5 ms·

Federal Gov. left ‘completely blind’ on cyberattacks looks to force reporting

63 points by Black101 5y ago

trompetenaccoun 5y ago
It's a war and most haven't even noticed. So far Western governments aren't actively forcing anything but are merely reacting. And so they're always at least a step behind.
- ethbr0 5y ago
  > aren't actively forcing anything You mean like a worm destroying Iranian PLCs?
  - quackyodata 5y ago
    That wasn't just the USA, and it turned into a boondoggle which embarrassed the perpetrators and gave the appearance that targeted cyberattacks were high-cost/low-impact. I suppose that it is a diplomat's job to appear stupid until they have stolen your shoes, but I'm not sure anybody can act that well. My confidence in the West's ability to perpetuate an offensive cyber war is pretty low. Our main advantage is the quantity of servers/data that reside in/flow through our borders, but that's not too hard to dodge. Cryptocurrencies also erase the hammer of losing access to US financing.
  - mastax 5y ago
    The Iranian government is not a significant source of ransomware, to my knowledge, so I don't see how that's relevant at all.
    - qeternity 5y ago
      Stuxnet was/is a worm that attacked air gapped PLC systems at Iran’s Natanz nuclear enrichment facility. It was the most sophisticated piece of malware ever discovered, allegedly by US/Israeli operatives.
- mbg721 5y ago
  How would we even know if they were acting, though? It's not like they're going to broadcast all the security steps they're taking. Just because we don't hear a strategy doesn't mean there isn't one.
  - PeterisP 5y ago
    The targets of those attacks are large numbers of private companies whose IT employs many of HN subscribers. If something was being done by the government to fix (or, more likely, mandate fixing) those networks, this community would see it.
- Black101 5y ago
  The war is just beginning... they need to unplug critical systems even if a dropped USB stick could circumvent that. Someone I know was happy because he could do his job remotely... controlling an hydroelectric plant... (that should not be possible).
  - exikyut 5y ago
    How on Earth do you react with reasonable latency if you're N milliseconds away from all sources of truth, and or on a residential-class Internet connection without all kinds of SLAs? That's a security problem in and of itself.
    - kortilla 5y ago
      Humans don’t react on those timescales. These systems where operators are doing things remotely have low latency things for any automation. It’s the “management” interface we’re talking about here.
- boomboomsubban 5y ago
  >So far Western governments aren't actively forcing anything What would you call the regular use of sanctions or the recent "trade war" with China? I don't agree with the statement that criminal hackers mean we are at war, but if you consider that kind of damage war the US has been an aggressor for years.
caseysoftware 5y ago
Remember 6 months ago when Christopher Krebs insisted that DHS had successfully protected US infrastructure? Since that time, we've discovered the Solar Winds breach which had gone on for 9+ months and then the Colonial Pipeline. And those are just the ones we know about. :| However behind/compromised we think the US Feds+private infrastructure is, seems like it's even worse.
- dataflow 5y ago
  > Remember 6 months ago when Christopher Krebs insisted that DHS had successfully protected US infrastructure? I remember his statements about election integrity specifically, but not a general one about infrastructure... what was his statement exactly? Protected what against what?
  - tw04 5y ago
    Krebs didn't say anything about infrastructure. He said: > Chris Krebs: I have confidence in the security of this election because I know the work that we've done for four years in support of our state and local partners. I know the work that the intelligence community has done, the Department of Defense has done, that the FBI has done, that my team has done. I know that these systems are more secure. I know based on what we have seen that any attacks on the election were not successful. https://www.cbsnews.com/news/election-results-security-chris-krebs-60-minutes-2020-11-29/#app https://www.cbsnews.com/news/election-results-security-chris... Based on op's post history this is some odd attempt at turning a thread about infrastructure security into "the election was stolen" nonsense. I doubt you'll get a response because there appears to be 0 evidence to back up that claim.
    - dataflow 5y ago
      Gotcha, thanks!
    - caseysoftware 5y ago
      No, I don't believe and have never promoted that the election was stolen. Paper ballots - as noted by Krebs - are a great audit trail. I believe DHS Cybersecurity didn't know - and still doesn't know - the depth and severity of what's going on or even how to get a handle on it as evidenced by the last year+. Therefore, when that agency makes a claim, we should be skeptical until there's evidence otherwise.
egberts1 5y ago
No words on whether SolarWind was install on electronic ballot machines.
- Black101 5y ago
  You can assume electronic voting machines were compromised.
- throwitaway12 5y ago
  They were compromised. Look up what a certain agency does to foreign nations. One of the funniest things I heard in awhile is when Kreb's said the election was the 'most secure history'
  - Tostino 5y ago
    Let's see some proof for that claim.
    - egberts1 5y ago
      Default password is still “SolarWind!23”.
- javagram 5y ago
  Good news is that most ballot machines have been updated to print paper receipts or are simply scanners. And the machine results were audited by a hand count, in some cases a full hand count (e.g. Georgia), and shown to be accurate.
  - EricE 5y ago
    You can accurately count invalid ballots all you want - still doesn't mean the votes mean anything. Witness all the fireworks that suddenly explode onto the scene when signature validation comes up. Case in point - Gavin Newsom suddenly got really concerned about signature validation - but only for his recall election :p
count 5y ago
Companies doing business, at least with the DoD, are already required to report: https://www.acq.osd.mil/dpap/dars/dfars/html/current/252204.htm#252.204-7012 https://www.acq.osd.mil/dpap/dars/dfars/html/current/252204.... What the hell is the government going to do? The government can't even protect it's own systems, they sure as hell aren't going to be helicoptering in to save some power company from malware...
- m463 5y ago
  > What the hell is the government going to do? I can't help but think - if a person has a car accident with more than $500 (?) damage, they're required to report it. The government doesn't have to take action on anything, but it can. Also insurance companies.
  - count 5y ago
    Insurance companies require reporting already, also. And many of the companies getting nailed have insurance, which is, in some respects, driving the increase: companies get a 'free' payout for the ransomware. If you get physical shit stolen, and buy it back, do you have to report it?
Animats 5y ago
Of course DHS isn't getting good reporting. If you report a break-in or a vulnerability to DHS, they don't do much.
solstice 5y ago
Slightly off-topics but I'd like to know if there is some kind of turn-key solution for small business or home use which uses a Raspberry Pi with attached USB HD, that connects to other PCs via the network and pulls the files to be backed up. The idea being that the Pi and the HD themselves are never writeable from the outside and thus can't be encrypted themselves, 1) if using some suitably long retention time for older backups and 2) some kind of semi-smart monitoring system that can give warnings like "Hey, your data changed a lot suddenly. Might wanna have a look at that".

63 points by Black101 5y ago

It's a war and most haven't even noticed. So far Western governments aren't actively forcing anything but are merely reacting. And so they're always at least a step behind.

ethbr0 5y ago
> aren't actively forcing anything You mean like a worm destroying Iranian PLCs?
- quackyodata 5y ago
  That wasn't just the USA, and it turned into a boondoggle which embarrassed the perpetrators and gave the appearance that targeted cyberattacks were high-cost/low-impact. I suppose that it is a diplomat's job to appear stupid until they have stolen your shoes, but I'm not sure anybody can act that well. My confidence in the West's ability to perpetuate an offensive cyber war is pretty low. Our main advantage is the quantity of servers/data that reside in/flow through our borders, but that's not too hard to dodge. Cryptocurrencies also erase the hammer of losing access to US financing.
- mastax 5y ago
  The Iranian government is not a significant source of ransomware, to my knowledge, so I don't see how that's relevant at all.
  - qeternity 5y ago
    Stuxnet was/is a worm that attacked air gapped PLC systems at Iran’s Natanz nuclear enrichment facility. It was the most sophisticated piece of malware ever discovered, allegedly by US/Israeli operatives.
mbg721 5y ago
How would we even know if they were acting, though? It's not like they're going to broadcast all the security steps they're taking. Just because we don't hear a strategy doesn't mean there isn't one.
- PeterisP 5y ago
  The targets of those attacks are large numbers of private companies whose IT employs many of HN subscribers. If something was being done by the government to fix (or, more likely, mandate fixing) those networks, this community would see it.
Black101 5y ago
The war is just beginning... they need to unplug critical systems even if a dropped USB stick could circumvent that. Someone I know was happy because he could do his job remotely... controlling an hydroelectric plant... (that should not be possible).
- exikyut 5y ago
  How on Earth do you react with reasonable latency if you're N milliseconds away from all sources of truth, and or on a residential-class Internet connection without all kinds of SLAs? That's a security problem in and of itself.
  - kortilla 5y ago
    Humans don’t react on those timescales. These systems where operators are doing things remotely have low latency things for any automation. It’s the “management” interface we’re talking about here.
boomboomsubban 5y ago
>So far Western governments aren't actively forcing anything What would you call the regular use of sanctions or the recent "trade war" with China? I don't agree with the statement that criminal hackers mean we are at war, but if you consider that kind of damage war the US has been an aggressor for years.

caseysoftware 5y ago

Remember 6 months ago when Christopher Krebs insisted that DHS had successfully protected US infrastructure? Since that time, we've discovered the Solar Winds breach which had gone on for 9+ months and then the Colonial Pipeline. And those are just the ones we know about. :| However behind/compromised we think the US Feds+private infrastructure is, seems like it's even worse.

dataflow 5y ago
> Remember 6 months ago when Christopher Krebs insisted that DHS had successfully protected US infrastructure? I remember his statements about election integrity specifically, but not a general one about infrastructure... what was his statement exactly? Protected what against what?
- tw04 5y ago
  Krebs didn't say anything about infrastructure. He said: > Chris Krebs: I have confidence in the security of this election because I know the work that we've done for four years in support of our state and local partners. I know the work that the intelligence community has done, the Department of Defense has done, that the FBI has done, that my team has done. I know that these systems are more secure. I know based on what we have seen that any attacks on the election were not successful. https://www.cbsnews.com/news/election-results-security-chris-krebs-60-minutes-2020-11-29/#app https://www.cbsnews.com/news/election-results-security-chris... Based on op's post history this is some odd attempt at turning a thread about infrastructure security into "the election was stolen" nonsense. I doubt you'll get a response because there appears to be 0 evidence to back up that claim.
  - dataflow 5y ago
    Gotcha, thanks!
  - caseysoftware 5y ago
    No, I don't believe and have never promoted that the election was stolen. Paper ballots - as noted by Krebs - are a great audit trail. I believe DHS Cybersecurity didn't know - and still doesn't know - the depth and severity of what's going on or even how to get a handle on it as evidenced by the last year+. Therefore, when that agency makes a claim, we should be skeptical until there's evidence otherwise.

egberts1 5y ago

No words on whether SolarWind was install on electronic ballot machines.

Black101 5y ago
You can assume electronic voting machines were compromised.
throwitaway12 5y ago
They were compromised. Look up what a certain agency does to foreign nations. One of the funniest things I heard in awhile is when Kreb's said the election was the 'most secure history'
- Tostino 5y ago
  Let's see some proof for that claim.
  - egberts1 5y ago
    Default password is still “SolarWind!23”.
javagram 5y ago
Good news is that most ballot machines have been updated to print paper receipts or are simply scanners. And the machine results were audited by a hand count, in some cases a full hand count (e.g. Georgia), and shown to be accurate.
- EricE 5y ago
  You can accurately count invalid ballots all you want - still doesn't mean the votes mean anything. Witness all the fireworks that suddenly explode onto the scene when signature validation comes up. Case in point - Gavin Newsom suddenly got really concerned about signature validation - but only for his recall election :p

count 5y ago

Companies doing business, at least with the DoD, are already required to report: https://www.acq.osd.mil/dpap/dars/dfars/html/current/252204.htm#252.204-7012 https://www.acq.osd.mil/dpap/dars/dfars/html/current/252204.... What the hell is the government going to do? The government can't even protect it's own systems, they sure as hell aren't going to be helicoptering in to save some power company from malware...

m463 5y ago
> What the hell is the government going to do? I can't help but think - if a person has a car accident with more than $500 (?) damage, they're required to report it. The government doesn't have to take action on anything, but it can. Also insurance companies.
- count 5y ago
  Insurance companies require reporting already, also. And many of the companies getting nailed have insurance, which is, in some respects, driving the increase: companies get a 'free' payout for the ransomware. If you get physical shit stolen, and buy it back, do you have to report it?

Animats 5y ago

Of course DHS isn't getting good reporting. If you report a break-in or a vulnerability to DHS, they don't do much.

solstice 5y ago

Slightly off-topics but I'd like to know if there is some kind of turn-key solution for small business or home use which uses a Raspberry Pi with attached USB HD, that connects to other PCs via the network and pulls the files to be backed up. The idea being that the Pi and the HD themselves are never writeable from the outside and thus can't be encrypted themselves, 1) if using some suitably long retention time for older backups and 2) some kind of semi-smart monitoring system that can give warnings like "Hey, your data changed a lot suddenly. Might wanna have a look at that".