help you with that if you're stuck in a debt based economy? Well it's very obvious. The Fed will keep printing aggressively to fund the US Government's finances. And the Fed will have to hold interest rates as low as possible forever now, because the US Government can't afford its debt any longer at normal interest rates (3% * $40 trillion = bye bye social security or medicare or the US military). That need by the US to inflate massively, to constantly debase the rapidly expanding monster pile of debt, can be hedged via gold, sometimes via high quality stocks, and possibly via crypto (pick the one/s you think will endure).

And as this all gets worse, the tax hikes have to keep getting worse, which will choke off growth, which accelerates the stagnation and makes everything that much worse. All in all, the average rate of growth in the US economy will keep sinking toward zero.

Given enough time, somewhere between 10 and 20 years depending on how wild the clowns in DC get with spending, they'll have to begin directly debasing the USD to accomplish their goals (they'll promptly educate the public on how it's economically beneficial to devalue their currency), it won't be enough to do it slowly. There's nothing novel about any of this, we already know exactly what the playbook looks like, see: Japan. The US will be able to maneuver a little better than Japan has courtesy of having the global reserve currency (although at the rate they're destroying things, that global reserve position will drop out even faster than it was otherwise going to).

The only way Bitcoin & Co aren't useful given where the US is obviously going at this point, is if the powers that be get so desperate about the context that they outlaw crypto or otherwise make it very impractical (artificially add enormous cost to owning it, via tax or regulation).

Post reply on HN