10 ms·

While this is one line of thinking, in another way of thinking, we're just now in a perpetual cyber cold war. As long as there are some rogue nations that turn

by pradn 5y ago

While this is one line of thinking, in another way of thinking, we're just now in a perpetual cyber cold war. As long as there are some rogue nations that turn their eyes away from cybercriminals, or adversaries that actively promote them, we're going to have an endless series of outages - every possible thing from factories to toll roads to desalination plants to illicit photos.

stingraycharles 5y ago
I don’t think a Cold War is a good description of what’s happening; it’s not as if there’s some arms race going on as it is just a very public exposure of how bad our overall tech / security infrastructure is. The question is whether the pains we’re currently feeling are enough to cause a change in the industries affected.
- joemazerino 5y ago
  The arms race is in exploits and software development. The country with the largest stockpile of the former and the best talent in the latter will emerge the victor.
  - PeterisP 5y ago
    A large stockpile of exploits can only harm someone else's economy, and it does not protect your economy. So perhaps your neighbour will suffer more than you do, but none of you will be winners in any sense.
    - munificent 5y ago
      The threat of retalition is historically one of the best defenses.
      - PeterisP 5y ago
        With big limitations that don't apply here. Things like mutually assured destruction work if/because an attack is quickly detectable, reasonably clearly attributable, and a symmetric tit-for-tat retaliation is plausible. That's not the case for cyberattacks. Solarwinds was attacked many months before it was detected, Stuxnet was hidden for years. We have attributed some attacks but not most and attribution often succeeds only years after detection. And the attackers aren't as vulnerable to cyberattacks simply because their economy is "less connected" - for example, North Korea is at the extreme end of that scale and they really don't care much about what exploits you have; you have a digital economy that's wealthy but vulnerable to attacks by those who don't have it.
- yaw12 5y ago
  > The question is whether the pains we’re currently feeling are enough to cause a change in the industries affected. Considering downthread there are honest suggestions to send special forces after the ransomware gangs, I’m gonna go with “probably not”. That type of denial is pervasive. The F500 and companies like JBS just need to move essentially dataframes around from automation to automation, but somehow the software ecosystem is still building that with the same tools used to write Google. The next answer is usually “they don’t invest in a security team, clearly,” and I’m waiting for that subthread to kick off, too, to continue the denial. Software complexity is the enemy, not the malicious actors exploiting it. Fix one, fix the other.
  - Dylan16807 5y ago
    I'm confused, why isn't a security team a good way to make and enforce things like smaller attack surfaces and network isolation?
    - viraptor 5y ago
      It is, but it's never going to be perfect. Nobody has achieved that so far. Or at least not in an environment where you have international distribution and thousands of endpoints touching different areas of the system.
  - throwaway3699 5y ago
    Software complexity is hard to tackle because it's really the underlying business complexity that's being modelled, which is usually beurocratic, Byzantine-like. See the recent post on why the Uber app is so large: https://news.ycombinator.com/item?id=25376346 https://news.ycombinator.com/item?id=25376346
handrous 5y ago
Nah, we're just gonna get every state having its own mini-Great-Firewall and very limited access to non-friendly states, at the routing level. There's a next gen Internet protocol that makes this easy. Maybe also personal IDs with a kind of Internet "credit score". We already do that, but with IP addresses and machine fingerprints. I expect some countries will adopt something like that, even in the "West". Either that or the cost of attacks will remain lower than the benefit of being able to sell bits and bytes to your adversaries. I do not expect this to be the case, but maybe. The open, global, semi-anonymous web is what's not going to survive this fight, I'm afraid. I give it 20 more years, tops, and maybe a lot less.
- lallysingh 5y ago
  While I don't doubt the motivation of such a naked power grab, it has almost no useful security effect.
  - handrous 5y ago
    How so? Can't attack from abroad if non-trusted states have trouble even getting packets routed to the target state, let alone the specific network you're trying to breach. Very hard to attack from inside the "firewall" if access is, as a condition of being considered a trusted routing peer, gated by tying all traffic to a personal or corporate ID that would cause all kinds of trouble for the holder of same IDs should they route traffic on some bad actor's behalf (as, say, through Tor or other means).
    - lallysingh 5y ago
      That's just a matter of finding a vulnerable ally county to hop through. That's SOP now to hide your tracks. It's not like current attacks from Iran to the US have Irani addresses in the IP header.
      - handrous 5y ago
        That's fine until it's nearly impossible to route a packet from (for example) Iran to any IP in any state that's legally unfriendly to hackers and scammers, or otherwise operates outside the broad legal jurisdiction of the hackers' target states.
bostonsre 5y ago
Hopefully its not endless. I kind of view these attacks as forced penetration testing of sloppy companies. They may not have been hired or perform their work legally, but hopefully their work results in changes similar to legal penetration testers. Also, the more that these attacks happen, the more that insurance companies will begin to increase premiums and the more that they will push back on companies that practice sloppy security. It may be painful in the near term, but hopefully these attacks are a net good in the long term.
- fakedang 5y ago
  Did anything happen after the Equifax hack? awaits with bated breath
  - phone8675309 5y ago
    Yeah, my free credit monitoring offer ended and now I have to pay to continue using it. Great marketing, Equifax - they created the problem and tried to sell you the fix.
    - recursive 5y ago
      The thing that really pissed me off about it is that the same organization that leaked my data in the first place was going to monitor my privacy. But in order to sign up, they needed... more personal data. No thanks.
  - bostonsre 5y ago
    Maybe they have slightly better security? Or hopefully at least they patched the one flaw that was used to get in.
wyager 5y ago
The good news is that cyber-war has a huge asymmetric advantage for defenders. For modestly more money, we can stop building absolute crap infrastructure that constantly gets owned. A little bit of investment in quality drastically raises the cost of an attack.
graphtrader 5y ago
Or you could go a step further that it is our hubris as a nation that expects the other side to fight us on a traditional battlefield with tanks and bombs and get crushed in a month. As if the other side is just so stupid as to never figure out a different strategy. This is a 21st century hot war that we are losing badly.

by pradn 5y ago

stingraycharles 5y ago

I don’t think a Cold War is a good description of what’s happening; it’s not as if there’s some arms race going on as it is just a very public exposure of how bad our overall tech / security infrastructure is. The question is whether the pains we’re currently feeling are enough to cause a change in the industries affected.

joemazerino 5y ago
The arms race is in exploits and software development. The country with the largest stockpile of the former and the best talent in the latter will emerge the victor.
- PeterisP 5y ago
  A large stockpile of exploits can only harm someone else's economy, and it does not protect your economy. So perhaps your neighbour will suffer more than you do, but none of you will be winners in any sense.
  - munificent 5y ago
    The threat of retalition is historically one of the best defenses.
    - PeterisP 5y ago
      With big limitations that don't apply here. Things like mutually assured destruction work if/because an attack is quickly detectable, reasonably clearly attributable, and a symmetric tit-for-tat retaliation is plausible. That's not the case for cyberattacks. Solarwinds was attacked many months before it was detected, Stuxnet was hidden for years. We have attributed some attacks but not most and attribution often succeeds only years after detection. And the attackers aren't as vulnerable to cyberattacks simply because their economy is "less connected" - for example, North Korea is at the extreme end of that scale and they really don't care much about what exploits you have; you have a digital economy that's wealthy but vulnerable to attacks by those who don't have it.
yaw12 5y ago
> The question is whether the pains we’re currently feeling are enough to cause a change in the industries affected. Considering downthread there are honest suggestions to send special forces after the ransomware gangs, I’m gonna go with “probably not”. That type of denial is pervasive. The F500 and companies like JBS just need to move essentially dataframes around from automation to automation, but somehow the software ecosystem is still building that with the same tools used to write Google. The next answer is usually “they don’t invest in a security team, clearly,” and I’m waiting for that subthread to kick off, too, to continue the denial. Software complexity is the enemy, not the malicious actors exploiting it. Fix one, fix the other.
- Dylan16807 5y ago
  I'm confused, why isn't a security team a good way to make and enforce things like smaller attack surfaces and network isolation?
  - viraptor 5y ago
    It is, but it's never going to be perfect. Nobody has achieved that so far. Or at least not in an environment where you have international distribution and thousands of endpoints touching different areas of the system.
- throwaway3699 5y ago
  Software complexity is hard to tackle because it's really the underlying business complexity that's being modelled, which is usually beurocratic, Byzantine-like. See the recent post on why the Uber app is so large: https://news.ycombinator.com/item?id=25376346 https://news.ycombinator.com/item?id=25376346

handrous 5y ago

Nah, we're just gonna get every state having its own mini-Great-Firewall and very limited access to non-friendly states, at the routing level. There's a next gen Internet protocol that makes this easy. Maybe also personal IDs with a kind of Internet "credit score". We already do that, but with IP addresses and machine fingerprints. I expect some countries will adopt something like that, even in the "West". Either that or the cost of attacks will remain lower than the benefit of being able to sell bits and bytes to your adversaries. I do not expect this to be the case, but maybe. The open, global, semi-anonymous web is what's not going to survive this fight, I'm afraid. I give it 20 more years, tops, and maybe a lot less.

lallysingh 5y ago
While I don't doubt the motivation of such a naked power grab, it has almost no useful security effect.
- handrous 5y ago
  How so? Can't attack from abroad if non-trusted states have trouble even getting packets routed to the target state, let alone the specific network you're trying to breach. Very hard to attack from inside the "firewall" if access is, as a condition of being considered a trusted routing peer, gated by tying all traffic to a personal or corporate ID that would cause all kinds of trouble for the holder of same IDs should they route traffic on some bad actor's behalf (as, say, through Tor or other means).
  - lallysingh 5y ago
    That's just a matter of finding a vulnerable ally county to hop through. That's SOP now to hide your tracks. It's not like current attacks from Iran to the US have Irani addresses in the IP header.
    - handrous 5y ago
      That's fine until it's nearly impossible to route a packet from (for example) Iran to any IP in any state that's legally unfriendly to hackers and scammers, or otherwise operates outside the broad legal jurisdiction of the hackers' target states.

bostonsre 5y ago

Hopefully its not endless. I kind of view these attacks as forced penetration testing of sloppy companies. They may not have been hired or perform their work legally, but hopefully their work results in changes similar to legal penetration testers. Also, the more that these attacks happen, the more that insurance companies will begin to increase premiums and the more that they will push back on companies that practice sloppy security. It may be painful in the near term, but hopefully these attacks are a net good in the long term.

fakedang 5y ago
Did anything happen after the Equifax hack? awaits with bated breath
- phone8675309 5y ago
  Yeah, my free credit monitoring offer ended and now I have to pay to continue using it. Great marketing, Equifax - they created the problem and tried to sell you the fix.
  - recursive 5y ago
    The thing that really pissed me off about it is that the same organization that leaked my data in the first place was going to monitor my privacy. But in order to sign up, they needed... more personal data. No thanks.
- bostonsre 5y ago
  Maybe they have slightly better security? Or hopefully at least they patched the one flaw that was used to get in.

wyager 5y ago

The good news is that cyber-war has a huge asymmetric advantage for defenders. For modestly more money, we can stop building absolute crap infrastructure that constantly gets owned. A little bit of investment in quality drastically raises the cost of an attack.

graphtrader 5y ago

Or you could go a step further that it is our hubris as a nation that expects the other side to fight us on a traditional battlefield with tanks and bombs and get crushed in a month. As if the other side is just so stupid as to never figure out a different strategy. This is a 21st century hot war that we are losing badly.