9 ms·

Victoria Police cancel hundreds of speeding fines after WannaCry virus attack

90 points by jaimex2 9y ago

iDemonix 9y ago
Every cloud has its silver lining.
- mirimir 9y ago
  Indeed, that's too funny for words.
mirekrusin 9y ago
No mention that this security hole has been kept secret by US government and leaked with devastating consequences around the world. You can't imply that it's the sole customers' fault by saying that it's "the easiest thing to do - update operating system" without mentioning NSA not cooperating with Microsoft to patch the hole. Many setups require certification which is void after modifications which may include system updates so it's not "the easiest thing to do". It needs to go through the certification process again. Even without certification requirements it may not be as trivial as it looks at first to "just update OS" on every device. The "easiest thing to do" is for the government to report holes just like everybody else does. Isn't it kind of strange that the only ones that fail to report security issues are a) criminals and b) government?
- dtech 9y ago
  > No mention that this security hole has been kept secret by US government and leaked with devastating consequences around the world. This is irrelevant in this case. The infection happened months after the security holes had been made public and patches had been released. The same could have happened if the US government had immediately reported the security holes instead of keeping them secret. > Many setups require certification which is void after modifications which may include system updates so it's not "the easiest thing to do". It needs to go through the certification process again. That's seems like an utterly useless certification process then. Any certification worth its salt should refuse to certify a networked Windows computer that doesn't automatically install security updates, since things like this WILL happen.
  - cube00 9y ago
    In this case it wasn't networked, operators infected the cameras using USB sneaker-net.
    - kavok 9y ago
      I don't see any mention of USB in the article. Can you link a source?
      - DanBC 9y ago
        https://www.theguardian.com/australia-news/2017/jun/22/traffic-cameras-in-victoria-infected-by-wannacry-ransomware https://www.theguardian.com/australia-news/2017/jun/22/traff... > The department of justice said Victoria’s infection was not the result of a targeted attack, but was caused by a contractor mistakenly connecting infected hardware to cameras. Some sources are calling this a USB stick, the Guardian is being a bit more cautious.
        jaimex2 9y ago
        Interesting, I always assumed the cameras transmitted the photos and data back to a source over mobile networks. Technically this means if someone gets snapped and is desperate enough ( will lose job as a result of losing licence etc ) they can turn back and destroy the evidence.
        digi_owl 9y ago
        Now that you mention it, i recall reading about a local case where someone tried to take out a camera using dynamite. This revealed that the actual image storage was in a hardened cased buried in the ground some distance from the camera. I suspect though that these are older installs. And that newer ones, particularly those that issue tickets based on time between two cameras, are networked.
  - snarfy 9y ago
    It doesn't matter if it's utterly useless if it's legally required.
- darawk 9y ago
  Why is a comment like this always at the top of one of these HN threads? Does everyone here actually believe that the NSA shouldn't hoard vulnerabilities? I find it hard to believe that people here would collectively be that naive and simple-minded in their thinking. The NSA hoards vulnerabilities for the same reason the military has guns. Because other countries have guns too. This is too obvious a point to be lost on the readers here. So, i'm left wondering who it is that's upvoting these things.
  - wfunction 9y ago
    I do get the impression a fair number of people actually believe the NSA shouldn't do this. Whether it's out of naiveté or wisdom is harder to tell, but I definitely don't get the impression everyone here is speaking from, say, 50 years of wisdom or experience in domestic and foreign policy or (cyber)warfare or what have you.
  - michaelt 9y ago
    The NSA hoards vulnerabilities for the same reason the military has guns. Vulnerabilities are fundamentally unlike guns. Because vulnerabilities can be independently discovered or accidentally released, then reproduced in vast quantities and used against the public and civilian infrastructure of both us and our allies - largely with impunity. If wannacry was a gun, it'd be a gun that fired backwards and sideways at the same time as forwards, and you can't stop it firing once it's started, and sometimes it starts firing on its own.
    - wfunction 9y ago
      Correct me if I'm wrong but WannaCry used vulnerabilities that already had patches. How does reporting these vulnerabilities earlier instead of keeping them fix this situation? You'd still have the problem of slow updates regardless.
      - naz 9y ago
        If the bug were responsibly disclosed to Microsoft, there'd be no proof of concept in the wild, available for anyone to integrate into their ransomware. Instead, intelligence agencies irresponsibly hold onto them. And so they get leaked at best, or at worst end up in the wrong hands.
King-Aaron 9y ago
Oh no
warthogfiend 9y ago
"I cancelled the fines because I think it's important the pubic has 100 per cent confidence in the system" [emphasis added] o_O
- gundul 9y ago
  saw that too... confused me at first
- danieltillett 9y ago
  The Age is giving the Graudian a run for its money. There is almost nobody left working at Fairfax outside of management that was born last century.
stonewhite 9y ago
I wonder if it has infected any critical military infrastructure at US? and any real way to know about it?
- hueving 9y ago
  Critical military infrastructure isn't connected to the Internet, so it's unlikely as part of this regular epidemic.
  - askvictor 9y ago
    Iran's nuclear fuel processing systems weren't connected to the internet either...
  - angry_octet 9y ago
    But it is collected to an internet, which might be just as good.
  - andai 9y ago
    [serious] wasn't the Internet basically invented to support critical military infrastructure? Or do their have their own parallel thing?
    - willstrafach 9y ago
      Not "parallel" but a few networks. NIPR - Unclassified DoD internet plus powerful defensive capabilities when traffic goes between the intranet and public internet. SIPR - Private "internet" for military and defense contractors and such to allow for handling SECRET and below. Dedicated circuits. JWICS - Like SIPR but for TS and SCI channels. Then other dedicated networks for international partnerships which run on dedicated circuits and using sats.
    - hueving 9y ago
      The technology of the internet was definitely invented to support it (i.e resilient networks). The public internet that we use is separate though.
fxlv 9y ago
And what about having a firewall on the devices? I could understand slow patching, crappy or processes and all. But if the cameras are networked, why is there no firewall on them?
- askvictor 9y ago
  They might not be networked; could have been infected while an operator was collecting photos. But probably networked.
ams6110 9y ago
Why do so many commercial embedded devices use Window OS, and generally old versions like NT or XP? Do vendors get a kickback from Microsoft to use Windows in systems that don't even have a display? Otherwise I don't see why they would license Windows instead of using a no-cost BSD or Linux derived OS.
- giovannibajo1 9y ago
  I have extensive experience in the embedded field and the answer is that most programmers and technicians know Windows and don't know Linux. Then of course there might be a few benefits to Windows in specific cases, but it's mostly the case of simply being familiar with it.
- coldpie 9y ago
  I think a lot of it is programmer expertise. There's a lot of people out there who only use Windows and have never used a Unix and wouldn't know where to begin programming for it. Especially when you get into lowest-bidder and outsourcing situations, where the technology used isn't even a consideration when planning the project.
- jerardope 9y ago
  Concerning the display: I've seen it quite often at random public places that when a technician tries to fix something on these devices, he or she will connect an external device with display and touch screen (at least when Windows 8+ is used). My guess is that maintenance of such systems is just much cheaper. Virtually everyone knows the Windows GUI.
- patcheudor 9y ago
  I have a oscilloscope which you can regularly find on eBay at a fairly high price. It's an awesome scope that runs XP and will always run XP because the vendor has moved on and no longer supports it. Given the age, it's unrealistic to expect that if they would have used a BSD or Linux kernel that wouldn't be vulnerable to any number of attacks. Thus, I would suggest the question isn't why are manufacturers using Windows, but rather, how can we get to a point where vendors either support their products for the anticipated life of the device or allow end-users to upgrade the kernel and related packages themselves?
jaclaz 9y ago
I am completely failing to see how Wannacry could have affected the operations of those devices AND at the same time leave some data "good enough" to produce the fines. I presume that essentally it is a photo taking device that superimposes a date/time and detected speed (and maybe also OCR's the license plate). More or less three or four pieces of data: 1) picture 2) date/time 3) speed 4) (maybe) OCR'ed liense plate number If any of these items were encrypted it would be evident, and the following step (looking in a database for the ownere of the license plate number) would have returned a null result. The only way for this to actually work (creating a wrong fine) would be if ONLY the license plate number was encrypted by Wannacry AND the encrypted string matched another existing license plate number.

90 points by jaimex2 9y ago

iDemonix 9y ago

Every cloud has its silver lining.

mirimir 9y ago
Indeed, that's too funny for words.

mirekrusin 9y ago

No mention that this security hole has been kept secret by US government and leaked with devastating consequences around the world. You can't imply that it's the sole customers' fault by saying that it's "the easiest thing to do - update operating system" without mentioning NSA not cooperating with Microsoft to patch the hole. Many setups require certification which is void after modifications which may include system updates so it's not "the easiest thing to do". It needs to go through the certification process again. Even without certification requirements it may not be as trivial as it looks at first to "just update OS" on every device. The "easiest thing to do" is for the government to report holes just like everybody else does. Isn't it kind of strange that the only ones that fail to report security issues are a) criminals and b) government?

dtech 9y ago
> No mention that this security hole has been kept secret by US government and leaked with devastating consequences around the world. This is irrelevant in this case. The infection happened months after the security holes had been made public and patches had been released. The same could have happened if the US government had immediately reported the security holes instead of keeping them secret. > Many setups require certification which is void after modifications which may include system updates so it's not "the easiest thing to do". It needs to go through the certification process again. That's seems like an utterly useless certification process then. Any certification worth its salt should refuse to certify a networked Windows computer that doesn't automatically install security updates, since things like this WILL happen.
- cube00 9y ago
  In this case it wasn't networked, operators infected the cameras using USB sneaker-net.
  - kavok 9y ago
    I don't see any mention of USB in the article. Can you link a source?
    - DanBC 9y ago
      https://www.theguardian.com/australia-news/2017/jun/22/traffic-cameras-in-victoria-infected-by-wannacry-ransomware https://www.theguardian.com/australia-news/2017/jun/22/traff... > The department of justice said Victoria’s infection was not the result of a targeted attack, but was caused by a contractor mistakenly connecting infected hardware to cameras. Some sources are calling this a USB stick, the Guardian is being a bit more cautious.
      - jaimex2 9y ago
        Interesting, I always assumed the cameras transmitted the photos and data back to a source over mobile networks. Technically this means if someone gets snapped and is desperate enough ( will lose job as a result of losing licence etc ) they can turn back and destroy the evidence.
        digi_owl 9y ago
        Now that you mention it, i recall reading about a local case where someone tried to take out a camera using dynamite. This revealed that the actual image storage was in a hardened cased buried in the ground some distance from the camera. I suspect though that these are older installs. And that newer ones, particularly those that issue tickets based on time between two cameras, are networked.
- snarfy 9y ago
  It doesn't matter if it's utterly useless if it's legally required.
darawk 9y ago
Why is a comment like this always at the top of one of these HN threads? Does everyone here actually believe that the NSA shouldn't hoard vulnerabilities? I find it hard to believe that people here would collectively be that naive and simple-minded in their thinking. The NSA hoards vulnerabilities for the same reason the military has guns. Because other countries have guns too. This is too obvious a point to be lost on the readers here. So, i'm left wondering who it is that's upvoting these things.
- wfunction 9y ago
  I do get the impression a fair number of people actually believe the NSA shouldn't do this. Whether it's out of naiveté or wisdom is harder to tell, but I definitely don't get the impression everyone here is speaking from, say, 50 years of wisdom or experience in domestic and foreign policy or (cyber)warfare or what have you.
- michaelt 9y ago
  The NSA hoards vulnerabilities for the same reason the military has guns. Vulnerabilities are fundamentally unlike guns. Because vulnerabilities can be independently discovered or accidentally released, then reproduced in vast quantities and used against the public and civilian infrastructure of both us and our allies - largely with impunity. If wannacry was a gun, it'd be a gun that fired backwards and sideways at the same time as forwards, and you can't stop it firing once it's started, and sometimes it starts firing on its own.
  - wfunction 9y ago
    Correct me if I'm wrong but WannaCry used vulnerabilities that already had patches. How does reporting these vulnerabilities earlier instead of keeping them fix this situation? You'd still have the problem of slow updates regardless.
    - naz 9y ago
      If the bug were responsibly disclosed to Microsoft, there'd be no proof of concept in the wild, available for anyone to integrate into their ransomware. Instead, intelligence agencies irresponsibly hold onto them. And so they get leaked at best, or at worst end up in the wrong hands.

King-Aaron 9y ago

Oh no

warthogfiend 9y ago

"I cancelled the fines because I think it's important the pubic has 100 per cent confidence in the system" [emphasis added] o_O

gundul 9y ago
saw that too... confused me at first
danieltillett 9y ago
The Age is giving the Graudian a run for its money. There is almost nobody left working at Fairfax outside of management that was born last century.

stonewhite 9y ago

I wonder if it has infected any critical military infrastructure at US? and any real way to know about it?

hueving 9y ago
Critical military infrastructure isn't connected to the Internet, so it's unlikely as part of this regular epidemic.
- askvictor 9y ago
  Iran's nuclear fuel processing systems weren't connected to the internet either...
- angry_octet 9y ago
  But it is collected to an internet, which might be just as good.
- andai 9y ago
  [serious] wasn't the Internet basically invented to support critical military infrastructure? Or do their have their own parallel thing?
  - willstrafach 9y ago
    Not "parallel" but a few networks. NIPR - Unclassified DoD internet plus powerful defensive capabilities when traffic goes between the intranet and public internet. SIPR - Private "internet" for military and defense contractors and such to allow for handling SECRET and below. Dedicated circuits. JWICS - Like SIPR but for TS and SCI channels. Then other dedicated networks for international partnerships which run on dedicated circuits and using sats.
  - hueving 9y ago
    The technology of the internet was definitely invented to support it (i.e resilient networks). The public internet that we use is separate though.

fxlv 9y ago

And what about having a firewall on the devices? I could understand slow patching, crappy or processes and all. But if the cameras are networked, why is there no firewall on them?

askvictor 9y ago
They might not be networked; could have been infected while an operator was collecting photos. But probably networked.

ams6110 9y ago

Why do so many commercial embedded devices use Window OS, and generally old versions like NT or XP? Do vendors get a kickback from Microsoft to use Windows in systems that don't even have a display? Otherwise I don't see why they would license Windows instead of using a no-cost BSD or Linux derived OS.

giovannibajo1 9y ago
I have extensive experience in the embedded field and the answer is that most programmers and technicians know Windows and don't know Linux. Then of course there might be a few benefits to Windows in specific cases, but it's mostly the case of simply being familiar with it.
coldpie 9y ago
I think a lot of it is programmer expertise. There's a lot of people out there who only use Windows and have never used a Unix and wouldn't know where to begin programming for it. Especially when you get into lowest-bidder and outsourcing situations, where the technology used isn't even a consideration when planning the project.
jerardope 9y ago
Concerning the display: I've seen it quite often at random public places that when a technician tries to fix something on these devices, he or she will connect an external device with display and touch screen (at least when Windows 8+ is used). My guess is that maintenance of such systems is just much cheaper. Virtually everyone knows the Windows GUI.
patcheudor 9y ago
I have a oscilloscope which you can regularly find on eBay at a fairly high price. It's an awesome scope that runs XP and will always run XP because the vendor has moved on and no longer supports it. Given the age, it's unrealistic to expect that if they would have used a BSD or Linux kernel that wouldn't be vulnerable to any number of attacks. Thus, I would suggest the question isn't why are manufacturers using Windows, but rather, how can we get to a point where vendors either support their products for the anticipated life of the device or allow end-users to upgrade the kernel and related packages themselves?

jaclaz 9y ago

I am completely failing to see how Wannacry could have affected the operations of those devices AND at the same time leave some data "good enough" to produce the fines. I presume that essentally it is a photo taking device that superimposes a date/time and detected speed (and maybe also OCR's the license plate). More or less three or four pieces of data: 1) picture 2) date/time 3) speed 4) (maybe) OCR'ed liense plate number If any of these items were encrypted it would be evident, and the following step (looking in a database for the ownere of the license plate number) would have returned a null result. The only way for this to actually work (creating a wrong fine) would be if ONLY the license plate number was encrypted by Wannacry AND the encrypted string matched another existing license plate number.