7 ms·

Am I confused about something? How is everybody not absolutely running around frantically ripping ethernet cables out of patch panels right now in every single

by blhack 6y ago

Am I confused about something? How is everybody not absolutely running around frantically ripping ethernet cables out of patch panels right now in every single one of these companies? I mean...the smart controllers on the HVAC systems in these companies have to be replaced don't they? The smart locks, everything IoT, everything with a network interface in it at this point has to be assumed compromised. This seems like by far the worst cyber security incident of all time.

webmaven 6y ago
> I mean...the smart controllers on the HVAC systems in these companies have to be replaced don't they? Did you recently binge-watch Mr. Robot?
- blhack 6y ago
  That was a nod to an actual hack that happened back in 2014: https://krebsonsecurity.com/2014/02/target-hackers-broke-in-via-hvac-company/ https://krebsonsecurity.com/2014/02/target-hackers-broke-in-... And my comment was also a nod to that prominent hack. The discussion back then revolved a lot around the idea that Target had done a really good job of hardening most of their network, but then allowed a smart HVAC controller onto it. What seemed at the time like something minor (I believe it was a remote diagnostic device or something like that) is what the intruders used to gain access.
  - XMPPwocky 6y ago
    Your article seems to directly contradict the idea that any sort of IoT / "smart" device was involved: > Fazio Mechanical Services just issued an official statement through a PR company, stating that its “data connection with Target was exclusively for electronic billing, contract submission and project management.”
    - bostik 6y ago
      We should all remember to read PR statements with the assumption they aim to be technically true but come with an intent to deceive. Because what you quoted is a weaselly statement, and it neatly avoids answering the underlying questions. Namely: was that "exclusively" a contractual exclusion or a technically sound, enforceable exclusion? And on top of that, how was it secured? If the connection setup was breached, what was the maximum blast radius?
      - XMPPwocky 6y ago
        None of those questions seem to be relevant to whether or not there was some sort of smart device involved.
        bostik 6y ago
        I'm sorry, but in this case I disagree. Whether the device was smart or not is irrelevant. If there is a connected device in a supposedly otherwise secure network that allows traffic in or calls home, that device is an attack vector. Pure and simple. The only safe assumption is that such a thing is an insecure, unmaintainable black box that was put together by the cheapest fly-by-night contractor. A "smart" device is worse, and guaranteed to be a dumpster fire. One should not be allowed anywhere near a secure network, regardless of its function. Printers, VoIP phones, climate control systems, ... they're all the same.
- _trampeltier 6y ago
  I now factorys, they replaced every PC (complete Harware, not just software) and also loaded every PLC, connected to the network, new. Such things can happen.
anonymouse008 6y ago
Why do I have this really bad feeling that the dead man switch is about to drop... based on what we know of the deployment / strategy, ‘they’ really might have every key to every castle. The only thing left to do is find out who hasn’t been affected by this.
- tjr225 6y ago
  Likely nothing will change or happen regardless of your feelings.
  - coldpie 6y ago
    Correct. It's been blindingly obvious for at least a decade that there is no such thing as computer security. Any computer that is connected in any way to the Internet should be considered at least semi-public. We get reminders of this weekly. Yet we continue to connect everything to the Internet. This is going to get a whole lot worse before it gets any better.
    - _trampeltier 6y ago
      And the complexity get higher and higher. And USB-C charger has now more computer power than an Apollo moon lander. https://forrestheller.com/Apollo-11-Computer-vs-USB-C-chargers.html https://forrestheller.com/Apollo-11-Computer-vs-USB-C-charge...
lawnchair_larry 6y ago
> I mean...the smart controllers on the HVAC systems in these companies have to be replaced don't they? Hah, no. And it’s definitely not the worst of all time. There is really no reason to be any more concerned than you were at this time last year.
ASalazarMX 6y ago
> Am I confused about something? How is everybody not absolutely running around frantically ripping ethernet cables out of patch panels right now in every single one of these companies? You mean everyone should have a panic attack? As deeply terrifying this is, anyone giving in to panic would make them unfit for their job. I assure you they are very scared, but huge companies have protocols to deal with situations like this.

by blhack 6y ago

webmaven 6y ago

> I mean...the smart controllers on the HVAC systems in these companies have to be replaced don't they? Did you recently binge-watch Mr. Robot?

blhack 6y ago
That was a nod to an actual hack that happened back in 2014: https://krebsonsecurity.com/2014/02/target-hackers-broke-in-via-hvac-company/ https://krebsonsecurity.com/2014/02/target-hackers-broke-in-... And my comment was also a nod to that prominent hack. The discussion back then revolved a lot around the idea that Target had done a really good job of hardening most of their network, but then allowed a smart HVAC controller onto it. What seemed at the time like something minor (I believe it was a remote diagnostic device or something like that) is what the intruders used to gain access.
- XMPPwocky 6y ago
  Your article seems to directly contradict the idea that any sort of IoT / "smart" device was involved: > Fazio Mechanical Services just issued an official statement through a PR company, stating that its “data connection with Target was exclusively for electronic billing, contract submission and project management.”
  - bostik 6y ago
    We should all remember to read PR statements with the assumption they aim to be technically true but come with an intent to deceive. Because what you quoted is a weaselly statement, and it neatly avoids answering the underlying questions. Namely: was that "exclusively" a contractual exclusion or a technically sound, enforceable exclusion? And on top of that, how was it secured? If the connection setup was breached, what was the maximum blast radius?
    - XMPPwocky 6y ago
      None of those questions seem to be relevant to whether or not there was some sort of smart device involved.
      - bostik 6y ago
        I'm sorry, but in this case I disagree. Whether the device was smart or not is irrelevant. If there is a connected device in a supposedly otherwise secure network that allows traffic in or calls home, that device is an attack vector. Pure and simple. The only safe assumption is that such a thing is an insecure, unmaintainable black box that was put together by the cheapest fly-by-night contractor. A "smart" device is worse, and guaranteed to be a dumpster fire. One should not be allowed anywhere near a secure network, regardless of its function. Printers, VoIP phones, climate control systems, ... they're all the same.
_trampeltier 6y ago
I now factorys, they replaced every PC (complete Harware, not just software) and also loaded every PLC, connected to the network, new. Such things can happen.

anonymouse008 6y ago

Why do I have this really bad feeling that the dead man switch is about to drop... based on what we know of the deployment / strategy, ‘they’ really might have every key to every castle. The only thing left to do is find out who hasn’t been affected by this.

tjr225 6y ago
Likely nothing will change or happen regardless of your feelings.
- coldpie 6y ago
  Correct. It's been blindingly obvious for at least a decade that there is no such thing as computer security. Any computer that is connected in any way to the Internet should be considered at least semi-public. We get reminders of this weekly. Yet we continue to connect everything to the Internet. This is going to get a whole lot worse before it gets any better.
  - _trampeltier 6y ago
    And the complexity get higher and higher. And USB-C charger has now more computer power than an Apollo moon lander. https://forrestheller.com/Apollo-11-Computer-vs-USB-C-chargers.html https://forrestheller.com/Apollo-11-Computer-vs-USB-C-charge...

lawnchair_larry 6y ago

> I mean...the smart controllers on the HVAC systems in these companies have to be replaced don't they? Hah, no. And it’s definitely not the worst of all time. There is really no reason to be any more concerned than you were at this time last year.

ASalazarMX 6y ago

> Am I confused about something? How is everybody not absolutely running around frantically ripping ethernet cables out of patch panels right now in every single one of these companies? You mean everyone should have a panic attack? As deeply terrifying this is, anyone giving in to panic would make them unfit for their job. I assure you they are very scared, but huge companies have protocols to deal with situations like this.