8 ms·

We're quickly heading toward the age of the first Virtual WMD. The implications can be as wide as your imagination, but possibly worse than existing WMDs.

Harvey-Specter 8y ago
I'm having a hard time imagining a virtual WMD that is worse than the instant obliteration of millions of people.
- Omnus 8y ago
  Presumably the person you replied to is including the potential takeover of nuclear weapons by terrorist hackers, etc.
  - Harvey-Specter 8y ago
    I would consider that to be an 'existing WMD' rather than some new 'virtual WMD'
- Clubber 8y ago
  Think of controllers for say a dam, or an autopilot system in a jet.
  - Harvey-Specter 8y ago
    How would either of these be worse than a nuke going off in Hong Kong or NYC?
    - galieos_ghost 8y ago
      If you took out a dam in Montana the following chain of dam failures would cut the United States in half all the way to the Gulf of Mexico and destroy US agricultural output. The US produces 40-50% of the world Soybean and Corn supply. Long term you're probably talking billions of deaths due to food shortages.
    - scarmig 8y ago
      Dams are dangerous beasts. The KMT breached some dikes in the 1930s for the purpose of environmental warfare, and in the process killed half a million peasants and displaced millions more.
  - jjjjjjjjjjjjjjj 8y ago
    Which you consider worse than the instant obliteration of millions of people?
    - Clubber 8y ago
      I'm not sure it would be. I don't think we've considered all that can happen with a sophisticated worm. The problem with leveraging nukes is MAD. With worms, you can do a lot of damage without even knowing who did it. Think the Anthrax attacks in 2001 x 1000. With worms, you can do a bunch of damage over a long period of time without getting discovered. What's the US going to do, start a nuclear war over it? No, see MAD above. I mean if a worm could figure out how to stop shipping (say simultaneously disable control / start systems of vehicles or gas pumps), people will start to starve after a few days, then probably total chaos will happen leading to a bunch of deaths. That's just a single scenario. How about if a worm took control of all the air traffic towers simultaneously and change the information so that controllers would start crashing planes everywhere. I know nuclear war has been played out on tv and in movies for the last 70 years or so, but I don't see an all out nuclear war between two states lobbing hundreds of warheads at each other ever happening. At least not intentionally. Any type of nuclear detonation would either be accidental, or very isolated.
    - onion2k 8y ago
      Mosul dam in Iraq was in serious trouble and some argued that it might collapse after the second Iraq war. If it's ever breached the disaster could kill as many as 1.5 million people living in the city below and displace a further 5 million. It's not beyond the realms of possibility that a Stuxnet aimed at the dam's control systems could kill more people than at attack with nuclear or chemical weapons.
- aequitas 8y ago
  I think you would need to think in the line of a global economy/technology/infrastructure collapse (no power production/utilities, (global) transport, financial crisis), millions of first world being thrown into third world conditions (no access to water, food, medicine) due to the large cities depending on technology. Also see: https://archive.org/details/james-burke-connections_s01e01 https://archive.org/details/james-burke-connections_s01e01
- steego 8y ago
  You know what's worse than the instant obliteration of millions of people? The slow obliteration and starving of millions of people. Imagine Venezuela, but much much worse. Picture a society that doesn't know how to create institutions, conduct trade and collaborate with the people around them without the aid of a computers. Now, I don't know if disabling their computers would result in an incredibly dysfunctional society that would starve, but it's not unthinkable. If it did, the suffering could be far beyond the instant obliteration of millions of people.
  - um_ya 8y ago
    Actually, in a capitalist country it might be easier to survive such an attack. If there is demand for a product or service, people and businesses will find a way to meet that demand. Millions of people working independently to satisfy their local market demand. It would probably hurt centralized socialist or communist countries more since it severs their control, surveillance, and communication mechanisms.
    - xfitm3 8y ago
      Supply will be lower than what’s currently available. Prices could go up. If so, lower income households may not survive.
    - steego 8y ago
      I agree that markets tend to buffer the effects significantly. The problem is in times of crisis, the appreciation of market dynamics and rule of law tend to wane. Even if those things are intact, the flow of goods and services can be undermined by well-intentioned but misguided politicians. My point was simple. Despite the systems of trade, a catastrophic shock in trade or production systems could literally kill millions in a way that is more brutal and horrific than instant obliteration.
      - Lionsion 8y ago
        > My point was simple. Despite the systems of trade, a catastrophic shock in trade or production systems could literally kill millions in a way that is more brutal and horrific than instant obliteration. Systems have trade have made the market economy of the US more vulnerable to many kinds of "a catastrophic shock[s] in trade or production systems." IIRC, there are only a few days of slack in the US food supply chain. That's down from a month or two during the cold war (where I think there were mandates for reserves).
- baud147258 8y ago
  If you can shut down enough utilities (electricity, mobile telecommunications, television & radio station, water treatment plants, access to water...) at the same time on a wide enough area, it would be devastating.
- uptown 8y ago
  This article is relevant: https://www.bloomberg.com/graphics/2018-food-trade-chokepoints/ https://www.bloomberg.com/graphics/2018-food-trade-chokepoin... It highlights the shipping "chokepoints" where disruption causes potential food crisis for where the ship had intended to deliver its payload. If the infrastructure which manages these pathways is attacked, the security of these regions is in jeopardy.
- JadeNB 8y ago
  > I'm having a hard time imagining a virtual WMD that is worse than the instant obliteration of millions of people. Incidentally, my impression has always been that, at least with the comparatively low-yield atomic weapons that have actually been used, it's not the instant obliteration that's the biggest problem, but rather the lingering effects of fallout and radiation sickness.
- Certhas 8y ago
  Blackouts. Do what Stuxnet did to the control rooms of a large number of power plants, spinning up the machines to hard, coordinate this attack so it triggers in a large number of places. If you can pull this off for a continental scale, you're looking at potentially months to restore power to everywhere. https://en.wikipedia.org/wiki/December_2015_Ukraine_power_grid_cyberattack https://en.wikipedia.org/wiki/December_2015_Ukraine_power_gr...
  - toong 8y ago
    Without power, logistics & supply lines stop working, no more groceries after a few days, riots and plunderings in the streets a week later...
    - Cthulhu_ 8y ago
      Anything that doesn't require refrigeration would still work though, trucks run on diesel after all. Which makes me concerned about the future; if the transport network becomes electric, a power outage will cripple things even more. Unless we build self-contained, internet-disconnected charging stations maybe, but that's not going to be done at any kind of significant scale.
      - Certhas 8y ago
        Just a guess, but: Gas stations use pumps that run on electricity.
        bluGill 8y ago
        They are still pumps: a physical system. Give me a couple hours and I can get gasoline out of any gas station without needing electricity. Of course I will destroy large parts of the machine in the process. I'll get my gas, and so will anyone else while that turns the crank. The pump will need to be replaced to use normally afterwards. The bigger worry is gasoline in tanks is good for at most a month. The refinery is much harder to start/operate without power. They have their own backup power on site (I assume) so this might or might not be a real worry. If it is I'll just brew some ethanol.
- Maybestring 8y ago
  Virtual weapons are worse when it comes to proliferation. And they are worse when it comes to identifying attackers. Both of these could make them more likely to be used. Software which say opened the throttle and disabled the brakes on millions of vehicles simultaneously would be in the ballpark for total destruction in a short time. With self-driving cars, the total destruction can be optimized, hunting down pedestrians and hitting vulnerable infrastructure.
- lurker456 8y ago
  Imagine a delayed killswitch in Intel's ME and AMD's PSP.
- jerf 8y ago
  In 20 years, a virtual WMD may well instantly obliterate millions of people. I'm already unsure of what the most possible damage someone could do with over-the-air automobile firmware updates is today, just to take one example. What would it be like if someone put out a virus that at 11:32:42am on March 3rd, 2036 causes every GM, Ford, and Tesla self-driving car to lock all the doors, floor the accelerator, and let the chips fall where they may? Consider not just the immediate impact of the crashes, but the fact that you just completely obliterated emergency services (they couldn't hope to serve but a tiny fraction of the victims), choked every major road and most of the minor roads with wreckage, wrought a catastrophe so large that while I don't predict what the effects would be, we're talking something more defining for a generation that would handily compete with both World Wars combined for psychological effect, with the Great Depression tossed in for good measure... it would be astonishing. I'm not even sure we couldn't get close to that in 2018, to be honest. What if by some horrors the Stuxnet authors were set the task of making this happen? How close could they get?
  - bluGill 8y ago
    The problem all virus authors have is escaping detection. 2036 is too far out for them to count on not being detected, and on cars being the same. Release it today, and even if you infect all cars and are undetected, GM and Ford's normal update cycle is likely to change things such that by accident your virus cannot spread. You can expect to get a handful of cars to accelerate out of control - and odds are the door locks don't work on them so you failed to lock the door. Infecting a cars is hard for other reasons. Radios tend to be easy to updated (they can sell you new features - maps if nothing else). All other controllers tend to be more locked down such that it is likely that a virus couldn't actually spread to anything that can take control. Maybe, who knows who GM will change over the next 20 years. GM only has guesses.
    - jerf 8y ago
      "2036 is too far out for them to count on not being detected, and on cars being the same." Sorry, I conflated two things here. I meant someone in 2036 setting a logic bomb for something like a month in advance in their time, and as a separate question, how close one could get to such a virus today. As we keep wiring up our cars to networks (not necessarily "the Internet", but networks), it's only going to get easier. One of the problems I think will happen with cars, only accelerated by self driving cars and the high probability that people will largely lease them rather than own them, is that the governments of the world are going to see a big pot of real-time surveillance data and real-time person control mechanisms and won't be able keep their hands off, mandating that cars start getting very connected and that cars have backdoors for authorities to take over and redirect them, etc. My scenario in 2036 may not even be a brilliant virus designer, but just one person with Python scripting skills and a bit too much access to the government control system. It's not even that hard to imagine such a disaster happening accidentally. I'm sure, no sarcasm, that protections will be put into place, but there always has to be a developer back door mechanism of some sort, and there may be enough controls added, or they may not be added competently enough. (And in terms of the protections of the cars themselves, remember that Stuxnet included the use of not one, but two code signing certificates that the Stuxnet authors clearly did not have true authority to use. If there's a way from the Internet to the control mechanism, even if it requires signed code, there's no guarantee a particularly capable and motivated enemy won't penetrate the protections.)
otakucode 8y ago
A significant amount of how our society approaches technology issues almost seems like everyone has agreed that they WANT a gigantic catastrophe. Like they want to see an action-movie-scale real life supervillain to emerge who uses technology to severely harm people. I won't be surprised when one nutcase has prison doors flying open, planes falling from the sky, ATMs nationwide spilling into the streets, stock market prices spinning randomly, electrical grids frying themselves and everything attached, all at the same time.
- carapace 8y ago
  Yep. Our (global) civilization carries within it the seeds of its own destruction. https://en.wikipedia.org/wiki/Civilization_and_Its_Discontents https://en.wikipedia.org/wiki/Civilization_and_Its_Disconten... Corollary: It is vital (no pun intended) that we learn to live in harmony with Nature or we will destroy ourselves.
3pt14159 8y ago
You're 100% right, but you should use the word cyber, not virtual. I know hackers hate the word cyber because grandma uses it, but it's the right word for it. The stand-in "computer based" almost works, but it doesn't cover things like hacking radios.
tomatotomato37 8y ago
Eh, I'm not so sure. One of the biggest appeals of our current WMDs is they can take out the enemy's WMDs in addition to infrastructure. An attack that paralyzes an entire nation's computer network and sends self-driving cars crashing into substations doesn't mean anything to the group of guys in a bunker/submarine with the keys to the 50 year rocket powered by vaccum tubes

Harvey-Specter 8y ago

I'm having a hard time imagining a virtual WMD that is worse than the instant obliteration of millions of people.

Omnus 8y ago
Presumably the person you replied to is including the potential takeover of nuclear weapons by terrorist hackers, etc.
- Harvey-Specter 8y ago
  I would consider that to be an 'existing WMD' rather than some new 'virtual WMD'
Clubber 8y ago
Think of controllers for say a dam, or an autopilot system in a jet.
- Harvey-Specter 8y ago
  How would either of these be worse than a nuke going off in Hong Kong or NYC?
  - galieos_ghost 8y ago
    If you took out a dam in Montana the following chain of dam failures would cut the United States in half all the way to the Gulf of Mexico and destroy US agricultural output. The US produces 40-50% of the world Soybean and Corn supply. Long term you're probably talking billions of deaths due to food shortages.
  - scarmig 8y ago
    Dams are dangerous beasts. The KMT breached some dikes in the 1930s for the purpose of environmental warfare, and in the process killed half a million peasants and displaced millions more.
- jjjjjjjjjjjjjjj 8y ago
  Which you consider worse than the instant obliteration of millions of people?
  - Clubber 8y ago
    I'm not sure it would be. I don't think we've considered all that can happen with a sophisticated worm. The problem with leveraging nukes is MAD. With worms, you can do a lot of damage without even knowing who did it. Think the Anthrax attacks in 2001 x 1000. With worms, you can do a bunch of damage over a long period of time without getting discovered. What's the US going to do, start a nuclear war over it? No, see MAD above. I mean if a worm could figure out how to stop shipping (say simultaneously disable control / start systems of vehicles or gas pumps), people will start to starve after a few days, then probably total chaos will happen leading to a bunch of deaths. That's just a single scenario. How about if a worm took control of all the air traffic towers simultaneously and change the information so that controllers would start crashing planes everywhere. I know nuclear war has been played out on tv and in movies for the last 70 years or so, but I don't see an all out nuclear war between two states lobbing hundreds of warheads at each other ever happening. At least not intentionally. Any type of nuclear detonation would either be accidental, or very isolated.
  - onion2k 8y ago
    Mosul dam in Iraq was in serious trouble and some argued that it might collapse after the second Iraq war. If it's ever breached the disaster could kill as many as 1.5 million people living in the city below and displace a further 5 million. It's not beyond the realms of possibility that a Stuxnet aimed at the dam's control systems could kill more people than at attack with nuclear or chemical weapons.
aequitas 8y ago
I think you would need to think in the line of a global economy/technology/infrastructure collapse (no power production/utilities, (global) transport, financial crisis), millions of first world being thrown into third world conditions (no access to water, food, medicine) due to the large cities depending on technology. Also see: https://archive.org/details/james-burke-connections_s01e01 https://archive.org/details/james-burke-connections_s01e01
steego 8y ago
You know what's worse than the instant obliteration of millions of people? The slow obliteration and starving of millions of people. Imagine Venezuela, but much much worse. Picture a society that doesn't know how to create institutions, conduct trade and collaborate with the people around them without the aid of a computers. Now, I don't know if disabling their computers would result in an incredibly dysfunctional society that would starve, but it's not unthinkable. If it did, the suffering could be far beyond the instant obliteration of millions of people.
- um_ya 8y ago
  Actually, in a capitalist country it might be easier to survive such an attack. If there is demand for a product or service, people and businesses will find a way to meet that demand. Millions of people working independently to satisfy their local market demand. It would probably hurt centralized socialist or communist countries more since it severs their control, surveillance, and communication mechanisms.
  - xfitm3 8y ago
    Supply will be lower than what’s currently available. Prices could go up. If so, lower income households may not survive.
  - steego 8y ago
    I agree that markets tend to buffer the effects significantly. The problem is in times of crisis, the appreciation of market dynamics and rule of law tend to wane. Even if those things are intact, the flow of goods and services can be undermined by well-intentioned but misguided politicians. My point was simple. Despite the systems of trade, a catastrophic shock in trade or production systems could literally kill millions in a way that is more brutal and horrific than instant obliteration.
    - Lionsion 8y ago
      > My point was simple. Despite the systems of trade, a catastrophic shock in trade or production systems could literally kill millions in a way that is more brutal and horrific than instant obliteration. Systems have trade have made the market economy of the US more vulnerable to many kinds of "a catastrophic shock[s] in trade or production systems." IIRC, there are only a few days of slack in the US food supply chain. That's down from a month or two during the cold war (where I think there were mandates for reserves).
baud147258 8y ago
If you can shut down enough utilities (electricity, mobile telecommunications, television & radio station, water treatment plants, access to water...) at the same time on a wide enough area, it would be devastating.
uptown 8y ago
This article is relevant: https://www.bloomberg.com/graphics/2018-food-trade-chokepoints/ https://www.bloomberg.com/graphics/2018-food-trade-chokepoin... It highlights the shipping "chokepoints" where disruption causes potential food crisis for where the ship had intended to deliver its payload. If the infrastructure which manages these pathways is attacked, the security of these regions is in jeopardy.
JadeNB 8y ago
> I'm having a hard time imagining a virtual WMD that is worse than the instant obliteration of millions of people. Incidentally, my impression has always been that, at least with the comparatively low-yield atomic weapons that have actually been used, it's not the instant obliteration that's the biggest problem, but rather the lingering effects of fallout and radiation sickness.
Certhas 8y ago
Blackouts. Do what Stuxnet did to the control rooms of a large number of power plants, spinning up the machines to hard, coordinate this attack so it triggers in a large number of places. If you can pull this off for a continental scale, you're looking at potentially months to restore power to everywhere. https://en.wikipedia.org/wiki/December_2015_Ukraine_power_grid_cyberattack https://en.wikipedia.org/wiki/December_2015_Ukraine_power_gr...
- toong 8y ago
  Without power, logistics & supply lines stop working, no more groceries after a few days, riots and plunderings in the streets a week later...
  - Cthulhu_ 8y ago
    Anything that doesn't require refrigeration would still work though, trucks run on diesel after all. Which makes me concerned about the future; if the transport network becomes electric, a power outage will cripple things even more. Unless we build self-contained, internet-disconnected charging stations maybe, but that's not going to be done at any kind of significant scale.
    - Certhas 8y ago
      Just a guess, but: Gas stations use pumps that run on electricity.
      - bluGill 8y ago
        They are still pumps: a physical system. Give me a couple hours and I can get gasoline out of any gas station without needing electricity. Of course I will destroy large parts of the machine in the process. I'll get my gas, and so will anyone else while that turns the crank. The pump will need to be replaced to use normally afterwards. The bigger worry is gasoline in tanks is good for at most a month. The refinery is much harder to start/operate without power. They have their own backup power on site (I assume) so this might or might not be a real worry. If it is I'll just brew some ethanol.
Maybestring 8y ago
Virtual weapons are worse when it comes to proliferation. And they are worse when it comes to identifying attackers. Both of these could make them more likely to be used. Software which say opened the throttle and disabled the brakes on millions of vehicles simultaneously would be in the ballpark for total destruction in a short time. With self-driving cars, the total destruction can be optimized, hunting down pedestrians and hitting vulnerable infrastructure.
lurker456 8y ago
Imagine a delayed killswitch in Intel's ME and AMD's PSP.
jerf 8y ago
In 20 years, a virtual WMD may well instantly obliterate millions of people. I'm already unsure of what the most possible damage someone could do with over-the-air automobile firmware updates is today, just to take one example. What would it be like if someone put out a virus that at 11:32:42am on March 3rd, 2036 causes every GM, Ford, and Tesla self-driving car to lock all the doors, floor the accelerator, and let the chips fall where they may? Consider not just the immediate impact of the crashes, but the fact that you just completely obliterated emergency services (they couldn't hope to serve but a tiny fraction of the victims), choked every major road and most of the minor roads with wreckage, wrought a catastrophe so large that while I don't predict what the effects would be, we're talking something more defining for a generation that would handily compete with both World Wars combined for psychological effect, with the Great Depression tossed in for good measure... it would be astonishing. I'm not even sure we couldn't get close to that in 2018, to be honest. What if by some horrors the Stuxnet authors were set the task of making this happen? How close could they get?
- bluGill 8y ago
  The problem all virus authors have is escaping detection. 2036 is too far out for them to count on not being detected, and on cars being the same. Release it today, and even if you infect all cars and are undetected, GM and Ford's normal update cycle is likely to change things such that by accident your virus cannot spread. You can expect to get a handful of cars to accelerate out of control - and odds are the door locks don't work on them so you failed to lock the door. Infecting a cars is hard for other reasons. Radios tend to be easy to updated (they can sell you new features - maps if nothing else). All other controllers tend to be more locked down such that it is likely that a virus couldn't actually spread to anything that can take control. Maybe, who knows who GM will change over the next 20 years. GM only has guesses.
  - jerf 8y ago
    "2036 is too far out for them to count on not being detected, and on cars being the same." Sorry, I conflated two things here. I meant someone in 2036 setting a logic bomb for something like a month in advance in their time, and as a separate question, how close one could get to such a virus today. As we keep wiring up our cars to networks (not necessarily "the Internet", but networks), it's only going to get easier. One of the problems I think will happen with cars, only accelerated by self driving cars and the high probability that people will largely lease them rather than own them, is that the governments of the world are going to see a big pot of real-time surveillance data and real-time person control mechanisms and won't be able keep their hands off, mandating that cars start getting very connected and that cars have backdoors for authorities to take over and redirect them, etc. My scenario in 2036 may not even be a brilliant virus designer, but just one person with Python scripting skills and a bit too much access to the government control system. It's not even that hard to imagine such a disaster happening accidentally. I'm sure, no sarcasm, that protections will be put into place, but there always has to be a developer back door mechanism of some sort, and there may be enough controls added, or they may not be added competently enough. (And in terms of the protections of the cars themselves, remember that Stuxnet included the use of not one, but two code signing certificates that the Stuxnet authors clearly did not have true authority to use. If there's a way from the Internet to the control mechanism, even if it requires signed code, there's no guarantee a particularly capable and motivated enemy won't penetrate the protections.)

otakucode 8y ago

A significant amount of how our society approaches technology issues almost seems like everyone has agreed that they WANT a gigantic catastrophe. Like they want to see an action-movie-scale real life supervillain to emerge who uses technology to severely harm people. I won't be surprised when one nutcase has prison doors flying open, planes falling from the sky, ATMs nationwide spilling into the streets, stock market prices spinning randomly, electrical grids frying themselves and everything attached, all at the same time.

carapace 8y ago
Yep. Our (global) civilization carries within it the seeds of its own destruction. https://en.wikipedia.org/wiki/Civilization_and_Its_Discontents https://en.wikipedia.org/wiki/Civilization_and_Its_Disconten... Corollary: It is vital (no pun intended) that we learn to live in harmony with Nature or we will destroy ourselves.

3pt14159 8y ago

You're 100% right, but you should use the word cyber, not virtual. I know hackers hate the word cyber because grandma uses it, but it's the right word for it. The stand-in "computer based" almost works, but it doesn't cover things like hacking radios.

tomatotomato37 8y ago

Eh, I'm not so sure. One of the biggest appeals of our current WMDs is they can take out the enemy's WMDs in addition to infrastructure. An attack that paralyzes an entire nation's computer network and sends self-driving cars crashing into substations doesn't mean anything to the group of guys in a bunker/submarine with the keys to the 50 year rocket powered by vaccum tubes