4 ms·

Really? It'd be surprising if they hadn't. I'd expect utilities to be one of the softest targets out there, based on prior interaction with the industry... ed

Really? It'd be surprising if they hadn't. I'd expect utilities to be one of the softest targets out there, based on prior interaction with the industry... edit: About 8-10 years ago I used to collect news articles, reports to congress, etc, about ICS (industrial control systems, the superset of utilities) being hacked. It was regular, comprehensive, and depressing. The ICS industry was running 15-20 years behind in grasping the fact that hacking could be a problem. Think 1990 era security mindsets in 2010.

ryanmercer 8y ago
>Really? It'd be surprising if they hadn't. Ding ding ding. PLA Unit 61398, Bureau 121, Unit 8200, Fancy Bear... doesn't surprise me if all of them have any variety of ways into our infrastructure.
- pnathan 8y ago
  Yes, I expect pretty much every funded "cyber" agency has explored our systems, from the UK to Somalia. I expect any neutral to semi-hostile country (e.g., North Korea) has dormant C&C systems in our infrastructure. The conversation needs to be around, "we have known electronic critical infrastructure has been thoroughly compromised for a decade, how do we contain, mitigate, and remove the compromises." I don't mean to fear-monger or suggest fear mongering. The status quo has been "don't do anything particularly troublesome" on all sides, and that has been stable to date with only mild perturbations such as Stuxnet. It's probably a MAD calculus, with the recognition that open hostile acts would escalate to, as the phrase goes, "kinetic actions". The US could open the dialogue with the frank admission that our pants are not only down, but blew away in the breeze - we should, all of us, mutually, improve our security. I don't know that this is possible with, e.g., the US power grid without nationalizing it - the profit motive for defending against rare argues against security, as we all know...
  - ryanmercer 8y ago
    I keep waiting for someone to accidentally discover something in networking hardware that shuts down/shits itself when it gets some specific VLF signal, with it baked right into an IC. Example: Hostile satellite broadcasts VLF signal, the compromised hardware is always sitting there listening for a specific command with a hybrid IC that does both its expected job and acts as a radio receiver for a very specific signal or signals with code that gets activated when a specific match is detected. VLF is used by submarines to get small amounts of data out from deep underwater, would pass through buildings with ease. Code triggers chip to stop its intended purpose or to run some other code. Even with a few % of networking hardware compromised you'd create a massive disruption that could bring the internet to a grind leading up to an invasion. You could have the same hybrid chip in traditional telephony hardware, cellular telephony hardware, civilian GPS units, power industry hardware, vehicles. It's not unplausible, in fact, counterfeit chips have already been found time and time again in hardware, polluting a supply intended for sale in the U.S. at one or more Chinese factories would be trivial for the Chinese government for example. Even just sending a signal to cheap IoT devices or those cody streaming devices all over the internet, at gun shows, at fairs, at flea markets and you could instantly turn on some massive army that starts randomly pinging specific IP addresses or just random sets of IP addresses to just bog down the internet. People worry about the software, I worry about the ICs themselves.

ryanmercer 8y ago

>Really? It'd be surprising if they hadn't. Ding ding ding. PLA Unit 61398, Bureau 121, Unit 8200, Fancy Bear... doesn't surprise me if all of them have any variety of ways into our infrastructure.

pnathan 8y ago
Yes, I expect pretty much every funded "cyber" agency has explored our systems, from the UK to Somalia. I expect any neutral to semi-hostile country (e.g., North Korea) has dormant C&C systems in our infrastructure. The conversation needs to be around, "we have known electronic critical infrastructure has been thoroughly compromised for a decade, how do we contain, mitigate, and remove the compromises." I don't mean to fear-monger or suggest fear mongering. The status quo has been "don't do anything particularly troublesome" on all sides, and that has been stable to date with only mild perturbations such as Stuxnet. It's probably a MAD calculus, with the recognition that open hostile acts would escalate to, as the phrase goes, "kinetic actions". The US could open the dialogue with the frank admission that our pants are not only down, but blew away in the breeze - we should, all of us, mutually, improve our security. I don't know that this is possible with, e.g., the US power grid without nationalizing it - the profit motive for defending against rare argues against security, as we all know...
- ryanmercer 8y ago
  I keep waiting for someone to accidentally discover something in networking hardware that shuts down/shits itself when it gets some specific VLF signal, with it baked right into an IC. Example: Hostile satellite broadcasts VLF signal, the compromised hardware is always sitting there listening for a specific command with a hybrid IC that does both its expected job and acts as a radio receiver for a very specific signal or signals with code that gets activated when a specific match is detected. VLF is used by submarines to get small amounts of data out from deep underwater, would pass through buildings with ease. Code triggers chip to stop its intended purpose or to run some other code. Even with a few % of networking hardware compromised you'd create a massive disruption that could bring the internet to a grind leading up to an invasion. You could have the same hybrid chip in traditional telephony hardware, cellular telephony hardware, civilian GPS units, power industry hardware, vehicles. It's not unplausible, in fact, counterfeit chips have already been found time and time again in hardware, polluting a supply intended for sale in the U.S. at one or more Chinese factories would be trivial for the Chinese government for example. Even just sending a signal to cheap IoT devices or those cody streaming devices all over the internet, at gun shows, at fairs, at flea markets and you could instantly turn on some massive army that starts randomly pinging specific IP addresses or just random sets of IP addresses to just bog down the internet. People worry about the software, I worry about the ICs themselves.