7 ms·

I feel silly saying this, but I sometimes imagine a scenario in which the attackers are not motivated by money but instead are aiming to simply cause as much de

I feel silly saying this, but I sometimes imagine a scenario in which the attackers are not motivated by money but instead are aiming to simply cause as much destruction as possible, like some kind of "cyberterrorism". Imagine if the creators of WannaCry had decided to brick everything they could, instead of _just_ holding data for ransom. What then? Ben-Oni (from the article) says he sees it as "life-and-death". I agree. We're simply not prepared for a well-coordinated attack. I think it will take a true catastrophe before anyone really understands just how vulnerable the Internet is.

paradite 9y ago
So it's like building weapons of mass destruction without being noticed? Sounds really bad.
blitmap 9y ago
I'm imagining a future where systems have become so complex it's impossible to isolate and deactivate a worm. Malware that may not be effective anymore, but persists on the Internet hopping from unmaintained system to unmaintained system forever. https://www.youtube.com/watch?v=jSospSmAGL4 https://www.youtube.com/watch?v=jSospSmAGL4
- ams6110 9y ago
  Malware does that now. There are enough unpatched/vulnerable systems on the internet at any given time that nothing is ever really eradicated.
- eob 9y ago
  When alien archeologists study the third rock from Sol, they will find no life save for IRC C&C bots chattering back and forth. Feels like the end to an interesting sci-fi novel.
  - DonHopkins 9y ago
    That would be Stanislaw Lem's most depressing but aptly named masterpiece, "Fiasco". https://en.wikipedia.org/wiki/Fiasco_(novel) https://en.wikipedia.org/wiki/Fiasco_(novel) http://garethrees.org/2012/05/31/fiasco/ http://garethrees.org/2012/05/31/fiasco/ 2. Radio static A radiolocation map of the planet showed hundreds of transmitters of white noise, which merged into shapeless blotches. Quinta was emitting noise on all wavelengths. In the Cold War theory: “What came to mind was an image of “radio warfare” taken to the point of absurdity, where no one any longer transmitted anything, because each side drowned out the other… All bands of radio waves were jammed. The entire capacity of the channels of transmission was filled with noise. In a fairly short period of time the race became a contest between the forces of jamming and the forces of intelligence-gathering and command-signaling. But this escalation, too, penetrating the noise with stronger signals and in turn jamming the signals with stronger noise, resulted in an impasse.” Other hypotheses considered: “The noise was either the scrambling of broadcast signals or a kind of coded communication concealed by the semblance of chaos.” [It’s a consequence of the Shannon–Hartley theorem that the maximum information is transferred on a channel in the form of white noise.]
    - gech 9y ago
      Sounds like American politics on the Internet right now
      - deleted 9y ago
        [deleted]
  - peteforde 9y ago
    https://www.vice.com/en_us/article/ppzd9g/complexities-human-sitcom-431-v15n12 https://www.vice.com/en_us/article/ppzd9g/complexities-human...
- throwanem 9y ago
  That's actually a major plot element in Peter Watts' ßehemoth trilogy.
  - qb45 9y ago
    Nitpick: isn't it β instead of ß?
    - throwanem 9y ago
      Crud, it is. Well spotted, and thanks for the catch!
- jlgaddis 9y ago
  Check your web server's access logs. I still see evidence of Code Red [0] on a regular basis. [0]: https://en.m.wikipedia.org/wiki/Code_Red_(computer_worm) https://en.m.wikipedia.org/wiki/Code_Red_(computer_worm)
- problems 9y ago
  That's already the case last I checked - plug any machine into the internet directly you'll still get scanned for vulns from early 2000s.
- tlrobinson 9y ago
  That seems pretty inevitable, not unlike biological pathogens. Actually, I can imagine a future where we use AI to eliminate biological pathogens, but digital pathogens proliferate.
PhasmaFelis 9y ago
> I feel silly saying this, but I sometimes imagine a scenario in which the attackers are not motivated by money but instead are aiming to simply cause as much destruction as possible, like some kind of "cyberterrorism". That's pretty much how viruses worked before people figured out how to monetize them. A whole industry was built to defend against bored, malicious teenagers.
virmundi 9y ago
We're not trying to fight it at a legislative level. For example, ISPs could mitigate DDoS attacks through various means [1]. Sadly they just don't want to do the few day worth of labor (maybe more if they haven't properly automated their infrastructure over the last few years). Now look at Congress, they haven't required that. They haven't used the power of the Constitution to regulate interstate commerce, definitionally what happens when you buy things online, to require that ISPs must do reasonable things to limit the affect of such attacks. 1 - https://tools.ietf.org/html/rfc2827 https://tools.ietf.org/html/rfc2827
- sanderjd 9y ago
  I don't think the attitude that it's "a few days worth of work or oh I guess maybe a few more if they don't have everything automated yet..." is very helpful. It diminishes the problem and is incredibly unrealistic. While I don't have experience running an ISP, it's huge infrastructure, which is inevitably incredibly complex and it is almost certainly expensive, time consuming, and extremely risky to roll out major changes. But I don't disagree with you! This is even more of a reason that we need help from regulators on this front. Things that are prohibitively costly for private entities to do but must be done for society to function the way we want it to are the sweet spot for regulation. I keep hearing that the government is taking cyber security seriously, but I see no evidence. Where is the DHS funded formal verification tool or subsidized penetration testing for critical infrastructure? I'm not saying these are the right ideas, but I don't see anything at all. Perhaps I just don't know of the programs that already exist though - looking forward to being educated here!
  - throwaway2048 9y ago
    Ingress filtering really is not a big deal, and has been supported by all routing edge hardware/software for 15 or 20 years now. The fact it isn't implemented is down to apathy, ignorance and people making excuses. I don't think throwing your hands up and saying "oh this is probably hard" is very constructive on this front. Stop making excuses for people whos lack of action puts everyone else is danger. http://www.bcp38.info/index.php/Main_Page http://www.bcp38.info/index.php/Main_Page
Silhouette 9y ago
I think it will take a true catastrophe before anyone really understands just how vulnerable the Internet is. Or how bad an idea it is to connect anything and everything to that Internet, particularly if it does anything important or potentially dangerous. If the Internet is one of the best ideas humanity ever had, the Internet of Things may prove to be one of the worst. My personal nightmare involves a vulnerability in a popular model of remotely connected and semi-autonomous or autonomous vehicle. I don't think Western governments have any idea how much harm something like that could do or how plausible it actually is, and I don't think the auto industry executives care enough to stop it.
- ElijahLynn 9y ago
  Yeah, I think vehicle software is going to be a nightmare. No way are they going to keep patching software after 5 years or maybe 10. I can imagine that a 20 year old vehicle will just be recycled into scrap because it has been compromised.
  - maxerickson 9y ago
    In the US most vehicles are already recycled for scrap before they are 20 years old. Average age has just ticked up to 11.6 years: http://www.autonews.com/article/20161122/RETAIL05/161129973/average-age-of-vehicles-on-road-hits-11.6-years http://www.autonews.com/article/20161122/RETAIL05/161129973/...
- ocdtrekkie 9y ago
  I personally don't really intend to buy any cars with a wireless network connection. I don't know how much longer that will be possible. But at least requiring physical access will help a lot. (And prevent a true horror: Someone figuring out how to make malware spread from car to car.) Regarding "IoT": There's no reason your light switches should talk to the Internet, even for home automation purposes.
  - mark-r 9y ago
    I'm having a new A/C and furnace installed. About half the proposals we received had wifi-connected thermostats, and I said no thank you.
SomeStupidPoint 9y ago
The situation is so scary, I don't even joke about it. I don't want to discuss it in depth for the same reasons, but joking around with friends has led to feeling physically ill and bouts of drinking because of the extremely dangerous possibilities that exist. It's a fundamental mistake to network all of society to make it efficient: inefficiency is security. (In a broad, theoretical sense -- from capitalism to government to IT.)
rbosinger 9y ago
I bet it would actually end up stimulating the economy like a war does. Not to say I think this scenario would be good.
xyrnoble 9y ago
Have you seen the Live Free or Die Hard [1] fire sale? Also, the original Deus Ex has the New Dark Age [2] ending. Both are similar to what you've described. 1: http://diehard.wikia.com/wiki/Fire_Sale http://diehard.wikia.com/wiki/Fire_Sale 2: http://deusex.wikia.com/wiki/Deus_Ex_endings http://deusex.wikia.com/wiki/Deus_Ex_endings
- paulie_a 9y ago
  Have you seen live free or die hard? It was a heist flick and a crappy movie in general. It utilized scary "cyberweapons" as a plot point but the goal was to steal.
pvg 9y ago
We're simply not prepared for a well-coordinated attack. Aren't we? We handle natural disasters, large-scale power grid failures, etc. If WannaCry bricked everything it touched, the results would have been much worse and more tragic but would they be worse than an earthquake or hurricane in a major metropolitan area?
- Clubber 9y ago
  Yes and no. Natural disasters are contained to a region. Imagine a completely undefended attack that bricks all Windows, Linux and Mac OS computers computers worldwide at the same time. It could be all routers. All chips made in say China. So many people would starve because food couldn't be delivered in the efficiency it takes to feed the population. You've seen grocery stores wiped out during hurricanes, and those have several days lead time to prepare. We are much more dependent on technology than a lot of people realize.
  - pvg 9y ago
    I honestly don't think anyone in a 1st world country would starve, if that happened. It sets you back 20 years, the processes and technology to deal with that are still in place. And it's a lot less than 'entire eastern seaboard has no electricity'.
    - Clubber 9y ago
      I dunno. We're a seriously automated country. Food processing and refrigeration plants are designed around robots and those robots are controlled by (hypothetically) bricked computers. Even if we had the volunteers, the floor just isn't designed to hold them, it's designed for 2 ton hunks of metal that don't move anymore. How do you feed 320 million people? 20 years ago, we had around 50 million fewer. How do you deliver the food to them when automated fuel pumps no longer work and security systems no longer open doors and gates? What happens when the water purification plants stop? I mean our society is built around Just-In-Time delivery; what happens when almost every node in that system fails?
akhilcacharya 9y ago
> like some kind of "cyberterrorism". Or even worse, a state actor with nuclear weapons to back it up.
partiallypro 9y ago
A fear of mine, that I think wouldn't be too hard (relatively speaking) would be to interrupt bid/ask sizes in markets, since it's largely machines trading now with no humans able to step in like a floor specialist. Effecting the bid/ask sizes could cause a massive over supply of equities and cause it to crater, which could induce more machine selling simply because that's how their algorithms are written. The market could crash 10% before anyone knew what was happening. There are breakers that are built to prevent this but high leverage in ETF securities, etc could exacerbate the event. In effect, causing an '87-like crash from a hack. The '87 crash was also largely machine driven.
- phlo 9y ago
  What you're describing happened to Ethereum this week [1]. On one exchange (GDAX), a large sell order pushed the price down by 30% or so, which in turn triggered a lot of (market) stop loss orders, pushing the price farther down. In the end, a couple of thousand ETH traded hands for $0.10 while the price at other exchanges was around $300. I share your fear. At the same time, it's also important to remember that most other instruments trade at way deeper order books, with orders of magnitude greater liquidity and massively better controls (e.g. circuit breakers). [1] https://news.ycombinator.com/item?id=14611333 https://news.ycombinator.com/item?id=14611333
dsfyu404ed 9y ago
As a security guy my long bet is transportation infrastructure. Industrial systems (like cars) typically have some very rudimentary security with no depth. Someone will get root somewhere and shut down some small percent of light vehicles (i.e. not medium and heavy trucks) on the road at an inconvenient time causing a massive economic panic and screwing up the used car market in a way that makes cash for clunkers seem well thought out. Even a complicated attack vector that results in a narrow target selection (e.g. android malware -> infotainment system on a particular few model years of one brand) would have a massive psychological impact. Edit: a similar occurrence could happen by accident (edge cases, poor testing and so on). Edit: meant to reply to a comment. Oh well.
andygates 9y ago
What then? Well, users wouldn't have wasted their time trying to recover unrecoverable systems. They'd just have rebuilt them. Really properly permanently bricking is much harder, and hardware-specific.

paradite 9y ago

So it's like building weapons of mass destruction without being noticed? Sounds really bad.

blitmap 9y ago

I'm imagining a future where systems have become so complex it's impossible to isolate and deactivate a worm. Malware that may not be effective anymore, but persists on the Internet hopping from unmaintained system to unmaintained system forever. https://www.youtube.com/watch?v=jSospSmAGL4 https://www.youtube.com/watch?v=jSospSmAGL4

ams6110 9y ago
Malware does that now. There are enough unpatched/vulnerable systems on the internet at any given time that nothing is ever really eradicated.
eob 9y ago
When alien archeologists study the third rock from Sol, they will find no life save for IRC C&C bots chattering back and forth. Feels like the end to an interesting sci-fi novel.
- DonHopkins 9y ago
  That would be Stanislaw Lem's most depressing but aptly named masterpiece, "Fiasco". https://en.wikipedia.org/wiki/Fiasco_(novel) https://en.wikipedia.org/wiki/Fiasco_(novel) http://garethrees.org/2012/05/31/fiasco/ http://garethrees.org/2012/05/31/fiasco/ 2. Radio static A radiolocation map of the planet showed hundreds of transmitters of white noise, which merged into shapeless blotches. Quinta was emitting noise on all wavelengths. In the Cold War theory: “What came to mind was an image of “radio warfare” taken to the point of absurdity, where no one any longer transmitted anything, because each side drowned out the other… All bands of radio waves were jammed. The entire capacity of the channels of transmission was filled with noise. In a fairly short period of time the race became a contest between the forces of jamming and the forces of intelligence-gathering and command-signaling. But this escalation, too, penetrating the noise with stronger signals and in turn jamming the signals with stronger noise, resulted in an impasse.” Other hypotheses considered: “The noise was either the scrambling of broadcast signals or a kind of coded communication concealed by the semblance of chaos.” [It’s a consequence of the Shannon–Hartley theorem that the maximum information is transferred on a channel in the form of white noise.]
  - gech 9y ago
    Sounds like American politics on the Internet right now
    - deleted 9y ago
      [deleted]
- peteforde 9y ago
  https://www.vice.com/en_us/article/ppzd9g/complexities-human-sitcom-431-v15n12 https://www.vice.com/en_us/article/ppzd9g/complexities-human...
throwanem 9y ago
That's actually a major plot element in Peter Watts' ßehemoth trilogy.
- qb45 9y ago
  Nitpick: isn't it β instead of ß?
  - throwanem 9y ago
    Crud, it is. Well spotted, and thanks for the catch!
jlgaddis 9y ago
Check your web server's access logs. I still see evidence of Code Red [0] on a regular basis. [0]: https://en.m.wikipedia.org/wiki/Code_Red_(computer_worm) https://en.m.wikipedia.org/wiki/Code_Red_(computer_worm)
problems 9y ago
That's already the case last I checked - plug any machine into the internet directly you'll still get scanned for vulns from early 2000s.
tlrobinson 9y ago
That seems pretty inevitable, not unlike biological pathogens. Actually, I can imagine a future where we use AI to eliminate biological pathogens, but digital pathogens proliferate.

PhasmaFelis 9y ago

> I feel silly saying this, but I sometimes imagine a scenario in which the attackers are not motivated by money but instead are aiming to simply cause as much destruction as possible, like some kind of "cyberterrorism". That's pretty much how viruses worked before people figured out how to monetize them. A whole industry was built to defend against bored, malicious teenagers.

virmundi 9y ago

We're not trying to fight it at a legislative level. For example, ISPs could mitigate DDoS attacks through various means [1]. Sadly they just don't want to do the few day worth of labor (maybe more if they haven't properly automated their infrastructure over the last few years). Now look at Congress, they haven't required that. They haven't used the power of the Constitution to regulate interstate commerce, definitionally what happens when you buy things online, to require that ISPs must do reasonable things to limit the affect of such attacks. 1 - https://tools.ietf.org/html/rfc2827 https://tools.ietf.org/html/rfc2827

sanderjd 9y ago
I don't think the attitude that it's "a few days worth of work or oh I guess maybe a few more if they don't have everything automated yet..." is very helpful. It diminishes the problem and is incredibly unrealistic. While I don't have experience running an ISP, it's huge infrastructure, which is inevitably incredibly complex and it is almost certainly expensive, time consuming, and extremely risky to roll out major changes. But I don't disagree with you! This is even more of a reason that we need help from regulators on this front. Things that are prohibitively costly for private entities to do but must be done for society to function the way we want it to are the sweet spot for regulation. I keep hearing that the government is taking cyber security seriously, but I see no evidence. Where is the DHS funded formal verification tool or subsidized penetration testing for critical infrastructure? I'm not saying these are the right ideas, but I don't see anything at all. Perhaps I just don't know of the programs that already exist though - looking forward to being educated here!
- throwaway2048 9y ago
  Ingress filtering really is not a big deal, and has been supported by all routing edge hardware/software for 15 or 20 years now. The fact it isn't implemented is down to apathy, ignorance and people making excuses. I don't think throwing your hands up and saying "oh this is probably hard" is very constructive on this front. Stop making excuses for people whos lack of action puts everyone else is danger. http://www.bcp38.info/index.php/Main_Page http://www.bcp38.info/index.php/Main_Page

Silhouette 9y ago

I think it will take a true catastrophe before anyone really understands just how vulnerable the Internet is. Or how bad an idea it is to connect anything and everything to that Internet, particularly if it does anything important or potentially dangerous. If the Internet is one of the best ideas humanity ever had, the Internet of Things may prove to be one of the worst. My personal nightmare involves a vulnerability in a popular model of remotely connected and semi-autonomous or autonomous vehicle. I don't think Western governments have any idea how much harm something like that could do or how plausible it actually is, and I don't think the auto industry executives care enough to stop it.

ElijahLynn 9y ago
Yeah, I think vehicle software is going to be a nightmare. No way are they going to keep patching software after 5 years or maybe 10. I can imagine that a 20 year old vehicle will just be recycled into scrap because it has been compromised.
- maxerickson 9y ago
  In the US most vehicles are already recycled for scrap before they are 20 years old. Average age has just ticked up to 11.6 years: http://www.autonews.com/article/20161122/RETAIL05/161129973/average-age-of-vehicles-on-road-hits-11.6-years http://www.autonews.com/article/20161122/RETAIL05/161129973/...
ocdtrekkie 9y ago
I personally don't really intend to buy any cars with a wireless network connection. I don't know how much longer that will be possible. But at least requiring physical access will help a lot. (And prevent a true horror: Someone figuring out how to make malware spread from car to car.) Regarding "IoT": There's no reason your light switches should talk to the Internet, even for home automation purposes.
- mark-r 9y ago
  I'm having a new A/C and furnace installed. About half the proposals we received had wifi-connected thermostats, and I said no thank you.

SomeStupidPoint 9y ago

The situation is so scary, I don't even joke about it. I don't want to discuss it in depth for the same reasons, but joking around with friends has led to feeling physically ill and bouts of drinking because of the extremely dangerous possibilities that exist. It's a fundamental mistake to network all of society to make it efficient: inefficiency is security. (In a broad, theoretical sense -- from capitalism to government to IT.)

rbosinger 9y ago

I bet it would actually end up stimulating the economy like a war does. Not to say I think this scenario would be good.

xyrnoble 9y ago

Have you seen the Live Free or Die Hard [1] fire sale? Also, the original Deus Ex has the New Dark Age [2] ending. Both are similar to what you've described. 1: http://diehard.wikia.com/wiki/Fire_Sale http://diehard.wikia.com/wiki/Fire_Sale 2: http://deusex.wikia.com/wiki/Deus_Ex_endings http://deusex.wikia.com/wiki/Deus_Ex_endings

paulie_a 9y ago
Have you seen live free or die hard? It was a heist flick and a crappy movie in general. It utilized scary "cyberweapons" as a plot point but the goal was to steal.

pvg 9y ago

We're simply not prepared for a well-coordinated attack. Aren't we? We handle natural disasters, large-scale power grid failures, etc. If WannaCry bricked everything it touched, the results would have been much worse and more tragic but would they be worse than an earthquake or hurricane in a major metropolitan area?

Clubber 9y ago
Yes and no. Natural disasters are contained to a region. Imagine a completely undefended attack that bricks all Windows, Linux and Mac OS computers computers worldwide at the same time. It could be all routers. All chips made in say China. So many people would starve because food couldn't be delivered in the efficiency it takes to feed the population. You've seen grocery stores wiped out during hurricanes, and those have several days lead time to prepare. We are much more dependent on technology than a lot of people realize.
- pvg 9y ago
  I honestly don't think anyone in a 1st world country would starve, if that happened. It sets you back 20 years, the processes and technology to deal with that are still in place. And it's a lot less than 'entire eastern seaboard has no electricity'.
  - Clubber 9y ago
    I dunno. We're a seriously automated country. Food processing and refrigeration plants are designed around robots and those robots are controlled by (hypothetically) bricked computers. Even if we had the volunteers, the floor just isn't designed to hold them, it's designed for 2 ton hunks of metal that don't move anymore. How do you feed 320 million people? 20 years ago, we had around 50 million fewer. How do you deliver the food to them when automated fuel pumps no longer work and security systems no longer open doors and gates? What happens when the water purification plants stop? I mean our society is built around Just-In-Time delivery; what happens when almost every node in that system fails?

akhilcacharya 9y ago

> like some kind of "cyberterrorism". Or even worse, a state actor with nuclear weapons to back it up.

partiallypro 9y ago

A fear of mine, that I think wouldn't be too hard (relatively speaking) would be to interrupt bid/ask sizes in markets, since it's largely machines trading now with no humans able to step in like a floor specialist. Effecting the bid/ask sizes could cause a massive over supply of equities and cause it to crater, which could induce more machine selling simply because that's how their algorithms are written. The market could crash 10% before anyone knew what was happening. There are breakers that are built to prevent this but high leverage in ETF securities, etc could exacerbate the event. In effect, causing an '87-like crash from a hack. The '87 crash was also largely machine driven.

phlo 9y ago
What you're describing happened to Ethereum this week [1]. On one exchange (GDAX), a large sell order pushed the price down by 30% or so, which in turn triggered a lot of (market) stop loss orders, pushing the price farther down. In the end, a couple of thousand ETH traded hands for $0.10 while the price at other exchanges was around $300. I share your fear. At the same time, it's also important to remember that most other instruments trade at way deeper order books, with orders of magnitude greater liquidity and massively better controls (e.g. circuit breakers). [1] https://news.ycombinator.com/item?id=14611333 https://news.ycombinator.com/item?id=14611333

dsfyu404ed 9y ago

As a security guy my long bet is transportation infrastructure. Industrial systems (like cars) typically have some very rudimentary security with no depth. Someone will get root somewhere and shut down some small percent of light vehicles (i.e. not medium and heavy trucks) on the road at an inconvenient time causing a massive economic panic and screwing up the used car market in a way that makes cash for clunkers seem well thought out. Even a complicated attack vector that results in a narrow target selection (e.g. android malware -> infotainment system on a particular few model years of one brand) would have a massive psychological impact. Edit: a similar occurrence could happen by accident (edge cases, poor testing and so on). Edit: meant to reply to a comment. Oh well.

andygates 9y ago

What then? Well, users wouldn't have wasted their time trying to recover unrecoverable systems. They'd just have rebuilt them. Really properly permanently bricking is much harder, and hardware-specific.