5 ms·

Yeah but I would assume the same attack is not going to be successfully against the same target a second time. So they are essentially providing free pentesting

Yeah but I would assume the same attack is not going to be successfully against the same target a second time. So they are essentially providing free pentesting. And creating a climate that allows governments to introduce much stronger security measures. Without creating much actual damage. Also I wonder if it was a physical oder purely software attack? If it was a physical attack on a critical system, it could have been anybody, not just state actors.

gberger 4y ago
> Yeah but I would assume the same attack is not going to be successfully against the same target a second time. That's a bold assumption
- microjim 4y ago
  Chaos engineering... for public infrastructure? :)
- euroderf 4y ago
  And that's why the CIA started this merry band of shadowy infrastructure hackers :)
hendrikrassmann 4y ago
There are reports that a cable was severed. (https://twitter.com/gebauerspon/status/1578706469570351104 https://twitter.com/gebauerspon/status/1578706469570351104) But it's just a tweet. Don't know for sure.
- Xylakant 4y ago
  Tagesschau, citing the federal police, reports that two cables at two locations in germany were cut https://www.tagesschau.de/inland/bahn-sabotage-101.html https://www.tagesschau.de/inland/bahn-sabotage-101.html The locations are a few hundred kilometers apart.
  - GekkePrutser 4y ago
    That doesn't mean it wasn't a state actor, the act itself can be done by anyone but knowing which cables to cut for maximum effect does require knowledge. Considering it was two cables I wonder if they were part of the same fibre ring. Usually with those if the cable gets cut the traffic can route the other way around the loop. This is why they use rings instead of simple links. It's because fibre cables are easy to cut by mistake, a digging machine will cut through it without knowing. Unlike the old backbone cables of old that were thick as a sewer pipe and carried thousands of cable pairs and heavy armour.
dividedbyzero 4y ago
The German security landscape in general is in a pretty bad shape, hence such pentesting isn't all that valuable. Patch one vector, dozens or hundreds left open, and there is neither a strong security mindset nor a realistic option to implement meaningful security in infrastructure that often as not is decades old, fully analog, built without any security considerations at all, and falling apart on its own. IT security is pretty catastrophic (German law makes it hard to do it properly, it's much stricter than e.g. the corresponding US law), but physical security often as not turns out to be a sturdy closet with a hardware store combination padlock, even for things that would be considered critical and protected much better in other places. I think this is about sending a message (we're aware of that situation + able and willing to take advantage of it) and to do it in a way that can't be kept under wraps. I guess this won't make it any easier for Chancellor Scholz to send the tanks Ukraine requested.
- formerly_proven 4y ago
  > IT security is pretty catastrophic (German law makes it hard to do it properly, it's much stricter than e.g. the corresponding US law) To chime in on this, if you're in Germany and report a security vulnerability to a vendor there's a very good chance you'll get a criminal investigation, house searched, computers/phones seized for a long time etc. in return. Often in combination with a cease and desist or civil charges. It's not a good idea to approach vendors directly with findings in general, but in Germany doing that can seriously screw your life up. I wouldn't do security research in Germany at all. If you have talents in the area, just go to the US.
  - dividedbyzero 4y ago
    > If you have talents in the area, just go to the US. I believe most simply go to another EU country since that's extremely easy to do and you can still serve the German market easily.
  - mk89 4y ago
    Really interesting topic: do you have any source you could share?
thatguy0900 4y ago
They can't cut two cables again? And Voda phone has now been made hack proof, I assume? Infrastructure is not secure, either digitally or physically. The only thing keeping them up is threats from the three letter agencies, like that hacking group that accidentally hit infrastructure and apologized for the international incident. https://www.theverge.com/2021/5/10/22428996/colonial-pipeline-ransomware-attack-apology-investigation https://www.theverge.com/2021/5/10/22428996/colonial-pipelin... there is literally nothing protecting any of these targets from state sponsored hacking or two guys with some bolt cutters and grenades. What's our success rate against Joe randoms with a rifle attacking domestic targets, much less actual trained operatives

gberger 4y ago

> Yeah but I would assume the same attack is not going to be successfully against the same target a second time. That's a bold assumption

microjim 4y ago
Chaos engineering... for public infrastructure? :)
euroderf 4y ago
And that's why the CIA started this merry band of shadowy infrastructure hackers :)

hendrikrassmann 4y ago

There are reports that a cable was severed. (https://twitter.com/gebauerspon/status/1578706469570351104 https://twitter.com/gebauerspon/status/1578706469570351104) But it's just a tweet. Don't know for sure.

Xylakant 4y ago
Tagesschau, citing the federal police, reports that two cables at two locations in germany were cut https://www.tagesschau.de/inland/bahn-sabotage-101.html https://www.tagesschau.de/inland/bahn-sabotage-101.html The locations are a few hundred kilometers apart.
- GekkePrutser 4y ago
  That doesn't mean it wasn't a state actor, the act itself can be done by anyone but knowing which cables to cut for maximum effect does require knowledge. Considering it was two cables I wonder if they were part of the same fibre ring. Usually with those if the cable gets cut the traffic can route the other way around the loop. This is why they use rings instead of simple links. It's because fibre cables are easy to cut by mistake, a digging machine will cut through it without knowing. Unlike the old backbone cables of old that were thick as a sewer pipe and carried thousands of cable pairs and heavy armour.

dividedbyzero 4y ago

The German security landscape in general is in a pretty bad shape, hence such pentesting isn't all that valuable. Patch one vector, dozens or hundreds left open, and there is neither a strong security mindset nor a realistic option to implement meaningful security in infrastructure that often as not is decades old, fully analog, built without any security considerations at all, and falling apart on its own. IT security is pretty catastrophic (German law makes it hard to do it properly, it's much stricter than e.g. the corresponding US law), but physical security often as not turns out to be a sturdy closet with a hardware store combination padlock, even for things that would be considered critical and protected much better in other places. I think this is about sending a message (we're aware of that situation + able and willing to take advantage of it) and to do it in a way that can't be kept under wraps. I guess this won't make it any easier for Chancellor Scholz to send the tanks Ukraine requested.

formerly_proven 4y ago
> IT security is pretty catastrophic (German law makes it hard to do it properly, it's much stricter than e.g. the corresponding US law) To chime in on this, if you're in Germany and report a security vulnerability to a vendor there's a very good chance you'll get a criminal investigation, house searched, computers/phones seized for a long time etc. in return. Often in combination with a cease and desist or civil charges. It's not a good idea to approach vendors directly with findings in general, but in Germany doing that can seriously screw your life up. I wouldn't do security research in Germany at all. If you have talents in the area, just go to the US.
- dividedbyzero 4y ago
  > If you have talents in the area, just go to the US. I believe most simply go to another EU country since that's extremely easy to do and you can still serve the German market easily.
- mk89 4y ago
  Really interesting topic: do you have any source you could share?

thatguy0900 4y ago

They can't cut two cables again? And Voda phone has now been made hack proof, I assume? Infrastructure is not secure, either digitally or physically. The only thing keeping them up is threats from the three letter agencies, like that hacking group that accidentally hit infrastructure and apologized for the international incident. https://www.theverge.com/2021/5/10/22428996/colonial-pipeline-ransomware-attack-apology-investigation https://www.theverge.com/2021/5/10/22428996/colonial-pipelin... there is literally nothing protecting any of these targets from state sponsored hacking or two guys with some bolt cutters and grenades. What's our success rate against Joe randoms with a rifle attacking domestic targets, much less actual trained operatives