5 ms·

Just for additional context several super computing sites in Europe were attacked a few weeks ago and are still down, among them PizDaint at CSCS, which ranks 6

Just for additional context several super computing sites in Europe were attacked a few weeks ago and are still down, among them PizDaint at CSCS, which ranks 6th in the world, several super computing sites in Germany (FZ Juelich) and so on. I think no-one wishes this to turn into a kinetic war, but for all we know besides the economic warfare that has been going on for quite some time, this feels like we are in an all out conflict with China.

RobertoG 6y ago
we are in all out conflict with China because some super computing sites were "attacked"? That's not a very responsible statement.
- orbifold 6y ago
  Well this is clearly a hostile act during a time in which several European countries have declared medical emergencies. They were not just "attacked" but have been completely offline for almost two weeks now (https://www.hpcwire.com/2020/05/18/hacking-streak-forces-european-supercomputers-offline-in-midst-of-covid-19-research-effort/ https://www.hpcwire.com/2020/05/18/hacking-streak-forces-eur...). In Germany it is (incident was 15.05) - NEMO (Freiburg) - bwUniCluster 2.0 and ForHLR II (Karlsruhe) - Hawk (Stuttgart) - Leibniz Supercomputing Center (Munich) - JURECA, JUWELS und JUDAC (FZ Jülich) - Taurus (Dresden) Switzerland shutdown access to all of CSCS (16.05).
  - goodcjw2 6y ago
    Facts: 1 - HPC centers in Europes are down. 2 - Those are useful resources to battle battle against COVID-19. 3 - HPC centers are down due to malware infections. 4 - FBI warned and Department of Homeland Security warns of possible cyberattacks targeting COVID-19 research.
    - acqq 6y ago
      And in the linked article the probable cause is much more prosaic: "The attacks may have been perpetrated in order to mine cryptocurrency; investigations are ongoing."
      - salawat 6y ago
        I feel like cryptocurrency miner install is going to end up being the new cover story anytime someone doesn't want to tip their hand on capabilities.
        gnufx 6y ago
        Yes, but if you were serious about espionage, say, you wouldn't draw attention to the compromise by running one.
        salawat 6y ago
        Unless you're testing a zero day, and staging an alternate route of infiltration to hide your installation of threat persistence. I believe it's referred to as the "limited hangout" in spycraft jargon. You maintain the target's sense of security and ability to detect intrusion while you maintain the capability to reintrude at will.
    - orbifold 6y ago
      Facts: 1 - one of the two incidences reported (#EGI2020512) targeted academic data centers "for unknown purposes" (https://csirt.egi.eu/academic-data-centers-abused-for-crypto-currency-mining/ https://csirt.egi.eu/academic-data-centers-abused-for-crypto...) and not necessarily crypto currency mining. 2 - IP addresses associated with that second attack were all assigned to a Chinese University (Shanghai Jiaotong University), CSTNET and one Polish host known to be compromised by someone from China.
      - TeMPOraL 6y ago
        Re 2., since when IP is address tracking a reliable method of attack attribution? It's like trying to assign blame for a terrorist attack based on where the jacket dropped by a terrorist was made. Maybe it was made in their home country. Maybe it was imported. Or maybe they purposefully wore a jacket made in a different country and dropped it on the scene to confuse you.
  - deleted 6y ago
    [deleted]
  - Reelin 6y ago
    > this is clearly a hostile act That's not my reading of the article you linked. A bad actor compromised the credentials of multiple researchers with access to various supercomputers (over some unknown or at least unspecified period of time). They then simultaneously accessed the compromised machines and installed cryptocurrency mining software on them. This could easily be profit motivated (as it appears). It could also be (as you suggest) a hostile act disguised as the former, but I don't see what the motivation to do that would be?
    - fpgaminer 6y ago
      Also the article mentions that Chinese researchers had access to the clusters as well. So the GP's implication is that the PRC attacked these datacenters ... to stop their own research? Seems more likely that more people are using/accessing these services, and people's guards are down, which made it easier for intruders to get in.
    - orbifold 6y ago
      Well there were two incidents (https://csirt.egi.eu/academic-data-centers-abused-for-crypto-currency-mining/ https://csirt.egi.eu/academic-data-centers-abused-for-crypto...) one of which had "unknown purpose". It had the real effect of disrupting the majority of the super computing infrastructure in Switzerland and Germany for almost two weeks now. The attacks originated from China (Shanghai Jiao Tong University and CSTNET).
antpls 6y ago
Do you have a reference about those attacks? A press release or a link to a blog maybe?
- throwanem 6y ago
  https://www.hpcwire.com/2020/05/18/hacking-streak-forces-european-supercomputers-offline-in-midst-of-covid-19-research-effort/ https://www.hpcwire.com/2020/05/18/hacking-streak-forces-eur...
pjc50 6y ago
So, when do we launch the nukes? If you're talking about conflict, be clear how far both sides might be willing to escalate.
zaxu 6y ago
These are crypto mining schemes, though. This looks a lot more like run of the mill money making cybercrime than espionage - I don't think any nation state would be interested in outing themselves for a pittance in bitcoin.
- orbifold 6y ago
  At least according to this incident report https://csirt.egi.eu/academic-data-centers-abused-for-crypto-currency-mining/ https://csirt.egi.eu/academic-data-centers-abused-for-crypto..., one of the two attacks had "unknown purpose". In particular it was not tied to crypto mining.
  - zaxu 6y ago
    From the site you linked, the one with "unknown" motive has exclusively attacked Chinese academic victims. It would be extremely bizarre to suggest that the Chinese government is behind this.
    - zaxu 6y ago
      Ah, I misread the table. This is very suggestive, then.
    - orbifold 6y ago
      The second one is the attack that spread all the way to a basement HPC cluster in the Physics Institute at LMU Munich, the IP addresses listed are indicators to look for that your system might be compromised, not the victims of the attack.
    - scarmig 6y ago
      It's worth pointing out that countries regularly hack and attack their own citizens. In some ways, it's more important to know what they're doing than what your opponents' are.
- eloisius 6y ago
  Would they set up a crypto mining scheme to obfuscate the origin and intent of the attack though?
pengaru 6y ago
I'm not under the impression that non-military research and academic computing facilities are particularly well secured. Decades ago I spent a bunch of time around fnal.gov with a buddy who worked there, and they were debating the requirement of every computer, including desktops, having a static, public IPv4 address. Nobody wanted to be behind a firewall in the name of open, collaborative research.
- gnufx 6y ago
  Yes, the fundamental problem is that this sort of thing has around the top of the threat list for academic computing facilities for 30 years or so (originally typically coming in to the UK from CERN). It's just that this is larger scale, possibly more automated (filching SSH keys), and has a higher profile. Despite that, the systems are normally not managed to counter the threat, running with known privilege escalations either through unpatched OS vulnerabilities or through something like the batch system. Don't trust them with anything sensitive, including credentials like typed passwords or SSH forwarding, yet people do. I have an existence proof that it doesn't have to be like that for HPC systems, even if you're not allowed system time -- in which case live patching of login node kernels is specifically necessary. Incidentally, if attackers were looking for sensitive research results from this, I think it would have to be targeted with detailed knowledge about what specific researchers were doing; after all, it's difficult enough for a typical researcher to keep track of their own stuff, and it mostly won't have look-at-me names.
yibg 6y ago
How do we jump from some super computers being attacked by unknown actors to a conflict with China. When did every cyber attack become automatically a chinese cyber attack?

RobertoG 6y ago

we are in all out conflict with China because some super computing sites were "attacked"? That's not a very responsible statement.

orbifold 6y ago
Well this is clearly a hostile act during a time in which several European countries have declared medical emergencies. They were not just "attacked" but have been completely offline for almost two weeks now (https://www.hpcwire.com/2020/05/18/hacking-streak-forces-european-supercomputers-offline-in-midst-of-covid-19-research-effort/ https://www.hpcwire.com/2020/05/18/hacking-streak-forces-eur...). In Germany it is (incident was 15.05) - NEMO (Freiburg) - bwUniCluster 2.0 and ForHLR II (Karlsruhe) - Hawk (Stuttgart) - Leibniz Supercomputing Center (Munich) - JURECA, JUWELS und JUDAC (FZ Jülich) - Taurus (Dresden) Switzerland shutdown access to all of CSCS (16.05).
- goodcjw2 6y ago
  Facts: 1 - HPC centers in Europes are down. 2 - Those are useful resources to battle battle against COVID-19. 3 - HPC centers are down due to malware infections. 4 - FBI warned and Department of Homeland Security warns of possible cyberattacks targeting COVID-19 research.
  - acqq 6y ago
    And in the linked article the probable cause is much more prosaic: "The attacks may have been perpetrated in order to mine cryptocurrency; investigations are ongoing."
    - salawat 6y ago
      I feel like cryptocurrency miner install is going to end up being the new cover story anytime someone doesn't want to tip their hand on capabilities.
      - gnufx 6y ago
        Yes, but if you were serious about espionage, say, you wouldn't draw attention to the compromise by running one.
        salawat 6y ago
        Unless you're testing a zero day, and staging an alternate route of infiltration to hide your installation of threat persistence. I believe it's referred to as the "limited hangout" in spycraft jargon. You maintain the target's sense of security and ability to detect intrusion while you maintain the capability to reintrude at will.
  - orbifold 6y ago
    Facts: 1 - one of the two incidences reported (#EGI2020512) targeted academic data centers "for unknown purposes" (https://csirt.egi.eu/academic-data-centers-abused-for-crypto-currency-mining/ https://csirt.egi.eu/academic-data-centers-abused-for-crypto...) and not necessarily crypto currency mining. 2 - IP addresses associated with that second attack were all assigned to a Chinese University (Shanghai Jiaotong University), CSTNET and one Polish host known to be compromised by someone from China.
    - TeMPOraL 6y ago
      Re 2., since when IP is address tracking a reliable method of attack attribution? It's like trying to assign blame for a terrorist attack based on where the jacket dropped by a terrorist was made. Maybe it was made in their home country. Maybe it was imported. Or maybe they purposefully wore a jacket made in a different country and dropped it on the scene to confuse you.
- deleted 6y ago
  [deleted]
- Reelin 6y ago
  > this is clearly a hostile act That's not my reading of the article you linked. A bad actor compromised the credentials of multiple researchers with access to various supercomputers (over some unknown or at least unspecified period of time). They then simultaneously accessed the compromised machines and installed cryptocurrency mining software on them. This could easily be profit motivated (as it appears). It could also be (as you suggest) a hostile act disguised as the former, but I don't see what the motivation to do that would be?
  - fpgaminer 6y ago
    Also the article mentions that Chinese researchers had access to the clusters as well. So the GP's implication is that the PRC attacked these datacenters ... to stop their own research? Seems more likely that more people are using/accessing these services, and people's guards are down, which made it easier for intruders to get in.
  - orbifold 6y ago
    Well there were two incidents (https://csirt.egi.eu/academic-data-centers-abused-for-crypto-currency-mining/ https://csirt.egi.eu/academic-data-centers-abused-for-crypto...) one of which had "unknown purpose". It had the real effect of disrupting the majority of the super computing infrastructure in Switzerland and Germany for almost two weeks now. The attacks originated from China (Shanghai Jiao Tong University and CSTNET).

antpls 6y ago

Do you have a reference about those attacks? A press release or a link to a blog maybe?

throwanem 6y ago
https://www.hpcwire.com/2020/05/18/hacking-streak-forces-european-supercomputers-offline-in-midst-of-covid-19-research-effort/ https://www.hpcwire.com/2020/05/18/hacking-streak-forces-eur...

pjc50 6y ago

So, when do we launch the nukes? If you're talking about conflict, be clear how far both sides might be willing to escalate.

zaxu 6y ago

These are crypto mining schemes, though. This looks a lot more like run of the mill money making cybercrime than espionage - I don't think any nation state would be interested in outing themselves for a pittance in bitcoin.

orbifold 6y ago
At least according to this incident report https://csirt.egi.eu/academic-data-centers-abused-for-crypto-currency-mining/ https://csirt.egi.eu/academic-data-centers-abused-for-crypto..., one of the two attacks had "unknown purpose". In particular it was not tied to crypto mining.
- zaxu 6y ago
  From the site you linked, the one with "unknown" motive has exclusively attacked Chinese academic victims. It would be extremely bizarre to suggest that the Chinese government is behind this.
  - zaxu 6y ago
    Ah, I misread the table. This is very suggestive, then.
  - orbifold 6y ago
    The second one is the attack that spread all the way to a basement HPC cluster in the Physics Institute at LMU Munich, the IP addresses listed are indicators to look for that your system might be compromised, not the victims of the attack.
  - scarmig 6y ago
    It's worth pointing out that countries regularly hack and attack their own citizens. In some ways, it's more important to know what they're doing than what your opponents' are.
eloisius 6y ago
Would they set up a crypto mining scheme to obfuscate the origin and intent of the attack though?

pengaru 6y ago

I'm not under the impression that non-military research and academic computing facilities are particularly well secured. Decades ago I spent a bunch of time around fnal.gov with a buddy who worked there, and they were debating the requirement of every computer, including desktops, having a static, public IPv4 address. Nobody wanted to be behind a firewall in the name of open, collaborative research.

gnufx 6y ago
Yes, the fundamental problem is that this sort of thing has around the top of the threat list for academic computing facilities for 30 years or so (originally typically coming in to the UK from CERN). It's just that this is larger scale, possibly more automated (filching SSH keys), and has a higher profile. Despite that, the systems are normally not managed to counter the threat, running with known privilege escalations either through unpatched OS vulnerabilities or through something like the batch system. Don't trust them with anything sensitive, including credentials like typed passwords or SSH forwarding, yet people do. I have an existence proof that it doesn't have to be like that for HPC systems, even if you're not allowed system time -- in which case live patching of login node kernels is specifically necessary. Incidentally, if attackers were looking for sensitive research results from this, I think it would have to be targeted with detailed knowledge about what specific researchers were doing; after all, it's difficult enough for a typical researcher to keep track of their own stuff, and it mostly won't have look-at-me names.

yibg 6y ago

How do we jump from some super computers being attacked by unknown actors to a conflict with China. When did every cyber attack become automatically a chinese cyber attack?