5 ms·

This title feels at least somewhat clickbait. A less clickbait title would be: "Researchers discover that, with physical access, they can disrupt TTEthernet sy

This title feels at least somewhat clickbait. A less clickbait title would be: "Researchers discover that, with physical access, they can disrupt TTEthernet synchronization". "Ethernet" in the title does not refer to normal ethernet devices, but rather TTEthernet. "Cyberattack" to me implies the attack doesn't require physical access, but this attack does require physical access to a switch on the network, and how they've implemented it requires installing a persistent powered device on the hardware. "Crunches Critical Systems" to me implies it's actually been exploited in the wild. This has not been. The article implies this attack could be deployed against airplanes, space ships, and wind turbines. From my understanding of this attack, I would recommend protecting from it in the same way you currently protect against the attack of "someone DoSd us by walking up and unplugging the ethernet cable", which is to say a combination of closed panel doors, "do not touch" signs, and, if you must, a physical lock.

joe_name 4y ago
Why would "cyberattack" imply non-physical access? Cybersecurity has always had physical components to it. Would you consider an attack using a rubber ducky a cyberattack?
- QuarterReptile 4y ago
  The killer feature of cyberattack is that it exposes you to a global market of criminals. If physical access is required, that presumably cuts back on the market size. In the age of significant ecosystems for stealing devices from network stores to conduct SIM-swaps, complete with intermediate stooges paid to protect the anonymity of higher-ups, it's fair to point out that this split is less clear-cut. Much like network exploitation required mass-market standardization, maybe you could argue that breaking physical security for critical systems isn't quite at that point. On the other hand, if it turns out that everyone follows the same 10-step guide to legal compliance for physical security, we might end up with standardized attacks against that security.
  - joe_name 4y ago
    I was purely responding to the notion that "cyberattack" as a term implies something exclusively non-physical, since it has been used many, many times to refer to techniques that require physical access to the system that is being attacked.
    - TheNewsIsHere 4y ago
      This kind of disparate interpretation is why I still prefer the term information security (and related, information assurance). It’s much more unambiguously inclusive, and still perfectly descriptive of the field and practice.
    - QuarterReptile 4y ago
      I'm sympathetic to that idea on first glance. Would you consider Stuxnet a cyber attack, though? I think I instinctively would, despite liking your description, yet it required USB drive placement.

joe_name 4y ago

Why would "cyberattack" imply non-physical access? Cybersecurity has always had physical components to it. Would you consider an attack using a rubber ducky a cyberattack?

QuarterReptile 4y ago
The killer feature of cyberattack is that it exposes you to a global market of criminals. If physical access is required, that presumably cuts back on the market size. In the age of significant ecosystems for stealing devices from network stores to conduct SIM-swaps, complete with intermediate stooges paid to protect the anonymity of higher-ups, it's fair to point out that this split is less clear-cut. Much like network exploitation required mass-market standardization, maybe you could argue that breaking physical security for critical systems isn't quite at that point. On the other hand, if it turns out that everyone follows the same 10-step guide to legal compliance for physical security, we might end up with standardized attacks against that security.
- joe_name 4y ago
  I was purely responding to the notion that "cyberattack" as a term implies something exclusively non-physical, since it has been used many, many times to refer to techniques that require physical access to the system that is being attacked.
  - TheNewsIsHere 4y ago
    This kind of disparate interpretation is why I still prefer the term information security (and related, information assurance). It’s much more unambiguously inclusive, and still perfectly descriptive of the field and practice.
  - QuarterReptile 4y ago
    I'm sympathetic to that idea on first glance. Would you consider Stuxnet a cyber attack, though? I think I instinctively would, despite liking your description, yet it required USB drive placement.