5 ms·
> Logic bombs planted on those systems will delete all the backups once they’re brought on-line. All of it gone. Forever. I am wondering how this is going to
by kahawe 15y ago
> Logic bombs planted on those systems will delete all the backups once they’re brought on-line. All of it gone. Forever.
I am wondering how this is going to work, considering most financial institutions have cold-standby back up systems, often off-site or in another country and you cannot just overwrite backups like that.
This sounds way too much like SciFi FUD bla-bla and anyone using "logic bomb" as an argument is automatically suspicious. One of the beauties of the digital world is that given sufficient precautions, you can wipe all financial data as often as you like, you can always get it back from backups and those messages don't just exist at one point-of-failure but at a lot of nodes, very likely around the world. Data that took a whole department years to gather can be erased, transferred and made available again in a matter of seconds.
Banks have existed LONG before the interwebs and have only started to use network infrastructure during the last maybe 20 or so years - and though very limited, they would still be able to function without it by simply switching back to pen and paper like they did 40 years ago.
Contrast this to blowing up major infrastructure nodes like bridges, airports etc. which literally took years to build.
> At the same time, all cloud-based assets, all companies applications and customer data will be attacked and deleted. All of it gone. Forever.
It will be a grievous day... without petabytes of porn readily accessible at the click of my mouse, without news on LuLzSec and without the ground-noise of twitter and facebook updates about pets, lunch or bowl movements but I daresay I will survive that, thank you very much.
And companies storing that kind of critical information only in "the cloud"? They deserve to be gone. Forever.
- loumf 15y agoImagine applying STUXNET style cracking to this -- they would not explode "logic bombs" immediately. Instead you might have months or years of penetration into the live systems, the backups, the recovery systems, etc. Maybe they figure out a way to affect the paper systems too -- FAX machine infiltration, etc. He's positing professional warfare and extreme secrecy of results -- not the lulz style hacks.
- kahawe 15y agoOne more thing about this... you can use about the same kind of explosives on buildings and bridges just varying amounts and methods of application. Whereas screwing over the whole banking system of north USA like that requires the kind of cracking you described but against maybe a few hundred different targets, likely all running different systems and posing different challenges - not un-do-able - but ultimately to not that great avail. So you have a lot of effort actually pulling the attack off to even make a dent and then it is probably going to be not much more than a scary headline in the newspaper. Banks and governments are not the internet or in the internet. They are offering their services ALSO over the internet but not exclusively. And the really important backups need to be kept for years and years, off site. I doubt it is as easy and efficient to launch "cyber war" on the USA and then just "cyber nuke them back to the stone age" which is something this article subtly suggests. Also, how many power plants, reactors, flood gates and traffic systems are controllable over the internet like that? At least here in Europe I have honestly no idea but strongly doubt they work like that.
- groby_b 15y agoOf course, you could equally well just sow doubt with a few precise surgical strikes. If random customers lose all their money often enough, the rest of the customers will withdraw theirs to have it in physical assets. Which is enough to cause tremendous damage. And a way more likely scenario.
- kahawe 15y agoMy point was: you cannot simply just like that loose money without any trace of what happened... it's not like you can just "DELETE FROM accounts" and it is totally un-tracably gone. I would trust more in the people who design our SWIFT and other transaction systems.
- groby_b 15y agoI wouldn't. After seeing such tremendous security accumen from CitiGroup, I wonder how you can blindly trust. But the larger point is, even if you can mostly undo the damage, you have a much harder time restoring trust. The money doesn't need to be lost. If you create enough of a panic to trigger a run on banks, you've achieved your goal, too.
- cabalamat 15y agoFurthermore, a determined adversary with a well-funded and well-prepared attack wouldn't just attack the financial services industry, they'd attack other key industries. So for example, their are 9 major oil refineries in the UK. If they could all be put out of action with Stuxnet-style attacks (or maybe with precision cruise missiles), then 2 weeks later the UK runs out of fuel and supermarkets run out of food. Or consider an attack on the internet infrastructure itself. Since we're envisaging an attack in the future, when TV, radio and telephones are just services that run on the internet, bringing down the net will destroy communications. And the end-pints -- computers in homes and offices -- will themselves be down. Societies are only going to get more dependent on computers, and computers are only going to get more complicated (making logic bombs harder to find). The damage that a cyberspace attack could do, and the ease of pulling it off, will therefore both only increase.
- webXL 15y agoAll of it gone. Forever. Boy, he sure does like that phrase! You're right. These attacks can only be destructive if there are relatively few points of failure. I think our financial institutions can learn a lot from distributed systems like Bitcoin. I don't have a clue how it would work, but I can envision a distributed bank opening up one day, where all transactions and balances were distributed so that it would be impossible to destroy all that data, or any of it with enough redundancy.