7 ms·
Cyber Attackers Crash Muni Computer System Across SF
- tedunangst 10y agoIf the fare machines are all out of order, opening the gates is not a "precaution".
- Animats 10y agoMessage is: “You Hacked, ALL Data Encrypted. Contact For Key(cryptom27@yandex.com)ID:681 ,Enter.”
- s_q_b 10y agoFrom the text, it is pretty clear he wants people to think he's from Russia. From this I conclude two things: 1. He's not Russian. 2. This a good hacker but an amateur at OPSEC.
- iondream 10y agohe may not be so good. they could be using very old operating systems. I believe the NY subway is running OS2 and win xp.
- rincebrain 10y ago[1] says Windows 2000, and whatever version of Flash ran on there, so...shooting fish in a barrel? [1] - https://news.ycombinator.com/item?id=13051310 https://news.ycombinator.com/item?id=13051310
- s_q_b 10y agoThe most secure voting machine certified in my county runs Android Jelly Bean from 2012. It's fish in barrels all the way down...
- rincebrain 10y agoAs much fun as Android is, I don't _think_ there's any public RCEs that recent, while I can think of a couple of recent Windows XP+ RCEs that are probably also doable-but-unpatched on Win2k: [1] - https://www.cvedetails.com/cve/CVE-2013-3175/ https://www.cvedetails.com/cve/CVE-2013-3175/ [2] - https://www.cvedetails.com/cve/CVE-2012-1852/ https://www.cvedetails.com/cve/CVE-2012-1852/ [3] - https://www.cvedetails.com/cve/CVE-2012-0173/ https://www.cvedetails.com/cve/CVE-2012-0173/ [4] - https://www.cvedetails.com/cve/CVE-2012-0002/ https://www.cvedetails.com/cve/CVE-2012-0002/ (Those were just the ones I quickly found that allow RCE on XP SP2 (the oldest thing that they still provided patches for, so most likely to be shared code with Win2k) without requiring active interaction on the target's behalf, e.g. not including "convince target to open X malformed file, receive payload")
- s_q_b 10y agoWell, the most common voting machines are iVotronics from ten years ago, which are pretty laughable. Dr. Appel at Princeton already hacked these systems back in 2006. There's even a flash card on the top of the machine, which even the state's hand-picked pen tester had to admit could be accessed even with a tamper-proof lock in place. It's starting to bother me that the PA election officials keep saying that the voting machines aren't connected networked together, and that one would need 4,500 cards to compromise an election. It's just flatly false, since every county feeds into a central system such as Unity or GEMS, which themselves are provably insecure, and can be infected via the compact flash cards when they're collected. You would only need a few people in key counties to swing an entire election. What I would give for the days of hanging chads...
- eridius 10y agoJust because you think the message looks like it suggestions a Russian hacker doesn't mean that it isn't in fact Russian. Sometimes a cigar is just a cigar.
- s_q_b 10y agoThis is a personal opinion based on experience, speaking for myself alone, made with access only to public information. Take it for what you will.
- ryanlol 10y agoI'm not sure how you could legitimately come to those conclusions based on on the publicly available information. There's very little indicating the author is Russian, but considering that's legitimately how most eastern European and Russian hackers type it wouldn't be much of a stretch. However I can't see how that leads to the conclusion that the author is trying to pretend to be Russian, as opposed to just being from Ukraine, Romania or Russia. And unless I'm missing something, there's even less information about his OPSEC practices.
- s_q_b 10y agoA few hints that tickle my spider sense: 1. Yandex is an email provider that is almost exclusively to the new Russian sphere of influence. This is a the first thing that would jump out to an attribution analyst. Combined with the non-native language mistakes, a first pass analysis would indicate Russia. But the name of the game is deception. 2. The "mistakes" in the text are not those which a Russian-speaker would make. The most obvious signal is leading space before the comma.
- i336_ 10y agoGoogling the email address shows a few hits with other IDs, so at the very least this has gotten around a bit. (I haven't chased down the search hits, there may/may not be some leads as to what it is out there)
- kbaker 10y agoWow, crazy. Sounds like a huge ransomware infestation. http://www.sfexaminer.com/hacked-appears-muni-stations-fare-payment-system-crashes/ http://www.sfexaminer.com/hacked-appears-muni-stations-fare-...
- jrspence 10y agoJust in time for watch_dogs 2 to come out for PC...
- AgentME 10y agoHas viral advertising gone too far? /s
- yarou 10y agoI've always been curious about the type of embedded OS that ATMs and ticket kiosks use. Most of the time, it seems to be an unpatched version of Windows. Does anyone know what the SFMTA runs on their kiosks?
- xenadu02 10y agoIt looked to me like the kiosks themselves are OK but the PCs they communicate with got hacked. Making life worse through technology, welcome to the future!
- web007 10y agoNot sure about SFMTA but I know BART at Fremont is running Windows9x for its pay machines. Once I clicked the "add fare" button too fast and somehow dropped to desktop.
- some1else 10y agoI made software for a few museum exhibitions with multiple interactive terminals (sometimes up to 30). At first we used WinXP/Flash, and later moved to Linux/Opera (to cut licensing fees and shorten development time). That was 6 years ago.
- Animats 10y agoThe live track map of Muni has been frozen for two days now. [1] http://www.sfmunicentral.com/sfmunicentral_Snapshot_Objects/Muni_Subway_Snapshot.html http://www.sfmunicentral.com/sfmunicentral_Snapshot_Objects/...
- Animats 10y agoNow it's down semi-permanently.[1] [1] http://www.sfmunicentral.com/sfmunicentral_Snapshot_Objects/Muni_Subway_Snapshot.html http://www.sfmunicentral.com/sfmunicentral_Snapshot_Objects/...
- pdx6 10y agoI am on the Citizen's Advisory Council for the SFMTA. I also happen to be specialize in computer security! I have asked SFMTA staff to have this item put on a committee agenda so we can get a full post mortem of what happened. It will likely be a few months before we get any real details. Since people are asking... The ticket kiosks run Win2k, the subway display screens run Flash (on Win2k I imagine), and the SFMuniCentral display is DOS under OS/2. For the latter, it might be running Linux now. The subway system is in the middle of a major modernization project since SF is going to open a new subway line with new cars in the next 18 months.
- dkarapetyan 10y agoWhy is the response so slow? I mean why can't they just replace everything in the ticket kiosks and then restore the central system from a backup on new machines? 100% secure systems I understand are pipe dreams but at least the mitigation and response in case of failures and hacks should not be so long.
- cft 10y ago>Why is the response so slow? Socialism. Not Swedish post capitalism, but the Soviet style, intolerant to dissent. Do you know that San Francisco has 10 billion dollar budget and over 30,000 city employees? And they want more.
- mikeash 10y agoPerhaps technically correct, but totally lacking in any explanatory power. It's one step short of explaining it as "because of physics." True, but not useful.
- deleted 10y ago[deleted]
- nickthemagicman 10y agoIt's fixed. It took the Red Army one day. Not bad. http://www.sfchronicle.com/news/article/Muni-back-to-normal-after-apparent-computer-hack-10638550.php http://www.sfchronicle.com/news/article/Muni-back-to-normal-...
- kaiku 10y agoFix the SFMTA would be a great hackathon project. I'm sure there's more than a few willing and talented people in the city to lend their skills to solving this immediate problem...
- pdx6 10y agoI think this is a good idea, but there isn't much in the way of API access or documentation for SFMTA systems. Beyond Nextbus, there is no API to poll for data. Nearly everything requires a request for information or Sunshine request, where a staff member stops what they are doing, goes to an internal system (Trapeze, for example), does a C&P, removes HR info, and passes it along. That being said, some of the newer SFMTA projects do have a data stream to at least scrape, like road construction schedules, Muni Forward, and Vision Zero collision data. There is a whole lot more data available, most of it released quarterly, I could help get access too as well.
- iask 10y agoWin2k...not surprised. I often see this. If it ain't broken why fix it. O'boy,tomorrow is cyber Monday.
- i336_ 10y agoDid a bit of quick digging, this article shows an actual (potato) photo: http://www.sfexaminer.com/hacked-appears-muni-stations-fare-payment-system-crashes/ http://www.sfexaminer.com/hacked-appears-muni-stations-fare-... Looks like it tinkered with the MBR, but I'm very curious as to why it's also saying "Missing operating system" under the message. Maybe the string is part of the replaced MBR for added effect? Also, dupe thread with more comments: https://news.ycombinator.com/item?id=13050262 https://news.ycombinator.com/item?id=13050262 - maybe those comments could be moved over here.