Perhaps we should pass a law that no utilities / infrastructure should be attached to the internet. Private networks are fine for this purpose.
I think the issue there is data, even on critical infra. Modernization, reliability and the such require data analysis. There are definitely ‘strong’ ways of protecting the assets and mitigating attack vectors, but almost no way to eliminate them entirely. For example, event if you isolate the process computers you’ll typically have an interface node that presents the data up a level (hopefully to a DMZ). Obviously y…
U.S.'s Biggest Gasoline Pipeline Halted After Cyberattack
71–80 of 218 posts
Re: U.S.'s Biggest Gasoline Pipeline Halted After Cyberattack
#72Earlier quoted context omitted.
I work in control systems OT space. A lot of distributed control systems and scada systems interface with the business layer in some fashion to provide access to time series and event data and to allow for alerts via email/mobile. Some people do this properly with good network segmentation, firewalls, A/V and patching, etc (there are several standards that dictate best practice). That said, even when doing it properl…
The reason I'm going for firmware is while the HMIs could have had a solarwinds style exposure, but that's just any generically wormable OS vulnerability, and not something that should cause a physical shutdown. To shutdown a pipeline, it's not a management console issue, hence why I'd speculate it's in the ICS devices themselves, which probably use uClinux toolchains on SoCs from one or two large vendors. I did some…
No need for firmware vulnerabilities in VxWorks when there are internet connected windows pcs.
Re: U.S.'s Biggest Gasoline Pipeline Halted After Cyberattack
#73Earlier quoted context omitted.
I think the issue there is data, even on critical infra. Modernization, reliability and the such require data analysis. There are definitely ‘strong’ ways of protecting the assets and mitigating attack vectors, but almost no way to eliminate them entirely. For example, event if you isolate the process computers you’ll typically have an interface node that presents the data up a level (hopefully to a DMZ). Obviously y…
They can gather the data on the infrastructure network and then carry across an air gap on a USB or tape to do their analysis. I don't see the upside of allowing any connectivity to the internet given the danger other than some mechanism for sending an alert. I'm sure creative people can air gap that too (camera on the internet side and some image recognition for example).
There are devices called data diodes that provide unidirectional network topology, but not all time series data interfaces can work with them.
All in all, I agree that total air gap is obviously the best way to mitigate network attack vectors, but sometimes not practical. No controlling device should be at level 3 or 4 though (business or enterprise level).
Re: U.S.'s Biggest Gasoline Pipeline Halted After Cyberattack
#74In a twisted sort of way I am happy to see these types of ransomware attacks making headlines. Before it was much harder to quantify how much a breach might cost but with ransomeware you get a fuzzy lower bound. Also the prevalence of these attacks might actually make us all safer in the long run.
Re: U.S.'s Biggest Gasoline Pipeline Halted After Cyberattack
#75Earlier quoted context omitted.
I work in control systems OT space. A lot of distributed control systems and scada systems interface with the business layer in some fashion to provide access to time series and event data and to allow for alerts via email/mobile. Some people do this properly with good network segmentation, firewalls, A/V and patching, etc (there are several standards that dictate best practice). That said, even when doing it properl…
Why wouldn't you use a unidirectional connection for time series and event data? I understand why you might want to send things out to the rest of the world, I can't fathom why you wouldn't require physical access to have write access.
I replied to a comment on a dupe post regarding PAT, in which analysis is done on process data and fed back into the process to increase efficiency or yield. Obviously there are varying levels of criticality where the risk vs the business reward might not be worth it though.
Re: U.S.'s Biggest Gasoline Pipeline Halted After Cyberattack
#76Earlier quoted context omitted.
It's like 100x more expensive. Would be nice to have separate data lines, running fiber optics sealed in pressurized conduits for double tamper detection. The military actually does this for their critical infra.
> Would be nice to have separate data lines, running fiber optics sealed in pressurized conduits for double tamper detection. At least German Telekom has been doing this for ages for the trunk cables serving entire areas with analog phone service - although not for tamper detection as an anti-spionage measure, but rather to detect and pinpoint damage to the cables, e.g. from excavators, tree growth or splice seals de…
Re: U.S.'s Biggest Gasoline Pipeline Halted After Cyberattack
#77Earlier quoted context omitted.
This. I've said it a thousand times, all the security in the world will not defend a SCADA system if someone left TeamViewer running somewhere. Don't mean to pick on TeamViewer. It could be any number of packages, but I think security minded people get an idea of the type of attack vectors I'm talking about.
It is mind boggling the lack of basic security principles some people have. I won't just put that on the plants and their IT/OT, or lack thereof. I've seen plenty of vendors and integrators do some cringe worthy stuff too.
If the owner has an IT department they usually don’t want to be responsible for it either since locking things down leads to weird issues with legacy proprietary SCADA systems.
There is no out of the box secure solution available yet. Rockwell certainly makes an attempt with their factory talk directory but I highly doubt that isn’t easily worked around somehow.
Re: U.S.'s Biggest Gasoline Pipeline Halted After Cyberattack
#78Given Government inaction on climate change, could we begin to see motivated individuals or groups taking matters into their own hands and targeting fossil fuel infrastructure in this manner?
That would be domestic terrorism and is an easy way to turn the entire population against the cause
Re: U.S.'s Biggest Gasoline Pipeline Halted After Cyberattack
#79Re: U.S.'s Biggest Gasoline Pipeline Halted After Cyberattack
#80Earlier quoted context omitted.
It isn’t, and you might be a little misinformed. But it’s ok, you can scream into the abyss as long as you like. We don’t want to cure cancer (don’t know how). We want to free the world of the tyranny of central banking, debt-based economies and theft of savings through inflation. It is a noble endeavor. Selfishness is continuing along the old broken road. There are new, better ones.
How do cryptocurrencies save you from a debt based economy or inflation? Don't you still need to pay for goods and services in the same debt-based economy? How does the flavor of money change whether someone needs to go into debt? What would prevent cryptocurrency values from inflating or deflating?
I'm not much of a crypto cultist (which is the latest trend here on HN, to tag anybody that defends crypto with that to shut down conversation), however it's extraordinarily obvious at this point how cryptocurrencies can help you evade inflation in eg USD or evade the debt damage to the US economy. Bitcoin for its part is global and not primarily dependent on the condition of the US economy, and it's likely to become increasingly global and even less dependent on the US over time.
> Don't you still need to pay for goods and services in the same debt-based economy
Of course. This is a case where crypto is even better than gold. It's particularly trivial to convert in and out of traditional fiat.
Surely you understand enough about cryptocurrencies at this point to know how easy that is. And it appears likely to keep getting easier, given the effort companies like Coinbase, Robinhood and Square are putting into it (check out what Square did in its latest quarter courtesy crypto).
> How does the flavor of money change whether someone needs to go into debt?
The parent said debt based economies. The US has an economy and government system that is increasingly drowning in debt (check out the corporate balance sheets in the US; nationally it's horrific; that situation has been spurred on by the Fed's forever low interest rates, which encourages corporations to take on ever greater sums of debt because it's artificially cheap, which will ultimately lead to zombies ala Japan). The Federal answer to that is to print ever increasing sums of fiat USD, because there are no foreign buyers left that can absorb tens of trillions in new US government debt. The Fed unavoidably becomes the primary buyer of the US Government's debt (this is where a nation begins eating itself; that began for the US over a decade ago now as a trickle, that trickle is picking up pace). Once upon a time not so long ago it was a huge deal that China held a trillion dollars of US government debt, now that sum is a joke, a mere portion of one spending program this week or next. That's how quickly the US is imploding fiscally.
How does Bitcoin help you with that if you're stuck in a debt based economy? Well it's very obvious. The Fed will keep printing aggressively to fund the US Government's finances. And the Fed will have to hold interest rates as low as possible forever now, because the US Government can't afford its debt any longer at normal interest rates (3% * $40 trillion = bye bye social security or medicare or the US military). That need by the US to inflate massively, to constantly debase the rapidly expanding monster pile of debt, can be hedged via gold, sometimes via high quality stocks, and possibly via crypto (pick the one/s you think will endure).
And as this all gets worse, the tax hikes have to keep getting worse, which will choke off growth, which accelerates the stagnation and makes everything that much worse. All in all, the average rate of growth in the US economy will keep sinking toward zero.
Given enough time, somewhere between 10 and 20 years depending on how wild the clowns in DC get with spending, they'll have to begin directly debasing the USD to accomplish their goals (they'll promptly educate the public on how it's economically beneficial to devalue their currency), it won't be enough to do it slowly. There's nothing novel about any of this, we already know exactly what the playbook looks like, see: Japan. The US will be able to maneuver a little better than Japan has courtesy of having the global reserve currency (although at the rate they're destroying things, that global reserve position will drop out even faster than it was otherwise going to).
The only way Bitcoin & Co aren't useful given where the US is obviously going at this point, is if the powers that be get so desperate about the context that they outlaw crypto or otherwise make it very impractical (artificially add enormous cost to owning it, via tax or regulation).