5 ms·

Well this is clearly a hostile act during a time in which several European countries have declared medical emergencies. They were not just "attacked" but have b

Well this is clearly a hostile act during a time in which several European countries have declared medical emergencies. They were not just "attacked" but have been completely offline for almost two weeks now (https://www.hpcwire.com/2020/05/18/hacking-streak-forces-european-supercomputers-offline-in-midst-of-covid-19-research-effort/ https://www.hpcwire.com/2020/05/18/hacking-streak-forces-eur...). In Germany it is (incident was 15.05) - NEMO (Freiburg) - bwUniCluster 2.0 and ForHLR II (Karlsruhe) - Hawk (Stuttgart) - Leibniz Supercomputing Center (Munich) - JURECA, JUWELS und JUDAC (FZ Jülich) - Taurus (Dresden) Switzerland shutdown access to all of CSCS (16.05).

goodcjw2 6y ago
Facts: 1 - HPC centers in Europes are down. 2 - Those are useful resources to battle battle against COVID-19. 3 - HPC centers are down due to malware infections. 4 - FBI warned and Department of Homeland Security warns of possible cyberattacks targeting COVID-19 research.
- acqq 6y ago
  And in the linked article the probable cause is much more prosaic: "The attacks may have been perpetrated in order to mine cryptocurrency; investigations are ongoing."
  - salawat 6y ago
    I feel like cryptocurrency miner install is going to end up being the new cover story anytime someone doesn't want to tip their hand on capabilities.
    - gnufx 6y ago
      Yes, but if you were serious about espionage, say, you wouldn't draw attention to the compromise by running one.
      - salawat 6y ago
        Unless you're testing a zero day, and staging an alternate route of infiltration to hide your installation of threat persistence. I believe it's referred to as the "limited hangout" in spycraft jargon. You maintain the target's sense of security and ability to detect intrusion while you maintain the capability to reintrude at will.
- orbifold 6y ago
  Facts: 1 - one of the two incidences reported (#EGI2020512) targeted academic data centers "for unknown purposes" (https://csirt.egi.eu/academic-data-centers-abused-for-crypto-currency-mining/ https://csirt.egi.eu/academic-data-centers-abused-for-crypto...) and not necessarily crypto currency mining. 2 - IP addresses associated with that second attack were all assigned to a Chinese University (Shanghai Jiaotong University), CSTNET and one Polish host known to be compromised by someone from China.
  - TeMPOraL 6y ago
    Re 2., since when IP is address tracking a reliable method of attack attribution? It's like trying to assign blame for a terrorist attack based on where the jacket dropped by a terrorist was made. Maybe it was made in their home country. Maybe it was imported. Or maybe they purposefully wore a jacket made in a different country and dropped it on the scene to confuse you.
deleted 6y ago
[deleted]
Reelin 6y ago
> this is clearly a hostile act That's not my reading of the article you linked. A bad actor compromised the credentials of multiple researchers with access to various supercomputers (over some unknown or at least unspecified period of time). They then simultaneously accessed the compromised machines and installed cryptocurrency mining software on them. This could easily be profit motivated (as it appears). It could also be (as you suggest) a hostile act disguised as the former, but I don't see what the motivation to do that would be?
- fpgaminer 6y ago
  Also the article mentions that Chinese researchers had access to the clusters as well. So the GP's implication is that the PRC attacked these datacenters ... to stop their own research? Seems more likely that more people are using/accessing these services, and people's guards are down, which made it easier for intruders to get in.
- orbifold 6y ago
  Well there were two incidents (https://csirt.egi.eu/academic-data-centers-abused-for-crypto-currency-mining/ https://csirt.egi.eu/academic-data-centers-abused-for-crypto...) one of which had "unknown purpose". It had the real effect of disrupting the majority of the super computing infrastructure in Switzerland and Germany for almost two weeks now. The attacks originated from China (Shanghai Jiao Tong University and CSTNET).

goodcjw2 6y ago

Facts: 1 - HPC centers in Europes are down. 2 - Those are useful resources to battle battle against COVID-19. 3 - HPC centers are down due to malware infections. 4 - FBI warned and Department of Homeland Security warns of possible cyberattacks targeting COVID-19 research.

acqq 6y ago
And in the linked article the probable cause is much more prosaic: "The attacks may have been perpetrated in order to mine cryptocurrency; investigations are ongoing."
- salawat 6y ago
  I feel like cryptocurrency miner install is going to end up being the new cover story anytime someone doesn't want to tip their hand on capabilities.
  - gnufx 6y ago
    Yes, but if you were serious about espionage, say, you wouldn't draw attention to the compromise by running one.
    - salawat 6y ago
      Unless you're testing a zero day, and staging an alternate route of infiltration to hide your installation of threat persistence. I believe it's referred to as the "limited hangout" in spycraft jargon. You maintain the target's sense of security and ability to detect intrusion while you maintain the capability to reintrude at will.
orbifold 6y ago
Facts: 1 - one of the two incidences reported (#EGI2020512) targeted academic data centers "for unknown purposes" (https://csirt.egi.eu/academic-data-centers-abused-for-crypto-currency-mining/ https://csirt.egi.eu/academic-data-centers-abused-for-crypto...) and not necessarily crypto currency mining. 2 - IP addresses associated with that second attack were all assigned to a Chinese University (Shanghai Jiaotong University), CSTNET and one Polish host known to be compromised by someone from China.
- TeMPOraL 6y ago
  Re 2., since when IP is address tracking a reliable method of attack attribution? It's like trying to assign blame for a terrorist attack based on where the jacket dropped by a terrorist was made. Maybe it was made in their home country. Maybe it was imported. Or maybe they purposefully wore a jacket made in a different country and dropped it on the scene to confuse you.

deleted 6y ago

[deleted]

Reelin 6y ago

> this is clearly a hostile act That's not my reading of the article you linked. A bad actor compromised the credentials of multiple researchers with access to various supercomputers (over some unknown or at least unspecified period of time). They then simultaneously accessed the compromised machines and installed cryptocurrency mining software on them. This could easily be profit motivated (as it appears). It could also be (as you suggest) a hostile act disguised as the former, but I don't see what the motivation to do that would be?

fpgaminer 6y ago
Also the article mentions that Chinese researchers had access to the clusters as well. So the GP's implication is that the PRC attacked these datacenters ... to stop their own research? Seems more likely that more people are using/accessing these services, and people's guards are down, which made it easier for intruders to get in.
orbifold 6y ago
Well there were two incidents (https://csirt.egi.eu/academic-data-centers-abused-for-crypto-currency-mining/ https://csirt.egi.eu/academic-data-centers-abused-for-crypto...) one of which had "unknown purpose". It had the real effect of disrupting the majority of the super computing infrastructure in Switzerland and Germany for almost two weeks now. The attacks originated from China (Shanghai Jiao Tong University and CSTNET).